21 ms·

CCPA Scam – Human subject research study conducted by Princeton University

• KingMachiavelli 5y ago
  I don't really see the issue with this. Nothing stops someone from mass sending fake CCPA/GDPR inquiry emails. It seems like a perfectly reasonable thing to ask. Is asking people their favorite type of ice cream unethical because a very small percentage or going to have a negative mental/emotional reaction?
  • xwolfi 5y ago
    What s the cost of running it past the usual people so they can give an opinion ? Why do it in the shadow ?
    • pseudalopex 5y ago
      Who are the usual people? The researchers said they submitted it to Princeton's IRB.
• rootsudo 5y ago
  Hm, they use https://tranco-list.eu/ https://tranco-list.eu/ for top website list and not alexa. Whatever happened to Alexa ratings?
  • h2odragon 5y ago
    Announced shutdown last week: https://support.alexa.com/hc/en-us/articles/4410503838999 https://support.alexa.com/hc/en-us/articles/4410503838999
  • azernik 5y ago
    From Tranco's "Methodology" page: "We designed the standard configuration of the Tranco list to improve agreement on the popularity of domains and stability over time, using the rankings from the four studied providers as our source data." (Alexa is one of their data sources.)
• ehasbrouck 5y ago
  I got one of the "Tom Harris" messages, sent to an e-mail address scraped from the Web site of a small California-based nonprofit organization. I've gotten no response to my e-mail messages sent to the 3 researchers who have identified themselves, or the Princeton IRB. But I was able to find phone numbers for all 3 of the researchers in their c.v.'s posted online. The Principal Investigator has yet to return my calls, but the grad student took my call. He referred most of my questions to the principal investigator, but he did tell me that they sent e-mail to between 200K and 300K addresses scraped form a list of the "top" 1M Web sites.
• hallarempt 5y ago
  I invoiced them for the time they made me waste...
• dredmorbius 5y ago
  Note that the title doesn't provide the full meat. It reads: "CCPA Scam November 2021" Story update notes: "This is a human subject research study conducted Princeton University" I was attempting to submit my own instance of this when I discovered ColinWright's. My suggested title was going to be "CCPA Scam ... is a human subject research study conducted by Princeton University". Panicking small web operators without consent being the issue.
  • dang 5y ago
    Ok we've squeezed that in above. Thanks!
    • dredmorbius 5y ago
      And thanks. I was concerned that might be too much adaptation. Apparently not.
      • vulcan01 5y ago
        I'm not a moderator (obviously) but I've noticed that when the article's original title is sufficiently vague (like for this one) the mods allow for a lot of leeway in the title as long as it is representative of the article.
        • dredmorbius 5y ago
          Nor am I, though I often email HN with issues (titles is a frequent case). The guidelines call for original titles unless excessively long or clickbait, and request no editorialisation: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html The typical options for alternatives are: - Shorten the original title, especially by elmininating superlatives or counts. "Ten things you should know ..." becomes "Things you should know...", "Incredible new light..." becomes "New light ..." - Replace vague terms. "This guy who.,." becomes "<Name of guy>...". Note that this often (though not always) shortens the title. - Substitute an alternative title. The <title> tag might work, if present, otherwise a line picked verbatim from the article if possible. Occasionally gluing two phrases together is justified, as here, where "CCPA Scam" was the obvious substitution for the pronoun "This". The key here is to find something that clearly expresses the significant content / context of the article, without sensationalisation. Different types of submissions have their own challenges. Many commercial pieces are clickbaity, vague, listicles, or sensationalised. Microblogs (Mastodon, Twitter) have no title, and the lede line may not be especially descriptive. Blog titles run the gamut from infuriatingly vague to pretentious to long to overly terse. So long as I think I can make a reasonable argument for a substitution and it improves the headline, I'll propose it. If it's my own submission, I'll include a comment describing any changes made. (The start of this thread was to be that comment except that the article was already submitted.) There's an exception to the clarity rule in practice for major announcements, as in corporate earnings and departures, which are often simply titled "Letter to..." or "<period> Earning statement ...". Rather than highlight the principle point, especially in the first case, HN tends to shy from that, largely to help tamp down hot takes and emotive responses. Which probably does help improve the quality of discourse. (See for example Jeff Bezos's CEO resignation announcement, or Jack Dorsey's.) My suggestions for alternatives are frequently accepted by HN mods, or they'll come up with something close to it.
• ColinWright 5y ago
  Here is a chart of (some of) the conversation so far on Mastodon: https://www.solipsys.co.uk/Chartodon/107464941539596242.svg https://www.solipsys.co.uk/Chartodon/107464941539596242.svg Language warning.
  • kstrauser 5y ago
    Heh, most of the worst language is mine. My hands are still shaking from the adrenalin rush of panic and fury this inspired in me.
• ColinWright 5y ago
  Also here: https://news.ycombinator.com/item?id=29599154 https://news.ycombinator.com/item?id=29599154
• apignotti 5y ago
  Yep, we got the same. Seriously unethical behavior.
  • dang 5y ago
    We've gotten them too, including one as far back as last April.
    • killion 5y ago
      We've gotten them not just for CCPA but also GDPR.
    • 0xFF0123 5y ago
      Interesting, did HN respond, or was it considered spam?
      • dang 5y ago
        We always respond, and we get a plethora of them. Far beyond this particular study. There's a whole other blog post waiting to be written about the intersection between GDPR/CCPA threats and spam.
    • dangrossman 5y ago
      I got the GDPR one in April as well, and four more this month.
  • the_optimist 5y ago
    Please explain why this is unethical. The worst case is that you’re simply subject to the law. Presumably you’re abiding by the law. edit: I'm playing devil's advocate. I think the law sucks, the study is weird, and I empathize directly with the blog author. That said, downvoting to 'disagree' without explaining your reasoning is below the grade of this fine institution.
    • 0xFF0123 5y ago
      From the perspective of someone not living in the US, how on earth would one be expected to know what "the law" in California is?
