They likely didn't speak to an IRB
.I've complained a number of times about sketchy behavior from researchers in the space of "Bitcoin transaction deanonymization" which were likely to cause harm to people and have reliably gotten a response from CS departments that sounds like "anyone could do this, so there are no ethical considerations".
E.g. for an example in print from CMU, see section 6.2 of http://arxiv.org/abs/1207.7139
I don't consider the argument persuasive:
First, if we look to physical law there is no experiment that couldn't just be conducted by 'anyone'-- That nothing prevents me from stabbing you in the chest just to see what happens doesn't make it ethical.
Much research in this space ends up actually breaking the law-- at least pedantically. For example, in the above citation they talk about the efforts they had to go through to avoid being blocked ("We spent some additional effort making our measurements as difficult to detect as possible", "Perhaps, bypassing the authentication mechanism
and associated CAPTCHA by reusing an authentication cookie could be construed as a “hack.” However, we argue this is nothing more than using a convenient feature that the site operators have willingly offered their visitors.") which demonstrates that their access was beyond their authority, a violation of the CFAA (at least by the standard Weev, who incremented a counter in a URL, was prosecuted under!). Even outside of criminal law, the foreseeable harm you cause to another by investigating them opens you up to a tort even when 'anyone' could have performed the investigation.
Researchers have access to institutional, governmental, and structural support (cheap students) which heighten the potential risk of their work (as well as their potential liability). But even ignoring that, research that causes harm to people is harmful regardless of who does it. Owing to the heightened risk and liability public institutions have infrastructure for harm mitigation which appears to be being bypassed.
It sounds like over a million dollars of public funding went into these recent attacks, and efforts the tor project spent defending those attacks were diverted from being spent on protecting against other ones.
But I don't think any of this is a problem limited to CMU or even University research.
I think Computing professionals are simply falling down on their ordinary professional and ethical obligations to the users of their systems on a regular basis, in part because we're making a mistake of confusing the appropriate adversarial model we use for security analysis for an ethical maxim... and CMU acting as paid outsourced law enforcement due process violation mill is just a symptom of a greater dysfunction along with things like the Facebook emotional manipulation experiment.
Edit: This is speculation on my part based on responses I've seen when asking researchers about their; but I am told that at least on other projects CMU CS does at times seek IRB approval, so my impression that they never do is probably sampling error.