5 ms·

Well for starters they are lying and misreprenting themselves and the basis for their query. They say they are a data subject from Nice and represent that they

Well for starters they are lying and misreprenting themselves and the basis for their query. They say they are a data subject from Nice and represent that they are going to make a request under the CCPA. In actual practise they are a researcher from Princeton. If you don't think that's an ethical problem then I don't see it's worth discussing further. When you say "If I as an ordinary citizen..." you essentially make this point. They are not an ordinary citizen making a data request, they are researcher who thinks it's ok to lie to collect data perhaps because they think people would give different responses when faced with a genuine data subject access request than when talking to a known researcher.

dcow 5y ago
It really depends on your ethical framework doesn't it? People lie all the time for good reasons. Are those actions unethical? Further, I am struggling to see who was harmed here or how there was any ill intent. On top of that, the results of this study seem like they would be enlightening. It seems like society should want this experiment to be able to take place. Certainly a western liberal understanding of ethics is more sophisticated than “you didn’t tell them you were observing their behavior bzzzzt unethical”? Put another way, is “right not to be observed (in public)” something we protect? If I write down my observations at a park as I watch humans interact is that unethical simply because I didn’t bring a megaphone and announce my intent? I think the problem is that despite what’s in vogue, I don’t understand how acting in a way that is not illegal even if it impacts somebody else and then observing the results is by default (unquestionably) unethical. Why is that bad? Are there some “case experiments” the research community looks to where humans where harmed that has shaped our modern understanding?
- watwut 5y ago
  The formal ethics of research on humans requires informed consent of participants. You can take framework of sales or management where lie is just being smart, but it is not applicable here.
  - mbesto 5y ago
    > The formal ethics of research on humans requires informed consent of participants. How do you explain research on placebos then?
    - albedoa 5y ago
      Participants are informed about and agree to the chance of a placebo.
  - malwarebytess 5y ago
    it's not research on humans as such. it was intended to be research on organizations, websites large enough to be subject to the law.
    - kstrauser 5y ago
      I got one of these letters, and the website in question has $0.00 revenue, and an order of magnitude fewer total users than would invoke the users. The linked story here is about someone who got a letter to their personal blog. The researchers did no (or very poor) screening.
      - malwarebytess 5y ago
        That I agree with. Their collection methodology was clearly inadequate. They should have been more careful who they mailed, even though they did try to be careful it wasn't enough.
  - hatsunearu 5y ago
    Deception is allowed, but should be scrutinized carefully to determine if it is necessary. In this case, it was not necessary. The researcher could have easily just said "we want to know if you are compliant with CCPA for the purpose of doing this research, could you tell us your policy please" https://research.oregonstate.edu/irb/research-involving-deception https://research.oregonstate.edu/irb/research-involving-dece... quotes: a) Psychologists do not conduct a study involving deception unless they have determined that the use of deceptive techniques is justified by the study's significant prospective scientific, educational or applied value and that effective nondeceptive alternative procedures are not feasible. b) Psychologists do not deceive prospective participants about research that is reasonably expected to cause physical pain or severe emotional distress. c) Psychologists explain any deception that is an integral feature of the design and conduct of an experiment to participants as early as is feasible, preferably at the conclusion of their participation, but no later than at the conclusion of the data collection, and permit participants to withdraw their data. a) -- Hell no b) -- I can give the benefit of the doubt that they didn't foresee small website owners getting panic attacks from this threat, but their non-empathetic tone in that apology write up is appalling c) -- Hell no The more I think about this the more I'm furious that a supposedly top tier institution like Princeton approved all of this and the "researchers" seems to have 0 fucks to give on ethical experiment design.
- seanhunter 5y ago
