I was part of a human subject research study without my consent
christine.website
christine.website
The nature of legal practices in the USA is such that the answers to "Are you totally in the clear legally?" and "Will you lose significant amounts of money proving in random courts that you are in the clear legally?" are often both yes.
As a result, any researchers who send out thinly veiled legal threats as a "research experiment" are firmly in the wrong ethically, and should be called out by all the people to whom they have issued these veiled threats. Review boards that approved this experiment should be themselves subjected to an audit and potentially dissolved.
So yeah, pretty sure it's that. I almost never get harassed by people who think I'm cis male, the bulk of the harassment came from people who thought I was transmasc.
Probably the furry stuff too, which is honestly sort of terrifying, do these people not know how much infrastructure relies on stressed and overworked furries?
By my estimation it is real, the proprietorship (who I like and appreciate personally, and I think are operating on good faith) of this community has often made noises about how it should be better. It's not, and it should be.
[0] The irony that the whole problem is based on wording that implies a lawsuit is not lost on me.
So what happens when a site receives a CCPA inquiry from an actual person concerned about privacy instead of a researcher under a fake identity? The site still needs to determine if the law applies to them and if so what they must do to satisfy their obligations, so a real inquiry should be as costly and as stressful as a research inquiry.
Does this suggest that privacy laws such as CCPA (and GDPR) which create obligations for sites to deal directly with users on privacy matters are a bad idea? Should such laws instead require users to go through some state agency as an intermediary which would then only contact the site on behalf of the person if the agency determines that the user's data at the site is covered?
They conclude that it's a Princeton research study and throw it in the trash.
This is part of the harm this study has done; because the researchers were not upfront about who they were and what they were doing, they have introduced uncertainty about the CCPA process.
> Should such laws instead require users to go through some state agency as an intermediary which would then only contact the site on behalf of the person if the agency determines that the user's data at the site is covered?
That could be a good idea. It would depend, of course, on that agency being well-staffed and well-trained (both of which are separate from being well-funded, which can help). There's a giant pile of messy problems that can crop up due to negative influences from, say, corporations that want to sell more data.
That said, it would be nice to have an org that can do the minimum legal work necessary to figure out if the claimant has a leg to stand on. That would not only minimize the harm of this sort of ill-advised study, but also make it harder to use threats of legal force to coerce smaller site owners.
You don't get out much, do you?
I've known tons of lawyers that won't look at their watch and tell you the time, unless they get a tenner from it. To be fair, they are used to folks trying to extract highly valuable services from them, for free, so it's sort of a defense mechanism.
I have (and have had) many friends that are lawyers. A few will help me out with quick consults for free. I even have one chap that has gone beyond that, and I'm grateful. I'm quite aware of the value of their services, and always offer (and am willing) to pay; even if they decline to invoice me.
This creates even more incentives to have a paywall--one, it keeps people from bugging you for free legal advice that can bite them and you in the ass later, and two, it ensures that the people who do get advice from you have followed your procedures for setting up an account with you.
The CCPA applies to for-profit businesses that do business in California and meet any of the following:
Have a gross annual revenue of over $25 million; Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or Derive 50% or more of their annual revenue from selling California residents’ personal information.
It's not a very hard decision to make, the text is pretty clear. Especially if literally the fifth word of it - "for profit" - makes the further reading unnecessary.
> any of the following
OK
> Buy, receive, or sell the personal information of 50,000 or more California residents,
"receive" and "50,000" seem like a low bar if the definition of "personal" includes anything caught in typical web logging.
You see? It's not clear cut from reading the thing you just said was very clear and it's hard to be 100% sure it doesn't apply.
"For profit" and "business" and similarly wide nets. Business can include individual sole traders and "profit" could be "accepting donations" or "running AdWords"
"Before the courts and on the high seas, we are in God's hands" isn't a proverb for no reason, and it's valid pretty much anywhere.
I don't think this is mocking (excluding the few obligatory spammers). It's a known fact that if you have a public e-mail, you will receive a lot of spam and threats. Also, an actual request could've very well taken a similar form - would you have been okay with this if they actually requested their data?
I'm not saying these actions were great. Sending out these mails was definitely not the nice thing to do. And yes, the threat of a lawsuit can be very scary. But, unfortunately, this is something you must be able to handle as a webmaster. It's also not great or nice that people try to log into my ssh server all the time, but this is just something you get when you have an ssh server on the internet. Same thing.
Based on the way the system works, especially the civil side, it's sometimes impossible to even answer this question.
If a Russian were able to file suit in California, wouldn't the defendant have a chance early on to ask a judge to dismiss it?
I'm trying to sound naive because I want some gory details.
a particularly foolish or over-confident defendent might represent themselves, but otherwise, I would not budget less than $2000-3000 to hire a lawyer to draft and file a response to statement of claim and show up in court to attempt to get it dismissed before it gets started.
Foolish, overconfident, or just "never have had $3000 in one place and time in my entire life."
For most people, if you pull them into the spot light, you will quickly shut them up. That does not make their legal threats baseless.
I think the core issue here is not being able to distinguish the two cases easily.
Yes, it's a bad thing to do, it's pretty obvious that it'll scare the bejesus out of some people and even worse, have some chilling effect.
On the other hand the pendulum on ethical boards has gone waaaay in the other direction to the point where a lot of very useful research doesn't get done. The most vivid example being that we don't have human challenge trials with Covid, even now when it's crystal clear that actual risks to young healthy people are close to zero. Another example: https://slatestarcodex.com/2017/08/29/my-irb-nightmare/
So, what's my opinion? Well, an "opinion" would require me to chose one of those two perfectly valid points of view. But if I had to, I'd say the travesty that is "ethics boards" has become a bureaucracy so rotten it doesn't even perform its original function of stopping vaguely unethical research, and has instead gone completely the way of paper pushing. While, of course, still drawing a salary from making sure tens of thousands of people are dying needlessly.
FWIW, the author of the essay at the link you provided seems deeply ignorant of why IRBs exist. "Mere resident doctors weren’t allowed to do studies on their own. They would probably screw up and start building concentration camps or something. " really?
Human challenge trials. Hundreds of thousands of dead later, and we're still using statistics to answer questions like "is Omicron ignoring immunity", instead of answering them definitely in a few days with an absolute minimum of risk. I'd volunteer for that, btw, so would literally millions. But it's just not inside the Overton window. This isn't wisdom or caution. It's plain cowardice.
How is asking someone questions a legal threat?
From the email:
>My questions are about your process for when I do submit a request.
It's really easy to read this as "I am going to be submitting a request."
>I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.
So I'd say there is some legal threat here.
Random blogger who's not a business does not have any connection to this. It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.
>These FAQs provide general consumer information about the CCPA and how you can exercise your rights under the CCPA. They are not legal advice, regulatory guidance, or an opinion of the Attorney General. We will update this information periodically.
I understand that someone can do cursory research and be overly confident in their understanding of a law that spans 46 pages. I hope you can understand that people can be underconfident in their understanding of a law that spans 46 pages, is bound by the entirety of a state’s statutes and case law, and feel overwhelmed by someone asking for a response on their compliance with said law. Regardless of what their interpretation of the original email should or shouldn’t be.
>It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.
