11 ms·

Can someone help me understand the ethical problem here? If I as an ordinary citizen contacted the webmaster with a similar worded email, the result would have

by dcow 5y ago

Can someone help me understand the ethical problem here? If I as an ordinary citizen contacted the webmaster with a similar worded email, the result would have been the same. The fact is that this “experiment” did not create any more or additional stress than is created for normal citizens/businesses simply engaging in normal legal activities. If submitting such a request has the potential to cause such undue stress, shouldn't society create protections or disallow such requests? Edit: It's not that hard to see that there are potentially some social problems here e.g. "the message is easily construed as a legal threat" or "the message was mass mailed in a spam-like nature". However, my comment is in response to the title of the blog post which implies that the webmaster believes there's an ethical problem that this "experiment" was even run in the first place. For the purpose of this thread, assume the email was worded perfectly and the university was very thoughtful and deliberate in who they contacted. I'm interested in discussing the ethics behind how a perfectly legal and reasonable thing can in one case be ethical and another case be unethical simply by virtue of the context in which the action was carried out.

analog31 5y ago
In my view the academe can't control how people treat one another in general, but they can refuse to support research based on abusing people.
jameshart 5y ago
This argument amounts to "If something can happen, then it's okay for a researcher to cause it to happen in order to study the result." I hope it's obvious why that is a poor ethical standard for what constitutes acceptable research practice.
- dcow 5y ago
  If the way it was caused to happen was unethical then yes I see a problem. But it’s not, so no, it’s not clear to me, hence why I asked.
  - jameshart 5y ago
    Lying about your identity and failing to reveal that the reason for your inquiry is that it is part of an academic research project would be the ‘unethical’ part. It is unacceptable to do something to a person so you can study the way they behave, without first obtaining their consent to participate in such a study. You can observe how people behave when they are subjected to the same stimulus naturally; you can ask them if it’s okay to subject them to a stimulus to see how they react; but you can’t just do something to them and write down what happens.
  - dawnbreez 5y ago
    "Someone can be shot at, therefore a researcher shooting people to see how they react is ethical." "Someone can be sued, therefore a researcher making vague legal threats to see if people waste money on lawyers is ethical." "Someone can get syphilis and not receive treatment, therefore infecting people with syphilis and denying treatment is ethical." (By the way, 2 out of the 3 are real studies. The middle one is this one. The third one is the Tuskegee Syphilis Study.)
snowytrees 5y ago
I see the issue being the email was formulated in a way that is easily perceived as a legal threat. I don't see how it is ethical for a study to be sending out legal threats to see how someone responds. Now if the goal is to understand how websites respond to the CCPA/GDPR then it shouldn't be too difficult to ask how they would respond to a request and note that it is part of a voluntary study.
progman32 5y ago
Perhaps you're making an assumption that "normal citizens" receive legal threats regularly? I can count the legal threats I've received on one hand, and I can assure you the days following them were, unfortunately, quite unpleasant (fortunately nothing came of it). Stress aside, part of the problem is the very real possibility of a subject wasting money on hiring a lawyer.
- avalys 5y ago
  I didn't see a legal threat in the original email.
  - tantalor 5y ago
    > ... as required by Section 1798.130 of the California Civil Code.
    - dcow 5y ago
      That’s not a threat. A threat would be, “I’ll sue you if you don’t comply with my request”.
      - rectang 5y ago
        Interesting. Do you or any of your associates send these sorts of notices to anyone?
        charcircuit 5y ago
        Yes, I have had friends jokingly say they would request the information I have on them because of GDPR.
        progman32 5y ago
        Responding to throwaway, I think the critical difference here is that you're making the requests in good faith. The researcher was making these (could be interpreted as vague) requests deceptively.
s1artibartfast 5y ago
The first ethical problem is that it is lying and deceitful. Is the bar so low that this is considered acceptable behavior for a moral and reputable person or institution?
pkrotich 5y ago
It absolutely looked like a legal treat of some sort. The study is now suspended and the investigator is even admitting they errored [0]. [0] https://privacystudy.cs.princeton.edu https://privacystudy.cs.princeton.edu
- Jiro 5y ago
  I noticed the "FAQ" doesn't include the question "will you be paying out money to people who read your email and spent money on a lawyer checking it out?"
- PeterisP 5y ago
  Are you reading some other comment than what you linked? I'm not seeing any admission of error in this FAQ.
  - pkrotich 5y ago
    See “Note from Jonathan Mayer” section - he apologized and took responsibility on the first paragraph.
    - PeterisP 5y ago
      Ah, okay, thank you - now I also see the "Update 2"; for some reason my browser had been returning a cached older version with just the Update 1 / FAQ added.
deleted 5y ago
[deleted]
pdonis 5y ago
> Can someone help me understand the ethical problem here? The ethical problem is that you can't do research on people without their consent. The fact that the researchers knew they were doing research, not actually asking a question as an ordinary user of the website, makes a difference. Intent matters.
- kiklion 5y ago
  > The ethical problem is that you can't do research on people without their consent. But can you do research on a business without the businesses consent? Or do I need a businesses consent before sending out identical resumes except one has a stereotypical minority name to attempt to judge discrimination? Because websites aren’t people. Websites are businesses. A lot don’t make money or fail. They may have a small staff managing them. They may not be ‘for profit’ but they are still businesses. That’s my issue with the complaints about the study. They blow up and claim to be unwitting participants of human subject research, drawing mental parallels with the Tuskegee experiment when it’s a closer parallel to research performed against companies who were never notified like when researchers sent out identical resumes except for their names. The researcher definitely could have worded the email better so it didn’t come across as an ominous legal threat. There are valid criticisms against the research. But claiming to be an unwitting subject of a human research experiment is incredibly misleading.