  "People lie all the time for good reasons. Are those actions unethical?" is whataboutism of the worst kind. We're not talking about any other hypothetical case where a person might lie for good reasons. We're talking about this case, and the lie/misrepresentation was at the heart of why it was unethical. Secondly, you say you don't see who was harmed - the person who posted the original blog post was clearly harmed. She had a panic attack she was so stressed about the legal implications of the implied threat. The fact that someone else may perhaps have not found receiving this email stressful doesn't really matter - that was the effect on her and it was harmful on its face. Remember that people have different life circumstances which affect things like this - someone who was short of money may see a legal threat with implied financial consequences such as this as an existential threat. Secondly the people who paid money for legal advice were very clearly also harmed. Their harm has a specific monetary value. Your "put another way" extrapolation is just a complete straw man. Noone here other than you is talking about observing people in the park. This is about a research study which sent an email which some people saw as scammy or threatening in order to gather data about how small websites handle data subject access requests.
  - dcow 5y ago
    > We're not talking about any other hypothetical case where a person might lie for good reasons. We're talking about this case, and the lie/misrepresentation was at the heart of why it was unethical. I don’t find this type of benign use of anonymity/misdirection to be an outright lie of the unethical kind. > She had a panic attack she was so stressed about the legal implications of the implied threat. What?! When/where? She said the request stressed her out… come on. If webmasters have panic attacks when encountering spam then perhaps we should outlaw spam (I’d support this). > Your "put another way" extrapolation is just a complete straw man. Noone here other than you is talking about observing people in the park. Please… I 100% do not understand the reason why this experiment should be considered unethical and I’m trying to explain what I see as parallels. It’s not a straw man and I’m not the only one.. read down thread. What I’m looking for is an explanation for why you think that legal normal behavior (even behavior that causes stress) is allowable but legal normal behavior for science is not allowed. I also believe context motive and intent matter, for the record (which I why I believe censorship imposes a net negative on society, example: comedians are “allowed” to use offensive language). I simply find the intent here to be arguably ethical depending on what your goal is for society. For example, if the goal is to never have any individual experience 1 ounce more stress than is absolutely required throughout their life, then this behavior is unethical arguably whether it’s an experiment or not but definitely in the case of the experiment because it’s unnecessary. On the other hand, if your goal as a society is to make sure people’s data privacy rights are protected, it seems strictly ethical to conduct such an exercise to raise awareness and document how well institutions comply with the law.
lisper 5y ago
> They say they are a data subject from Nice Huh? Are we reading the same article? Because what I see is this: > My name is Maya Mishina, and I am a resident of Novosibirsk, Russia.
- dchest 5y ago
  There were multiple emails with multiple fake identities from these domains: envoiemail.fr novatormail.ru potomacmail.com princetondmarcstudy.org princetonprivacystudy.org yosemitemail.com They also send different messages, e.g. fake California residents asking about GDPR, not CCPA.
- jfax 5y ago
  The article the article linked said Nice https://blog.freeradical.zone/post/ccpa-scam-2021-12/ https://blog.freeradical.zone/post/ccpa-scam-2021-12/
brabel 5y ago
> they are lying and misreprenting themselves The police does that quite often to catch criminals. Sometimes they also target innocent people, is that ethical? People on HN don't usually lie, I hope, but most "misrepresent" themselves using anonymous accounts, sometimes claiming to be more than they actually are (I know, shocking). Emails you receive are more likely to be scams than not. If you're like the author and freaks out at legally-sounding emails (or phone calls, discussion forum comments etc) received from random people, you're going to be a really stressed, anxious person your whole life.
- lysium 5y ago
  > The police does that quite often to catch criminals. Sometimes they also target innocent people, is that ethical? This should tell you something about your police, not about ethics.
- kube-system 5y ago
  Academic research has a well established and formal set of ethics rules. These rules are not as established or strict for other professions.
  - nr2x 5y ago
    specifically, deception studies are really hard to get approved - and for good reason. looks like this wasn't properly reviewed.
    - josefx 5y ago
      "Hard to get approved" my ass. The attacks on the Linux code review process with real harm code and zero safeguards against successfully hijacking a production kernel got approved and the review board even reaffirmed its decision when confronted about it, as far as I remember by claiming that the study wasn't focused medical issues. Did this study focus on medical issues? If not then at least one review board out there would rubber stamp it.
      - 5y ago
quadrifoliate 5y ago
