10 ms·

Perhaps you're making an assumption that "normal citizens" receive legal threats regularly? I can count the legal threats I've received on one hand, and I can a

Perhaps you're making an assumption that "normal citizens" receive legal threats regularly? I can count the legal threats I've received on one hand, and I can assure you the days following them were, unfortunately, quite unpleasant (fortunately nothing came of it). Stress aside, part of the problem is the very real possibility of a subject wasting money on hiring a lawyer.

avalys 5y ago
I didn't see a legal threat in the original email.
- tantalor 5y ago
  > ... as required by Section 1798.130 of the California Civil Code.
  - dcow 5y ago
    That’s not a threat. A threat would be, “I’ll sue you if you don’t comply with my request”.
    - rectang 5y ago
      Interesting. Do you or any of your associates send these sorts of notices to anyone?
      - charcircuit 5y ago
        Yes, I have had friends jokingly say they would request the information I have on them because of GDPR.
        progman32 5y ago
        Responding to throwaway, I think the critical difference here is that you're making the requests in good faith. The researcher was making these (could be interpreted as vague) requests deceptively.
        throawayblahads 5y ago
        Yeah, I think that's right. But it does raise an interesting point. The meta-point of the study was a good one, I think, which is to "study privacy on the internet". I'm soooo behind that (one reason I am disappointed in the ethical lapses here)—I've often considered publishing the steps I take for each website on a substack or whatever, to help other people. Sometimes, it can be hard to figure out (1) if your data can be requested-to-be-deleted, and (2) how to even do it. Clearly, the deception was bad; I guess, just thinking out loud, how could this study have been done ethically? Perhaps, sign up real people to request the data, and transparently include a notice that this was part of a study? The last bit is the tricky one; including that might skew the results in favor of websites being compliant.
        dcow 5y ago
        If I understand correctly the sentiment is that the study is not in “good faith” by virtue of being a study. That’s where I’m genuinely ethically confused. It’s not like the study is bad faith (like they’re trying to trick websites into something illegal then sue them). At worst it’s neutral faith. But why is that unethical?
      - throawayblahads 5y ago
        EDIT: Some grammar, and minor clause clarification in second-to-last paragraph. Yes, frequently. And throwaway. About once a week, I pick an account in my LastPass collection, and initiate the following process: 1. Initiate a CCPA data request using a form or email, and I always include language about the timeline. I am not a lawyer, I'm just a person. 2. Then, once I have the data, I delete the account. I'm trying to purge my web presence before I move out of California. I have about 200 accounts left, and have done this with 50. Admittedly, these are all large businesses, so far. Think Google, where I've worked myself, so I know they are equipped to handle it. But, I will be working my way down to small businesses eventually, and I am surprised to find out that simply quoting the statute (which is what I do) is considered anything but vaguely legally threatening. If the website doesn't fall under CCPA, or hell, if it does, I just expect it to be ignored. I mean no ill will. I'm personally pretty conflicted, since I actually fully agree with this [1] about the study being unethical, but if I send an email as an individual to a website with my data, quoting a California law, that doesn't seem wrong to me, even if it causes $10k in legal costs, since my request is truly genuine and not intended to cause harm. I would agree that there is a distinction at the study level, but I'm not exactly sure why. [1] https://news.ycombinator.com/item?id=29599553#29601020 https://news.ycombinator.com/item?id=29599553#29601020
        seanhunter 5y ago
        The distinction is super clear to me. You as an individual are exercising genuine data subject access rights granted to you by law. They are a researcher prentending to be a data subject exercising rights in order to gather data for their study.
        eigenvalue 5y ago
        Even if what you are doing is "legal" it seems abusive as hell to me, especially if it is ever targeted at a smaller company or person like in the OP's case. Why are being so difficult? Why don't you find something more useful to do with your time instead of making others jump through idiotic hoops out of some misplaced sense of justice?
        5y ago
    - MR4D 5y ago
      You’ve clearly never dealt with lawyers very much. The implied threat is pretty obvious to those that have.
      - Godel_unicode 5y ago
        MR4D 5y ago
