10 ms·

OkCupid Study Reveals the Perils of Big-Data Science

88 points by sonabinu 10y ago

AdmiralAsshat 10y ago
When asked whether the researchers attempted to anonymize the dataset, Aarhus University graduate student Emil O. W. Kirkegaard, who was lead on the work, replied bluntly: “No. Data is already public.” The guy seems completely unrepentant to even the idea that he might be violating people's privacy.
- oarsinsync 10y ago
  Worse still, it seems likely that they were using data that wasn't actually public: Their paper reveals that initially they designed a bot to scrape profile data, but that this first method was dropped because it was “a decidedly non-random approach to find users to scrape because it selected users that were suggested to the profile the bot was using.” This implies that the researchers created an OkCupid profile from which to access the data and run the scraping bot. Since OkCupid users have the option to restrict the visibility of their profiles to logged-in users only, it is likely the researchers collected—and subsequently released—profiles that were intended to not be publicly viewable.
  - AdmiralAsshat 10y ago
    Oh, I'm quite sure it wasn't public. I had an OkCupid profile at one time (thankfully deleted, and even then it had no identifying details and was linked to a dummy email), and the only reason I agreed to sign up was the site's assurance that absolutely NOTHING was publicly visible unless you had a profile. So, yeah, at the risk of breaking my attempted objectivity, I'd be personally thrilled if the guy got sued.
    - deleted 10y ago
      [deleted]
    - sinxoveretothex 10y ago
      It seems to me that the problem here is that you were assured that things weren't public. In that sense, I would say that OKCupid should be sued. I mean, sure, academics might get stopped by lawsuits. Russian social engineering hackers won't though.
      - MasterScrat 10y ago
        From https://www.okcupid.com/legal/terms https://www.okcupid.com/legal/terms: "You should appreciate that all information submitted on the Website might potentially be publicly accessible. Important and private information should be protected by you. We are not responsible for protecting, nor are we liable for failing to protect, the privacy of electronic mail or other information transferred through the Internet or any other network that you may utilize."
  - greeneggs 10y ago
    Also, the way OkCupid works, you can answer questions either privately or publicly. Even when you answer a question publicly, it is still only visible to other users who have answered the same question. Privately answered questions are never visible, but are used in calculating the "percent match" between two users. So I would presume that they started their scraping bot with fake answers to every single question. This is of course a kind of "privacy by obscurity," and it is not at all secure. For example, if you want you can probably figure out people's answers to all questions, even the private ones, by having a separate bot for every question. Then the percent match between the bot and a user reveals the user's answer to that one question. (Possibly OkCupid introduces some noise in the matching algorithm to make this harder, but it can almost certainly be circumvented.)
- brudgers 10y ago
  I am not sanctioning the behavior. However, the exposure of the data is no more [or less] a violation of privacy than what is typically reserved for operators under the terms and conditions of large websites. Neither is it more [or less] a violation of privacy than what is allowed by right when data is treated as a corporate asset [under US law] when ownership of the asset is transfered via sale or bankruptcy. To put it another way, it is only to the degree that it is in OkCupid's business interest to limit disclosure of the same data points that OkCupid [insert other any other corporation here] refrains from releasing that data. The only reason our visceral reactions are different is that we hold biologic people to a different standard of "doing the right thing" than the fictitious persons that are corporations. Legally, a person owned that data. That's why a breach was possible. It's the reification that creates the privacy problem.
  - deleted 10y ago
    [deleted]
- peatmoss 10y ago
  > When contacted by Motherboard for comment, Kirkegaard was dismissive, stating he “would like to wait until the heat has declined a bit before doing any interviews. Not to fan the flames on the social justice warriors.” Yeah, this is a grad student who fails the maturity test in a big way. I could perhaps kind of understand the position that repackaging publicly available sensitive data was just a lapse in taste (assuming, likely erroneously, that it was truly public and not harvested by posing as a mate-seeker). Now he's equating blowback from this lapse with "social justice warriors"? This person sounds like an absolute peach.