• kstrauser 5y ago
  I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I thought I was about to be sued by someone who was the equivalent of a patent troll, but for the CCPA. I had a minor panic attack before I was able to calm down and piece together an open response (as I wasn't about to reply directly to them, not after their thinly veiled legal threat). I briefly considered lawyering up just in case, which would have cost me a fair chunk of money. After all that, it turns out it was research by Princeton University: https://privacystudy.cs.princeton.edu https://privacystudy.cs.princeton.edu The lead researcher, Ross Teixeira, says that: > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. The focus of the study is understanding website policies and practices, and emails associated with the study do not solicit personally identifiable information. Either: 1. Teixeira misrepresented his research to the IRB, or 2. The IRB is grossly incompetent or unimaginative. I don't see a middle ground on this, particularly after the University of Minnesota vs Linux contributors debacle (see https://www.theverge.com/2021/4/30/22410164/linux-kernel-university-of-minnesota-banned-open-source https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...). I see Teixeira's research as the equivalent of sending a bunch of fake legal notices to random people to "study the legal system", while claiming with a straight face that it doesn't involve human subjects research. Frankly, that's bullshit, and I can't believe someone signed off on this. As noted on the blog post, I've reported this to Princeton's Research Integrity & Assurance department. This isn't OK. I didn't consent to be a part of their human research (which it absolutely is, however they might try to claim otherwise), and this research seriously freaked me out. I slept poorly for a couple of days thinking I was facing possible legal issues over hosting a little not-for-profit hobby website.
  • Paul-E 5y ago
    I've met Ross during my time at Princeton and he is a really genuine person, he is not trying to ruin anyone's life. This incident is the result of an uncharacteristic blind spot in empathy: a mistake. I also have experience with the Princeton IRB on similar topics. The reality is that Princeton's IRB, and IRBs in general, are not equipped to deal with this sort of online research. IRBs were created as a reaction to unethical medical research, in particular the Tuskegee Syphilis Study [1]. My experience has been that the IRB has a greater expertise on medical and sociological studies. This leads the IRB to having a very narrow view of its remit in other domains. Unless humans are in a very literal way "subjects" of the study, then the IRB doesn't see it as human subjects research. In this case the IRB likely saw "Free Radical" and other websites as the subject. In both my studies and those done by my peers, the responses on what is and isn't human subjects research is uneven and you will often get a generic "this study does not constitute human subjects research" response from the IRB. This can be the case even if there possible negative repercussions to the "not subjects" in your research. For example, say your study involves testing the vulnerability disclosure policies. How well do websites respond to vuln reports? In your study you send out 100 vulnerability disclosures. After you report these vulnerabilities, a human may read your vulnerability report and make a decision based on it. This presents a risk that the individual security team employees involved in your study will be scapegoated and fired when you publish your (potentially damning) results. How do you balance the value this study provides the public against the risk to the individual employees' livelihoods? The IRB isn't going to help you do this balancing, they will just say "this isn't human subjects research". IRBs quite simply aren't equipped to evaluate this sort of research at the moment. This can be frustrating for a young twenty-something researcher just out of college trying to do the right thing while generating impactful research. You come in thinking that the IRB will be a guiding hand of wisdom and prudence, but you are quickly disabused of that notion after most of your interactions feel like conversations with lawyers in a compliance department. Many researchers in "CS" don't even involve the IRB, because they don't always see the ethical dimension of their work, but the fact that Ross did shows that he was trying to do the right thing here. [1] https://en.wikipedia.org/wiki/Tuskegee_Syphilis_Study https://en.wikipedia.org/wiki/Tuskegee_Syphilis_Study
• reactspa 5y ago
  > reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code So I looked this up and it really exists. I wonder if an account holder of a Facebook or Google account can use this law to get actual customer service.
  • kstrauser 5y ago
    Almost certainly. The law seems pretty clear that they'd have to completely delete all information about if you ask them to.
    • User23 5y ago
      I guarantee you that they don't even know what all the information about you they have is and even if they wanted to they couldn't actually delete all of it because their systems have so many levels of redundancy to prevent data loss that even intentional deletion is impracticable, at least if you want it to be comprehensive.
      • gpm 5y ago
        GDPR and CCPA compliance has been a big thing in the enterprise space recently. I wouldn't be surprised if they missed a small amount, and would assume that they didn't properly 0 out the bytes on the actual hard disk (as opposed to deleting the metadata used to find them - ssds in particular can make actually 0ing data hard), but I bet they do a reasonably good job.
      • GauntletWizard 5y ago
        Having worked at these companies and those like it, there's a lot to unpack in this law. The short version is, they have to delete data "about you", not data that was generated by you. Business records, such as receipts, are allowed to can be kept. They just delete your name and phone number, your photos and videos, and documents that were visible to you, but all of the actually useful tracking information is encoded into "Anonymized rows". It's bullshit and everyone knows it except the legislators writing the laws. That said, there's also a clever but effective workaround to all that redundancy - They store all your documents and photos encrypted with a key that's unique per user. When you request all your data, they delete the key - It's much easier for them to completely and quickly purge all that as a singular key, and clean up the files later. It's not a cop-out, because there's no effective way to get at your data once the key has been deleted. Those systems still have backups, but with much shorter lifetimes and explicit audit logs.
• kstrauser 5y ago
  This is Teixeira's Twitter claiming that the study has been very well received by its unknowing participants: https://twitter.com/RossTeixeira/status/1471249557883432967 https://twitter.com/RossTeixeira/status/1471249557883432967
  • hpoe 5y ago
    Well I hope the bill for legal services is as well received by Teixeira as he claims the unknowing participants are receiving his "research"
  • deleted 5y ago
    [deleted]
• User23 5y ago
  Serious question: why should academic institutions be held to a higher standard than commercial ones? Google and Facebook, to just name two, routinely perform human subject research without informed consent as a matter of course. That's what A/B testing is. Ethically speaking the fine print in the ToS obviously isn't actually informed consent, even if the law says it is. I don't see why being a for-profit company should somehow lower the ethical bar.