Also, the text on the page reads as tone-deaf enough for me to wonder if it's deliberately written to misrepresent the nature of the study activities to people on the IRB who are unfamiliar with technology. A quick Googling for everyone on the Stanford IRB Committee [1] shows Kyle Jamieson [2] as the only CS person – everyone else seems to be a clinician, scientist, or administrator. > As part of the study, we are asking public websites about their processes for responding to GDPR and CCPA data access requests. We attempt to identify a website's correct email address for data access requests through an automated system. You cannot "ask a website" and a website doesn't have a "correct email address". Given the targeted nature of the emails, I have trouble believing that these phrases were written in good faith by someone who understands that they are emailing the webmaster for a website, and expect an answer within a reasonable timeframe. ---------------------------------------- [1] https://ria.princeton.edu/Human-Research/Committee https://ria.princeton.edu/Human-Research/Committee [2] https://www.cs.princeton.edu/~kylej/ https://www.cs.princeton.edu/~kylej/
bborud 5y ago
Someone on the Internet is lying and misrepresenting themselves? Nooo! (The rest isn't a response to seanhunter's comment, but a comment on the discussion in general) If we take a step back from the discussion; I'd have to say that this is in a gray area that kind of ends up being mostly in the "ok" region - or possibly in the "probably not worth giving a shit about" region. There is a simple litmus test you can make: how would people have reacted if this had been limited to large corporations you do not like? The response would have been very different. Let us at least be honest enough to admit that to ourselves. That this is part of academic research doesn't really change anything. It also needs to be said that people tend to be too uptight about perceived small infringements on what they see as their inalienable rights. If we are going to label subjects of what is at best described as akin to consumer research as victims we are watering out the term to the point where every person who has accessed the web is essentially a victim. Hence the victim blaming someone tried to call out in a comment, is needless douchebaggery and drama. There are real victims of real transgressions and this is belittling. People need to take themselves a bit less seriously. You are part of human subject research studies every time you use the web. And yet you come back for more every day. Half of you probably contribute code and time to an industry that turns human behavior into numbers that the is translated into cash. And proudly so. Hypocrisy just makes us all look like douchebags.
- dawnbreez 5y ago
  > how would people have reacted if this had been limited to large corporations you do not like? Those large corporations we do not like have lawyers on retainer specifically to deal with this situation (probably by suing the pants off of whoever sent the email). It is acceptable to react differently when the victim is defenseless. That is why we would have a different reaction to a large corporation being struck by this, versus an individual who may not be able to afford legal counsel (and who certainly can't afford to pay legal counsel when the threat turns out to be baseless).
  - bborud 5y ago
    So you are making the argument that one should apply different rules to different people depending on how much money they have. Well, no way that could go wrong. Interesting how you also make the tortured argument that privacy laws create victims.
geekster777 5y ago
I think lying is a reasonably fundamental part of human research, or at least obfuscation. You don't tell the participants what you're testing for, since you don't want the results to be biased, and often obfuscate what you're measuring. I think the real ethical issue is actually that the email reads like it's coming from a lawyer. It's weirdly formal and cites that a response is legally required within 45 days. As other comments have mentioned, this has the real world consequence of heavy stress where most folks would (and should) lawyer up. This is the biggest ethical issue, since the study is costing its participants nontrivial money, and without consent.
- seebs 5y ago
  Lying is a reasonably fundamental part of research, but lying to humans can hurt them in various ways, and that's why we have human research ethics rules and standards that require an explicit process for obtaining consent to do something, even if we can't say what in advance, and debriefing and harm mitigation. Which the IRB missed because they didn't understand that, to ask questions about a website's policy, you must get an answer from a human.
  - dcow 5y ago
    That’s _not_ how it works. The fact that information comes from a human does not make something a human subject experiment. The information has to be about a human. Here the information is about a process for handling CCPA requests. We can argue about whether, in a single site operator case that also qualifies as information about a human since there’s no clear organizational policy, but I want to make it clear that information simply coming from a human does not make an experiment a human subject experiment.
    - wtallis 5y ago
      > The fact that information comes from a human does not make something a human subject experiment. The information has to be about a human. The experiment is collecting more information than just survey results about CCPA policies. They're also collecting and evaluating information about how humans respond to their legal threats vs how they respond to less pointed inquiries from academics. If this study was merely ordinary survey methodology with questions that aren't asking about humans, it wouldn't be human subject research. But they have actually gone outside the bounds of a mere survey with the deception and threats.