- oneloop 10y ago
  This guy is the Martin Shkrelin of scraping: just as much of an asshole but less successful.
vidarh 10y ago
This guy better seek legal assistance quickly. EU data protection legislation is strict, and data about sexual orientation etc. falls under particularly strict protections. The combination of lack of consent and publishing personally identifiable information in a different context, by a different entity of the one that collected it, has plenty of potential for legal challenges that could get rather expensive for him, and I think his glib comment about how the data is already public won't get him very far in court - EU data protection law takes context and what the subject of the information has given consent to very seriously.
apecat 10y ago
Here's a thing I wrote on my personal FB wall as I linked to this article. #### Some creepy Danish assholes went ahead and released a full dataset on 70.000 random users of the OkCupid dating service "because data science". After being confronted about the questionable ethics of this stunt, lead researcher Emil O. W. Kirkegaard refuses interviews, stating that the data was already public. Kirkegaard also implies that opponents of his methods are "social justice warriors", an oftentimes euphemistic term for people interested in things like gender and minority rights issues. Interestingly, this term is repeated and specified as an area explicitly excluded from Kirkegaard's interest in "civil liberties" on his personal website. In addition to "civil liberties", the personal website of this "26 year old polymath wannabe" (read: fuckwit neckbeard) lists interests such as online privacy and the Pirate Party. That's right, you can't make this shit up: http://emilkirkegaard.dk http://emilkirkegaard.dk These people simply don't care that the "public" information posted on a dating site may cost certain people their jobs, families or even their lives, at any point in the future. Open source intelligence like this may be used to extort people at a later date or lower the threshold for invisible discrimination everywhere from the job market to insurance claims. Perhaps all this seems irrelevant to Kirkegaard, as his self-defined interest in liberty explicitly excludes those most vulnerable to such structures. The rest of us could do worse than to remember what is going on and question how informed our consent really is: By default, everything you do on the mainstream internet is recorded. Private browser modes don't really help to protect you and neither do VPNs. Practically everything you typically do leaks information that can be connected back to you. For a demo, see https://panopticlick.eff.org https://panopticlick.eff.org. And oh, dating sites don't exclude sharing your dating related personal info with interested third parties ( https://www.abine.com/blog/2012/privacy-on-okcupid/ https://www.abine.com/blog/2012/privacy-on-okcupid/ ). But hey, you probably don't live with one foot in the closet concerning any aspect of your life you may have hinted at in a dating profile or its chat service. Right? This time, professional stalkers in imaginary data science lab coats just happened to unmask a bunch of information. The wilful cluelessness apparent in this case is even worse than in the decade-old case there AOL released a bunch of poorly anonymised data on search habits: https://en.wikipedia.org/wiki/AOL_search_data_leak https://en.wikipedia.org/wiki/AOL_search_data_leak Normally, interested parties would have to pay a bunch of money for datasets from data brokers or ad/analytics companies and perform a varying degree of computation to unmask and correlate some of the personally identifiable from different sources. That sounds like work, but it's of course increasingly possible to automate. So, take a step back and realize that the only thing protecting you from an existence in something way worse than the oversight of Stasi, the KGB or Securitate, is the thin veil of aging and increasingly inefficient legal protections we happen to have in many western democracies. Parties interested in exploring the utter and complete exploitation of your most intimate information sometimes do so with a holier-than-thou aura of privacy mindedness and selective personal liberty politics. All while personally getting their filthy little hands ever dirtier when the power is at their fingertips. ####
FordPrefectAO 10y ago
If you follow the links to get to the dataset (for instance to see if you're in it), you arrive here[1], which says Unavailable For Legal Reasons This record has been suspended [1] https://osf.io/p9ixw/ https://osf.io/p9ixw/
- oneloop 10y ago
  Yes, because the guy has already started feeling the heat.
  - minimaxir 10y ago
    Another article said OKC did file a legitimate takedown with the data repository host, and they complied.
    - gohrt 10y ago