  • kstrauser 5y ago
    You're asking this backward: why should commercial institutions be held to a lower bar than academic ones. The response isn't to make it easier for universities to conduct research on you, but to make it harder for companies to.
    • jldugger 5y ago
      I routinely launch canaries before deploying new code to production. Given there is no intent to deceive, mislead, or otherwise harm customers, and all internal testing has yielded a 'ship it' signal, is there any ethical need for users to opt-in to these A/B tests? In my view, the alternative is to ship something we _don't_ have data on and hope for the best. And if we demand informed consent, I have to assume it goes into boilerplate agreements nobody reads at signup, which is a mockery of the term 'informed' IMO.
  • numpad0 5y ago
    I thought similar - it's such a routine and basic task to set up and run A/B testing to measure and optimize websites and apps for preferred conscious or subconscious response to visual stimuli. If this is a human subject research and human subject research without consent is a crime against humanity, most if not any proper web developer and the whole Web industry collectively are technically guilty of such a mouthful and abstract crime, which by the way I think they are.
    • deleted 5y ago
      [deleted]
• the_optimist 5y ago
  This regulation explicitly tasks everyone with responsibilities. The human consequences of those tasks are something we each simply have to be aware of as citizens. I like this study because it renders the obligation explicit, and it raises awareness of the society we are building. It should happen with all regulation.
  • PeterisP 5y ago
    It does not task everyone with responsibilities, and a key flaw of this study is that it lied that a responsibility exists to people who, in fact did not have any - as the article explains why.
• ineedasername 5y ago
  Ross Teixeira, the PhD student that did this, had the brazen nerve to post this lie on Twitter: Responses to the study have been overwhelmingly positive, and I particularly appreciate the notes of encouragement that some websites have sent. We look forward to sharing results in the coming year, with the goals of identifying best practices and informing future policy making. https://mobile.twitter.com/RossTeixeira/status/1471249557883432967 https://mobile.twitter.com/RossTeixeira/status/1471249557883...
  • ajkjk 5y ago
    How could you know it's a lie?
    • ineedasername 5y ago
      Because he said the response was overwhelming positive at the same time that he is dealing with anxious & irate recipients of his messages.
      • jonas21 5y ago
        I'd be willing to believe that, say, 90% of the responses were polite, positive customer-service language, and the other 10% were anxious and irate.
      • fastball 5y ago
        There is such a thing as a vocal minority. In fact it is a surprisingly common phenomenon.
        • ineedasername 5y ago
          That is true, although I think it would still be a poor choice of words to say "overwhelmingly" without tempering that with a note about assuaging the fears of some few that misunderstood the nature of the communication. Assuming he was aware that some were stressed and involving legal council. The "secret shopper" justification for not informing participants ahead of time about the study can only take him so far, and I don't think it was necessary here to begin with. His research is to determine the policies in place at target recipients' organizations, and that doesn't require secrecy. In fact that justification undermines the exemption status of the study: he expected that people may react differently if they thought it was a user vs. a research study.
• dangrossman 5y ago
  I've gotten 4 of these mails to 4 of my domains (including my personal domain used just for email, and a one-page documentation site for an open source library)... 2 about CCPA and 2 about GDPR. They also gave me a lot of anxiety for no reason. Looking at the responses on Twitter, a lot of websites spent real money consulting lawyers before responding to these mails due to the thinly veiled threat of legal repercussions at the end of each one.
  • blagie 5y ago
    Sounds like a good place for a class action! Those legal fees ought to come out of Princeton.
    • Shaanie 5y ago
      Why? If that's indeed the law, then it's up to the website owner to comply. Whether it's Princeton or a private individual writing the email doesn't matter.
      • gnud 5y ago
        The websites have to comply with the law, but a university should not be sending them emails lying about their obligations under any law. The emails were from fake people. So any work preparing any response regarding those fake peoples personal data is obviously not required by law. They don't exist. And, as pointed out elsewhere in the thread, the researchers are probably not protected by either of CCPA or GDPR.
      • indymike 5y ago
        > Why? No costs would have been incurred without Princeton asking a very scary question. Additionally, by not disclosing that the question was research, they also skewed the results if they were looking to see what prevailing attitudes and practices actually are.
      • PeterisP 5y ago
        A key point is that it's not indeed the law. Many (probably most) of the recipients - including the author of the original article - are not actually required by Section 1798.130 of the California Civil Code do do anything even if it was a legitimate question from a real person, because their websites are far below the limits were those CCPA requirements start to apply. The survey was making a fraudulent legal threat, requiring the recipient do some things for the benefit of the sender (namely, providing them with data for the study; also lying about how that data will be used) based on false allegations that there is a legal duty for them to respond in some certain time, while in fact there is none.
• cblconfederate 5y ago
  > resident of Nice, France I wonder why they d use a french as a hypothetical privacy nazi
  • kstrauser 5y ago
    Dude. Annoyed as I am with the researcher, there's no need to bring that kind of nonsense into the conversation.
• tom_devref 5y ago
  I received exactly the same email with a different sender ("Anna Roland", a resident of San Francisco, California) and was also left quite paranoid by it. The email had an combative tone and felt like a legal threat.
  • case 5y ago
    We received the same email as well, also from “Anna Roland.”
• malwarebytess 5y ago
  I'm confused how this is human experimentation. Were they not merely collecting information on how a site handles these requests? Is it because they erroneously sent emails to sites that do not fall under the umbrella of the law they were examining? An email asking an organization for answers to questions is human experimentation? I must be missing something.
  • wtallis 5y ago
    > Were they not merely collecting information on how a site handles these requests? No. Obviously not. How could you have missed the fact that they were "collecting information" under false pretenses?
    • eli 5y ago
      With a false legal threat, no less
  • nikitaga 5y ago
    * When you do something to people to see how they act, it's a human experiment. The purpose of this study was officially "to understand how websites would respond to real users" * The participants / subjects of the study are people, not "websites" as the study claims. Websites don't read and respond to emails, people do. * The participants of this study were selected without their consent * The participants were not told that they are in a study, nor the purpose of that study * The participants were lied to, as the researcher pretended to be someone else * The researcher deliberately communicated in a way that heavily implied legal consequences if they don't get what they demand * The researcher's threats and demands do not actually match what is afforded to them by the law * The study caused undue stress and financial losses (e.g. hiring lawyers) to the participants, including those that were not subject to CCPA at all. I don't care what labels you choose to put or not put on it, it's a shitty, abusive study that should have never passed ethics review.