Comparing a reasonable fear that one may not be in compliance with a complex legal system to something absurd does not invalidate that fear.
And, as someone also pointed out in that thread, being on Hackernews and having IP logging may be enough to trigger that requirement.
Further, with the absolute shitshow that is the US court system, if someone brings a frivolous suit you're looking at thousands of dollars in legal fees, because you're going to need a lawyer (or previous experience in law) to properly explain to the judge why this suit is utterly ridiculous. And there's no guarantee if you'll get compensated for that, even if you file counter-suit--and even if you do get compensation, it's likely going to happen several years later, after the guy who tried to sue you does everything in his power to avoid paying up, because he knows you're eventually going to run out of money.
This reads as a thinly vieled command to respond, not a mere request, citing legal code and (incorrectly) asserting it's applicability as a basis for the authority to give such a command, with the implication being the possibility of legal action if the demanded response is not provided.
It isn't. Being paranoid about lawsuits against some personal blog shows a lack of legal sophistication and this type of sensationalism promotes an irrational fear of being somehow financially vulnerable to almost any legal predation. That's simply not how the US system works. There have to be actual damages for a court case to go forward to the worst-case expensive end (depending on what most people consider "crippling"). Courts aren't pernicious and are very sensitive to anyone attempting to waste court time on exploitation (except in Texas courts supporting patent trolling, obv).
Any judge would have this resolved by giving the parties a 15 minute sidebar to come to an actionable resolution or sanction both sides in some motivating manner. The US legal system has a vested interest in not taking everything to a long drawn out fight, due to limited court time, even if it is presented differently in media (or the comments in these threads, which are laughable).
And yet, many people reacted just like this writer. Perhaps, given that the reaction was widespread, it could and should have been anticipated, instead of expecting every person to have your evident legal knowledge.
Nope. A legal threat is a statement by a party that it intends to take legal action on another party. GL with whatever.
Asking questions is an implied threat often enough that a question can indeed effectively be a threat.
Edit: It's not that hard to see that there are potentially some social problems here e.g. "the message is easily construed as a legal threat" or "the message was mass mailed in a spam-like nature". However, my comment is in response to the title of the blog post which implies that the webmaster believes there's an ethical problem that this "experiment" was even run in the first place. For the purpose of this thread, assume the email was worded perfectly and the university was very thoughtful and deliberate in who they contacted. I'm interested in discussing the ethics behind how a perfectly legal and reasonable thing can in one case be ethical and another case be unethical simply by virtue of the context in which the action was carried out.
When you say "If I as an ordinary citizen..." you essentially make this point. They are not an ordinary citizen making a data request, they are researcher who thinks it's ok to lie to collect data perhaps because they think people would give different responses when faced with a genuine data subject access request than when talking to a known researcher.
Put another way, is “right not to be observed (in public)” something we protect? If I write down my observations at a park as I watch humans interact is that unethical simply because I didn’t bring a megaphone and announce my intent? I think the problem is that despite what’s in vogue, I don’t understand how acting in a way that is not illegal even if it impacts somebody else and then observing the results is by default (unquestionably) unethical. Why is that bad? Are there some “case experiments” the research community looks to where humans where harmed that has shaped our modern understanding?
Secondly, you say you don't see who was harmed - the person who posted the original blog post was clearly harmed. She had a panic attack she was so stressed about the legal implications of the implied threat. The fact that someone else may perhaps have not found receiving this email stressful doesn't really matter - that was the effect on her and it was harmful on its face. Remember that people have different life circumstances which affect things like this - someone who was short of money may see a legal threat with implied financial consequences such as this as an existential threat.
Secondly the people who paid money for legal advice were very clearly also harmed. Their harm has a specific monetary value.
Your "put another way" extrapolation is just a complete straw man. Noone here other than you is talking about observing people in the park. This is about a research study which sent an email which some people saw as scammy or threatening in order to gather data about how small websites handle data subject access requests.
I don’t find this type of benign use of anonymity/misdirection to be an outright lie of the unethical kind.
> She had a panic attack she was so stressed about the legal implications of the implied threat.
What?! When/where? She said the request stressed her out… come on. If webmasters have panic attacks when encountering spam then perhaps we should outlaw spam (I’d support this).
> Your "put another way" extrapolation is just a complete straw man. Noone here other than you is talking about observing people in the park.
Please… I 100% do not understand the reason why this experiment should be considered unethical and I’m trying to explain what I see as parallels. It’s not a straw man and I’m not the only one.. read down thread.
What I’m looking for is an explanation for why you think that legal normal behavior (even behavior that causes stress) is allowable but legal normal behavior for science is not allowed.
I also believe context motive and intent matter, for the record (which I why I believe censorship imposes a net negative on society, example: comedians are “allowed” to use offensive language). I simply find the intent here to be arguably ethical depending on what your goal is for society.
For example, if the goal is to never have any individual experience 1 ounce more stress than is absolutely required throughout their life, then this behavior is unethical arguably whether it’s an experiment or not but definitely in the case of the experiment because it’s unnecessary. On the other hand, if your goal as a society is to make sure people’s data privacy rights are protected, it seems strictly ethical to conduct such an exercise to raise awareness and document how well institutions comply with the law.
You can take framework of sales or management where lie is just being smart, but it is not applicable here.
https://research.oregonstate.edu/irb/research-involving-dece...
quotes:
a) Psychologists do not conduct a study involving deception unless they have determined that the use of deceptive techniques is justified by the study's significant prospective scientific, educational or applied value and that effective nondeceptive alternative procedures are not feasible.
b) Psychologists do not deceive prospective participants about research that is reasonably expected to cause physical pain or severe emotional distress.
c) Psychologists explain any deception that is an integral feature of the design and conduct of an experiment to participants as early as is feasible, preferably at the conclusion of their participation, but no later than at the conclusion of the data collection, and permit participants to withdraw their data.
a) -- Hell no
b) -- I can give the benefit of the doubt that they didn't foresee small website owners getting panic attacks from this threat, but their non-empathetic tone in that apology write up is appalling
c) -- Hell no
The more I think about this the more I'm furious that a supposedly top tier institution like Princeton approved all of this and the "researchers" seems to have 0 fucks to give on ethical experiment design.
I agree with it, and I feel it's my duty to be well-informed on this. So I thought I'd ask you.
Everything I can find is only applicable for medical research, and not social research.
How do you explain research on placebos then?
I think the real ethical issue is actually that the email reads like it's coming from a lawyer. It's weirdly formal and cites that a response is legally required within 45 days. As other comments have mentioned, this has the real world consequence of heavy stress where most folks would (and should) lawyer up. This is the biggest ethical issue, since the study is costing its participants nontrivial money, and without consent.
Which the IRB missed because they didn't understand that, to ask questions about a website's policy, you must get an answer from a human.
In short, if lawyers asking people to follow laws are an ethical problem, then maybe we need to address that and not get enraged about a totally legal request for information about a website’s CCPA process.
> As part of the study, we are asking public websites about their processes for responding to GDPR and CCPA data access requests. We attempt to identify a website's correct email address for data access requests through an automated system.