        I’ve been on the internet since before Al Gore invented it. I’ve seen more crappy stuff from lawyers all the time. Remember, in the US, you do not need a reason to sue someone. A friend just got sued by a guy who tried to by his house for some BS reason. Trust me, stupid stuff happens.
        Godel_unicode 5y ago
        Bet he heard about that by some method other than email ;)
        MR4D 5y ago
        Ha! Good point. But then his was an actual suit, not a threat.
      - tiahura 5y ago
        Lawyers don’t imply potential litigation, they are quite explicit.
        watwut 5y ago
        No, not in first contact fish for mistake email.
        MR4D 5y ago
        It depends on what they are doing. A lawsuit is explicit, as is a contract. But a Cease & Desist may or may not be explicit.
  - Sophira 5y ago
    Also, while not a legal threat, "My questions are about your process for when I do submit a request." strongly implies an intent to submit a legal CCPA request in the future. Using "if" instead of "when" would have somewhat mitigated this, although it still comes across as somebody trying to find a loophole.
- vkou 5y ago
  And I don't see what's threatening about pointing out that you have a very nice windshield, and that it would truly be a shame if anything happened to it... And that I sell windshield insurance.
justahuman74 5y ago
I've received plenty of voicemail from scammers who claim that I owe some agency money and that there will be penalties if I do not comply. That feels like a threat
stormcode 5y ago
Completely agree here. There was no reason the people running this couldn't have been clear about what they were doing and why up front. I've dealt with GDPR requests before and it is a hassle. Especially when someone does it for the purposes of causing that hassle.
MattGaiser 5y ago
Does this qualify as a legal threat? It just seems like a reminder of existing laws, like one sees in all manner of contracts or Terms of Service. Like the "you are obligated to pay within X days" you see on your credit card statements. Or even if there is a legal threat, do you take it seriously unless you know the source? People regularly get calls saying they are in violation of tax law and must pay.
- progman32 5y ago
  Maybe not "officially", if such a bright line exists. But in practice, a "reminder" of a law including a legal citation and phrases such as "without undue delay" will be interpreted as a threat in many circles. Whether or not it will be seen as a credible threat is a function of the recipient's risk tolerance, prior experience, familiarity with legal processes, etc. Hiring a lawyer ($$$) isn't out of the question if the recipient is unsure or has a low risk tolerance (as, perhaps, an individual blogger might have). It is a little cruel for a researcher to assume every recipient will respond neutrally. I've received legit legal threats over email from very serious people. I'm certain they would have escalated to more "official" channels if the situation wasn't resolved to their satisfaction (if you're curious, it was a contractor billing issue that was being ignored by my HOA. I was caught in the crossfire). The fact that random scammers are calling folks claiming they're violating tax law isn't a justification for researchers to engage in similar acts. Do you agree?
- quadrifoliate 5y ago
  > People regularly get calls saying they are in violation of tax law and must pay. This is an interesting point you bring up, which merits diving into a bit further. I think it's precisely because CCPA is so new that this experiment is more unethical than if they were just calling up people saying "you owe money to the IRS, send me gift cards". The IRS spends a ton of money every year telling people that these calls are scams; but Christine or the operator of freeradical.zone likely had no such public service announcements from the State of California. On the other hand, they probably did hear news items about this new data privacy law that California passed, and thought the emails were from actual individuals.
- pdonis 5y ago
dcow 5y ago
To be clear, I find the ability for anybody to threaten anybody else with a lawyer to be problematic for many reasons. The legal system in the US sucks and I would love to see some sort of social remedy to this type of lopsided interaction and abuse of power. If that happened in this case that’s part of my question: perhaps there’s noting wrong with the “experiment” itself but rather with wording that might imply legal consequence? However I’m dubious that there was even a threat of a lawyer. The request simply asked for a prompt response as required by law. That’s quite a stones throw from “I’ll sue you and take you for everything you own if you don’t reply”. BTW, if you are actually being threatened by a lawyer then they send certified mail or show up at your door. And in terms of the webmaster almost contacting one, no lawyer is going to take your money before talking for 5-15 min to even figure out what the issue is. And even if you paid for 30 min of a lawyer's time, then they would promptly inform you that you can ignore such requests since you’re not a business. Again, what’s the ethical problem here?
