7 ms·

> We analyze the financial activity of 653,455 anonymous accounts corresponding to 298,556 households from one of the largest brokerage firms in the United Stat

> We analyze the financial activity of 653,455 anonymous accounts corresponding to 298,556 households from one of the largest brokerage firms in the United States. This pisses me off. I don’t want any of my financial firms handing out my data to anyone. It looks like they even gave them demographic information specific enough to likely be identifiable. What firm is this data from? This should be illegal.

huitzitziltzin 5y ago
I’m an economist who does research with sensitive data, though not in finance. I don’t know if I can assuage your concerns but… - any project like this goes through layers of lawyers on both sides (mit and the brokerage). They are extremely careful about exactly your concern. - mit has infrastructure to securely hold data. They do a ton of defense work, for example. They take it seriously. In the non-defense context, accidentally exposing certain health data can (iirc) lead to the entire university losing eligibility for NIH funding. At MIT that might be a half billion dollar hit. They don’t mess around with that. (Compare to the private sector where there are effectively no meaningful fines or consequences for data breaches.) - none of the researchers care about you as an individual enough to try to deidentify you in the data. I work with health data, some of which includes addresses. I have never thought for even one second that I should find out who lives at the address, even when dealing with data which includes the city I live in (so potentially my neighbors, eg.) - everyone involved in the project also separately promises not to de-identify anyone. Again: I really doubt anyone I have ever met in my field would care identify someone, but we do promise not to. - any data which is going to be merged with whatever the researchers got from the brokerage will be outlined in great detail in advance. As another point of comparison, how many breaches of university research data are you aware of? These things happen in the corporate world all the time with extremely sensitive data but I have not heard of university data beaches myself. Finally, there is generally some scientific benefit to the work that the researchers do. We know something from this paper about panic selling which we didn’t know before. That may be valuable.
- throwawaygh 5y ago
  It used to be that IRBs required AFFIRMATIVE CONSENT from participants. It doesn’t matter what just so story you tell yourself. Research ethics 101: Don’t use people as lab specimens unless they affirmatively consent. Period. We should go back to the days of actual ethics in research. Banks and brokerages can do whatever they want with customer data, subject to relevant laws and contracts. Researchers who ever want a penny from the public should be held to higher ethical standards.
  - SubiculumCode 5y ago
    IRB's do require affirmative consent, but the IRB is not required to analyze certain datasets. Moreover, the contract of investors with the trading firm probably already had language allowing this usage.
    - throwawaygh 5y ago
      Dataset ethics review is becoming nore common. I'll be surprised if this "use corporate data without irb input" model survives the decade. Corps can put whatever they want in tos, and researchers are free to use data from those corps. But federal agencies should refuse to fund those pis and their institutions.
  - huitzitziltzin 5y ago
    > It used to be that IRBs required AFFIRMATIVE CONSENT This is (and has always been) waivable in cases (like this one) where either obtaining consent is impractical (which maybe applies here) OR you are making use of de-identified data (more likely to apply in this case). Affirmative consent still is required in many cases. With health data (the case I know personally), it would not be feasible for me to find five million patients and ask them to participate in my boring study answering a question which wouldn’t interest them. Just mailing each of them a letter to ask would be cost prohibitive! The value of research is frequently non-zero, whereas the risk to the participants is generally zero or extremely low. This is the balance the IRB is trying to strike. And believe me, as someone who has gone through it, I think they err way way WAY too far on the side of being overly cautious!
elevenoh 5y ago
Agree. Retail investors have no access to data, and are deeply being exploited. Crypto helps with this.

huitzitziltzin 5y ago

I’m an economist who does research with sensitive data, though not in finance. I don’t know if I can assuage your concerns but… - any project like this goes through layers of lawyers on both sides (mit and the brokerage). They are extremely careful about exactly your concern. - mit has infrastructure to securely hold data. They do a ton of defense work, for example. They take it seriously. In the non-defense context, accidentally exposing certain health data can (iirc) lead to the entire university losing eligibility for NIH funding. At MIT that might be a half billion dollar hit. They don’t mess around with that. (Compare to the private sector where there are effectively no meaningful fines or consequences for data breaches.) - none of the researchers care about you as an individual enough to try to deidentify you in the data. I work with health data, some of which includes addresses. I have never thought for even one second that I should find out who lives at the address, even when dealing with data which includes the city I live in (so potentially my neighbors, eg.) - everyone involved in the project also separately promises not to de-identify anyone. Again: I really doubt anyone I have ever met in my field would care identify someone, but we do promise not to. - any data which is going to be merged with whatever the researchers got from the brokerage will be outlined in great detail in advance. As another point of comparison, how many breaches of university research data are you aware of? These things happen in the corporate world all the time with extremely sensitive data but I have not heard of university data beaches myself. Finally, there is generally some scientific benefit to the work that the researchers do. We know something from this paper about panic selling which we didn’t know before. That may be valuable.

throwawaygh 5y ago
It used to be that IRBs required AFFIRMATIVE CONSENT from participants. It doesn’t matter what just so story you tell yourself. Research ethics 101: Don’t use people as lab specimens unless they affirmatively consent. Period. We should go back to the days of actual ethics in research. Banks and brokerages can do whatever they want with customer data, subject to relevant laws and contracts. Researchers who ever want a penny from the public should be held to higher ethical standards.
- SubiculumCode 5y ago
  IRB's do require affirmative consent, but the IRB is not required to analyze certain datasets. Moreover, the contract of investors with the trading firm probably already had language allowing this usage.
  - throwawaygh 5y ago
    Dataset ethics review is becoming nore common. I'll be surprised if this "use corporate data without irb input" model survives the decade. Corps can put whatever they want in tos, and researchers are free to use data from those corps. But federal agencies should refuse to fund those pis and their institutions.
- huitzitziltzin 5y ago
  > It used to be that IRBs required AFFIRMATIVE CONSENT This is (and has always been) waivable in cases (like this one) where either obtaining consent is impractical (which maybe applies here) OR you are making use of de-identified data (more likely to apply in this case). Affirmative consent still is required in many cases. With health data (the case I know personally), it would not be feasible for me to find five million patients and ask them to participate in my boring study answering a question which wouldn’t interest them. Just mailing each of them a letter to ask would be cost prohibitive! The value of research is frequently non-zero, whereas the risk to the participants is generally zero or extremely low. This is the balance the IRB is trying to strike. And believe me, as someone who has gone through it, I think they err way way WAY too far on the side of being overly cautious!

elevenoh 5y ago

Agree. Retail investors have no access to data, and are deeply being exploited. Crypto helps with this.