dcow 5y ago

It really depends on your ethical framework doesn't it? People lie all the time for good reasons. Are those actions unethical? Further, I am struggling to see who was harmed here or how there was any ill intent. On top of that, the results of this study seem like they would be enlightening. It seems like society should want this experiment to be able to take place. Certainly a western liberal understanding of ethics is more sophisticated than “you didn’t tell them you were observing their behavior bzzzzt unethical”? Put another way, is “right not to be observed (in public)” something we protect? If I write down my observations at a park as I watch humans interact is that unethical simply because I didn’t bring a megaphone and announce my intent? I think the problem is that despite what’s in vogue, I don’t understand how acting in a way that is not illegal even if it impacts somebody else and then observing the results is by default (unquestionably) unethical. Why is that bad? Are there some “case experiments” the research community looks to where humans where harmed that has shaped our modern understanding?

watwut 5y ago
The formal ethics of research on humans requires informed consent of participants. You can take framework of sales or management where lie is just being smart, but it is not applicable here.
- mbesto 5y ago
  > The formal ethics of research on humans requires informed consent of participants. How do you explain research on placebos then?
  - albedoa 5y ago
    Participants are informed about and agree to the chance of a placebo.
- malwarebytess 5y ago
  it's not research on humans as such. it was intended to be research on organizations, websites large enough to be subject to the law.
  - kstrauser 5y ago
    I got one of these letters, and the website in question has $0.00 revenue, and an order of magnitude fewer total users than would invoke the users. The linked story here is about someone who got a letter to their personal blog. The researchers did no (or very poor) screening.
    - malwarebytess 5y ago
      That I agree with. Their collection methodology was clearly inadequate. They should have been more careful who they mailed, even though they did try to be careful it wasn't enough.
- hatsunearu 5y ago
  Deception is allowed, but should be scrutinized carefully to determine if it is necessary. In this case, it was not necessary. The researcher could have easily just said "we want to know if you are compliant with CCPA for the purpose of doing this research, could you tell us your policy please" https://research.oregonstate.edu/irb/research-involving-deception https://research.oregonstate.edu/irb/research-involving-dece... quotes: a) Psychologists do not conduct a study involving deception unless they have determined that the use of deceptive techniques is justified by the study's significant prospective scientific, educational or applied value and that effective nondeceptive alternative procedures are not feasible. b) Psychologists do not deceive prospective participants about research that is reasonably expected to cause physical pain or severe emotional distress. c) Psychologists explain any deception that is an integral feature of the design and conduct of an experiment to participants as early as is feasible, preferably at the conclusion of their participation, but no later than at the conclusion of the data collection, and permit participants to withdraw their data. a) -- Hell no b) -- I can give the benefit of the doubt that they didn't foresee small website owners getting panic attacks from this threat, but their non-empathetic tone in that apology write up is appalling c) -- Hell no The more I think about this the more I'm furious that a supposedly top tier institution like Princeton approved all of this and the "researchers" seems to have 0 fucks to give on ethical experiment design.
seanhunter 5y ago
"People lie all the time for good reasons. Are those actions unethical?" is whataboutism of the worst kind. We're not talking about any other hypothetical case where a person might lie for good reasons. We're talking about this case, and the lie/misrepresentation was at the heart of why it was unethical. Secondly, you say you don't see who was harmed - the person who posted the original blog post was clearly harmed. She had a panic attack she was so stressed about the legal implications of the implied threat. The fact that someone else may perhaps have not found receiving this email stressful doesn't really matter - that was the effect on her and it was harmful on its face. Remember that people have different life circumstances which affect things like this - someone who was short of money may see a legal threat with implied financial consequences such as this as an existential threat. Secondly the people who paid money for legal advice were very clearly also harmed. Their harm has a specific monetary value. Your "put another way" extrapolation is just a complete straw man. Noone here other than you is talking about observing people in the park. This is about a research study which sent an email which some people saw as scammy or threatening in order to gather data about how small websites handle data subject access requests.
- dcow 5y ago
  > We're not talking about any other hypothetical case where a person might lie for good reasons. We're talking about this case, and the lie/misrepresentation was at the heart of why it was unethical. I don’t find this type of benign use of anonymity/misdirection to be an outright lie of the unethical kind. > She had a panic attack she was so stressed about the legal implications of the implied threat. What?! When/where? She said the request stressed her out… come on. If webmasters have panic attacks when encountering spam then perhaps we should outlaw spam (I’d support this). > Your "put another way" extrapolation is just a complete straw man. Noone here other than you is talking about observing people in the park. Please… I 100% do not understand the reason why this experiment should be considered unethical and I’m trying to explain what I see as parallels. It’s not a straw man and I’m not the only one.. read down thread. What I’m looking for is an explanation for why you think that legal normal behavior (even behavior that causes stress) is allowable but legal normal behavior for science is not allowed. I also believe context motive and intent matter, for the record (which I why I believe censorship imposes a net negative on society, example: comedians are “allowed” to use offensive language). I simply find the intent here to be arguably ethical depending on what your goal is for society. For example, if the goal is to never have any individual experience 1 ounce more stress than is absolutely required throughout their life, then this behavior is unethical arguably whether it’s an experiment or not but definitely in the case of the experiment because it’s unnecessary. On the other hand, if your goal as a society is to make sure people’s data privacy rights are protected, it seems strictly ethical to conduct such an exercise to raise awareness and document how well institutions comply with the law.