      "legitimate"? Is UGC copyrighted by the platform host?
      - toomuchtodo 10y ago
        It's most likely licensed by the user to the host (through a ToS), and the host has the ability to use that license to submit takedown notices of their collective database (which is how US copyright law works). Good!
        pbhjpbhj 10y ago
        > use that license to submit takedown notices of their collective database (which is how US copyright law works) // It would be contract law based on the click-wrap/T&Cs of the website wouldn't it? Copyright doesn't cover facts, only their arrangement; ergo as long as he didn't copy the way the content had been presented he would apparently be clear of copyright infringement. In Europe we have database rights law too, is there an equivalent in the USA?
chatmasta 10y ago
My first instinct in this case is to agree that the data is public, or at the very least, protected by account login and therefore only legally protected by the OkCupid terms of use. I see no possible legal argument against the methods of data collection, unless OkCupid wants to sue the researcher for breaching terms of use. Or, perhaps, users could sue OkCupid for failing to diligently protect their data. That said, this was an Academic study, presumably funded at least in part by the University, and therefore subject to approval from an Institutional Review Board (IRB) [0]. Granted it was not an American university, so perhaps no IRB exists. And it was a small study by a group of graduate students, which seems unlikely to be subject to as much scrutiny as a study officially funded and endorsed by the university. However, this is no excuse for circumventing research ethics. To quote the wiki article, "a key goal of IRBs is to protect human subjects from physical or psychological harm," which implies that moral arguments should hold at least as much weight as legal arguments when considering the potential impact of a study. It's entirely possible for a study to be legal, but immoral. Since this study came from a university, any moral argument should be as valid as a legal one. The trouble seems to be that nobody heard any argument, moral or legal, before approving the study. In this case, the failure seems to lie with the Danish University, who allowed its graduate students to conduct a study without consultation from an IRB or any kind of ethical oversight committee. Interestingly, the data is "public," in the sense that anyone could replicate this study with some Python and OkCupid accounts. So even if researchers are stopped by an IRB from collecting the data, that doesn't mean another entity can't do the exact same study, free from any procedural impediments. So it makes you wonder about the premise of questioning the study in the first place. Perhaps a better use of this soapbox, instead of lambasting the researchers, would be to raise awareness of the fact that what you put onto the Internet is public. [1] https://en.wikipedia.org/wiki/Institutional_review_board https://en.wikipedia.org/wiki/Institutional_review_board
- chimeracoder 10y ago
  > And it was a small study by a group of graduate students, which seems unlikely to be subject to as much scrutiny as a study officially funded and endorsed by the university Whether or not this is what happens in practice, the purview of an IRB in the US very much is supposed to cover this situation. IRBs have intentionally broad mandates and cover quite a lot of things that most people would not immediately recognize as 'research' or 'experiments'. > to raise awareness of the fact that what you put onto the Internet is public. Most technical people consider 'doxxing' to be bad. However, in most cases, 'doxxing' is simply publicizing information that is already part of the public record[0]. There's a difference, based on the barrier to accessing that information. [0] If I know your name and your city/state of residence, it's trivial for me to obtain a copy of your driver's license or voting registration information FOIA/FOIL requests typically charge a nominal processing fee to cover the costs of processing the requests, but only because it's a largely manual process, and the marginal costs of requesting many records at once is very low.
dimino 10y ago
This article begs the question. Why does "Public not equal consent"?
- maldusiecle 10y ago
  >The most important, and often least understood, concern is that even if someone knowingly shares a single piece of information, big data analysis can publicize and amplify it in a way the person never intended or agreed. Please read articles at least a few paragraphs in before commenting.
  - dimino 10y ago
    Your snark aside (c'mon, man), that doesn't even come close to answering the question of, "why is it not okay?" Making something public comes with the possibility that it might go "viral" or some other form of popularity. That's what "public" means, after all. This article presupposes the reader considers what happened to be wrong, and does nothing to explain why it's wrong.
