The formal ethics of research on humans requires informed consent of participants.
You can take framework of sales or management where lie is just being smart, but it is not applicable here.
You can take framework of sales or management where lie is just being smart, but it is not applicable here.
https://research.oregonstate.edu/irb/research-involving-dece...
quotes:
a) Psychologists do not conduct a study involving deception unless they have determined that the use of deceptive techniques is justified by the study's significant prospective scientific, educational or applied value and that effective nondeceptive alternative procedures are not feasible.
b) Psychologists do not deceive prospective participants about research that is reasonably expected to cause physical pain or severe emotional distress.
c) Psychologists explain any deception that is an integral feature of the design and conduct of an experiment to participants as early as is feasible, preferably at the conclusion of their participation, but no later than at the conclusion of the data collection, and permit participants to withdraw their data.
a) -- Hell no
b) -- I can give the benefit of the doubt that they didn't foresee small website owners getting panic attacks from this threat, but their non-empathetic tone in that apology write up is appalling
c) -- Hell no
The more I think about this the more I'm furious that a supposedly top tier institution like Princeton approved all of this and the "researchers" seems to have 0 fucks to give on ethical experiment design.
For example, I would feel comfortable with this study if at the bottom it said "Just kidding, we're actually researchers. Can you explain what was going through your mind when you read this?" even though it's technically deceptive.
I'm a former pentester, and deceptions like this were run all day, every day, by a dedicated team. It's often phase one of phishing, since you end up assuming you're talking to a trustworthy source. So I'm wondering why we seem comfortable with that, but not this.
I don't know about you but I learned about deception in research and its ethical implications in high school. To me, grown-ass adults working in the field of STEM not knowing ethical research, let alone a god damn researcher failing spectacularly and causing harm to an ungodly amount of people through the use of automated means is woefully beyond "oopsie, I really shouldn't have done that"
>For example, I would feel comfortable with this study if at the bottom it said "Just kidding, we're actually researchers. Can you explain what was going through your mind when you read this?" even though it's technically deceptive.
This is kinda what debriefing is, but it is usually more substantial than this. But that still feels extremely amateurish in my eyes. The stated research objective was to have a measure on CCPA/GDPA compliance and did not require deception whatsoever. Either the researcher was not imaginative, they didn't give a fuck, or they just wanted to try deception just for fun.
>I'm a former pentester, and deceptions like this were run all day, every day, by a dedicated team. It's often phase one of phishing, since you end up assuming you're talking to a trustworthy source.
I don't know about you but I hear news all the damn time where phishing emails go wrong--like I think I just saw a testimonial on reddit where fake phishing emails were so aggressive that it literally just ended up discouraging people from using email entirely to the point where people missed assignments and shit. Something similar happened in my company as well and a lot of people got furious.
Fake phishing things should also be heavily controlled, like for us, it is entirely voluntary.
University researchers are required to abide by ethical standards to prevent abuse of test subjects. One would assume that this should also include not randomly targeting people with deceptive emails causing them mental suffering and unnecessary legal costs.
Full disclosure: I’ve listened to at least 20 episodes of Darknet Diaries. I’m basically already in your network. ;)
Because pentesters get permission up-front. What the hell kind of pentesting operation are you running where trying to penetrate a site that isn't already one of your clients? You'd be in hot water, legally, if you did that--because the sites affected would have every reason to assume that you're malicious.
This is exactly the thing that was gone over last time, in the U of M case where researchers knowingly submitted exploitable code to see how the Linux kernel team would react. They were also compared to pentesters--but pentesters get permission first, and the U of M people didn't, which is why they were treated as malicious by the kernel team.
If you do not have rules of engagement that were agreed upon by the pentesting team and the client, you are not pentesting, you are committing some form of crime. Stop claiming that pentesters are allowed to phish/exploit things without permission, it makes everyone in that community look bad.
I agree with it, and I feel it's my duty to be well-informed on this. So I thought I'd ask you.
Everything I can find is only applicable for medical research, and not social research.
I've been seeing this a few times now. Extremely ignorant computer scientists and STEM folks skipping IRB and claiming "theyve never even heard of getting approval for social research". Pretty gross in my view honestly.
How do you explain research on placebos then?
The researchers did no (or very poor) screening.