    • seoaeu 5y ago
      > When you do something to people to see how they act, it's a human experiment. That's not the official definition an IRB would use. The official definition is a lot less broad than a lot of people on this thread seem to think. It requires that are collecting biospecimens, identifiable private information, or certain kinds of information about a specific person. [0] [0]: https://grants.nih.gov/policy/humansubjects/research.htm https://grants.nih.gov/policy/humansubjects/research.htm
• nneonneo 5y ago
  (cross posting from my comment on the other story) It isn't human subjects research just to read what a website says about its compliance to a law (or lack thereof), but once you start reaching out to actual humans to discuss the matter, it definitely does become human subjects research (we would categorize this as an interview or survey). At the very least, the emails should have come with a notice that they were being sent as part of an academic study - after all, misleading your participants wasn't a goal of this study!
• dboreham 5y ago
  This calls for extra popcorn supplies...
• kf6nux 5y ago
  From the study's FAQ[0]: > Did an Institutional Review Board consider this study? > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. From the social experiment[as reported by OP's link]: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I'm pretty sure most people would find that to be a thinly veiled threat of a lawsuit. I'd like to know if the review board considered the text of the email that the "researchers"[1] intended to send and the fact that they were likely to send it to individuals instead of solely publicly traded companies. [0] https://archive.md/cSDGT https://archive.md/cSDGT [1] Seems to fall more under experimental psychology to me https://en.wikipedia.org/wiki/Experimental_psychology?wprov=sfla1 https://en.wikipedia.org/wiki/Experimental_psychology?wprov=...
  • collectedparts 5y ago
    If I had to guess, the wording is in the study's FAQ is carefully chosen: "an application detailing our research methods" doesn't necessarily mean "an application with the verbatim text of the emails we planned to send, including our thinly veiled legal threat at the end." Not trying to turn this thread into a generic flameware against "academic" research methods, but this whole things seems oddly reminiscent of the "let's try to insert malicious code into Linux" fiasco [1]. I'm conceptually fine with generic passive tools like web crawlers to conduct research, but since when did the internet become a place where nonconsensual interactive research became fine? [1] https://www.bleepingcomputer.com/news/security/linux-bans-university-of-minnesota-for-committing-malicious-code/ https://www.bleepingcomputer.com/news/security/linux-bans-un...
    • seoaeu 5y ago
      The problem, like in that previous case, is that "human subject research" is a pretty narrowly defined category. It is mostly meant to cover testing out drugs on human subjects, and stuff like that. Notably, there is plenty of unethical research that doesn't qualify. So when an IRB gets a proposal that amounts to "I'm going to send some emails/interact with some folks online" their reply is likely to be along them lines "not our problem", and it becomes the responsibility of the research to assess the ethics of what they're doing.
• xkcd-sucks 5y ago
  So, it seems CCPA requests (and possibly GPDR etc) make companies/people shit bricks, because they don't have process in place for dealing with them. Maybe this legislation is beginning to accomplish its goals.
• xena 5y ago
  I got one of these emails too. I'm going to write up something on my blog and email princeton to complain.
  • xena 5y ago
    Here is my writeup: https://christine.website/blog/princeton-study-2021-12-17 https://christine.website/blog/princeton-study-2021-12-17
    • kstrauser 5y ago
      That was a great post and I feel similarly. I try to do the right thing because I care about this stuff. If I didn’t care, I would’ve deleted the email and moved on.
• jimmar 5y ago
  It is interesting in the study web page (https://privacystudy.cs.princeton.edu/ https://privacystudy.cs.princeton.edu/) that they consistently mention contacting "websites" instead of "people." As if a website is some autonomous thing that can communicate with a researcher. I wouldn't be sleeping well if I were involved in this study. There is no way an IRB could determine that this is not human subjects research if you're emailing people and asking them anything. If I want to ask random people about the weather and publish the results in a journal, that qualifies as human subjects research and IRB protocols must be followed. Emailing people asking about privacy policies is definitely human subjects research. Either they misrepresented the study in their IRB application, or the IRB didn't do due diligence reviewing the application.
  • RubberSoul 5y ago
    This is incorrect. It's only human subjects research if the researcher is obtaining data about a human. This is the "about whom" requirement. A classic example is calling a business and asking someone about the products and prices they offer. That's not human subjects research.
    • eli 5y ago
      Who is the subject of the emails sent to personal domains?
      • RubberSoul 5y ago
        Not sure I follow your question. An example of something that's not human subjects research would be emailing people who have websites and asking about their privacy policy. An example of something that is human subjects research would be emailing people who have websites and asking what inspired them to start a website. I realize that may seem like a subtle difference, but it's an important distinction from an IRB perspective. For reference, and because a lot of people seem confused on this thread, here's what the human subjects research training at my university says about this... "...some research that involves interactions with people does not meet the regulatory definition of research with human subjects because the focus of the investigation is not the opinions, characteristics, or behavior of the individual. In other words, the information being elicited is not about the individual ('whom'), but rather is about 'what.' For example, if a researcher calls the director of a shelter for battered women and asks her for the average length of stay of the women who use the shelter, that inquiry would not meet the definition of research with human subjects because the information requested is not 'about' the director. If the researcher interviewed the director about her training, experience, and how she defines the problem of battering, then the inquiry becomes about her - and therefore 'about whom.'"