lisper 5y ago

> They say they are a data subject from Nice Huh? Are we reading the same article? Because what I see is this: > My name is Maya Mishina, and I am a resident of Novosibirsk, Russia.

dchest 5y ago
There were multiple emails with multiple fake identities from these domains: envoiemail.fr novatormail.ru potomacmail.com princetondmarcstudy.org princetonprivacystudy.org yosemitemail.com They also send different messages, e.g. fake California residents asking about GDPR, not CCPA.
jfax 5y ago
The article the article linked said Nice https://blog.freeradical.zone/post/ccpa-scam-2021-12/ https://blog.freeradical.zone/post/ccpa-scam-2021-12/

brabel 5y ago

> they are lying and misreprenting themselves The police does that quite often to catch criminals. Sometimes they also target innocent people, is that ethical? People on HN don't usually lie, I hope, but most "misrepresent" themselves using anonymous accounts, sometimes claiming to be more than they actually are (I know, shocking). Emails you receive are more likely to be scams than not. If you're like the author and freaks out at legally-sounding emails (or phone calls, discussion forum comments etc) received from random people, you're going to be a really stressed, anxious person your whole life.

lysium 5y ago
> The police does that quite often to catch criminals. Sometimes they also target innocent people, is that ethical? This should tell you something about your police, not about ethics.
kube-system 5y ago
Academic research has a well established and formal set of ethics rules. These rules are not as established or strict for other professions.
- nr2x 5y ago
  specifically, deception studies are really hard to get approved - and for good reason. looks like this wasn't properly reviewed.
  - josefx 5y ago
    "Hard to get approved" my ass. The attacks on the Linux code review process with real harm code and zero safeguards against successfully hijacking a production kernel got approved and the review board even reaffirmed its decision when confronted about it, as far as I remember by claiming that the study wasn't focused medical issues. Did this study focus on medical issues? If not then at least one review board out there would rubber stamp it.
    - 5y ago