    - fizzbatter 10y ago
      Agree completely. With that said, with many pieces of data, there are still limitations on their usage - public or not. A company can't use your public photo as their brand image without your involvement, for example (... or so i hope, hah). I do agree that there are uncontrollable outcomes that need to be understood - your viral example is a great one. But the viral outcome is inherently uncontrollable and fully decentralized. A study done by a select group of person(s) is controllable. Thoughts?
      - dimino 10y ago
        I think there's a visceral reaction to this specific content, that "dating profile data" is different than "reddit comment history", despite being equally public, and both are probably similarly identifiable. It boils down to expectation vs. reality, right? It doesn't make sense to me to prohibit research institutions from pulling data if they can in a way that doesn't violate any usage agreements or user expectation. Do people get upset if OKCupid uses their data for their blog posts? What's the significant difference? To me, the action/lesson here is for OKCupid to implement something in their usage agreement preventing data scraping by end users (the bot the researcher wrote is probably not what OKC wants people doing). Then it becomes an ethical violation, but without it, I'd consider this data fair game.
lucb1e 10y ago
Meta: did something change in Wired's policy? Because I can read the article with an ad blocker turned on. Googling for recent articles about it, I don't see anything. Edit: Never mind, I can scroll all the way through and I can see the whole article. But if I read from the top and then scroll, it blocks me. So they give me a chance to see "oh it's all there," start reading, and then block it for me. Talking about dark patterns... I mean, I get it from a financial standpoint, and I'm totally going to circumvent this blocking now (private window, inspect element, I don't know what'll work yet), but it's just shitty.
- sdfjkl 10y ago
  Firefox' Reader mode seems to bypass this nonsense in one click.
  - brudgers 10y ago
    And bypasses Flash and page jumps as javascript and advertisements load. Particularly late loading hero ads.
- sudojudo 10y ago
  I'm running NoScript, uBlock Origin, and Disconnect. No issues at all. I'd imagine NoScript is to thank for not having the scroll issue that you're coming up against.
  - lucb1e 10y ago
    Yup, that'd be NoScript.
gohrt 10y ago
Article doesn't mention OKC ToS one way or the other. What are the ToS? Most sites ban content scraping by users (And good sites have technical countermeasures)
aab0 10y ago
So. I read the whole thing. And they cite several precedents. But what are the perils? They never say.
MasterScrat 10y ago
In the grand scheme of things this is good news. People need to realise they can't trust random websites with their deepest secrets. There is no reason to think no one is scraping dating websites, social medias and other "public" personal data for personal profit. For blackmailing, social engineering... The sooner people will get this chilling feel that "wait, what I post online may actually come back to bite me" the better.
kevincox 10y ago
I get that this isn't "socially acceptable" and that it requires an account to access (accounts which can be created by the general public). But every time I think about it I fall back to the conclusion that if they didn't release it it would be fairly easy to collect anyways. So yes, this release made it easier, but at some level I see that as a good thing to make people aware of. I see why this got so much discussion, it's a very grey area from my point of view.
curried_haskell 10y ago
I really do not understand this argument or belief people have, that they can send out their information into the world, via a network of unknown intermediaries to a private third party in another country, and somehow their data is still "private". That your data is posted for everybody to see on a publicly accessible website, and somehow your data is still "private". Here's something incredibly simple: if you don't want your data to be public, then don't share it! Don't transmit it! Don't want the other users on OkCupid storing your information? Why did you put it there in the first place!?!? The internet is not now, nor was it ever, a private place. These guys did nothing wrong as far as I'm concerned, besides maybe breaching OkCupid's TOS. OkCupid can sue if it pleases them, but that's a matter for civil law.
- taberiand 10y ago
  If I'm out chatting with friends about my life and I'm in public then I may have no real expectation of privacy, but that doesn't mean I won't be upset if someone decides to follow me around with a spotlight shouting about everything I'm saying
collyw 10y ago
70,000 users is now big data....?