• scblock 5y ago
  I thought a friend Jim, a professor of Writing, Rhetoric, and Digital Studies at the University of Kentucky, had a good take on this: https://twitter.com/ridolfoj/status/1471536878658719748 https://twitter.com/ridolfoj/status/1471536878658719748
  • adminprof 5y ago
    He seems to have good intentions, but does not seem to have knowledge of IRB which may make this situation worse. Specifically, he confuses "does not constitute human subjects research" with "exemption" which is a pretty big difference and anyone who works with human subjects should know this. From his Twitter thread, "Update: They are now saying they have an exemption. They have not made any forms available or explained the lack of informed consent." Exemptions are protocols that have been reviewed, and deemed exempt based on one of 8 very specific criteria. Studies deemed not constituting human subjects research are returned by the IRB, and not considered reviewed. Given that the authors actually said "...to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research" this is clearly NOT an exemption, and informed consent is not a consideration as far as the IRB is concerned.
• tzs 5y ago
  Some jurisdictions consider IP addresses to be personal identifying information, and so if you run a web site that logs the IP addresses of visitors you should generally try to be aware of the privacy laws in any jurisdiction that might think its laws apply to you. These fall into three groups. First, there are those jurisdictions in which you and/or your site are actually located. You almost always have to care about the laws in these jurisdictions. Second, there are jurisdictions where the people who visit your site live. For these there are two questions. #1 does the jurisdiction think their law applies to you? #2 Does your jurisdiction, or someone else that you have to obey, agree? The answer to #1 often depend on what your relationship is with the visitor. If you are selling (or trying to sell) them something it is more likely that the jurisdiction will think their law applies. If your website is not in any way targeted to them or encouraging them it is more likely that the jurisdiction won't think its law applies. (But some, like the EU with GDPR, do think it applies if you are tracking the behavior of EU users regardless of whether or not you are selling anything or trying to get EU visitors). #2 is murkier. Say I've got a site in X specifically selling to people in Y. Y brings a civil case against me in Y. I ignore it thinking they can't touch me here in X, and Y gets a monetary judgement against me. I may be in for a surprise, because X may consider my sales to people in Y as taking place in Y, and so agree that Y has jurisdiction. If Y then brings the judgement to an X court to enforce, there is a decent change the X courts will enforce it. Oops. Another thing you need to consider when thinking about #2 is entities that both you and the jurisdiction deal with. If you use a service provider (credit card processor, cloud service, hosting provider, etc) that operates in that jurisdiction, you may face pressure via that provider to obey the jurisdiction's law. Finally, there are jurisdictions that you are not in, you aren't selling to or doing anything to attract visitors from, you are sure your jurisdiction won't cooperate with them on enforcing their laws, you don't use any services that operate there, and you aren't even going to visit there so even if you thoroughly annoy them no big deal. You can probably mostly ignore these jurisdictions as far as privacy laws go. If you are in the US I'd say that this currently means that you should be aware of GDPR and CCPA, and have some idea of how you will response to requests under them. For a lot of sites (like the OP's) a short form letter explaining that you are not covered should be fine. As more states in the US pass their own CCPA-like laws, or we get Federal action on privacy, I'd expect those will generate large threads here. Keep an eye out for them and update your form letters appropriately.
• mthrow_123 5y ago
  I run a SaaS product solo, and I receive these message and other similar ones (GDPR requests) every week. Most are generic like this one, but some are out right offensive name calling. I have no problem following these laws and extended the data/privacy rights to everyone (not just CA or EU residents). I must say though, when people threaten me or resort to name calling I make the process deliberately difficult. edit I just scanned my email and I got the same email, with CCPA swapped out for GDPR via a "Tom Harris".
  • mthrow_123 5y ago
    Here's a copy: > > > To Whom It May Concern: > > My name is Tom Harris, and I am a resident of Sacramento, California. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests: > > Would you process a GDPR data access request from me even though I am not a resident of the European Union? > Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to? > What personal information do I have to submit for you to verify and process a GDPR data access request? > What information do you provide in response to a GDPR data access request? > > To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request. > > Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding nymeria.io, I kindly ask that you forward my request to them. > > I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR. > > Sincerely, > > Tom Harris
• aviancrane 5y ago
  Seems like a career academic with no experience in the real world playing around like this is some kind of game. I'm sure they meant no harm, because they don't consider anyone "participating" to be anything more than a potential subject in their agenda to get a good review on their paper. That letter and their social media posts are nothing more than a facade to maximize return with no consideration of impact. Total negligence.
  • UncleMeat 5y ago
    Mayer has a JD and is licensed in CA (I don't know about NJ), has worked for at least one US Senate office, and has been so involved in actual practical privacy work that ad companies pressured the president of Stanford to expel him for his legitimate work on DNT.
    • azernik 5y ago
      The person who designed and ran this study is not Mayer. Mayer runs the lab, but this is a subordinate's baby. From the study's website: "Please contact the lead researcher for this study, Ross Teixeira (rapt@princeton.edu), if you have any questions, believe you received an email in error, or would like to opt out of any future communication related to the study. The additional members of the study team are Professor Jonathan Mayer at the Princeton University Center for Information Technology Policy, who is the Principal Investigator, and Professor Gunes Acar at the Radboud University Digital Security Group."
      • ok_dad 5y ago
        Sounds like we should all e-mail him to opt out of his future studies. Maybe he’ll get why a massive e-mail campaign is a bad way to do this “study”.
      • UncleMeat 5y ago
        Ross appears to be a PhD student. Hardly a "career academic." The point is that the "these are all ivory tower idiots who don't know how real people work" is a silly argument to make given their backgrounds.
• reilly3000 5y ago
  Let me help: We’re some students from Princeton trying to understand how businesses are responding to CCPA and GRPR requests. Could you help us with our study? How would you answer these questions? … The point is disclosure. It’s unethical to do otherwise, especially given that is about the use of data. I’d love for there to be more data published about the impacts of these policies, but please don’t use the tactics of creeps in the process.
  • karmanyaahm 5y ago
    It is likely that quite a few people would lie if they knew they were going to be observed/studied or reported on. However, I'm sure they could've made the actual email less threatening and more friendly/ethical without revealing research intent. (or the intent to research this specfic aspect)
    • Ansil849 5y ago
      > It is likely that quite a few people would lie if they knew they were going to be observed/studied or reported on. Even assuming your premise is true (it's not), you think the solution to not have people lie is....to lie to them?