  - danaris 5y ago
    > Because websites aren’t people. But websites cannot answer questions. If your study is simply "how do the servers of various websites respond to my HTTP requests", that doesn't require informed consent, because it's not involving humans. Once your study moves into the realm of "how do the operators of websites respond to me legal requests", that requires informed consent, because website operators are humans. It's really very, very simple. If you need responses from human beings, that's human subjects research, and it requires informed consent and greater scrutiny from the IRB.
  - egypturnash 5y ago
    > Websites are businesses. Websites are one or more servers that respond to the HTTP and/or HTTPS protocols with something a web browser can show. They may have a business involved. They do not necessarily have one involved. They may simply be a goofy joke, such as https://zombo.com https://zombo.com or http://www.abevigoda.com http://www.abevigoda.com. They may be a personal site, such as, well, https://christine.website https://christine.website. Which is a blog and a list of projects done by one person. They may even be a front-end for a dynamic application but still not a business - I run a small Mastodon instance and it's just "a place for me and my friends to talk", not "a business"; having it grow to the size where I'd have to deal with stuff like the CCPA or the GDPR is something I absolutely do not want.
phendrenad2 5y ago
No you're absolutely right. The CCPA is onerous and should be repealed.
seanhunter 5y ago
Well for starters they are lying and misreprenting themselves and the basis for their query. They say they are a data subject from Nice and represent that they are going to make a request under the CCPA. In actual practise they are a researcher from Princeton. If you don't think that's an ethical problem then I don't see it's worth discussing further. When you say "If I as an ordinary citizen..." you essentially make this point. They are not an ordinary citizen making a data request, they are researcher who thinks it's ok to lie to collect data perhaps because they think people would give different responses when faced with a genuine data subject access request than when talking to a known researcher.
- dcow 5y ago
  It really depends on your ethical framework doesn't it? People lie all the time for good reasons. Are those actions unethical? Further, I am struggling to see who was harmed here or how there was any ill intent. On top of that, the results of this study seem like they would be enlightening. It seems like society should want this experiment to be able to take place. Certainly a western liberal understanding of ethics is more sophisticated than “you didn’t tell them you were observing their behavior bzzzzt unethical”? Put another way, is “right not to be observed (in public)” something we protect? If I write down my observations at a park as I watch humans interact is that unethical simply because I didn’t bring a megaphone and announce my intent? I think the problem is that despite what’s in vogue, I don’t understand how acting in a way that is not illegal even if it impacts somebody else and then observing the results is by default (unquestionably) unethical. Why is that bad? Are there some “case experiments” the research community looks to where humans where harmed that has shaped our modern understanding?
  - watwut 5y ago
    The formal ethics of research on humans requires informed consent of participants. You can take framework of sales or management where lie is just being smart, but it is not applicable here.
    - mbesto 5y ago
SeanLuke 5y ago
Scientific history is filled with awful experiments involving human subjects, and ones with terrible and long-reaching impacts: consider the effect of the Tuskegee experiments on Black reticence in taking the covid vaccine. Not to mention what the Nazis did. In response to this bleak history, in the mid-1960s, scientific organizations and universities began requiring Internal Review Boards (or IRBs) which would independently review proposed experiments and block them if they failed to meet ethical standards. The bar is very high, and with good reason: you're experimenting on humans. One of the foremost requirements is the notion of informed consent: you can't experiment on people who don't know or understand, or who didn't give you permission. This experiment very clearly involved human subjects and very clearly violated informed consent. If the student involved did not realize this, certainly his advisor did or he'd have to be considered incompetent. And if the experiment was indeed placed before the IRB and was given an exemption, as was implied, then Princeton's IRB made a glaring and incredible error. Had this student simply sent out a questionnaire from his Princeton email address, rather than conduct an experiment, he might have reasonably obtained IRB exemption or permission. But as I understand it, he (1) hid behind aliases so they did not know they were being experimented on, and (2) threatened legal deadlines in responding to his questions. There is no way this was ethical by IRB standards. One thing that really bothers me is that people are attacking the blogger for using the word "consent", suggesting it's hyperbole in the sense of date rape or whatnot. This is terrible: "consent" is the standard and correct term used in human subjects research, and is a factual description of exactly what occurred.
- dcow 5y ago
  I don’t think it’s accurate to say that any experiment where a human is simply involved qualifies as a human subject experiment. The IRB guidelines are pretty clear about the distinction between simply gathering data from a human and gathering data about a human.
  - SeanLuke 5y ago
    Sure. But the study is quite specific: > The study aims to understand how websites would respond to real users, while accommodating websites that may have less capacity to respond. That is, they're not interested in what the website's policies are via questionnaires. They're prodding them under false pretenses to see what would happen. This is definitely human subjects research.
dataflow 5y ago
> The fact is that this “experiment” did not create any more or additional stress than is created for normal citizens/businesses simply engaging in normal legal activities. Are you sure about this? Didn't these requests get sent to entities that didn't even fall under the categories in the statutes? Meaning they would in fact not have been normally dealing with these kinds of requests on a regular basis (if at all)?
dghlsakjg 5y ago