88 points by sonabinu 10y ago

When asked whether the researchers attempted to anonymize the dataset, Aarhus University graduate student Emil O. W. Kirkegaard, who was lead on the work, replied bluntly: “No. Data is already public.” The guy seems completely unrepentant to even the idea that he might be violating people's privacy.

oarsinsync 10y ago
Worse still, it seems likely that they were using data that wasn't actually public: Their paper reveals that initially they designed a bot to scrape profile data, but that this first method was dropped because it was “a decidedly non-random approach to find users to scrape because it selected users that were suggested to the profile the bot was using.” This implies that the researchers created an OkCupid profile from which to access the data and run the scraping bot. Since OkCupid users have the option to restrict the visibility of their profiles to logged-in users only, it is likely the researchers collected—and subsequently released—profiles that were intended to not be publicly viewable.
- AdmiralAsshat 10y ago
  Oh, I'm quite sure it wasn't public. I had an OkCupid profile at one time (thankfully deleted, and even then it had no identifying details and was linked to a dummy email), and the only reason I agreed to sign up was the site's assurance that absolutely NOTHING was publicly visible unless you had a profile. So, yeah, at the risk of breaking my attempted objectivity, I'd be personally thrilled if the guy got sued.
  - deleted 10y ago
    [deleted]
  - sinxoveretothex 10y ago
    It seems to me that the problem here is that you were assured that things weren't public. In that sense, I would say that OKCupid should be sued. I mean, sure, academics might get stopped by lawsuits. Russian social engineering hackers won't though.
    - MasterScrat 10y ago
      From https://www.okcupid.com/legal/terms https://www.okcupid.com/legal/terms: "You should appreciate that all information submitted on the Website might potentially be publicly accessible. Important and private information should be protected by you. We are not responsible for protecting, nor are we liable for failing to protect, the privacy of electronic mail or other information transferred through the Internet or any other network that you may utilize."
- greeneggs 10y ago
  Also, the way OkCupid works, you can answer questions either privately or publicly. Even when you answer a question publicly, it is still only visible to other users who have answered the same question. Privately answered questions are never visible, but are used in calculating the "percent match" between two users. So I would presume that they started their scraping bot with fake answers to every single question. This is of course a kind of "privacy by obscurity," and it is not at all secure. For example, if you want you can probably figure out people's answers to all questions, even the private ones, by having a separate bot for every question. Then the percent match between the bot and a user reveals the user's answer to that one question. (Possibly OkCupid introduces some noise in the matching algorithm to make this harder, but it can almost certainly be circumvented.)
brudgers 10y ago
I am not sanctioning the behavior. However, the exposure of the data is no more [or less] a violation of privacy than what is typically reserved for operators under the terms and conditions of large websites. Neither is it more [or less] a violation of privacy than what is allowed by right when data is treated as a corporate asset [under US law] when ownership of the asset is transfered via sale or bankruptcy. To put it another way, it is only to the degree that it is in OkCupid's business interest to limit disclosure of the same data points that OkCupid [insert other any other corporation here] refrains from releasing that data. The only reason our visceral reactions are different is that we hold biologic people to a different standard of "doing the right thing" than the fictitious persons that are corporations. Legally, a person owned that data. That's why a breach was possible. It's the reification that creates the privacy problem.
- deleted 10y ago
  [deleted]
peatmoss 10y ago
> When contacted by Motherboard for comment, Kirkegaard was dismissive, stating he “would like to wait until the heat has declined a bit before doing any interviews. Not to fan the flames on the social justice warriors.” Yeah, this is a grad student who fails the maturity test in a big way. I could perhaps kind of understand the position that repackaging publicly available sensitive data was just a lapse in taste (assuming, likely erroneously, that it was truly public and not harvested by posing as a mate-seeker). Now he's equating blowback from this lapse with "social justice warriors"? This person sounds like an absolute peach.
oneloop 10y ago
This guy is the Martin Shkrelin of scraping: just as much of an asshole but less successful.

