6 ms·

I’m an economist who does research with sensitive data, though not in finance. I don’t know if I can assuage your concerns but… - any project like this goes t

I’m an economist who does research with sensitive data, though not in finance. I don’t know if I can assuage your concerns but… - any project like this goes through layers of lawyers on both sides (mit and the brokerage). They are extremely careful about exactly your concern. - mit has infrastructure to securely hold data. They do a ton of defense work, for example. They take it seriously. In the non-defense context, accidentally exposing certain health data can (iirc) lead to the entire university losing eligibility for NIH funding. At MIT that might be a half billion dollar hit. They don’t mess around with that. (Compare to the private sector where there are effectively no meaningful fines or consequences for data breaches.) - none of the researchers care about you as an individual enough to try to deidentify you in the data. I work with health data, some of which includes addresses. I have never thought for even one second that I should find out who lives at the address, even when dealing with data which includes the city I live in (so potentially my neighbors, eg.) - everyone involved in the project also separately promises not to de-identify anyone. Again: I really doubt anyone I have ever met in my field would care identify someone, but we do promise not to. - any data which is going to be merged with whatever the researchers got from the brokerage will be outlined in great detail in advance. As another point of comparison, how many breaches of university research data are you aware of? These things happen in the corporate world all the time with extremely sensitive data but I have not heard of university data beaches myself. Finally, there is generally some scientific benefit to the work that the researchers do. We know something from this paper about panic selling which we didn’t know before. That may be valuable.

throwawaygh 5y ago
It used to be that IRBs required AFFIRMATIVE CONSENT from participants. It doesn’t matter what just so story you tell yourself. Research ethics 101: Don’t use people as lab specimens unless they affirmatively consent. Period. We should go back to the days of actual ethics in research. Banks and brokerages can do whatever they want with customer data, subject to relevant laws and contracts. Researchers who ever want a penny from the public should be held to higher ethical standards.
- SubiculumCode 5y ago
  IRB's do require affirmative consent, but the IRB is not required to analyze certain datasets. Moreover, the contract of investors with the trading firm probably already had language allowing this usage.
  - throwawaygh 5y ago
    Dataset ethics review is becoming nore common. I'll be surprised if this "use corporate data without irb input" model survives the decade. Corps can put whatever they want in tos, and researchers are free to use data from those corps. But federal agencies should refuse to fund those pis and their institutions.
- huitzitziltzin 5y ago
  > It used to be that IRBs required AFFIRMATIVE CONSENT This is (and has always been) waivable in cases (like this one) where either obtaining consent is impractical (which maybe applies here) OR you are making use of de-identified data (more likely to apply in this case). Affirmative consent still is required in many cases. With health data (the case I know personally), it would not be feasible for me to find five million patients and ask them to participate in my boring study answering a question which wouldn’t interest them. Just mailing each of them a letter to ask would be cost prohibitive! The value of research is frequently non-zero, whereas the risk to the participants is generally zero or extremely low. This is the balance the IRB is trying to strike. And believe me, as someone who has gone through it, I think they err way way WAY too far on the side of being overly cautious!
dataangel 5y ago
> I have not heard of university data beaches myself. Nearly every large organization has probably had a data breach, the only questions are if it was discovered and if so if it was reported. MIT can have the best cybersecurity team in the world and they will still be helpless against a 0-day.
- huitzitziltzin 5y ago
  Fair point. Nothing prevents mit from getting robbed tomorrow. Nothing prevents Vanguard from facing the same zero day. My claim only was that mit would take it seriously and that’s personally don’t hear about a lot of university data breaches.
heisenbergs 5y ago
Cambridge analytica, containing all facebook data for 87M people?
- filoleg 5y ago
  Cambridge Analytica is a private political consulting firm, not a university or any other type of an educational institution.
  - nostromo 5y ago
    Cambridge Analytica acquired their data from a research associate at the University of Cambridge, Aleksander Kogan.
playpause 5y ago
“They are extremely careful about your concern” requires that we trust both their intentions and their competence, which should not be assumed. “None of the researchers care about you” - strawman, no one said that or thinks that, and it’s irrelevant. “Everyone involved promises not to identify anyone” - see response to first point. I think the other points are valid though.
- jacobr1 5y ago
  > “Everyone involved promises not to identify anyone” - see response to first point. They legally promise via some form a non-disclosure agreement. A violation means they are liable in the case they are the source of a breach, which can both provide incentives and recourse. Certainly not ironclad, but it is stronger than just a vague "promise."
  - OnlineGladiator 5y ago
    It's stronger, but still pretty weak. In my experience people willfully ignore NDAs all the time. I think it's only lawyers who take them seriously, or at least pretend to take them seriously. First you have to care enough to go after the NDA breaker. Then you have to have enough evidence to legally demonstrate they broke the NDA. Then you have to pursue legal action. This all costs time and money, and even then there's a good chance you can't actually prove anything. You have to seriously piss off someone (most likely a large corporation) with a lot of time and money for it to matter that you broke an NDA.
- huitzitziltzin 5y ago
  > strawman, no one said that or thinks that, and it’s irrelevant. OP said he didn’t want to be de-anonymized. Either the researchers do that themselves or the data is stolen and someone else does it. For the first group, I tried to explain why the researchers themselves aren’t going to and why. So I’m not sure no one thinks it and it’s not irrelevant.
  - playpause 5y ago
jrumbut 5y ago
I agree with what you're saying (except I have heard of university data breaches because I follow that sort of thing), but also the information in this study is extremely personal and sensitive. While I'm sure there was a lot of attention on data security behind the scenes it is a little unnerving to hear someone say, when you aren't expecting it, "we looked at everyone's brokerage history and here's when they felt fear that they were about to lose everything." I do wish there was a way to at least reduce the surprise factor. Perhaps put a note about the data collection protocol in the abstract on the article page.
koheripbal 5y ago
MIT is not a single entity. Good security in one group does not mean good security in another group - at all.
janto 5y ago
I do not consent.
luckylion 5y ago
Thank you for the insightful comment. While there's similar concerns for health, I think financial circumstances are somewhat different. Few people have any interest in finding out "who that person with cancer in that small town is", but "who is that unknown multi-millionaire in my parents' village" might be more tempting. There's no political issue around individual health issues, but individual wealth is very political. I can definitely understand why someone wouldn't want identifiable information about their personal wealth given to third parties, especially not to US universities, which have a tendency to be rather left-wing and full of ideas of undeserved privilege that many don't share and would not feel comfortable knowing that their private information is shared with them. An angry research or student taking to Twitter to call out the evil capitalists isn't that crazy of an idea.
tartoran 5y ago
It’s not about identifying you it’s more about using the data from you and Weaponized in it against you. Citadel Securities, the market maker, is known to do this kind of thing to rip off retail traders via data obtained from trading platforms such as Robinhood, webull etc. This is an uneven battlefield and it’s obviously wrong and that’s the reason why we don’t want our data to be shared, it amounts to spying on our behavior in order to control, profit or what other nefarious reasons.
- cinntaile 5y ago
  That's why Robinhood is free no? Can't you choose a broker that doesn't sell your data?
  - tartoran 5y ago
    Yes absolutely but people don’t realize how much it works against them; this kind of thing should be illegal in my oppinion. If we care about protecting the investors and making a fair market at least. This is beyond a hidden fee, this is almost stealing the customer’s purse
- huitzitziltzin 5y ago
  Totally a fair point but Citadel does not need Andrew Lo’s (an author on this paper) help to do that. Nor is that what he gets out of it. Citadel can do it (and may try to do it?) itself without his input. The research angle is orthogonal to your concern.
ralphc 5y ago
https://en.wikipedia.org/wiki/AOL_search_data_leak https://en.wikipedia.org/wiki/AOL_search_data_leak https://techcrunch.com/2006/08/06/aol-proudly-releases-massive-amounts-of-user-search-data/ https://techcrunch.com/2006/08/06/aol-proudly-releases-massi...