The researcher invented false identities, and then used them to imply a legal requirement to expend labor and respond without notifying the recipient that they were just doing a study for academia. There are plenty of things you are allowed to do as an ordinary citizen that are considered unethical in an academic context. As an absurd example of something that is highly unethical, but perfectly legal: research into whether certain images or colors on protest signs are likely to elicit a response. You choose military funerals as the protest site. In the US the right to protest at a funeral has been confirmed by the courts. This would still be an unethical action. Many companies, including ones that I’ve worked for, that received a message like this would take it VERY seriously and expend some expensive resources (lawyers and programmers) to discover that ccpa does not apply and that they aren’t required to respond. A more ethical way to gather this data would have been to be honest about identity and purpose, Notify the recipient that their response would be anonymized and never used against them, and to inform them that a response is not required.
nextaccountic 5y ago
> Can someone help me understand the ethical problem here? https://news.ycombinator.com/item?id=29611305 https://news.ycombinator.com/item?id=29611305
danaris 5y ago
The unethical part is not that the experimenters sent these messages to the owners of the websites. It's that they: a) did not get the people's informed consent to participate in human subjects research, b) misrepresented themselves as being potentially-litigious parties interested in the handling of their own data under the CCPA, who further were misrepresenting the degree to which the CCPA applied to them, and c) misled their IRB into believing this was not human subjects research, so that they did not get stopped from doing (a). (That, or the IRB itself is culpable for this aspect of the unethical behavior; I haven't seen specific information one way or the other.) And to be clear about these requirements: You may recall stories about psychological experiments during the Cold War, like the Milgram Experiments (where the participants were told to administer electric shocks to people), and the Stanford Prison Experiment (where they assigned a bunch of undergrads to be prisoners and guards). Due to wildly unethical experiments like those, the scientific institutions of our country developed the system of Institutional Review Boards (the aforementioned IRB), which have fairly clear standards that they hold researchers to (though, granted, those standards will naturally vary somewhat from institution to institution). One of the primary purposes of IRBs is to ensure that all human scientific research participants give informed consent to participate in the study. That means, among other things, they have to be informed of the risks of the study—and those risks, by design, must include the mental distress that can be caused by the experiment. (That, after all, was the primary negative outcome of the Milgram Experiments and the Stanford Prison Experiment: they caused serious psychological distress.) I don't work at Princeton, so I can't speak to the specifics of how they consider such things, but I do work for the psychology department of a university with a strong tradition of research—in fact, I built the web-based system the IRB here now uses to manage their workflow, so I've worked closely with them for over a decade now—and I can tell you with some certainty that letters like these would not in any way be considered acceptable without a signed informed consent form. They are very clearly designed to evoke an emotional response in the recipients—a fear response, specifically—and that absolutely requires the full scrutiny of the IRB.
jefftk 5y ago
From my perspective, the problem isn't that they ran an experiment, the problem is that they lied to site owners, making them think they needed to deal with a tricky legal request. In many cases, the sites reached out to lawyers in answering those requests, which is pretty expensive. The experiment aspect is only a problem in as much as it being an experiment caused the researchers to do something they wouldn't normally have done, or been okay doing.
mirker 5y ago
It is unethical because you are lying to people in an effort to manipulate their natural state. As a researcher, you have to balance the good in a research study versus the bad, and you can’t always predict how bad the outcome will be. There are review boards in place to make theses decisions. Here’s an example. Your doctor calls to talk to you about you sexual health. You discuss at length about all the issues you’ve been having lately, and you break into tears when your doctor tells you it’s permanent. At the end of the call, your doctor explains that he/she was joking, and that you just have low vitamin levels. You find your anecdotal story in the front page of a medical journal the next year. You can imagine similar situations where someone calls to tell you have cancer and observes for a month. Or that your significant other died in a car crash this morning. Or if someone claims they are suing you for a large amount of money. In all those cases, the person contacted may have a mental breakdown or worse.
- dcow 5y ago
  Human subjects research guidelines are very clear as to where the line is. If your research is gathering information about a person, then the subject is a human and additional steps must be taken to ensure responsible conduct (this applies in your first example case which is clearly ethically problematic because the subject was not informed). If the information you are collecting, is about a process or procedure or general data, even if it is provided by a human, the subject of the research is not a human and it’s at least not by default ethically problematic. In regards to lying, I find such use of misdirection to be arguable ethical because 1) pseudo identities are entirely normal and expected on the internet so encountering one should not cause anybody undue stress, 2) it is not fraud, so it’s legal and does not cause harm, 3) because the experiment would not be possible without the appearance that the request came from an individual and not a research team, and 4) because if submitted to a corporation none of this discussion would even be happening. And 5) because California law requires organizations/websites to provide this information (in cases the law outlines) when it is requested which to me indicates these type of requests are supported/good/normal. The text says: “this is not a CCPA request I just have some questions about the logistics if I were to file one” and includes a reminder that there’s possibly a legal obligation to provide these details. It’s not asking for personal details or information about a person.