- quadrifoliate 5y ago
  > The request simply asked for a prompt response as required by law. That’s quite a stones throw from “I’ll sue you and take you for everything you own if you don’t reply”...BTW, if you are actually being threatened by a lawyer then they send certified mail or show up at your door. I think you are expected random people operating websites to share your knowledge of the legal system. I know you're right, but most people who operate a website likely don't, and these emails make them spend unnecessary time, money figuring that out; not to mention mental distress. I find this not dissimilar from a standard "I'm in prison, but know where a million dollars are buried, send me money" email scam; and if researchers were sending those around as tests to see who was gullible, they would be promptly end up on several blocklists. I don't see how this is different; and therein lies the ethical problem. Quite a few people seem to agree.
  - Sebb767 5y ago
    > I think you [are] expected random people operating websites to share your knowledge of the legal system. I know you're right, but most people who operate a website likely don't, and these emails make them spend unnecessary time, money figuring that out; not to mention mental distress. But if you're hosting a website, you should have that knowledge. I can't run a business and expect not to be asked about taxes, either. Honestly, as an EU citizen, if I wasn't aware of the GDPR in regards to my websites, I'd have bigger problems than some research study. That being said, I fully agree that this mail wasn't nice and I can absolutely understand why people became nervous. But things like this are expected and the issue seems exaggerated in that light. Quite a few people seem to agree to this, too ;-)
rndgermandude 5y ago
>Perhaps you're making an assumption that "normal citizens" receive legal threats regularly? I consider myself a normal citizen and I receive "legal" and "illegal" threats regularly, the very vast majority being scam attempts of course. Recently e.g. scammers keep telling me that my website's imprint is not up to code[0], either threatening to sue or outright claiming they are in fact a law firm and want a cease-and-desist and compensation for their law work, of course. I also noticed how the Indian and Pakistani "security researcher" scammers[1] telling me about "major vulnerabilities" in my website - aka missing DMARC/DKIM headers (which are not even missing) - also started telling me how one can be fined under the GDPR for "bad security". As for the "illegal" threats... I, according to scammers at least, watch a lot of "bad" porn[2] and they know about it because they hacked me, and recorded me on my own webcam. But if I paid them some BTC/monero/whatevercoin ("Follow this link to learn how you can easily buy <coin>"), they wouldn't rat me out to my family/friends or the police. I guess I will just have to pay them, but then again I have a HUGE payday coming from that nice Nigerian prince and another from that fantastic Singaporean economic attaché... once I send them some bucks to cover processing fees, of course[3]. All joking aside tho, I get how some people may be scared by things like the CCPA emails, or the kind of emails I mentioned (if those didn't work enough times, scammers would have stopped by now). When I just read that particular email in the article, I didn't see a legal threat, but that's just me of course. Other people might read it differently, and I cannot fault them for that. I remember being concerned myself the first time one of those "imprint" scam emails made it through the spam filter. [0] In Germany, commercial websites are legally required to have an imprint, and everybody can basically sue you if you mess that up, that much is true. It's also true that courts regularly rule that if you profit even from a private website, e.g. by displaying ads, then your website is in fact commercial and requires that imprint. https://www.bmjv.de/DE/Verbraucherportal/DigitalesTelekommunikation/Impressumspflicht/Impressumspflicht_node.html https://www.bmjv.de/DE/Verbraucherportal/DigitalesTelekommun... [1] This isn't to denigrate all Indian or Pakistani people, of course. It's just that the "security researcher" scammers I encountered thus far all operated from these two nations. [2] Ranging from "homosexual" to "child". I wouldn't consider adult gay porn "bad" myself at all (just not interesting to me), that's their definition. It's quite interesting to me to see how they try to phish for closeted gay people more often than for pedophiles, at least anecdotally from what makes it to my spam folder. My guess is that the number of people who actually watch gay porn and are ashamed of it largely exceeds the number of people watching child abuse porn. [3] I received those "huge money - pay fee" scam emails more than 20 years ago, and I still receive them today. Cannot argue with success, I guess?