You cannot "ask a website" and a website doesn't have a "correct email address". Given the targeted nature of the emails, I have trouble believing that these phrases were written in good faith by someone who understands that they are emailing the webmaster for a website, and expect an answer within a reasonable timeframe.
----------------------------------------
The police does that quite often to catch criminals. Sometimes they also target innocent people, is that ethical?
People on HN don't usually lie, I hope, but most "misrepresent" themselves using anonymous accounts, sometimes claiming to be more than they actually are (I know, shocking).
Emails you receive are more likely to be scams than not. If you're like the author and freaks out at legally-sounding emails (or phone calls, discussion forum comments etc) received from random people, you're going to be a really stressed, anxious person your whole life.
This should tell you something about your police, not about ethics.
These rules are not as established or strict for other professions.
Your country should crackdown on police behaviour.
Huh? Are we reading the same article? Because what I see is this:
> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia.
envoiemail.fr
novatormail.ru
potomacmail.com
princetondmarcstudy.org
princetonprivacystudy.org
yosemitemail.com
(The rest isn't a response to seanhunter's comment, but a comment on the discussion in general)
If we take a step back from the discussion; I'd have to say that this is in a gray area that kind of ends up being mostly in the "ok" region - or possibly in the "probably not worth giving a shit about" region. There is a simple litmus test you can make: how would people have reacted if this had been limited to large corporations you do not like? The response would have been very different.
Let us at least be honest enough to admit that to ourselves.
That this is part of academic research doesn't really change anything.
It also needs to be said that people tend to be too uptight about perceived small infringements on what they see as their inalienable rights. If we are going to label subjects of what is at best described as akin to consumer research as victims we are watering out the term to the point where every person who has accessed the web is essentially a victim.
Hence the victim blaming someone tried to call out in a comment, is needless douchebaggery and drama. There are real victims of real transgressions and this is belittling.
People need to take themselves a bit less seriously. You are part of human subject research studies every time you use the web. And yet you come back for more every day.
Half of you probably contribute code and time to an industry that turns human behavior into numbers that the is translated into cash. And proudly so. Hypocrisy just makes us all look like douchebags.
Those large corporations we do not like have lawyers on retainer specifically to deal with this situation (probably by suing the pants off of whoever sent the email).
It is acceptable to react differently when the victim is defenseless. That is why we would have a different reaction to a large corporation being struck by this, versus an individual who may not be able to afford legal counsel (and who certainly can't afford to pay legal counsel when the threat turns out to be baseless).
Interesting how you also make the tortured argument that privacy laws create victims.
Stress aside, part of the problem is the very real possibility of a subject wasting money on hiring a lawyer.
Or even if there is a legal threat, do you take it seriously unless you know the source? People regularly get calls saying they are in violation of tax law and must pay.
I've received legit legal threats over email from very serious people. I'm certain they would have escalated to more "official" channels if the situation wasn't resolved to their satisfaction (if you're curious, it was a contractor billing issue that was being ignored by my HOA. I was caught in the crossfire).
The fact that random scammers are calling folks claiming they're violating tax law isn't a justification for researchers to engage in similar acts. Do you agree?
This is an interesting point you bring up, which merits diving into a bit further.
I think it's precisely because CCPA is so new that this experiment is more unethical than if they were just calling up people saying "you owe money to the IRS, send me gift cards". The IRS spends a ton of money every year telling people that these calls are scams; but Christine or the operator of freeradical.zone likely had no such public service announcements from the State of California. On the other hand, they probably did hear news items about this new data privacy law that California passed, and thought the emails were from actual individuals.
An email purportedly from an individual is not the same as a contract or terms of service issued by a corporation from which I am getting a service. If I, as an individual, were to send you an email asking, for example, if you are paying all the taxes you legally owe, am I just giving you "a reminder of existing laws"? Or are you going to start wondering who I am and why I am asking and wonder if something is going on behind the scenes?
> People regularly get calls saying they are in violation of tax law and must pay.
Yes, that's true. And people who make such calls are regularly considered unethical scammers who do not deserve any consideration. So why should we treat researchers who send similar emails any differently?
However I’m dubious that there was even a threat of a lawyer. The request simply asked for a prompt response as required by law. That’s quite a stones throw from “I’ll sue you and take you for everything you own if you don’t reply”.
BTW, if you are actually being threatened by a lawyer then they send certified mail or show up at your door. And in terms of the webmaster almost contacting one, no lawyer is going to take your money before talking for 5-15 min to even figure out what the issue is. And even if you paid for 30 min of a lawyer's time, then they would promptly inform you that you can ignore such requests since you’re not a business.
Again, what’s the ethical problem here?
The usual legal standard is whether a reasonable person could interpret the email as potentially threatening legal action.
> The request simply asked for a prompt response as required by law.
And such a request reads exactly like something written by a lawyer. Lawyers don't usually explicitly threaten a lawsuit in their first communication. They write something very similar to the email the researchers sent. I can easily see how a reasonable person could interpret those emails as potentially threatening a lawsuit if the request were not complied with, or if the sender did not think the response was sufficient.
I think you are expected random people operating websites to share your knowledge of the legal system. I know you're right, but most people who operate a website likely don't, and these emails make them spend unnecessary time, money figuring that out; not to mention mental distress.
I find this not dissimilar from a standard "I'm in prison, but know where a million dollars are buried, send me money" email scam; and if researchers were sending those around as tests to see who was gullible, they would be promptly end up on several blocklists. I don't see how this is different; and therein lies the ethical problem. Quite a few people seem to agree.
But if you're hosting a website, you should have that knowledge. I can't run a business and expect not to be asked about taxes, either. Honestly, as an EU citizen, if I wasn't aware of the GDPR in regards to my websites, I'd have bigger problems than some research study.
That being said, I fully agree that this mail wasn't nice and I can absolutely understand why people became nervous. But things like this are expected and the issue seems exaggerated in that light. Quite a few people seem to agree to this, too ;-)
Sure, but if you haven't lawyered up by that point you're going to have a bad time. Doubly so if you aren't familiar with the amount of info-gathering and record-keeping involved in winning a suit--if you don't know what needs to be written down for when you do have to call a lawyer, waiting until the last second can easily shoot your entire case in the foot.
And if you do lawyer up, you're spending massive amounts of money--money that some people just don't have.
I consider myself a normal citizen and I receive "legal" and "illegal" threats regularly, the very vast majority being scam attempts of course.
Recently e.g. scammers keep telling me that my website's imprint is not up to code[0], either threatening to sue or outright claiming they are in fact a law firm and want a cease-and-desist and compensation for their law work, of course.
I also noticed how the Indian and Pakistani "security researcher" scammers[1] telling me about "major vulnerabilities" in my website - aka missing DMARC/DKIM headers (which are not even missing) - also started telling me how one can be fined under the GDPR for "bad security".
As for the "illegal" threats... I, according to scammers at least, watch a lot of "bad" porn[2] and they know about it because they hacked me, and recorded me on my own webcam. But if I paid them some BTC/monero/whatevercoin ("Follow this link to learn how you can easily buy <coin>"), they wouldn't rat me out to my family/friends or the police. I guess I will just have to pay them, but then again I have a HUGE payday coming from that nice Nigerian prince and another from that fantastic Singaporean economic attaché... once I send them some bucks to cover processing fees, of course[3].