by dcow 5y ago

analog31 5y ago

In my view the academe can't control how people treat one another in general, but they can refuse to support research based on abusing people.

jameshart 5y ago

This argument amounts to "If something can happen, then it's okay for a researcher to cause it to happen in order to study the result." I hope it's obvious why that is a poor ethical standard for what constitutes acceptable research practice.

dcow 5y ago
If the way it was caused to happen was unethical then yes I see a problem. But it’s not, so no, it’s not clear to me, hence why I asked.
- jameshart 5y ago
  Lying about your identity and failing to reveal that the reason for your inquiry is that it is part of an academic research project would be the ‘unethical’ part. It is unacceptable to do something to a person so you can study the way they behave, without first obtaining their consent to participate in such a study. You can observe how people behave when they are subjected to the same stimulus naturally; you can ask them if it’s okay to subject them to a stimulus to see how they react; but you can’t just do something to them and write down what happens.
- dawnbreez 5y ago
  "Someone can be shot at, therefore a researcher shooting people to see how they react is ethical." "Someone can be sued, therefore a researcher making vague legal threats to see if people waste money on lawyers is ethical." "Someone can get syphilis and not receive treatment, therefore infecting people with syphilis and denying treatment is ethical." (By the way, 2 out of the 3 are real studies. The middle one is this one. The third one is the Tuskegee Syphilis Study.)

snowytrees 5y ago

I see the issue being the email was formulated in a way that is easily perceived as a legal threat. I don't see how it is ethical for a study to be sending out legal threats to see how someone responds. Now if the goal is to understand how websites respond to the CCPA/GDPR then it shouldn't be too difficult to ask how they would respond to a request and note that it is part of a voluntary study.

