Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was part of a human subject research study without my consent

christine.website

Post reply on HN
Print view View original

71–80 of 382 posts

Re: I was part of a human subject research study without my consent

#71

Post by walrus01 »

0cVlTeIATBs wrote: post #65
quadrifoliate wrote: post #48

A lot of people mocking the author or others for being scared and worried are basically blaming the victim here, and I would like them to stop. The nature of legal practices in the USA is such that the answers to "Are you totally in the clear legally?" and "Will you lose significant amounts of money proving in random courts that you are in the clear legally?" are often both yes. As a result, any researchers who send…

What specifically is there to fear from an email like this? For one the sender opens by admitting they are not protected by the CCPA, and a quick reading about this law shows it does not apply to an individual's personal blog. If a Russian were able to file suit in California, wouldn't the defendant have a chance early on to ask a judge to dismiss it? I'm trying to sound naive because I want some gory details.

> If a Russian were able to file suit in California, wouldn't the defendant have a chance early on to ask a judge to dismiss it?

a particularly foolish or over-confident defendent might represent themselves, but otherwise, I would not budget less than $2000-3000 to hire a lawyer to draft and file a response to statement of claim and show up in court to attempt to get it dismissed before it gets started.

Re: I was part of a human subject research study without my consent

#72

Post by Sebb767 »

quadrifoliate wrote: post #48

A lot of people mocking the author or others for being scared and worried are basically blaming the victim here, and I would like them to stop. The nature of legal practices in the USA is such that the answers to "Are you totally in the clear legally?" and "Will you lose significant amounts of money proving in random courts that you are in the clear legally?" are often both yes. As a result, any researchers who send…

> A lot of people mocking the author or others for being scared and worried are basically blaming the victim here, and I would like them to stop.

I don't think this is mocking (excluding the few obligatory spammers). It's a known fact that if you have a public e-mail, you will receive a lot of spam and threats. Also, an actual request could've very well taken a similar form - would you have been okay with this if they actually requested their data?

I'm not saying these actions were great. Sending out these mails was definitely not the nice thing to do. And yes, the threat of a lawsuit can be very scary. But, unfortunately, this is something you must be able to handle as a webmaster. It's also not great or nice that people try to log into my ssh server all the time, but this is just something you get when you have an ssh server on the internet. Same thing.

Re: I was part of a human subject research study without my consent

#73

Post by charcircuit »

quadrifoliate wrote: post #48

A lot of people mocking the author or others for being scared and worried are basically blaming the victim here, and I would like them to stop. The nature of legal practices in the USA is such that the answers to "Are you totally in the clear legally?" and "Will you lose significant amounts of money proving in random courts that you are in the clear legally?" are often both yes. As a result, any researchers who send…

>thinly veiled legal threats

How is asking someone questions a legal threat?

Re: I was part of a human subject research study without my consent

#74

Post by seoaeu »

darkwizard42 wrote: post #3

The Institutional Review Board doesn't seem to be much of an "ethical board" given they don't consider the stress this causes the human side of the website operators. How did they conclude this doesn't count as "human subjects research" given the expectation is to measure a human response to an email (framed as from a person)?

> The Institutional Review Board doesn't seem to be much of an "ethical board"

YES! I know you intended this as an insult, but it is actually one of the most insightful comments in the thread. An IRB is not supposed to be an ethical board. They have a much more limited scope of overseeing human subject research.

> How did they conclude this doesn't count as "human subjects research" given the expectation is to measure a human response to an email (framed as from a person)?

Because there's a precise definition of "human subject research" which is actually a lot more limited than many people think.

Re: I was part of a human subject research study without my consent

#75

Post by quadrifoliate »

MattGaiser wrote: post #45
progman32 wrote: post #33

Earlier quoted context omitted.

Perhaps you're making an assumption that "normal citizens" receive legal threats regularly? I can count the legal threats I've received on one hand, and I can assure you the days following them were, unfortunately, quite unpleasant (fortunately nothing came of it). Stress aside, part of the problem is the very real possibility of a subject wasting money on hiring a lawyer.

Does this qualify as a legal threat? It just seems like a reminder of existing laws, like one sees in all manner of contracts or Terms of Service. Like the "you are obligated to pay within X days" you see on your credit card statements. Or even if there is a legal threat, do you take it seriously unless you know the source? People regularly get calls saying they are in violation of tax law and must pay.