avalys 5y ago

I didn't see a legal threat in the original email.

tantalor 5y ago
> ... as required by Section 1798.130 of the California Civil Code.
- dcow 5y ago
  That’s not a threat. A threat would be, “I’ll sue you if you don’t comply with my request”.
  - rectang 5y ago
    Interesting. Do you or any of your associates send these sorts of notices to anyone?
    - charcircuit 5y ago
      Yes, I have had friends jokingly say they would request the information I have on them because of GDPR.
      - progman32 5y ago
        Responding to throwaway, I think the critical difference here is that you're making the requests in good faith. The researcher was making these (could be interpreted as vague) requests deceptively.
        throawayblahads 5y ago
        Yeah, I think that's right. But it does raise an interesting point. The meta-point of the study was a good one, I think, which is to "study privacy on the internet". I'm soooo behind that (one reason I am disappointed in the ethical lapses here)—I've often considered publishing the steps I take for each website on a substack or whatever, to help other people. Sometimes, it can be hard to figure out (1) if your data can be requested-to-be-deleted, and (2) how to even do it. Clearly, the deception was bad; I guess, just thinking out loud, how could this study have been done ethically? Perhaps, sign up real people to request the data, and transparently include a notice that this was part of a study? The last bit is the tricky one; including that might skew the results in favor of websites being compliant.
        dcow 5y ago
        If I understand correctly the sentiment is that the study is not in “good faith” by virtue of being a study. That’s where I’m genuinely ethically confused. It’s not like the study is bad faith (like they’re trying to trick websites into something illegal then sue them). At worst it’s neutral faith. But why is that unethical?
    - throawayblahads 5y ago
      EDIT: Some grammar, and minor clause clarification in second-to-last paragraph. Yes, frequently. And throwaway. About once a week, I pick an account in my LastPass collection, and initiate the following process: 1. Initiate a CCPA data request using a form or email, and I always include language about the timeline. I am not a lawyer, I'm just a person. 2. Then, once I have the data, I delete the account. I'm trying to purge my web presence before I move out of California. I have about 200 accounts left, and have done this with 50. Admittedly, these are all large businesses, so far. Think Google, where I've worked myself, so I know they are equipped to handle it. But, I will be working my way down to small businesses eventually, and I am surprised to find out that simply quoting the statute (which is what I do) is considered anything but vaguely legally threatening. If the website doesn't fall under CCPA, or hell, if it does, I just expect it to be ignored. I mean no ill will. I'm personally pretty conflicted, since I actually fully agree with this [1] about the study being unethical, but if I send an email as an individual to a website with my data, quoting a California law, that doesn't seem wrong to me, even if it causes $10k in legal costs, since my request is truly genuine and not intended to cause harm. I would agree that there is a distinction at the study level, but I'm not exactly sure why. [1] https://news.ycombinator.com/item?id=29599553#29601020 https://news.ycombinator.com/item?id=29599553#29601020
      - seanhunter 5y ago
        The distinction is super clear to me. You as an individual are exercising genuine data subject access rights granted to you by law. They are a researcher prentending to be a data subject exercising rights in order to gather data for their study.
      - eigenvalue 5y ago
        Even if what you are doing is "legal" it seems abusive as hell to me, especially if it is ever targeted at a smaller company or person like in the OP's case. Why are being so difficult? Why don't you find something more useful to do with your time instead of making others jump through idiotic hoops out of some misplaced sense of justice?
        5y ago
  - MR4D 5y ago
    You’ve clearly never dealt with lawyers very much. The implied threat is pretty obvious to those that have.
    - Godel_unicode 5y ago
      - MR4D 5y ago
        I’ve been on the internet since before Al Gore invented it. I’ve seen more crappy stuff from lawyers all the time. Remember, in the US, you do not need a reason to sue someone. A friend just got sued by a guy who tried to by his house for some BS reason. Trust me, stupid stuff happens.
        Godel_unicode 5y ago
        Bet he heard about that by some method other than email ;)
        MR4D 5y ago
        Ha! Good point. But then his was an actual suit, not a threat.
    - tiahura 5y ago
      Lawyers don’t imply potential litigation, they are quite explicit.
      - watwut 5y ago
        No, not in first contact fish for mistake email.
      - MR4D 5y ago
        It depends on what they are doing. A lawsuit is explicit, as is a contract. But a Cease & Desist may or may not be explicit.
- Sophira 5y ago
  Also, while not a legal threat, "My questions are about your process for when I do submit a request." strongly implies an intent to submit a legal CCPA request in the future. Using "if" instead of "when" would have somewhat mitigated this, although it still comes across as somebody trying to find a loophole.
vkou 5y ago
And I don't see what's threatening about pointing out that you have a very nice windshield, and that it would truly be a shame if anything happened to it... And that I sell windshield insurance.