throwawaygh 5y ago

It used to be that IRBs required AFFIRMATIVE CONSENT from participants. It doesn’t matter what just so story you tell yourself. Research ethics 101: Don’t use people as lab specimens unless they affirmatively consent. Period. We should go back to the days of actual ethics in research. Banks and brokerages can do whatever they want with customer data, subject to relevant laws and contracts. Researchers who ever want a penny from the public should be held to higher ethical standards.

SubiculumCode 5y ago
IRB's do require affirmative consent, but the IRB is not required to analyze certain datasets. Moreover, the contract of investors with the trading firm probably already had language allowing this usage.
- throwawaygh 5y ago
  Dataset ethics review is becoming nore common. I'll be surprised if this "use corporate data without irb input" model survives the decade. Corps can put whatever they want in tos, and researchers are free to use data from those corps. But federal agencies should refuse to fund those pis and their institutions.
huitzitziltzin 5y ago
> It used to be that IRBs required AFFIRMATIVE CONSENT This is (and has always been) waivable in cases (like this one) where either obtaining consent is impractical (which maybe applies here) OR you are making use of de-identified data (more likely to apply in this case). Affirmative consent still is required in many cases. With health data (the case I know personally), it would not be feasible for me to find five million patients and ask them to participate in my boring study answering a question which wouldn’t interest them. Just mailing each of them a letter to ask would be cost prohibitive! The value of research is frequently non-zero, whereas the risk to the participants is generally zero or extremely low. This is the balance the IRB is trying to strike. And believe me, as someone who has gone through it, I think they err way way WAY too far on the side of being overly cautious!