    • shkkmo 5y ago
      Yes, there are reasons that studies sometimes lie to their participants. These lies are something that has to be justified to an IRB and the study has to be designed to carefully minimize harm. Lieing to unwilling particiants only raises that bar. In this case, the bare minimum ethical way to conduct this study would have been a careful manual review of every unwilling participant that was going to be recieving deceptive communication to ensure they actually fell under the laws in question. The compound of deception, legal intimidation, and scatter shot automated selection of unwilling participants is a particularly egregious ethical failure.
    • ineedasername 5y ago
      >people would lie Possibly. And the IRB review process may allow for non disclosure under circumstances of that sort. The problem is not merely that the IRB allowed non disclosure. It's that the IRB also granted an exemption from full review as human subject research. If the researcher expected that human behavior might change based on secrecy vs. disclosure then it is fundamentally not passive data collection. But debating the secrecy issue or limits if what constitutes a human subject are all besides the point: the research protocol had an adverse impact on humans involved with the study. Not matter any other considerations, that makes the research defacto one that should have had full IRB review. Evaluating the potential for adverse impact is literally one of the foundational reasons for the existence of IRBs. The presence of an adverse impact is defacto proof that an exemption should not have been granted and that a full review should have been done to determine how the protocols could be tweaked to mitigate the issue.
• morpheuskafka 5y ago
  > I’m not confident that I could remain civil when talking to the person who inflicted this on me without my permission or knowledge. I'm not sure how long anyone can last in business if this is their response to receiving a kind-of-threat of a lawsuit. I get that it may be a hassle but businesses get these kind of garbage threats frequently and often can be ignored unless and until they actually file something. If the threat is BS then its certainly wrong for them to waste your time but being so mad you can't even speak to them seems a bit much.
  • turnerc 5y ago
    The author states this after knowing the true identity of who sent the bogus email. At that point they know it's not legitimate.
  • kstrauser 5y ago
    I’m not handling this in a business context. They emailed my personal address with a threat about my personal zero-revenue server I maintain for the fun of it.
• earleybird 5y ago
  Bryan Cantrill (DTrace etc) has a good talk on ethics in software engineering[0]. Skip to 12:29 where he recalls Facebook in 2011 experimenting with users news feeds. [0] https://www.youtube.com/watch?v=0wtvQZijPzg https://www.youtube.com/watch?v=0wtvQZijPzg
  • doublepg23 5y ago
    Is there ever a bad Cantrill talk? thanks for the link.
    • earleybird 5y ago
      Anecdotally - no, I've yet to come across one.
• turnerc 5y ago
  It appears the study website has been edited to state they are no longer sending emails. Previously it said they were sending these emails up until Spring 2022[1] [1] https://web.archive.org/web/20211216002029/https://privacystudy.cs.princeton.edu/ https://web.archive.org/web/20211216002029/https://privacyst...
• janmo 5y ago
  I am surprised by the reactions here. I did not receive that e-mail but I receive all sort of weird inquiries for my websites, (at least 2 or 3 per day). I don't understand why people are so mad about it or even panicking.
  • tomudding 5y ago
    While I personally believe the questions stated were perfectly reasonable (and could have been genuine questions from someone), I can understand that people feel (legally) pressured to provide answers to the questions. Which puts this study in a grey area. With regard to GDPR, the "respond within x" is simply not applicable. The one month period is strictly for any requests concerning Article 15 through 22 and none of the questions are talking about any of that. Now, if one of the questions was something along the lines of "do you process any information related to me?" then it would potentially fall under Article 15.1 and would require a timely response. IANAL, however, I think in such cases you could simply point to a privacy policy, which you are already required to have.
  • DangitBobby 5y ago
    Mentioning a specific section of a law is threatening to hold them to the letter of that law. What happens if they don't follow the letter of that law? The insinuation is legal action will follow.
    • janmo 5y ago
      They did not threat anything, they were just asking information regarding their personal data. And therefor they were in their right.
      • DangitBobby 5y ago
        You don't have to actually directly say the threat for the threat to be known. For example, if you're hitting me up for protection money, and you said "it would be a shame if something were to happen to x", that would reasonably be understood as a threat. Notice how you don't have to directly say that you will be the reason something happens to x.
• Ansil849 5y ago
  The study FAQ claims: > What happens if a website ignores an email that is part of this study? > We are not aware of any adverse consequences for a website declining to respond to an email that is part of this study. But the email sent out states: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. So the email very clearly states that there is an adverse consequence for a failure to respond, namely a violation of the California Civil Code.
  • C19is20 5y ago
    > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. >So the email very clearly states that there is an adverse consequence for a failure to respond, namely a violation of the California Civil Code. I've read and re-read (and read many comments) but where is the adverse consequence stated?
    • Ansil849 5y ago
      > but where is the adverse consequence stated? Here: > as required by Section 1798.130 of the California Civil Code. If you tell someone that they are obliged to do something as per the law, the meaning is obvious that not doing so is a violation of the law, which is an adverse consequence (the consequence being breaking the law and whatever penalties come with that).
      • deleted 5y ago
        [deleted]
• throwaway8391 5y ago
  I forwarded an email that to legal counsel who is pulling in a privacy team. Lots of hours wasted.
• curiousgal 5y ago
  > I had a minor panic attack, literally, upon receipt, as I thought I was about to be sued Oh please! A tad bit dramatic, no? A single email from someone claiming to be in France is made out to be equivalent to an official letter from a US lawyer. They even said it was not a request for data so you can ignore it. Was this a mistake? Yes. Was it a big mistake? Hell no. Let's not lose perspective and keep things real.
• n9com 5y ago
  They've been doing this since April 202 [1]. Early reports also found on reddit with people being concerned. We too received quite a few of these emails over the last few days from various fake idenities and wasted time responding to one of them before realising it was not legit! I can't imagine how much time and potentially money was wasted on these mass emails. [1] https://joewein.net/blog/2021/04/21/questions-about-gdpr-data-access-process-spam-from-virginia/ https://joewein.net/blog/2021/04/21/questions-about-gdpr-dat...