progman32 5y ago

Perhaps you're making an assumption that "normal citizens" receive legal threats regularly? I can count the legal threats I've received on one hand, and I can assure you the days following them were, unfortunately, quite unpleasant (fortunately nothing came of it). Stress aside, part of the problem is the very real possibility of a subject wasting money on hiring a lawyer.

avalys 5y ago
I didn't see a legal threat in the original email.
- tantalor 5y ago
  > ... as required by Section 1798.130 of the California Civil Code.
  - dcow 5y ago
    That’s not a threat. A threat would be, “I’ll sue you if you don’t comply with my request”.
    - rectang 5y ago
      Interesting. Do you or any of your associates send these sorts of notices to anyone?
      - charcircuit 5y ago
        Yes, I have had friends jokingly say they would request the information I have on them because of GDPR.
        progman32 5y ago
        Responding to throwaway, I think the critical difference here is that you're making the requests in good faith. The researcher was making these (could be interpreted as vague) requests deceptively.

s1artibartfast 5y ago

The first ethical problem is that it is lying and deceitful. Is the bar so low that this is considered acceptable behavior for a moral and reputable person or institution?

pkrotich 5y ago

It absolutely looked like a legal treat of some sort. The study is now suspended and the investigator is even admitting they errored [0]. [0] https://privacystudy.cs.princeton.edu https://privacystudy.cs.princeton.edu

Jiro 5y ago
I noticed the "FAQ" doesn't include the question "will you be paying out money to people who read your email and spent money on a lawyer checking it out?"
PeterisP 5y ago
Are you reading some other comment than what you linked? I'm not seeing any admission of error in this FAQ.
- pkrotich 5y ago
  See “Note from Jonathan Mayer” section - he apologized and took responsibility on the first paragraph.
  - PeterisP 5y ago
    Ah, okay, thank you - now I also see the "Update 2"; for some reason my browser had been returning a cached older version with just the Update 1 / FAQ added.

deleted 5y ago

[deleted]

pdonis 5y ago

> Can someone help me understand the ethical problem here? The ethical problem is that you can't do research on people without their consent. The fact that the researchers knew they were doing research, not actually asking a question as an ordinary user of the website, makes a difference. Intent matters.

kiklion 5y ago
> The ethical problem is that you can't do research on people without their consent. But can you do research on a business without the businesses consent? Or do I need a businesses consent before sending out identical resumes except one has a stereotypical minority name to attempt to judge discrimination? Because websites aren’t people. Websites are businesses. A lot don’t make money or fail. They may have a small staff managing them. They may not be ‘for profit’ but they are still businesses. That’s my issue with the complaints about the study. They blow up and claim to be unwitting participants of human subject research, drawing mental parallels with the Tuskegee experiment when it’s a closer parallel to research performed against companies who were never notified like when researchers sent out identical resumes except for their names. The researcher definitely could have worded the email better so it didn’t come across as an ominous legal threat. There are valid criticisms against the research. But claiming to be an unwitting subject of a human research experiment is incredibly misleading.
- danaris 5y ago
  > Because websites aren’t people. But websites cannot answer questions. If your study is simply "how do the servers of various websites respond to my HTTP requests", that doesn't require informed consent, because it's not involving humans. Once your study moves into the realm of "how do the operators of websites respond to me legal requests", that requires informed consent, because website operators are humans. It's really very, very simple. If you need responses from human beings, that's human subjects research, and it requires informed consent and greater scrutiny from the IRB.
- egypturnash 5y ago
  > Websites are businesses. Websites are one or more servers that respond to the HTTP and/or HTTPS protocols with something a web browser can show. They may have a business involved. They do not necessarily have one involved. They may simply be a goofy joke, such as https://zombo.com https://zombo.com or http://www.abevigoda.com http://www.abevigoda.com. They may be a personal site, such as, well, https://christine.website https://christine.website. Which is a blog and a list of projects done by one person. They may even be a front-end for a dynamic application but still not a business - I run a small Mastodon instance and it's just "a place for me and my friends to talk", not "a business"; having it grow to the size where I'd have to deal with stuff like the CCPA or the GDPR is something I absolutely do not want.

phendrenad2 5y ago

No you're absolutely right. The CCPA is onerous and should be repealed.