vidarh 10y ago

This guy better seek legal assistance quickly. EU data protection legislation is strict, and data about sexual orientation etc. falls under particularly strict protections. The combination of lack of consent and publishing personally identifiable information in a different context, by a different entity of the one that collected it, has plenty of potential for legal challenges that could get rather expensive for him, and I think his glib comment about how the data is already public won't get him very far in court - EU data protection law takes context and what the subject of the information has given consent to very seriously.

apecat 10y ago

Here's a thing I wrote on my personal FB wall as I linked to this article. #### Some creepy Danish assholes went ahead and released a full dataset on 70.000 random users of the OkCupid dating service "because data science". After being confronted about the questionable ethics of this stunt, lead researcher Emil O. W. Kirkegaard refuses interviews, stating that the data was already public. Kirkegaard also implies that opponents of his methods are "social justice warriors", an oftentimes euphemistic term for people interested in things like gender and minority rights issues. Interestingly, this term is repeated and specified as an area explicitly excluded from Kirkegaard's interest in "civil liberties" on his personal website. In addition to "civil liberties", the personal website of this "26 year old polymath wannabe" (read: fuckwit neckbeard) lists interests such as online privacy and the Pirate Party. That's right, you can't make this shit up: http://emilkirkegaard.dk http://emilkirkegaard.dk These people simply don't care that the "public" information posted on a dating site may cost certain people their jobs, families or even their lives, at any point in the future. Open source intelligence like this may be used to extort people at a later date or lower the threshold for invisible discrimination everywhere from the job market to insurance claims. Perhaps all this seems irrelevant to Kirkegaard, as his self-defined interest in liberty explicitly excludes those most vulnerable to such structures. The rest of us could do worse than to remember what is going on and question how informed our consent really is: By default, everything you do on the mainstream internet is recorded. Private browser modes don't really help to protect you and neither do VPNs. Practically everything you typically do leaks information that can be connected back to you. For a demo, see https://panopticlick.eff.org https://panopticlick.eff.org. And oh, dating sites don't exclude sharing your dating related personal info with interested third parties ( https://www.abine.com/blog/2012/privacy-on-okcupid/ https://www.abine.com/blog/2012/privacy-on-okcupid/ ). But hey, you probably don't live with one foot in the closet concerning any aspect of your life you may have hinted at in a dating profile or its chat service. Right? This time, professional stalkers in imaginary data science lab coats just happened to unmask a bunch of information. The wilful cluelessness apparent in this case is even worse than in the decade-old case there AOL released a bunch of poorly anonymised data on search habits: https://en.wikipedia.org/wiki/AOL_search_data_leak https://en.wikipedia.org/wiki/AOL_search_data_leak Normally, interested parties would have to pay a bunch of money for datasets from data brokers or ad/analytics companies and perform a varying degree of computation to unmask and correlate some of the personally identifiable from different sources. That sounds like work, but it's of course increasingly possible to automate. So, take a step back and realize that the only thing protecting you from an existence in something way worse than the oversight of Stasi, the KGB or Securitate, is the thin veil of aging and increasingly inefficient legal protections we happen to have in many western democracies. Parties interested in exploring the utter and complete exploitation of your most intimate information sometimes do so with a holier-than-thou aura of privacy mindedness and selective personal liberty politics. All while personally getting their filthy little hands ever dirtier when the power is at their fingertips. ####