justahuman74 5y ago

I've received plenty of voicemail from scammers who claim that I owe some agency money and that there will be penalties if I do not comply. That feels like a threat

stormcode 5y ago

Completely agree here. There was no reason the people running this couldn't have been clear about what they were doing and why up front. I've dealt with GDPR requests before and it is a hassle. Especially when someone does it for the purposes of causing that hassle.

MattGaiser 5y ago

Does this qualify as a legal threat? It just seems like a reminder of existing laws, like one sees in all manner of contracts or Terms of Service. Like the "you are obligated to pay within X days" you see on your credit card statements. Or even if there is a legal threat, do you take it seriously unless you know the source? People regularly get calls saying they are in violation of tax law and must pay.

progman32 5y ago
Maybe not "officially", if such a bright line exists. But in practice, a "reminder" of a law including a legal citation and phrases such as "without undue delay" will be interpreted as a threat in many circles. Whether or not it will be seen as a credible threat is a function of the recipient's risk tolerance, prior experience, familiarity with legal processes, etc. Hiring a lawyer ($$$) isn't out of the question if the recipient is unsure or has a low risk tolerance (as, perhaps, an individual blogger might have). It is a little cruel for a researcher to assume every recipient will respond neutrally. I've received legit legal threats over email from very serious people. I'm certain they would have escalated to more "official" channels if the situation wasn't resolved to their satisfaction (if you're curious, it was a contractor billing issue that was being ignored by my HOA. I was caught in the crossfire). The fact that random scammers are calling folks claiming they're violating tax law isn't a justification for researchers to engage in similar acts. Do you agree?
quadrifoliate 5y ago
> People regularly get calls saying they are in violation of tax law and must pay. This is an interesting point you bring up, which merits diving into a bit further. I think it's precisely because CCPA is so new that this experiment is more unethical than if they were just calling up people saying "you owe money to the IRS, send me gift cards". The IRS spends a ton of money every year telling people that these calls are scams; but Christine or the operator of freeradical.zone likely had no such public service announcements from the State of California. On the other hand, they probably did hear news items about this new data privacy law that California passed, and thought the emails were from actual individuals.
pdonis 5y ago

dcow 5y ago

To be clear, I find the ability for anybody to threaten anybody else with a lawyer to be problematic for many reasons. The legal system in the US sucks and I would love to see some sort of social remedy to this type of lopsided interaction and abuse of power. If that happened in this case that’s part of my question: perhaps there’s noting wrong with the “experiment” itself but rather with wording that might imply legal consequence? However I’m dubious that there was even a threat of a lawyer. The request simply asked for a prompt response as required by law. That’s quite a stones throw from “I’ll sue you and take you for everything you own if you don’t reply”. BTW, if you are actually being threatened by a lawyer then they send certified mail or show up at your door. And in terms of the webmaster almost contacting one, no lawyer is going to take your money before talking for 5-15 min to even figure out what the issue is. And even if you paid for 30 min of a lawyer's time, then they would promptly inform you that you can ignore such requests since you’re not a business. Again, what’s the ethical problem here?