• cycomanic 5y ago
  As a counterpoint here I don't consider this study or the Linux kernel study human subject research unless we define human subject research so broadly that the definition essentially becomes meaningless. As a side note I find the "outrage" about these small academic studies quite hipocritical. This is a community where a significant proportion of people work in related to ads/clicks who constantly experiment on human subjects (at least by the definition applied to the cases above). Let's not even talk about the research done by Facebook et al (where a significant proportion of developers here work as well), who literally looked at how changing the time line affects the mental health of users.
  • latk 5y ago
    If a study is observing how human reacts to a certain situation, that's research with human subjects. The Linux study observed how maintainers react to bugs, this CCPA/GDPR request spam observed how data protection staff reacts to requests about their processes. And the backlash is not hypocritical. You're of course right that FB has also done really questionable research, but that doesn't matter here. I've also seen significant uncertainty about this spam series in the data protection/privacy community, i.e. criticism by those people who get to deal with these emails.
    • cycomanic 5y ago
      By that definition if I change the layout of my website and observe if it changes how humans change their behaviour, i.e. how and where they click it's human research. With that definition pretty much everything is human research. Well even if I track where rubbish is being transported to it is observing human behaviour and thus human research. It remains also hypocritical. If you (not you personally but in general) are outraged by this research as unethical and you are working for companies who do any optimisation of their ads/engagement etc., you are contributing to the same (and arguably much worse) behaviour that you condem as unethical. I call complaining in others about something that you do yourself on an often much larger scale hypocrisy.
      • gnud 5y ago
• turbinerneiter 5y ago
  I'm not sure what to think of this. I remember at least one article for which the journalist sent fake job applications tomdigfeeent companies, using European and Arabic names for the same CV, to uncover bias in the application process. Is this the same or different? It also wasted the time of the people reviewing the applications. Is the implicit legal threat what makes the difference between ok and not ok?
• gnfargbl 5y ago
  There a point here which seems to have been missed. From the study's FAQ: > The set of websites for this study is sampled from the Tranco list of popular websites and publicly available datasets of third-party tracking websites. If that's true, then I have a lot more sympathy for the researchers: it seems they were only targeting particularly popular sites, and sites which use tracking technology. Those sites really should have have developed processes for responding to GDPR and CCPA requests, rather than just banging in some Google Analytics code without really thinking about it.
  • iudqnolq 5y ago
    That's because people are reporting that's incorrect. A commentator on HN got one sent to their personal domain they use only for email https://news.ycombinator.com/item?id=29600542 https://news.ycombinator.com/item?id=29600542
  • kstrauser 5y ago
    I looked up my own site — the one that got this whole mess started — and I hover around number 350,000. I was utterly shocked given that I have a few thousand users, and many fewer active users. I don’t use GA, or any other third-party trackers, on any of my sites. Given that Tranco doesn’t have access to my web logs or the little Matomo setup that I self-host, I’m not sure how they claim to be analyzing my traffic in the first place.
    • gnfargbl 5y ago
      Thanks for that -- seems like you're a pretty good counterexample to my hypothesis. Totally agree that sending these emails to site #350,000 on the Tranco list isn't justifiable. > I’m not sure how they claim to be analyzing my traffic in the first place They wouldn't need to analyze your traffic to find out if you were using tracking technologies, they would just need to visit your site and examine what they were served. Companies like BuiltWith and Wappalyzer offer this kind of technology survey as a service.
      • kstrauser 5y ago
• h2odragon 5y ago
  So it'd be perfectly reasonable to conduct an experiment to see how certain Princeton researches react to emails telling them bad things are going to happen to them and their families and pets, right? "If thrown from a tall building how high do you think you'd bounce?"
  • 1f60c 5y ago
    No, it wouldn't. One is a polite but firm email reminding a website administrator of their obligations under the law, and the other is a thinly-veiled threat of bodily harm.
    • MichaelDickens 5y ago
      > One is a polite but firm email reminding a website administrator of their obligations under the law It is not, because OP does not have the obligations that the email claimed they have.
• petecooper 5y ago
  Me, 5 days ago: https://news.ycombinator.com/item?id=29539266 https://news.ycombinator.com/item?id=29539266 I was concerned enough about this that I updated our project privacy policy with pre-emptive wording about CCPA (now reverted): https://web.archive.org/web/20211218125309/https://textpattern.com/privacy https://web.archive.org/web/20211218125309/https://textpatte... I'm mildly annoyed about the time I wasted on this, but I guess that in itself is anecdata for this study.
• nkmnz 5y ago
  The problem here seems to be that governments created laws that allow everyone to scare the shit out of people who dare to build something and put it into the public - without having to leave the comfort of their chair (pun intended). Data privacy is important. Not feeling the urge to hire a lawyer just to publish a small blog is even more important.
  • DangitBobby 5y ago
    Even more fundamental is the fact that defending your innocence is expensive. A system that lightens your pockets when a bad actor invokes your name and will never compensate you for your loss afterwards is a bad system.
• 1f60c 5y ago
  I don't understand the outrage. Even knowing the context, the email is polite, to the point, tells the website administrator exactly what they need to do (something they are already legally required to do), and gives them ample time to do so.
  • kstrauser 5y ago
    I’m not legally required to reply in any way, although the email strongly implied that I am. This looked a lot like the kind of emails you’d get from someone gathering information before they decide whether to file a lawsuit against you.
• throwawaytod85 5y ago
  Anyone else may want to preemptively opt-out from future studies. Info from https://privacystudy.cs.princeton.edu/ https://privacystudy.cs.princeton.edu/ "Please contact the lead researcher for this study, Ross Teixeira (rapt@princeton.edu), if you have any questions, believe you received an email in error, or would like to opt out of any future communication related to the study."
• seanhunter 5y ago
  A lot of discussion on here about whether or not it constitutes human subjects research. It seems to me to be missing the point. Research can still be unethical even if it doesn't fit the definition of human subjects research.
