5 ms·

From TFA: We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our stud

From TFA: We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. The focus of the study is understanding website policies and practices, and emails associated with the study do not solicit personally identifiable information. This came up during the Linux security patch debacle as well. IRB guidelines are focused on a narrow set of harms based in historic abuses of medical research, and don't necessarily condemn the types of deception available here. As TFA points out, “secret shopper” methods are common in academic research of business practices.

dcow 5y ago
This is exactly what I don't understand about the whole thing. People are arguing that this was unethical but the researchers literally proposed the study to their review board which said "go ahead it's not a human subjects research study and does not need consent and is not by that virtue unethical". Perhaps the review board was wrong, people make mistakes, whatever. But assuming the review board was correct in its analysis of the situation (and who are we really to challenge that unless there's a glaring negligent tier mistake), I have yet to hear an argument that dissects the ethics of this case and clearly lays out what ethical quandary we have on our hands and where the line was crossed. It really seems to me that people are conflating "annoying" with "unethical". Sure, spamming people is annoying. But how is it unethical? I had the same questions about the linux kernal security patches issue. Annoying waste of a few maintainers time, arguably yes for some definition of waste. But unethical? How so and can someone link me to literature detailing the ethical framework that disallows otherwise legal activity in good faith pursuit of knowledge because someone got annoyed in the process? I think that would be an interesting read.
- deleted 5y ago
  [deleted]
- bryan0 5y ago
  I think you bring up a good point: that some of the blame going to the researcher really should be directed at the review board itself. It’s their responsibility to catch cases like this. The fact that some people who were included in the study without their consent are upset and angry, means they failed this responsibility. I think what you are missing though, is that just because something passed a review board, that does not make it ethical. Review boards, like everything else, will make mistakes.
- jmull 5y ago
  The emails purported to come from individuals, but were (1) written in an aggressive, legalistic style, and (2) directed at individuals who were not subject to CCPA and not equipped to deal with regulatory demands of it. This caused significant anxiety on the part of the individuals who received this email, since it implied they would be subject to legal action if they did not provide a sufficient reply. It caused them to take significant action -- e.g., to research the law (that they aren't subject to), to determine if/how they could comply with a CCPA data access request if they had to, to consider retaining legal representation, etc. It came off as some kind of scam or mistake, but one that had to be taken seriously. You could read some of the blog posts from people who received these emails to understand the effect it had on them. It might also help you to read the email they received and imaging receiving the same for a site for a personal blog or one-man shop.
- yjftsjthsd-h 5y ago
  People aren't upset about it being annoying. People are upset that it read as a threat and resulted in people spending money to hire a lawyer because they thought they were about to get dragged into court.
- matkoniecz 5y ago
  > Sure, spamming people is annoying. But how is it unethical? Spamming is unacceptable, unwanted, illegal and unethical for quite obvious reasons, namely (1) negative effects do not justify benefits (2) spammer gets benefits at cost of others (3) it is annoying (4) its is not needed. Rare exceptions may apply, it is not one of them.
- powersnail 5y ago
  Especially in the area of CS/programming, it's so easy for experts to fool the IRB because they can hide behind words like "website", "data", "policy", as if they are dealing exclusively with machines. > who are we really to challenge that We are not obligated to make the same ethical judgement as the IRB. We are all entitled to challenge that. Making bogus legal threats is unethical, when being sued can realistically lead to completely altered life. Yes, it's an annoyance, after the subjects determined that the threat is bogus, but it could be legitimately distressing (even costly) when they first received the threat. The researchers made no efforts to contain the negative impact of their email, either. The email contains no information about it being a bogus threat. The subjects weren't told in advance that they might be lied to. The subjects had given no consent to being scared. It doesn't seem "good faith" to send mass threatening emails with deliberately misrepresented laws. Remember that the Milgram experiment also involved no illegal actions, and were done in pursuit of knowledge.
- Beldin 5y ago
  The study is a case of deception research. Deception research is a type of research in which the researchers are lying to / hiding information from their subjects - the mails purported to come from individual citizens, and did not mention that this was an academic study. Other fields (e.g., psychology) have long since recognised inherent problems with the ethical aspects of deception research (in a very tiny nutshell: you harm your subjects' agency). Therefore, guidelines and protocols have been established (e.g., by the APA). Roughly, those boil down to: - don't do deception research unless no alternative method exists AND the outcome will have significant value - inform the participants as soon as possible about the deception. In this case, both IRB and researchers failed to recognise this as deception research. That is in itself a serious issue.
MaxBarraclough 5y ago
As it may be of interest to someone, here's the HN discussion of the University of Minnesota Linux kernel bug scandal, from April. https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670