All joking aside tho, I get how some people may be scared by things like the CCPA emails, or the kind of emails I mentioned (if those didn't work enough times, scammers would have stopped by now). When I just read that particular email in the article, I didn't see a legal threat, but that's just me of course. Other people might read it differently, and I cannot fault them for that. I remember being concerned myself the first time one of those "imprint" scam emails made it through the spam filter.
[0] In Germany, commercial websites are legally required to have an imprint, and everybody can basically sue you if you mess that up, that much is true. It's also true that courts regularly rule that if you profit even from a private website, e.g. by displaying ads, then your website is in fact commercial and requires that imprint.
https://www.bmjv.de/DE/Verbraucherportal/DigitalesTelekommun...
[1] This isn't to denigrate all Indian or Pakistani people, of course. It's just that the "security researcher" scammers I encountered thus far all operated from these two nations.
[2] Ranging from "homosexual" to "child". I wouldn't consider adult gay porn "bad" myself at all (just not interesting to me), that's their definition. It's quite interesting to me to see how they try to phish for closeted gay people more often than for pedophiles, at least anecdotally from what makes it to my spam folder. My guess is that the number of people who actually watch gay porn and are ashamed of it largely exceeds the number of people watching child abuse porn.
[3] I received those "huge money - pay fee" scam emails more than 20 years ago, and I still receive them today. Cannot argue with success, I guess?
Here’s an example. Your doctor calls to talk to you about you sexual health. You discuss at length about all the issues you’ve been having lately, and you break into tears when your doctor tells you it’s permanent. At the end of the call, your doctor explains that he/she was joking, and that you just have low vitamin levels. You find your anecdotal story in the front page of a medical journal the next year.
You can imagine similar situations where someone calls to tell you have cancer and observes for a month. Or that your significant other died in a car crash this morning. Or if someone claims they are suing you for a large amount of money. In all those cases, the person contacted may have a mental breakdown or worse.
In regards to lying, I find such use of misdirection to be arguable ethical because 1) pseudo identities are entirely normal and expected on the internet so encountering one should not cause anybody undue stress, 2) it is not fraud, so it’s legal and does not cause harm, 3) because the experiment would not be possible without the appearance that the request came from an individual and not a research team, and 4) because if submitted to a corporation none of this discussion would even be happening. And 5) because California law requires organizations/websites to provide this information (in cases the law outlines) when it is requested which to me indicates these type of requests are supported/good/normal.
The text says: “this is not a CCPA request I just have some questions about the logistics if I were to file one” and includes a reminder that there’s possibly a legal obligation to provide these details. It’s not asking for personal details or information about a person.
For the deception, you have to weigh the pros and cons. The harm isn’t very high but 1) it undermines public trust of research and 2) includes the participant in a study they did not consent for. The participant is not getting paid for their time and is in fact getting indirectly threatened/coerced with legal action.
The IRB board of course makes all these calls. But it’s not “obvious” that the research is ethical. For example, research can be unethical _with participant consent_ if participants are offered too much money, because people will do _very_ bad things for large sums of money, so it’s basically coercion. In this case, there is an implication of legal action if the participant does not participate and they may not have an option to withhold their participation.
Consider the alternative: “Hi, I am a researcher from Princeton. For your time answering these 4 questions, you will receive $50 and an opportunity to advance our understanding of ____.”
The ethical problem is that you can't do research on people without their consent. The fact that the researchers knew they were doing research, not actually asking a question as an ordinary user of the website, makes a difference. Intent matters.
But can you do research on a business without the businesses consent? Or do I need a businesses consent before sending out identical resumes except one has a stereotypical minority name to attempt to judge discrimination?
Because websites aren’t people. Websites are businesses. A lot don’t make money or fail. They may have a small staff managing them. They may not be ‘for profit’ but they are still businesses.
That’s my issue with the complaints about the study. They blow up and claim to be unwitting participants of human subject research, drawing mental parallels with the Tuskegee experiment when it’s a closer parallel to research performed against companies who were never notified like when researchers sent out identical resumes except for their names.
The researcher definitely could have worded the email better so it didn’t come across as an ominous legal threat. There are valid criticisms against the research. But claiming to be an unwitting subject of a human research experiment is incredibly misleading.
But websites cannot answer questions.
If your study is simply "how do the servers of various websites respond to my HTTP requests", that doesn't require informed consent, because it's not involving humans.
Once your study moves into the realm of "how do the operators of websites respond to me legal requests", that requires informed consent, because website operators are humans.
It's really very, very simple. If you need responses from human beings, that's human subjects research, and it requires informed consent and greater scrutiny from the IRB.
No, some websites are tools used by businesses to help achieve their business goals.
Is the website on which we are having this conversation a business?
Websites are one or more servers that respond to the HTTP and/or HTTPS protocols with something a web browser can show. They may have a business involved. They do not necessarily have one involved.
They may simply be a goofy joke, such as https://zombo.com or http://www.abevigoda.com.
They may be a personal site, such as, well, https://christine.website. Which is a blog and a list of projects done by one person.
They may even be a front-end for a dynamic application but still not a business - I run a small Mastodon instance and it's just "a place for me and my friends to talk", not "a business"; having it grow to the size where I'd have to deal with stuff like the CCPA or the GDPR is something I absolutely do not want.
The experiment aspect is only a problem in as much as it being an experiment caused the researchers to do something they wouldn't normally have done, or been okay doing.
I hope it's obvious why that is a poor ethical standard for what constitutes acceptable research practice.
It is unacceptable to do something to a person so you can study the way they behave, without first obtaining their consent to participate in such a study.
You can observe how people behave when they are subjected to the same stimulus naturally; you can ask them if it’s okay to subject them to a stimulus to see how they react; but you can’t just do something to them and write down what happens.
"Someone can be sued, therefore a researcher making vague legal threats to see if people waste money on lawyers is ethical."
"Someone can get syphilis and not receive treatment, therefore infecting people with syphilis and denying treatment is ethical."
(By the way, 2 out of the 3 are real studies. The middle one is this one. The third one is the Tuskegee Syphilis Study.)
As an absurd example of something that is highly unethical, but perfectly legal: research into whether certain images or colors on protest signs are likely to elicit a response. You choose military funerals as the protest site. In the US the right to protest at a funeral has been confirmed by the courts. This would still be an unethical action.
Many companies, including ones that I’ve worked for, that received a message like this would take it VERY seriously and expend some expensive resources (lawyers and programmers) to discover that ccpa does not apply and that they aren’t required to respond.
A more ethical way to gather this data would have been to be honest about identity and purpose, Notify the recipient that their response would be anonymized and never used against them, and to inform them that a response is not required.
The bar is very high, and with good reason: you're experimenting on humans. One of the foremost requirements is the notion of informed consent: you can't experiment on people who don't know or understand, or who didn't give you permission.
This experiment very clearly involved human subjects and very clearly violated informed consent. If the student involved did not realize this, certainly his advisor did or he'd have to be considered incompetent. And if the experiment was indeed placed before the IRB and was given an exemption, as was implied, then Princeton's IRB made a glaring and incredible error.