> People regularly get calls saying they are in violation of tax law and must pay.

This is an interesting point you bring up, which merits diving into a bit further.

I think it's precisely because CCPA is so new that this experiment is more unethical than if they were just calling up people saying "you owe money to the IRS, send me gift cards". The IRS spends a ton of money every year telling people that these calls are scams; but Christine or the operator of freeradical.zone likely had no such public service announcements from the State of California. On the other hand, they probably did hear news items about this new data privacy law that California passed, and thought the emails were from actual individuals.

Re: I was part of a human subject research study without my consent

#76

Post by charcircuit »

rectang wrote: post #64
dcow wrote: post #61

Earlier quoted context omitted.

That’s not a threat. A threat would be, “I’ll sue you if you don’t comply with my request”.

Interesting. Do you or any of your associates send these sorts of notices to anyone?

Yes, I have had friends jokingly say they would request the information I have on them because of GDPR.

Re: I was part of a human subject research study without my consent

#77

Post by MR4D »

dcow wrote: post #61
tantalor wrote: post #52

Earlier quoted context omitted.

> ... as required by Section 1798.130 of the California Civil Code.

That’s not a threat. A threat would be, “I’ll sue you if you don’t comply with my request”.

You’ve clearly never dealt with lawyers very much. The implied threat is pretty obvious to those that have.

Re: I was part of a human subject research study without my consent

#78

Post by 42jd »

42jd wrote: post #66
quadrifoliate wrote: post #48

A lot of people mocking the author or others for being scared and worried are basically blaming the victim here, and I would like them to stop. The nature of legal practices in the USA is such that the answers to "Are you totally in the clear legally?" and "Will you lose significant amounts of money proving in random courts that you are in the clear legally?" are often both yes. As a result, any researchers who send…

Yep I posted this hoping to raise awareness, but the reaction was not what I expected. In the US even a meritless legal threat will require hiring a lawyer to ensure you are in the clear which requires significant amount of money, in addition to the stress. Researchers should never be putting anyone in that position.

Just going to tag along to my comment above. I can't help but notice the difference in tone of the responses to this article vs. the one yesterday (https://news.ycombinator.com/item?id=29599553) which I did not see. It seems those who participated in the thread yesterday had a quite different opinion.

Re: I was part of a human subject research study without my consent

#79

Post by [deleted] »

ethbr0 wrote: post #39
omgitsabird wrote: post #2

"In order to be considered a covered business, the organization needs to have annual gross revenues in excess of twenty-five million, possess the personal information of 50,000 consumers, or derive 50 percent or more of its annual revenue from selling consumers' personal information."

> or derive 50 percent or more of its annual revenue from selling consumers' personal information Wouldn't that cover most blogs that run ads?

[deleted]

Re: I was part of a human subject research study without my consent

#80

Post by throawayblahads »

rectang wrote: post #64
dcow wrote: post #61

Earlier quoted context omitted.

That’s not a threat. A threat would be, “I’ll sue you if you don’t comply with my request”.

Interesting. Do you or any of your associates send these sorts of notices to anyone?

EDIT: Some grammar, and minor clause clarification in second-to-last paragraph.

Yes, frequently. And throwaway.

About once a week, I pick an account in my LastPass collection, and initiate the following process:

1. Initiate a CCPA data request using a form or email, and I always include language about the timeline. I am not a lawyer, I'm just a person.

2. Then, once I have the data, I delete the account. I'm trying to purge my web presence before I move out of California. I have about 200 accounts left, and have done this with 50.

Admittedly, these are all large businesses, so far. Think Google, where I've worked myself, so I know they are equipped to handle it. But, I will be working my way down to small businesses eventually, and I am surprised to find out that simply quoting the statute (which is what I do) is considered anything but vaguely legally threatening. If the website doesn't fall under CCPA, or hell, if it does, I just expect it to be ignored. I mean no ill will.

I'm personally pretty conflicted, since I actually fully agree with this [1] about the study being unethical, but if I send an email as an individual to a website with my data, quoting a California law, that doesn't seem wrong to me, even if it causes $10k in legal costs, since my request is truly genuine and not intended to cause harm.

I would agree that there is a distinction at the study level, but I'm not exactly sure why.

[1] https://news.ycombinator.com/item?id=29599553#29601020

Post reply on HN