quadrifoliate 5y ago

Also, the text on the page reads as tone-deaf enough for me to wonder if it's deliberately written to misrepresent the nature of the study activities to people on the IRB who are unfamiliar with technology. A quick Googling for everyone on the Stanford IRB Committee [1] shows Kyle Jamieson [2] as the only CS person – everyone else seems to be a clinician, scientist, or administrator. > As part of the study, we are asking public websites about their processes for responding to GDPR and CCPA data access requests. We attempt to identify a website's correct email address for data access requests through an automated system. You cannot "ask a website" and a website doesn't have a "correct email address". Given the targeted nature of the emails, I have trouble believing that these phrases were written in good faith by someone who understands that they are emailing the webmaster for a website, and expect an answer within a reasonable timeframe. ---------------------------------------- [1] https://ria.princeton.edu/Human-Research/Committee https://ria.princeton.edu/Human-Research/Committee [2] https://www.cs.princeton.edu/~kylej/ https://www.cs.princeton.edu/~kylej/

bborud 5y ago

Someone on the Internet is lying and misrepresenting themselves? Nooo! (The rest isn't a response to seanhunter's comment, but a comment on the discussion in general) If we take a step back from the discussion; I'd have to say that this is in a gray area that kind of ends up being mostly in the "ok" region - or possibly in the "probably not worth giving a shit about" region. There is a simple litmus test you can make: how would people have reacted if this had been limited to large corporations you do not like? The response would have been very different. Let us at least be honest enough to admit that to ourselves. That this is part of academic research doesn't really change anything. It also needs to be said that people tend to be too uptight about perceived small infringements on what they see as their inalienable rights. If we are going to label subjects of what is at best described as akin to consumer research as victims we are watering out the term to the point where every person who has accessed the web is essentially a victim. Hence the victim blaming someone tried to call out in a comment, is needless douchebaggery and drama. There are real victims of real transgressions and this is belittling. People need to take themselves a bit less seriously. You are part of human subject research studies every time you use the web. And yet you come back for more every day. Half of you probably contribute code and time to an industry that turns human behavior into numbers that the is translated into cash. And proudly so. Hypocrisy just makes us all look like douchebags.

dawnbreez 5y ago
> how would people have reacted if this had been limited to large corporations you do not like? Those large corporations we do not like have lawyers on retainer specifically to deal with this situation (probably by suing the pants off of whoever sent the email). It is acceptable to react differently when the victim is defenseless. That is why we would have a different reaction to a large corporation being struck by this, versus an individual who may not be able to afford legal counsel (and who certainly can't afford to pay legal counsel when the threat turns out to be baseless).
- bborud 5y ago
  So you are making the argument that one should apply different rules to different people depending on how much money they have. Well, no way that could go wrong. Interesting how you also make the tortured argument that privacy laws create victims.

geekster777 5y ago

I think lying is a reasonably fundamental part of human research, or at least obfuscation. You don't tell the participants what you're testing for, since you don't want the results to be biased, and often obfuscate what you're measuring. I think the real ethical issue is actually that the email reads like it's coming from a lawyer. It's weirdly formal and cites that a response is legally required within 45 days. As other comments have mentioned, this has the real world consequence of heavy stress where most folks would (and should) lawyer up. This is the biggest ethical issue, since the study is costing its participants nontrivial money, and without consent.

seebs 5y ago
Lying is a reasonably fundamental part of research, but lying to humans can hurt them in various ways, and that's why we have human research ethics rules and standards that require an explicit process for obtaining consent to do something, even if we can't say what in advance, and debriefing and harm mitigation. Which the IRB missed because they didn't understand that, to ask questions about a website's policy, you must get an answer from a human.
- dcow 5y ago
  That’s _not_ how it works. The fact that information comes from a human does not make something a human subject experiment. The information has to be about a human. Here the information is about a process for handling CCPA requests. We can argue about whether, in a single site operator case that also qualifies as information about a human since there’s no clear organizational policy, but I want to make it clear that information simply coming from a human does not make an experiment a human subject experiment.
  - wtallis 5y ago
    > The fact that information comes from a human does not make something a human subject experiment. The information has to be about a human. The experiment is collecting more information than just survey results about CCPA policies. They're also collecting and evaluating information about how humans respond to their legal threats vs how they respond to less pointed inquiries from academics. If this study was merely ordinary survey methodology with questions that aren't asking about humans, it wouldn't be human subject research. But they have actually gone outside the bounds of a mere survey with the deception and threats.