Had this student simply sent out a questionnaire from his Princeton email address, rather than conduct an experiment, he might have reasonably obtained IRB exemption or permission. But as I understand it, he (1) hid behind aliases so they did not know they were being experimented on, and (2) threatened legal deadlines in responding to his questions. There is no way this was ethical by IRB standards.
One thing that really bothers me is that people are attacking the blogger for using the word "consent", suggesting it's hyperbole in the sense of date rape or whatnot. This is terrible: "consent" is the standard and correct term used in human subjects research, and is a factual description of exactly what occurred.
> The study aims to understand how websites would respond to real users, while accommodating websites that may have less capacity to respond.
That is, they're not interested in what the website's policies are via questionnaires. They're prodding them under false pretenses to see what would happen. This is definitely human subjects research.
Are you sure about this? Didn't these requests get sent to entities that didn't even fall under the categories in the statutes? Meaning they would in fact not have been normally dealing with these kinds of requests on a regular basis (if at all)?
It's that they:
a) did not get the people's informed consent to participate in human subjects research,
b) misrepresented themselves as being potentially-litigious parties interested in the handling of their own data under the CCPA, who further were misrepresenting the degree to which the CCPA applied to them, and
c) misled their IRB into believing this was not human subjects research, so that they did not get stopped from doing (a). (That, or the IRB itself is culpable for this aspect of the unethical behavior; I haven't seen specific information one way or the other.)
And to be clear about these requirements:
You may recall stories about psychological experiments during the Cold War, like the Milgram Experiments (where the participants were told to administer electric shocks to people), and the Stanford Prison Experiment (where they assigned a bunch of undergrads to be prisoners and guards). Due to wildly unethical experiments like those, the scientific institutions of our country developed the system of Institutional Review Boards (the aforementioned IRB), which have fairly clear standards that they hold researchers to (though, granted, those standards will naturally vary somewhat from institution to institution).
One of the primary purposes of IRBs is to ensure that all human scientific research participants give informed consent to participate in the study. That means, among other things, they have to be informed of the risks of the study—and those risks, by design, must include the mental distress that can be caused by the experiment. (That, after all, was the primary negative outcome of the Milgram Experiments and the Stanford Prison Experiment: they caused serious psychological distress.)
I don't work at Princeton, so I can't speak to the specifics of how they consider such things, but I do work for the psychology department of a university with a strong tradition of research—in fact, I built the web-based system the IRB here now uses to manage their workflow, so I've worked closely with them for over a decade now—and I can tell you with some certainty that letters like these would not in any way be considered acceptable without a signed informed consent form. They are very clearly designed to evoke an emotional response in the recipients—a fear response, specifically—and that absolutely requires the full scrutiny of the IRB.
"Second, our team is prioritizing a possible one-time follow-up email to recipients, identifying the academic study and recommending that they disregard the prior email. If that is feasible, and if experts in the email operator community agree with the proposal, we will send the follow-up emails as expeditiously as possible."
Did this study send automated emails in such volume that they can't work out how to send an apology without triggering spam protections? Or did they send email and not record it? What is he saying here?
"We screwed up by spamming a lot of people. We like to apologize and fix our mistake. We currently have two options:
1. apologize by sending a second email. This second email will contain an apology and the phrase 'disregard the prior email'
2. apologize by some other method (e.g. this website)
Option #1 pro: reaches everyone we're previously spammed
Option #1 con: we will be spamming people a second time. If the first round of spamming puts us in legal/ethical jeopardy, then this second round of spamming could make it worst
We have not performed Option #1 yet. We do not know whether we should perform Option #1 or not. We are taking the temperature of the 'email operator community' to see whether we should performed Option #1 or not. If Option #1 gets the green-light then we'll do it ASAP."
If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously?
I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.
Which even if it is completely nonsensical and has no basis in law, could cost thousands of dollars to hire a lawyer and file a response to a statement of claim.
If you have ever seen the experiences of people who have been sued by sovereign citizens/freeman-on-the-land/"this is an admiralty flag" people, it would help to better understand the context I'm viewing it in.
Recommend you don’t spend “ thousands of dollars to hire a lawyer and file a response” on something that you find very slightly worrisome.
Again, I think you, too, are being suckered into spam. Plenty of people fall for spam scams. It is nothing to be ashamed of. Think of all the people who fall for the fake IRS phone calls.
But learn from it: keep your guard up when you get emails, phone calls, or text messages from strangers.
Anything legally binding in the US will come to you via snail mail.
That statement is false. Please don’t provide incorrect legal information in this forum.
It doesn't need to be legally binding to be worrisome. Imagine I told you "I'm going to sue you. You don't need to do anything until you get the formal notice" and you found the statement credible. Would you go on with your life as normal, or would you be stressed and hire counsel if affordable?
yes it will, but a really determined person with an axe to grind will very often make known their intentions well in advance of that.
and no, it won't always come by snail mail, DMCA notices and similar with actual legal threats will arrive regularly via SMTP.
I call a lawyer any time I have a legal question for which I am not confident about the answer. If it’s not a real problem, a lawyer will be able to answer it a fraction of an hour’s worth of billable time.
Except that they will probably won't know the answer immediately an need more time than that: https://twitter.com/DanielleVEsq/status/1472105731474137094
Responding to spam and then feeling like you've been the victim of some injustice that the spam didn't say "hey, I'm not really spam, I'm grad-student flavored spam" is quite a take.
Here's a tip for anyone not running a business: If your response is legally required, it'll come in the physical mail. Don't take legal advice from spam, me, or your sysadmin.
Given that they were targeted here, this person has a public mail address, so it's very likely they receive similar spam. Given that and the observation that they seem to be stressed by spam, this seems like a plausible assumption.
[0] At least when we assume good faith.
Yes but you still need to be judicious and critical.
It would have gotten my response... probably an hour of my time explaining how our policies work and how, yes, we would comply with their request even if the laws don't technically protect them. There isn't really a prefilled template you can respond to questions like this (if you actually care about responding inquiries like this) so I would have genuinely spent time thinking about the questions and giving them more than a yes and no.
Seriously, just a few lines in this mail raises all sorts of flags.
> I have a few questions about your process for responding to California Consumer Privacy Act (CCPA) data access requests
This is the worrying part.
If the first sentence didn't already raise your suspicion, the second one definitely should, and put it over the threshold for spam/scam.
1. does not disclose that this is a research survey;
2. does not inform the recipient that they can decline to participate without any adverse consequence (as they state in their study FAQ), instead doing entirely the opposite - ending the mail with an assertion (untrue for most recipients) that they have a legal duty to respond;
3. lies about the origin of the email, inventing a fake persona;
4. lies about what the responses will be used for.
Yeah this is the big one for me. Coming from the context of medical research it is shocking to me how many commenters think this is okay. If this happened to be a disguised medical research survey the ethics board would never have let this past. And if they did it would bring down some serious bureaucracy on their heads.
I guess software and law just think they can test whatever they want and get away with it. Who cares if a few people end up emotionally scarred?
5. which caused people harm, in the form of time, stress, and in apparently a fair number of cases, money spent consulting a lawyer in the belief that they were about to be sued.
YES! I know you intended this as an insult, but it is actually one of the most insightful comments in the thread. An IRB is not supposed to be an ethical board. They have a much more limited scope of overseeing human subject research.