FordPrefectAO 10y ago

If you follow the links to get to the dataset (for instance to see if you're in it), you arrive here[1], which says Unavailable For Legal Reasons This record has been suspended [1] https://osf.io/p9ixw/ https://osf.io/p9ixw/

oneloop 10y ago
Yes, because the guy has already started feeling the heat.
- minimaxir 10y ago
  Another article said OKC did file a legitimate takedown with the data repository host, and they complied.
  - gohrt 10y ago
    "legitimate"? Is UGC copyrighted by the platform host?
    - toomuchtodo 10y ago
      It's most likely licensed by the user to the host (through a ToS), and the host has the ability to use that license to submit takedown notices of their collective database (which is how US copyright law works). Good!
      - pbhjpbhj 10y ago
        > use that license to submit takedown notices of their collective database (which is how US copyright law works) // It would be contract law based on the click-wrap/T&Cs of the website wouldn't it? Copyright doesn't cover facts, only their arrangement; ergo as long as he didn't copy the way the content had been presented he would apparently be clear of copyright infringement. In Europe we have database rights law too, is there an equivalent in the USA?

chatmasta 10y ago

My first instinct in this case is to agree that the data is public, or at the very least, protected by account login and therefore only legally protected by the OkCupid terms of use. I see no possible legal argument against the methods of data collection, unless OkCupid wants to sue the researcher for breaching terms of use. Or, perhaps, users could sue OkCupid for failing to diligently protect their data. That said, this was an Academic study, presumably funded at least in part by the University, and therefore subject to approval from an Institutional Review Board (IRB) [0]. Granted it was not an American university, so perhaps no IRB exists. And it was a small study by a group of graduate students, which seems unlikely to be subject to as much scrutiny as a study officially funded and endorsed by the university. However, this is no excuse for circumventing research ethics. To quote the wiki article, "a key goal of IRBs is to protect human subjects from physical or psychological harm," which implies that moral arguments should hold at least as much weight as legal arguments when considering the potential impact of a study. It's entirely possible for a study to be legal, but immoral. Since this study came from a university, any moral argument should be as valid as a legal one. The trouble seems to be that nobody heard any argument, moral or legal, before approving the study. In this case, the failure seems to lie with the Danish University, who allowed its graduate students to conduct a study without consultation from an IRB or any kind of ethical oversight committee. Interestingly, the data is "public," in the sense that anyone could replicate this study with some Python and OkCupid accounts. So even if researchers are stopped by an IRB from collecting the data, that doesn't mean another entity can't do the exact same study, free from any procedural impediments. So it makes you wonder about the premise of questioning the study in the first place. Perhaps a better use of this soapbox, instead of lambasting the researchers, would be to raise awareness of the fact that what you put onto the Internet is public. [1] https://en.wikipedia.org/wiki/Institutional_review_board https://en.wikipedia.org/wiki/Institutional_review_board

chimeracoder 10y ago
> And it was a small study by a group of graduate students, which seems unlikely to be subject to as much scrutiny as a study officially funded and endorsed by the university Whether or not this is what happens in practice, the purview of an IRB in the US very much is supposed to cover this situation. IRBs have intentionally broad mandates and cover quite a lot of things that most people would not immediately recognize as 'research' or 'experiments'. > to raise awareness of the fact that what you put onto the Internet is public. Most technical people consider 'doxxing' to be bad. However, in most cases, 'doxxing' is simply publicizing information that is already part of the public record[0]. There's a difference, based on the barrier to accessing that information. [0] If I know your name and your city/state of residence, it's trivial for me to obtain a copy of your driver's license or voting registration information FOIA/FOIL requests typically charge a nominal processing fee to cover the costs of processing the requests, but only because it's a largely manual process, and the marginal costs of requesting many records at once is very low.

dimino 10y ago

This article begs the question. Why does "Public not equal consent"?