seanhunter 5y ago

Well for starters they are lying and misreprenting themselves and the basis for their query. They say they are a data subject from Nice and represent that they are going to make a request under the CCPA. In actual practise they are a researcher from Princeton. If you don't think that's an ethical problem then I don't see it's worth discussing further. When you say "If I as an ordinary citizen..." you essentially make this point. They are not an ordinary citizen making a data request, they are researcher who thinks it's ok to lie to collect data perhaps because they think people would give different responses when faced with a genuine data subject access request than when talking to a known researcher.

dcow 5y ago
It really depends on your ethical framework doesn't it? People lie all the time for good reasons. Are those actions unethical? Further, I am struggling to see who was harmed here or how there was any ill intent. On top of that, the results of this study seem like they would be enlightening. It seems like society should want this experiment to be able to take place. Certainly a western liberal understanding of ethics is more sophisticated than “you didn’t tell them you were observing their behavior bzzzzt unethical”? Put another way, is “right not to be observed (in public)” something we protect? If I write down my observations at a park as I watch humans interact is that unethical simply because I didn’t bring a megaphone and announce my intent? I think the problem is that despite what’s in vogue, I don’t understand how acting in a way that is not illegal even if it impacts somebody else and then observing the results is by default (unquestionably) unethical. Why is that bad? Are there some “case experiments” the research community looks to where humans where harmed that has shaped our modern understanding?
- watwut 5y ago
  The formal ethics of research on humans requires informed consent of participants. You can take framework of sales or management where lie is just being smart, but it is not applicable here.
  - mbesto 5y ago

SeanLuke 5y ago

Scientific history is filled with awful experiments involving human subjects, and ones with terrible and long-reaching impacts: consider the effect of the Tuskegee experiments on Black reticence in taking the covid vaccine. Not to mention what the Nazis did. In response to this bleak history, in the mid-1960s, scientific organizations and universities began requiring Internal Review Boards (or IRBs) which would independently review proposed experiments and block them if they failed to meet ethical standards. The bar is very high, and with good reason: you're experimenting on humans. One of the foremost requirements is the notion of informed consent: you can't experiment on people who don't know or understand, or who didn't give you permission. This experiment very clearly involved human subjects and very clearly violated informed consent. If the student involved did not realize this, certainly his advisor did or he'd have to be considered incompetent. And if the experiment was indeed placed before the IRB and was given an exemption, as was implied, then Princeton's IRB made a glaring and incredible error. Had this student simply sent out a questionnaire from his Princeton email address, rather than conduct an experiment, he might have reasonably obtained IRB exemption or permission. But as I understand it, he (1) hid behind aliases so they did not know they were being experimented on, and (2) threatened legal deadlines in responding to his questions. There is no way this was ethical by IRB standards. One thing that really bothers me is that people are attacking the blogger for using the word "consent", suggesting it's hyperbole in the sense of date rape or whatnot. This is terrible: "consent" is the standard and correct term used in human subjects research, and is a factual description of exactly what occurred.

dcow 5y ago
I don’t think it’s accurate to say that any experiment where a human is simply involved qualifies as a human subject experiment. The IRB guidelines are pretty clear about the distinction between simply gathering data from a human and gathering data about a human.
- SeanLuke 5y ago
  Sure. But the study is quite specific: > The study aims to understand how websites would respond to real users, while accommodating websites that may have less capacity to respond. That is, they're not interested in what the website's policies are via questionnaires. They're prodding them under false pretenses to see what would happen. This is definitely human subjects research.

dataflow 5y ago

> The fact is that this “experiment” did not create any more or additional stress than is created for normal citizens/businesses simply engaging in normal legal activities. Are you sure about this? Didn't these requests get sent to entities that didn't even fall under the categories in the statutes? Meaning they would in fact not have been normally dealing with these kinds of requests on a regular basis (if at all)?

dghlsakjg 5y ago

The researcher invented false identities, and then used them to imply a legal requirement to expend labor and respond without notifying the recipient that they were just doing a study for academia. There are plenty of things you are allowed to do as an ordinary citizen that are considered unethical in an academic context. As an absurd example of something that is highly unethical, but perfectly legal: research into whether certain images or colors on protest signs are likely to elicit a response. You choose military funerals as the protest site. In the US the right to protest at a funeral has been confirmed by the courts. This would still be an unethical action. Many companies, including ones that I’ve worked for, that received a message like this would take it VERY seriously and expend some expensive resources (lawyers and programmers) to discover that ccpa does not apply and that they aren’t required to respond. A more ethical way to gather this data would have been to be honest about identity and purpose, Notify the recipient that their response would be anonymized and never used against them, and to inform them that a response is not required.