> How did they conclude this doesn't count as "human subjects research" given the expectation is to measure a human response to an email (framed as from a person)?
Because there's a precise definition of "human subject research" which is actually a lot more limited than many people think.
We've had two different cases now where that disconnect has led to studies which cause stress and other harm to human subjects, because the study was classified as "not human subject research" despite directly involving humans at every step of the way. Perhaps that definition needs to be rewritten.
Wouldn't that cover most blogs that run ads?
If you don't bother to check whether the things you're saying are true, you burden everyone else with the effort of correcting you.
https://leginfo.legislature.ca.gov/faces/codes_displaySectio...
> (v) (1) “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
> (A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
> (aj) “Unique identifier” or “Unique personal identifier” means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, “family” means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
I wouldn't be surprised if most boilerplate CCPA request templates out there included the same wording. It's like when I send a FOIA request and put at the bottom, "this law says you are supposed to respond in X days," everybody knows that's the law already its just there to sound a bit more formal and like I actually care about the outcome. Obviously there is not going to be time or money for the vast majority of such technical violations to go to court. Would a study not be able to send out FOIA requests and study how long the responses took after including that verbiage because it's a "legal threat"?
It reads to me like the first message as a toehold in the door, from somebody who intends to litigate frivolously against the person they're sending it to.
Every lawsuit threat, including "I'm suing your ass next Tuesday", is hypothetical.
It takes being used to communication that randomly quotes the law, or extreme lack of social skills to not consider randomly quoting the law a threat. Individuals don't often randomly quote the law for the funsies.
We could, of course, argue all day whether they should have just immediately dismissed it as junk email, but coming from what looks like junk email just lowers the expected threat.
State funded research groups sending dishonest messages using intimidating references to the law to induce a response was presumably outside of the threat model.
I am quite perplexed at the people who panicked over this. It would probably rank 4th in the scariest things I have received today and seems on par with a call from the tax man claiming you owe them money and need to send them iTunes gift cards.
99 out of 100 people are going to safely avoid it. 1 in 100 fall in and get severely injured.
I'm still at fault even though the injury only happens rarely. And a "rare" effect can harm a lot of people when you scale up the exposure far enough.
Those scam emails also cost a lot of people time and we rightfully outlaw them. In this case, it didn't fit the modality of the common scam messages, it looks a lot more like a professional litigant trying to set the recipient up for a lawsuit.
Experiments like these are training well-meaning people to ignore real privacy requests.
By coercing the participants into study the university has in fact waived own negotiation rights. The university should compensate the participants for the actual work done, at the a fair market rate, and reimburse the legal fees.
(I am not a laywer).
I am not at all surprised that it was not subject to IRB review, but only because I've had a bit of involvement in the IRB process before and know that the specific legal mandates that drive IRBs (45 CFR 46) have a surprisingly narrow definition of human subject research that is driven primarily towards medical interventions, so generally speaking any research that consists of just asking questions and then anonymizing the results for reporting gets waved past IRBs (45 CFR 46.104). You might disagree with the situation (there's plenty of reasons to) but it's the law of the land. IRBs were developed pretty specifically in response to a spate of incidents in the mid-century, but especially the Tuskegee trials, involving non-consensual drug and toxin trials. The IRB process is directly designed to address these kinds of medical research, and so IRBs I've dealt with are not even very interested in looking at proposals coming from departments other than life sciences. The idea that IRBs are a general-purpose ethics review seems to be a pretty recent idea and it's not something the IRBs themselves are that into, at least from my experience hearing professors gripe about having to go through a stack of pre-reviews for information assurance studies on the off chance they qualify as human subject research.
On the other hand, though, I operate several websites for small organizations, admittedly in a politics and public policy-adjacent space, and receive emails of this type as a matter of course. I'd be surprised if there are many people operating websites that get a meaningful amount of traffic that don't get an email of this type from time to time. It's sort of background noise if you're doing anything that's of much public interest. In some of these situations I benefit from having retained legal counsel that probably wouldn't even bother to bill for this kind of thing, but it would still be a rare situation that I referred such an email to counsel unless it was something about a more obscure corner of city political financing regulations, which I have gotten once before.
The "legal threat" here honestly doesn't read to me as much of a threat. Part of this is because in my hobby work I write emails very much like this one on a weekly basis... mostly citing FOIA or similar state sunshine/open records/open meetings laws. Many guides on transparency laws coming from this same community clearly advocate a similar sentence citing the response deadline, and I wouldn't be surprised if this researcher copied and pasted that from such a "consumer rights" guide. It's considered a best practice to state the deadline and citation with this kind of request. There are basically two reasons for this: first, some people, especially smaller organizations, may be totally unaware of the deadline and you will be telling them about it for the first time. They may not believe you on it if you don't provide some sort of backing. The second is that there's a perception (from my experience I'm skeptical this is frequently true but I'm sure it is occasionally) that especially federal offices may be aware of the deadline but feel comfortable ignoring it if they don't think the requester knows. So providing the deadline and citation is sort of a "savvy customer" indication that encourages them to at least issue an extension letter on time (even then it's very common, even before COVID but especially now, for federal agencies to run past the deadline without any response. Oddly, state and local agencies are usually much better about this).
Another part of why I have a hard time taking it as a threat is because it is the first in a rather long chain of actions that would lead to legal action. It does indicate that the requester is aware of the law but it's quite a few steps from the requester's intent to file a lawsuit. Most people that include a line like that never even bother to follow up with a nag when the deadline passes. What was in the email is basically a "I copied and pasted this from an online howto" level of effort, and there's a pretty big ramp from there to filing a lawsuit (especially from a far away place). Really, in my experience, people who are a serious legal risk (i.e. lawyers and people who use them) cite statute less often than slightly crazy internet randoms do.
So I suppose what I mean to say, is that I feel bad for the people who were alarmed by this, but I hope it has been a learning experience: when you operate a website, you are putting yourself out in public and exposing yourself to both legal obligations and dealing with random people that have weird ideas about your legal obligations (there tend to be more of the latter than the former). There are a lot of risks and responsibilities entailed in running a website, most of them fairly minor, and this kind of thing is one of them... just something you have to deal with when you make the decision to be a public entity.
Or maybe a better takeaway is this: if you get at all involved in politics, government, civil rights, or the public sector in general you will get a lot of stuff like this (and some of it will actually require action, but usually not especially difficult action). One result of increasing online privacy concerns is that just operating a website is starting to enter the civil rights realm, so I suppose over time every website will get more of this.
Maybe a “scam” email about CCPA would have been a better learning experience ;)
Then when on the receiving side, view it as a threat and freak out.
Note: I'm ignoring the whole lying aspect for now, because it isn't pertinent to my argument.
So it sounds like it's good for consumers, and a nightmare for producers. Seems the crux of the problem is the law itself.
Maybe the last sentence where they put a deadline on it, but that part was strange anyways since they explicitly said this is NOT a CCPA request, so that deadline doesn't even apply to this email.
The person seems to just be asking questions about the process and came off to me more as curious than threatening. Whatever veil there was most definitely was not thin in my opinion.