maldusiecle 10y ago
>The most important, and often least understood, concern is that even if someone knowingly shares a single piece of information, big data analysis can publicize and amplify it in a way the person never intended or agreed. Please read articles at least a few paragraphs in before commenting.
- dimino 10y ago
  Your snark aside (c'mon, man), that doesn't even come close to answering the question of, "why is it not okay?" Making something public comes with the possibility that it might go "viral" or some other form of popularity. That's what "public" means, after all. This article presupposes the reader considers what happened to be wrong, and does nothing to explain why it's wrong.
  - fizzbatter 10y ago
    Agree completely. With that said, with many pieces of data, there are still limitations on their usage - public or not. A company can't use your public photo as their brand image without your involvement, for example (... or so i hope, hah). I do agree that there are uncontrollable outcomes that need to be understood - your viral example is a great one. But the viral outcome is inherently uncontrollable and fully decentralized. A study done by a select group of person(s) is controllable. Thoughts?
    - dimino 10y ago
      I think there's a visceral reaction to this specific content, that "dating profile data" is different than "reddit comment history", despite being equally public, and both are probably similarly identifiable. It boils down to expectation vs. reality, right? It doesn't make sense to me to prohibit research institutions from pulling data if they can in a way that doesn't violate any usage agreements or user expectation. Do people get upset if OKCupid uses their data for their blog posts? What's the significant difference? To me, the action/lesson here is for OKCupid to implement something in their usage agreement preventing data scraping by end users (the bot the researcher wrote is probably not what OKC wants people doing). Then it becomes an ethical violation, but without it, I'd consider this data fair game.

lucb1e 10y ago

Meta: did something change in Wired's policy? Because I can read the article with an ad blocker turned on. Googling for recent articles about it, I don't see anything. Edit: Never mind, I can scroll all the way through and I can see the whole article. But if I read from the top and then scroll, it blocks me. So they give me a chance to see "oh it's all there," start reading, and then block it for me. Talking about dark patterns... I mean, I get it from a financial standpoint, and I'm totally going to circumvent this blocking now (private window, inspect element, I don't know what'll work yet), but it's just shitty.

sdfjkl 10y ago
Firefox' Reader mode seems to bypass this nonsense in one click.
- brudgers 10y ago
  And bypasses Flash and page jumps as javascript and advertisements load. Particularly late loading hero ads.
sudojudo 10y ago
I'm running NoScript, uBlock Origin, and Disconnect. No issues at all. I'd imagine NoScript is to thank for not having the scroll issue that you're coming up against.
- lucb1e 10y ago
  Yup, that'd be NoScript.

gohrt 10y ago

Article doesn't mention OKC ToS one way or the other. What are the ToS? Most sites ban content scraping by users (And good sites have technical countermeasures)

aab0 10y ago

So. I read the whole thing. And they cite several precedents. But what are the perils? They never say.

MasterScrat 10y ago

In the grand scheme of things this is good news. People need to realise they can't trust random websites with their deepest secrets. There is no reason to think no one is scraping dating websites, social medias and other "public" personal data for personal profit. For blackmailing, social engineering... The sooner people will get this chilling feel that "wait, what I post online may actually come back to bite me" the better.

kevincox 10y ago

I get that this isn't "socially acceptable" and that it requires an account to access (accounts which can be created by the general public). But every time I think about it I fall back to the conclusion that if they didn't release it it would be fairly easy to collect anyways. So yes, this release made it easier, but at some level I see that as a good thing to make people aware of. I see why this got so much discussion, it's a very grey area from my point of view.

curried_haskell 10y ago

I really do not understand this argument or belief people have, that they can send out their information into the world, via a network of unknown intermediaries to a private third party in another country, and somehow their data is still "private". That your data is posted for everybody to see on a publicly accessible website, and somehow your data is still "private". Here's something incredibly simple: if you don't want your data to be public, then don't share it! Don't transmit it! Don't want the other users on OkCupid storing your information? Why did you put it there in the first place!?!? The internet is not now, nor was it ever, a private place. These guys did nothing wrong as far as I'm concerned, besides maybe breaching OkCupid's TOS. OkCupid can sue if it pleases them, but that's a matter for civil law.

taberiand 10y ago
If I'm out chatting with friends about my life and I'm in public then I may have no real expectation of privacy, but that doesn't mean I won't be upset if someone decides to follow me around with a spotlight shouting about everything I'm saying

collyw 10y ago

70,000 users is now big data....?