nextaccountic 5y ago

> Can someone help me understand the ethical problem here? https://news.ycombinator.com/item?id=29611305 https://news.ycombinator.com/item?id=29611305

danaris 5y ago

The unethical part is not that the experimenters sent these messages to the owners of the websites. It's that they: a) did not get the people's informed consent to participate in human subjects research, b) misrepresented themselves as being potentially-litigious parties interested in the handling of their own data under the CCPA, who further were misrepresenting the degree to which the CCPA applied to them, and c) misled their IRB into believing this was not human subjects research, so that they did not get stopped from doing (a). (That, or the IRB itself is culpable for this aspect of the unethical behavior; I haven't seen specific information one way or the other.) And to be clear about these requirements: You may recall stories about psychological experiments during the Cold War, like the Milgram Experiments (where the participants were told to administer electric shocks to people), and the Stanford Prison Experiment (where they assigned a bunch of undergrads to be prisoners and guards). Due to wildly unethical experiments like those, the scientific institutions of our country developed the system of Institutional Review Boards (the aforementioned IRB), which have fairly clear standards that they hold researchers to (though, granted, those standards will naturally vary somewhat from institution to institution). One of the primary purposes of IRBs is to ensure that all human scientific research participants give informed consent to participate in the study. That means, among other things, they have to be informed of the risks of the study—and those risks, by design, must include the mental distress that can be caused by the experiment. (That, after all, was the primary negative outcome of the Milgram Experiments and the Stanford Prison Experiment: they caused serious psychological distress.) I don't work at Princeton, so I can't speak to the specifics of how they consider such things, but I do work for the psychology department of a university with a strong tradition of research—in fact, I built the web-based system the IRB here now uses to manage their workflow, so I've worked closely with them for over a decade now—and I can tell you with some certainty that letters like these would not in any way be considered acceptable without a signed informed consent form. They are very clearly designed to evoke an emotional response in the recipients—a fear response, specifically—and that absolutely requires the full scrutiny of the IRB.

jefftk 5y ago

From my perspective, the problem isn't that they ran an experiment, the problem is that they lied to site owners, making them think they needed to deal with a tricky legal request. In many cases, the sites reached out to lawyers in answering those requests, which is pretty expensive. The experiment aspect is only a problem in as much as it being an experiment caused the researchers to do something they wouldn't normally have done, or been okay doing.

mirker 5y ago

It is unethical because you are lying to people in an effort to manipulate their natural state. As a researcher, you have to balance the good in a research study versus the bad, and you can’t always predict how bad the outcome will be. There are review boards in place to make theses decisions. Here’s an example. Your doctor calls to talk to you about you sexual health. You discuss at length about all the issues you’ve been having lately, and you break into tears when your doctor tells you it’s permanent. At the end of the call, your doctor explains that he/she was joking, and that you just have low vitamin levels. You find your anecdotal story in the front page of a medical journal the next year. You can imagine similar situations where someone calls to tell you have cancer and observes for a month. Or that your significant other died in a car crash this morning. Or if someone claims they are suing you for a large amount of money. In all those cases, the person contacted may have a mental breakdown or worse.

dcow 5y ago
Human subjects research guidelines are very clear as to where the line is. If your research is gathering information about a person, then the subject is a human and additional steps must be taken to ensure responsible conduct (this applies in your first example case which is clearly ethically problematic because the subject was not informed). If the information you are collecting, is about a process or procedure or general data, even if it is provided by a human, the subject of the research is not a human and it’s at least not by default ethically problematic. In regards to lying, I find such use of misdirection to be arguable ethical because 1) pseudo identities are entirely normal and expected on the internet so encountering one should not cause anybody undue stress, 2) it is not fraud, so it’s legal and does not cause harm, 3) because the experiment would not be possible without the appearance that the request came from an individual and not a research team, and 4) because if submitted to a corporation none of this discussion would even be happening. And 5) because California law requires organizations/websites to provide this information (in cases the law outlines) when it is requested which to me indicates these type of requests are supported/good/normal. The text says: “this is not a CCPA request I just have some questions about the logistics if I were to file one” and includes a reminder that there’s possibly a legal obligation to provide these details. It’s not asking for personal details or information about a person.