That's the threat, yeah. And yes, it's not technically correct--but, as many others have pointed out, you don't need to have a correct legal claim to inflict thousands of dollars of legal fees on a target. Hell, part of what those legal fees pay for is an expert to explain whether or not that deadline applies.
More than that, most people simply do not have the time to memorize laws, or to get the legal background required to understand whether a law applies. This is partly a problem with laws being complex and having their own jargon--but that doesn't excuse what's going on here.
Should academic research be held to a high bar? Yes. Did this cross a line? From the response and subsequent apology, clearly. But the outrage here feels at least a little disproportionate.
We as software engineers are not used to being told by a government how to build our code. If China passes some law saying that you can't directly search a database without routing the call through a government server, I don't care. I'm not going to research their laws and make sure my code conforms to that. It's not my problem. It's the people of China's problem. If a company I'm working for has a legal team that says they need to accommodate that, they'll tell me they need to write some code to do it. I'm free to write it for the money, or tell them to fuck the CCP and themselves.
But if I happen to know that a client is using my code in China without meeting some regulation there, it's not my obligation to inform them. Best of luck. I'm not personally liable for that.
And so what happened here is, they went after developers and small self-coded sites. They intentionally went after the people writing the code, not the companies that have legal compliance departments.
So the big question it presents, that I think has some people hopping mad and other people too sanguine, is: Does this herald a wave of assault and blackmail against developers, where bad actors (or dumb actors, like Princeton undergrads) will use supposed infractions of local laws to try to extort settlements from makers of software? I mean, show me a piece of software, and I'm sure it would be illegal somewhere. But the question of threatening small developers this way is new - it's a new form of trolling, like patent trolling but potentially even worse. The novelty of it and the potential for abuse is why I think a lot of people have been outraged by it, more than the question of whether someone should have just ignored this particular email. It presents an entirely new chilling effect that changes the bar for anyone looking to start a website, among other things. If any newbie coder had to make sure their code conformed to every legal requirement around the planet before putting it online, their chances of being successful with new code would be nil, and our livelihoods and creative capacities would be severely diminished. Our entire culture of making things would be crushed. An entire category of artistic creativity and originality that most of our lives are based upon could be shut down completely by a blizzard of emails like this one. I don't think it's overreacting to be alarmed by it, nor to be furious at this approach being pioneered by a supposedly liberal institution.
Attorney: "is this Princeton privacy study email that one of my clients received legitimate?"
https://twitter.com/jdigiacomo/status/1470756584435249152
"Wow. I actually contacted my attorney over this email inquiry to see if I actually needed to respond and if so, how."
https://twitter.com/NerdPress/status/1472340768933113859
"our clients have spent around $10k aggregate trying to understand what these requests related to, and whether this was a coordinated mass phishing attempt"
https://twitter.com/FDTaisce/status/1471970527132618757
An attorney in Switzerland: "Wir wurden von Mandantinnen und Mandanten gefragt, wie sie auf diese E-Mails mit Fragen nach ihrem Umgang mit datenschutzrechtlichen Anfragen reagieren sollen." ("We have been asked by clients how they should respond to these emails with questions about how they handle privacy-related inquiries." (DeepL))
https://steigerlegal.ch/2021/12/16/datenschutz-gefaelschte-a...
Three *different* attorneys in this thread report having clients reach out to them:
(1) "As outside privacy counsel, these are so frustrating. First one I saw cited being a CA resident so more alarming. Now for those interested\able to learn it's more time and education as they think any request must be scams now. Plus how many clients won't reach out next time?"
(2) "As in-house counsel, my initial gut instinct was that it was someone who was trying to entrap us - hoping we would make a mistake so they could sue. (I don't have much faith in human nature, I suppose.) So I sent it to outside counsel to be safe. Waste of time and resources."
(3) "Same here. We deal with a lot of professional litigants and I was looking for the angle (it was GDPR not CCPA, so was worried about a private right of action being brought)"
https://twitter.com/JFuchsKC/status/1471921893758443526
https://twitter.com/DanielleVEsq/status/1472105731474137094
https://twitter.com/SOliverLaw/status/1472288392889073665
(Sorry for the spaghetti comment: I got a bit carried away).
"I got this. It took time out of my day, but thankfully my French employer hired an American lawyer with CCPA experience (*cough* me) so it just ended up being a brief distraction."
https://twitter.com/jkosseff/status/1471816212732596227
He says he sent back a GDPR demand letter.
I've thought about starting a blog a few times, and I had the exact same thought. While it's very easy to make a static website and store in on a CND to make it scale to billions of requests, it's very hard to create a moderation system that scales.
It smelled like SPAM enough for me to check the email headers - SPF and DMARC passed and was sent from potomacmail.com servers.
Another odd thing was - the request was for a customer using our SAAS application - so their targeting is not exactly accurate. I wanted to ignore it but we get emails all the time meant for our clients - so we simply replied that they should direct the request to the party in question.
From my point of view 45 days is plenty of time to read into the topic. On the other hand: Referring to 45 days was shooting way beyond the target here and unnecessary.
Scaring the author was wrong and by definition always happens without consent. That's what the author can blame the researchers for. This was turned into a 'without consent' situation and I find this to strong. The email is rather clear but is also weird enough to feel like scam.
Anyway,
127.0.0.1 - - [18/Dec/2021:04:04:57 +0000] "GET /security.txt HTTP/1.1" 404 2110 "-" "Go-http-client/2.0"
Love the look of the site btw :).
Maybe then their executives will seriously review what their researchers are doug9.
maybe it's a legitimate inquiry?
maybe it's performance art? (does the blog post have to be taken down if a right to be forgotten request is filed?)
does the ccpa even apply to hobby or non-revenue generating endeavors?
That is, in fact, the entire problem. The researchers doing the study lied about who they were and where they were from (in another case, they claimed to be from France; in this case, from Germany) and did not tell anyone it was a study until after some subjects contacted lawyers.
Also the CCPA isn't supposed to apply to hobby/no-revenue sites, but one of the things that qualifies you for CCPA is having PII from 50k Cali residents, so if you log IPs in just the 'right' way and Hackernews finds your site you may end up qualifying overnight.
This page uses Cloudflare so they’re offloading data collection but it’s still being done, right?
On the other hand, anyone in California could send such an email legitimately. If you're offended by the contents of the email rather than by the research itself, I have bad news for you: the text itself is perfectly fine. Someone can, and should be able to, exercise their rights regarding data collection. That goes for Big Tech which these laws are aimed at, but also for any other party our there collecting data. If you're afraid of someone exercising their digital rights, you should probably not host anything public.
The real problem here is not the research itself and not even the laws the research is about, but about the litigious nature of some countries. Bad research happens, turning this research attempt into a spam campaign. Everyone gets spam, it's not a reason for panic. It's only a problem when you think any email you receive can actually be the basis of a life-altering lawsuit.
If you are someone who got spooked by such an email, I can't help but think you might not want to publicly host anything. Attaching any kind of data collection to the web has come with legal implications for years now, even before the GDPR was a thing. This time it was a malevolent researcher; next time it might be someone who demands that their IP be purged from your logs. Look at this shoddy research as a training exercise, and consider if you're prepared when a real version of this email comes in, before it's too late to do anything about it!