dcow 5y ago

This is exactly what I don't understand about the whole thing. People are arguing that this was unethical but the researchers literally proposed the study to their review board which said "go ahead it's not a human subjects research study and does not need consent and is not by that virtue unethical". Perhaps the review board was wrong, people make mistakes, whatever. But assuming the review board was correct in its analysis of the situation (and who are we really to challenge that unless there's a glaring negligent tier mistake), I have yet to hear an argument that dissects the ethics of this case and clearly lays out what ethical quandary we have on our hands and where the line was crossed. It really seems to me that people are conflating "annoying" with "unethical". Sure, spamming people is annoying. But how is it unethical? I had the same questions about the linux kernal security patches issue. Annoying waste of a few maintainers time, arguably yes for some definition of waste. But unethical? How so and can someone link me to literature detailing the ethical framework that disallows otherwise legal activity in good faith pursuit of knowledge because someone got annoyed in the process? I think that would be an interesting read.

deleted 5y ago
[deleted]
bryan0 5y ago
I think you bring up a good point: that some of the blame going to the researcher really should be directed at the review board itself. It’s their responsibility to catch cases like this. The fact that some people who were included in the study without their consent are upset and angry, means they failed this responsibility. I think what you are missing though, is that just because something passed a review board, that does not make it ethical. Review boards, like everything else, will make mistakes.
jmull 5y ago
The emails purported to come from individuals, but were (1) written in an aggressive, legalistic style, and (2) directed at individuals who were not subject to CCPA and not equipped to deal with regulatory demands of it. This caused significant anxiety on the part of the individuals who received this email, since it implied they would be subject to legal action if they did not provide a sufficient reply. It caused them to take significant action -- e.g., to research the law (that they aren't subject to), to determine if/how they could comply with a CCPA data access request if they had to, to consider retaining legal representation, etc. It came off as some kind of scam or mistake, but one that had to be taken seriously. You could read some of the blog posts from people who received these emails to understand the effect it had on them. It might also help you to read the email they received and imaging receiving the same for a site for a personal blog or one-man shop.
yjftsjthsd-h 5y ago
People aren't upset about it being annoying. People are upset that it read as a threat and resulted in people spending money to hire a lawyer because they thought they were about to get dragged into court.
matkoniecz 5y ago
> Sure, spamming people is annoying. But how is it unethical? Spamming is unacceptable, unwanted, illegal and unethical for quite obvious reasons, namely (1) negative effects do not justify benefits (2) spammer gets benefits at cost of others (3) it is annoying (4) its is not needed. Rare exceptions may apply, it is not one of them.
powersnail 5y ago
Especially in the area of CS/programming, it's so easy for experts to fool the IRB because they can hide behind words like "website", "data", "policy", as if they are dealing exclusively with machines. > who are we really to challenge that We are not obligated to make the same ethical judgement as the IRB. We are all entitled to challenge that. Making bogus legal threats is unethical, when being sued can realistically lead to completely altered life. Yes, it's an annoyance, after the subjects determined that the threat is bogus, but it could be legitimately distressing (even costly) when they first received the threat. The researchers made no efforts to contain the negative impact of their email, either. The email contains no information about it being a bogus threat. The subjects weren't told in advance that they might be lied to. The subjects had given no consent to being scared. It doesn't seem "good faith" to send mass threatening emails with deliberately misrepresented laws. Remember that the Milgram experiment also involved no illegal actions, and were done in pursuit of knowledge.
Beldin 5y ago
The study is a case of deception research. Deception research is a type of research in which the researchers are lying to / hiding information from their subjects - the mails purported to come from individual citizens, and did not mention that this was an academic study. Other fields (e.g., psychology) have long since recognised inherent problems with the ethical aspects of deception research (in a very tiny nutshell: you harm your subjects' agency). Therefore, guidelines and protocols have been established (e.g., by the APA). Roughly, those boil down to: - don't do deception research unless no alternative method exists AND the outcome will have significant value - inform the participants as soon as possible about the deception. In this case, both IRB and researchers failed to recognise this as deception research. That is in itself a serious issue.

MaxBarraclough 5y ago

As it may be of interest to someone, here's the HN discussion of the University of Minnesota Linux kernel bug scandal, from April. https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670