I agree it's an oversight, but I'm not sure it's unexpected. Some fields just don't typically do human subjects research so IRBs don't come up. I can't see why

I agree it's an oversight, but I'm not sure it's unexpected. Some fields just don't typically do human subjects research so IRBs don't come up. I can't see why cryptographers would be wasting their time learning about how to prevent repeats of Tuskegee for example. So it probably depends on how these people got into the security research field.