• m-s 5y ago
  Without getting into the question of whether this study involved human subject research, I find a lot of the anxiety and paranoia unwarranted. Companies to which these laws apply should already have a process in place to deal with subject access requests. Complying with relevant laws is just part of doing business. All the other site owners could have figured out with a bit of googling that the laws don't apply to them—there is plenty of guidance available. I can only speak for the GDPR here, but had the requests been real and valid, the worst outcome would have been a regulator telling you to comply with it. Data protection authorities are more interested in helping companies get into compliance than punishing small businesses for minor infractions. If you look at past decisions, it usually takes serious and/or systematic violations to get fined.
  • tjalfi 5y ago
    > I can only speak for the GDPR here, but had the requests been real and valid, the worst outcome would have been a regulator telling you to comply with it. Data protection authorities are more interested in helping companies get into compliance than punishing small businesses for minor infractions. If you look at past decisions, it usually takes serious and/or systematic violations to get fined. The US legal system is quite different; litigants are responsible for their own legal fees[0] and frivolous lawsuits[1] are common. [0] https://en.wikipedia.org/wiki/American_rule_(attorney's_fees https://en.wikipedia.org/wiki/American_rule_(attorney's_fees) [1] https://www.azag.gov/press-release/serial-litigant-permanently-enjoined-filing-frivolous-ada-lawsuits-against-az https://www.azag.gov/press-release/serial-litigant-permanent...
• ineedasername 5y ago
  The researcher is using the "secret shopper" justification for why secrecy was needed here. This completely undermines his receipt of exempt status for full review of human subjects in research. If he anticipated that behaviors of recipients would be different as a result of knowing whether or not the communication was an authentic request from a user. This is a bit of a subtle point and wouldn't necessarily expect a PhD student to pickup: It's really something-- depending on how the application was presented-- that the IRB should have caught. I'm surprised that any IRB would grant an exempt status under those conditions because it fundamentally meant the study was not passive data collection such as a surveys, which usually are exempt. Hopefully there is a public post mortem of how this approval went down. Considering the adverse impacts on display it was defacto a study that needed complete human subject review.
• mindslight 5y ago
  If this email had actually been sent down by a shakedown attorney, there would be absolutely no recourse. But the sender is part of an institution that admits outside criticism, and so there is an angle to strike back. Regardless of the research ethics here, it seems most of the outrage is precisely because this perp has a chance to be held accountable. The real overarching problem is that anyone can be subject to life-altering lawsuits through the legal system, which will cost unreasonable amounts of time, money, and personal sanity. There's no hope for justice for small time actors, since the damage has been dealt out before ever seeing an informed decision by a judge. And even if you can invest enough to pay for a real judgement, the chance of getting awarded legal fees is slim, never mind rewards for lost time and emotional distress! I don't think the problem is specifically the CCPA, since it does except small time actors. Rather the setup for the problem is a heavyweight legal system, draconian laws that do apply to individual actors, and the massive fan out caused by being globally connected. Anybody is basically one doxxing away from a barrage of legal demands, and our poor technical architectures basically guarantee anybody who puts themselves out there even slightly can be doxxed. I don't know that there is a straightforward fix. The dynamics have been explored to death, and we seem to be trapped in this state because the real beneficiaries of the legal system (well-funded corporations and other professional actors) are happy to keep it this way. But this situation is a lightning rod that illustrates how outrage over it is growing. If it continues to not be reformed, eventually something is going to break catastrophically.
• stavros 5y ago
  I got one of these emails. Not being in the US, my usual reaction is "sue me", especially when someone emails me for a data access request on a static website. I can imagine how stressful it must be if you're actually in the US and there's a probability that you could actually be sued, though. For shame, Princeton.
• rolandm 5y ago
  Maybe the principal investigator Jonathan Mayer [1] should have read his own paper [2] about dark patterns. From the abstract "There is a rapidly growing literature on dark patterns [...] that researchers deem problematic" [2]. This research looks like a dark pattern to me. [1] https://privacystudy.cs.princeton.edu/ https://privacystudy.cs.princeton.edu/ [2] https://dl.acm.org/doi/abs/10.1145/3411764.3445610 https://dl.acm.org/doi/abs/10.1145/3411764.3445610
• gendal 5y ago
  I received one of these emails but, interestingly, whilst the email was about my personal blog, the email was sent to my work address, which is not listed on my blog. Implying they did a bit of manual work to figure out how to reach me? If so, I wonder whether whatever they did is itself covered by CCPA or GDPR? Idly considering whether to should send them a request that is near identical to the time-wasting, deceptive email they sent me?
• XCSme 5y ago
  Not only I received that email too, but I received from three different addresses. I marked it as spam in all cases and I even responded to the first one that it has nothing to do with me or my business.
• kseifried 5y ago
  On the flip side they sent me an email that wasn't lying, so they could have done this for everyone: priv...@princetonprivacystudy.org Tue, Dec 14, 12:25 AM (5 days ago) to me To Whom It May Concern, We are researchers at Princeton University conducting a study of how websites are implementing the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). We are reaching out to you because this email address is provided as a contact on the website seifried.org. Your website may be required to implement one or both of GDPR and CCPA, and we would appreciate if you would answer a few brief questions about your privacy practices. 1) Does seifried.org implement GDPR or CCPA? If not, could you please explain why? If you are uncertain about whether seifried.org is required to implement these laws or answer questions like ours, we have included informative resources at the end of this email. 2) If you implement GDPR or CCPA, do you process data access requests from individuals who are not residents of the EU or UK (for GDPR) or who are not residents of California (for CCPA)? 3) If you implement GDPR or CCPA, do you process data access requests via email, a website, or telephone? If via a website, what is the URL? 4) If you implement GDPR or CCPA, what personal information must a user submit for you to verify and process a data access request? 5) If you implement GDPR or CCPA, what personal information do you provide in response to a data access request? Thank you in advance for your answers to these questions. If there is a better contact for questions about privacy practices on seifried.org, I kindly ask that you forward my request to them. Sincerely, Ross Teixeira