quadrifoliate 5y ago
> The request simply asked for a prompt response as required by law. That’s quite a stones throw from “I’ll sue you and take you for everything you own if you don’t reply”...BTW, if you are actually being threatened by a lawyer then they send certified mail or show up at your door. I think you are expected random people operating websites to share your knowledge of the legal system. I know you're right, but most people who operate a website likely don't, and these emails make them spend unnecessary time, money figuring that out; not to mention mental distress. I find this not dissimilar from a standard "I'm in prison, but know where a million dollars are buried, send me money" email scam; and if researchers were sending those around as tests to see who was gullible, they would be promptly end up on several blocklists. I don't see how this is different; and therein lies the ethical problem. Quite a few people seem to agree.
- Sebb767 5y ago
  > I think you [are] expected random people operating websites to share your knowledge of the legal system. I know you're right, but most people who operate a website likely don't, and these emails make them spend unnecessary time, money figuring that out; not to mention mental distress. But if you're hosting a website, you should have that knowledge. I can't run a business and expect not to be asked about taxes, either. Honestly, as an EU citizen, if I wasn't aware of the GDPR in regards to my websites, I'd have bigger problems than some research study. That being said, I fully agree that this mail wasn't nice and I can absolutely understand why people became nervous. But things like this are expected and the issue seems exaggerated in that light. Quite a few people seem to agree to this, too ;-)

rndgermandude 5y ago

>Perhaps you're making an assumption that "normal citizens" receive legal threats regularly? I consider myself a normal citizen and I receive "legal" and "illegal" threats regularly, the very vast majority being scam attempts of course. Recently e.g. scammers keep telling me that my website's imprint is not up to code[0], either threatening to sue or outright claiming they are in fact a law firm and want a cease-and-desist and compensation for their law work, of course. I also noticed how the Indian and Pakistani "security researcher" scammers[1] telling me about "major vulnerabilities" in my website - aka missing DMARC/DKIM headers (which are not even missing) - also started telling me how one can be fined under the GDPR for "bad security". As for the "illegal" threats... I, according to scammers at least, watch a lot of "bad" porn[2] and they know about it because they hacked me, and recorded me on my own webcam. But if I paid them some BTC/monero/whatevercoin ("Follow this link to learn how you can easily buy <coin>"), they wouldn't rat me out to my family/friends or the police. I guess I will just have to pay them, but then again I have a HUGE payday coming from that nice Nigerian prince and another from that fantastic Singaporean economic attaché... once I send them some bucks to cover processing fees, of course[3]. All joking aside tho, I get how some people may be scared by things like the CCPA emails, or the kind of emails I mentioned (if those didn't work enough times, scammers would have stopped by now). When I just read that particular email in the article, I didn't see a legal threat, but that's just me of course. Other people might read it differently, and I cannot fault them for that. I remember being concerned myself the first time one of those "imprint" scam emails made it through the spam filter. [0] In Germany, commercial websites are legally required to have an imprint, and everybody can basically sue you if you mess that up, that much is true. It's also true that courts regularly rule that if you profit even from a private website, e.g. by displaying ads, then your website is in fact commercial and requires that imprint. https://www.bmjv.de/DE/Verbraucherportal/DigitalesTelekommunikation/Impressumspflicht/Impressumspflicht_node.html https://www.bmjv.de/DE/Verbraucherportal/DigitalesTelekommun... [1] This isn't to denigrate all Indian or Pakistani people, of course. It's just that the "security researcher" scammers I encountered thus far all operated from these two nations. [2] Ranging from "homosexual" to "child". I wouldn't consider adult gay porn "bad" myself at all (just not interesting to me), that's their definition. It's quite interesting to me to see how they try to phish for closeted gay people more often than for pedophiles, at least anecdotally from what makes it to my spam folder. My guess is that the number of people who actually watch gay porn and are ashamed of it largely exceeds the number of people watching child abuse porn. [3] I received those "huge money - pay fee" scam emails more than 20 years ago, and I still receive them today. Cannot argue with success, I guess?