dataangel 5y ago

> I have not heard of university data beaches myself. Nearly every large organization has probably had a data breach, the only questions are if it was discovered and if so if it was reported. MIT can have the best cybersecurity team in the world and they will still be helpless against a 0-day.

huitzitziltzin 5y ago
Fair point. Nothing prevents mit from getting robbed tomorrow. Nothing prevents Vanguard from facing the same zero day. My claim only was that mit would take it seriously and that’s personally don’t hear about a lot of university data breaches.

heisenbergs 5y ago

Cambridge analytica, containing all facebook data for 87M people?

filoleg 5y ago
Cambridge Analytica is a private political consulting firm, not a university or any other type of an educational institution.
- nostromo 5y ago
  Cambridge Analytica acquired their data from a research associate at the University of Cambridge, Aleksander Kogan.

playpause 5y ago

“They are extremely careful about your concern” requires that we trust both their intentions and their competence, which should not be assumed. “None of the researchers care about you” - strawman, no one said that or thinks that, and it’s irrelevant. “Everyone involved promises not to identify anyone” - see response to first point. I think the other points are valid though.

jacobr1 5y ago
> “Everyone involved promises not to identify anyone” - see response to first point. They legally promise via some form a non-disclosure agreement. A violation means they are liable in the case they are the source of a breach, which can both provide incentives and recourse. Certainly not ironclad, but it is stronger than just a vague "promise."
- OnlineGladiator 5y ago
  It's stronger, but still pretty weak. In my experience people willfully ignore NDAs all the time. I think it's only lawyers who take them seriously, or at least pretend to take them seriously. First you have to care enough to go after the NDA breaker. Then you have to have enough evidence to legally demonstrate they broke the NDA. Then you have to pursue legal action. This all costs time and money, and even then there's a good chance you can't actually prove anything. You have to seriously piss off someone (most likely a large corporation) with a lot of time and money for it to matter that you broke an NDA.
huitzitziltzin 5y ago
> strawman, no one said that or thinks that, and it’s irrelevant. OP said he didn’t want to be de-anonymized. Either the researchers do that themselves or the data is stolen and someone else does it. For the first group, I tried to explain why the researchers themselves aren’t going to and why. So I’m not sure no one thinks it and it’s not irrelevant.
- playpause 5y ago

jrumbut 5y ago

I agree with what you're saying (except I have heard of university data breaches because I follow that sort of thing), but also the information in this study is extremely personal and sensitive. While I'm sure there was a lot of attention on data security behind the scenes it is a little unnerving to hear someone say, when you aren't expecting it, "we looked at everyone's brokerage history and here's when they felt fear that they were about to lose everything." I do wish there was a way to at least reduce the surprise factor. Perhaps put a note about the data collection protocol in the abstract on the article page.

koheripbal 5y ago

MIT is not a single entity. Good security in one group does not mean good security in another group - at all.

janto 5y ago

I do not consent.

luckylion 5y ago

Thank you for the insightful comment. While there's similar concerns for health, I think financial circumstances are somewhat different. Few people have any interest in finding out "who that person with cancer in that small town is", but "who is that unknown multi-millionaire in my parents' village" might be more tempting. There's no political issue around individual health issues, but individual wealth is very political. I can definitely understand why someone wouldn't want identifiable information about their personal wealth given to third parties, especially not to US universities, which have a tendency to be rather left-wing and full of ideas of undeserved privilege that many don't share and would not feel comfortable knowing that their private information is shared with them. An angry research or student taking to Twitter to call out the evil capitalists isn't that crazy of an idea.

tartoran 5y ago

It’s not about identifying you it’s more about using the data from you and Weaponized in it against you. Citadel Securities, the market maker, is known to do this kind of thing to rip off retail traders via data obtained from trading platforms such as Robinhood, webull etc. This is an uneven battlefield and it’s obviously wrong and that’s the reason why we don’t want our data to be shared, it amounts to spying on our behavior in order to control, profit or what other nefarious reasons.

cinntaile 5y ago
That's why Robinhood is free no? Can't you choose a broker that doesn't sell your data?
- tartoran 5y ago
  Yes absolutely but people don’t realize how much it works against them; this kind of thing should be illegal in my oppinion. If we care about protecting the investors and making a fair market at least. This is beyond a hidden fee, this is almost stealing the customer’s purse
huitzitziltzin 5y ago
Totally a fair point but Citadel does not need Andrew Lo’s (an author on this paper) help to do that. Nor is that what he gets out of it. Citadel can do it (and may try to do it?) itself without his input. The research angle is orthogonal to your concern.

ralphc 5y ago

https://en.wikipedia.org/wiki/AOL_search_data_leak https://en.wikipedia.org/wiki/AOL_search_data_leak https://techcrunch.com/2006/08/06/aol-proudly-releases-massive-amounts-of-user-search-data/ https://techcrunch.com/2006/08/06/aol-proudly-releases-massi...