It's telling about many HN users' capacity for empathy that they think their reaction, real or hypothetical, has anything to do with whether this was a bad thing. Regardless of how any of us would react, it's clear from the many people who lawyered up or experienced anxiety because of the emails that this study had victims. Not seeing them as victims because you would have disregarded the email reveals what I'd consider a solipsistic mindset that causes them to regard others' experiences as less valid than their own.
This is a messed up situation, but it’s comforting to know I’m not alone in it (although I wish for your sake that you weren’t involved).
The senders either they didn't realize the sort of time and waste of money this would cause, in which case they are idiots, or they did, in which case they are arseholes.
How did this get past the Princeton ethics board?
What if every researcher started spamming thousands of businesses without their consent?
I'm sort of wondering whether you can get away with responding to such a request these days with "I am not in a jurisdiction that is obligated to comply with that law, and if you choose to charge me with violating it I am not under obligation to defend myself in court nor render myself for judgment?"
Your location and jurisdiction are mostly irrelevant - you’re obliged to comply with that law when you offer a your website in Europe. Of course the only possibility of enforcement is also in Europe, so there’s not much going to happen.
I suppose if you ran a rogue business then in theory credit card funds from European customers could get frozen by a court or something - but let’s be clear, GDPR is aimed at regulating big business primarily. Nobody is coming after your blog
Note from Jonathan Mayer, the Principal Investigator Hi, my name is Jonathan Mayer. I’m the Principal Investigator for this academic research study. I have carefully read every single message sent to our research team, and I am dismayed that the emails in our study came across as security risks or legal threats. The intent of our study was to understand privacy practices, not to create a burden on website operators, email system operators, or privacy professionals. I sincerely apologize. I am the senior researcher, and the responsibility is mine.
The touchstone of my academic and government career, for over a decade, has been respecting and empowering users. That’s why I study topics like web tracking, dark patterns, and broadband availability, and that’s why I launched this study on privacy rights. I aim to be beyond reproach in my research methods, both out of principle and because my work often involves critiquing powerful companies and government agencies. In this instance, I fell short of that standard. I take your feedback to heart, and here is what I am doing about it.
First, our team will not send any new automated inquiries for this study. We suspended sending on December 15, and that is permanent.
Second, our team is prioritizing a possible one-time follow-up email to recipients, identifying the academic study and recommending that they disregard the prior email. If that is feasible, and if experts in the email operator community agree with the proposal, we will send the follow-up emails as expeditiously as possible.
Third, I will use the lessons learned from this experience to write and post a formal research ethics case study, explaining in detail what we did, why we did it, what we learned, and how researchers should approach similar studies in the future. I will teach that case study in coursework, and I will encourage academic colleagues to do the same. While I cannot turn back the clock on this study, I can help ensure that the next generation of technology policy researchers learns from it.
Fourth, I will engage with the communities that have contacted me about this study, which have already offered valuable suggestions for future directions to simplify, standardize, and enhance transparency for GDPR and CCPA data rights processes. I very much appreciate the earnest outreach so far, and I will be reciprocating.
If you have questions or concerns about the study, please do not hesitate to reach out. I gratefully acknowledge the feedback that we have received.
Thank you for reading, and again, my sincere apologies.
To Whom It May Concern,
We are researchers at Princeton University conducting a study of how websites are implementing the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). We are reaching out to you because this email address is provided as a contact on the website [mydomain].
Your website may be required to implement one or both of GDPR and CCPA, and we would appreciate if you would answer a few brief questions about your privacy practices.
1) Does [mydomain] implement GDPR or CCPA? If not, could you please explain why? If you are uncertain about whether [mydomain] is required to implement these laws or answer questions like ours, we have included informative resources at the end of this email.
2) If you implement GDPR or CCPA, do you process data access requests from individuals who are not residents of the EU or UK (for GDPR) or who are not residents of California (for CCPA)?
3) If you implement GDPR or CCPA, do you process data access requests via email, a website, or telephone? If via a website, what is the URL?
4) If you implement GDPR or CCPA, what personal information must a user submit for you to verify and process a data access request?
5) If you implement GDPR or CCPA, what personal information do you provide in response to a data access request?
Thank you in advance for your answers to these questions. If there is a better contact for questions about privacy practices on [mydomain], I kindly ask that you forward my request to them.
Sincerely, Ross Teixeira
----------
We offer these resources about GDPR and CCPA for your convenience. Please note that we cannot provide legal advice about whether [mydomain] is required to implement these laws or respond to our questions like ours about GDPR and CCPA practices.
* Article 3 of the GDPR, which specifies coverage: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
* European Data Protection Board guidance on GDPR coverage: https://edpb.europa.eu/our-work-tools/our-documents/guidelin...
* California Attorney General guidance on CCPA coverage: https://oag.ca.gov/privacy/ccpa#sectiona
* Section 1798.140 of the California Civil Code, which specifies the businesses that CCPA covers: https://leginfo.legislature.ca.gov/faces/codes_displaySectio...
What is more likely is that they have multiple templates to try to determine if there were different responses depending on whether the request was known to be for research.
>someone asked me a question and it scared me
If you find the prospect of receiving this email so horrifying, perhaps your real problem is with the laws themselves?
If this came from a real person and was a real question then of course it would be ethical, but it wasnt
If you did this to my blog, I’d let you take me to small claims or whatever. The probability of you making it all the way to prosecution and the total harm is so low that I’m not going to CCPA or GDPR enforce on my blog.
Bite me.
I hope this line would get included in discovery; I would... actually pay money to watch you explain to a judge that you explicitly decided to ignore the law.
(IANAL, but I'm pretty sure the real defense would be that the law actually doesn't apply to you)
This is satire, yes? Come on.
If someone is serious about getting a hold of you, they can buy a stamp.
I've been on the IRB submission side for Iowa State, and I can tell you it was a rigurous process, though the training emphasized why things are the way they are.
If participants are concerned about their results becoming deanonymized, the basic trust we have that there will not be negative ramifications for the participant and that participants will be genuine in their responses and participation go out the window. That's a fundamental aspect of conducting good research that is valid and as broadly applicable as possible.
Deanonymized results may not seem like a big deal, however we have to also consider future impacts on the participant. What if discrimination based on that test result was permissible and they couldn't find a job? What if later analysis shows conclusions we couldn't imagine right now that would hurt the participant? What if your boss found out you were participating in a drug trial for PrEP, outing you as likely gay? What if social norms change and new standards are applied to old data?
I'm also curious about the expensive software they were wanting. The standards shift over time, but in my experience we might have a paper key for participants to participant number until _x_ months after the study is completed, at which time it would be destroyed. The key would probably only exist on paper and would be stored separately from the data, behind a separate differently keyed locks (or encrypted separately if electronic). All of this would be explicitly defined in the documents provided to the IRB.
For surveys, Qualtrics was an approved vendor, so we would often try to do all data collection in Qualtrics.
Yes, it is.
This is not a bad thing.
A lot of the calculuses that conclude it's a bad thing are fundamentally dehumanizing.
(... And then people rationally respond to such an invasion by no longer going to the doctors and lying about their medical history...)
We can't interpret people's desire for privacy as damage and route around it. There's decades of history of scientists interacting with the public to show why that has negative consequences for society.