The nature of legal practices in the USA is such that the answers to "Are you totally in the clear legally?" and "Will you lose significant amounts of money proving in random courts that you are in the clear legally?" are often both yes.

As a result, any researchers who send out thinly veiled legal threats as a "research experiment" are firmly in the wrong ethically, and should be called out by all the people to whom they have issued these veiled threats. Review boards that approved this experiment should be themselves subjected to an audit and potentially dissolved.

https://twitter.com/DanielleVEsq/status/1472105731474137094

So yeah, pretty sure it's that. I almost never get harassed by people who think I'm cis male, the bulk of the harassment came from people who thought I was transmasc.

Probably the furry stuff too, which is honestly sort of terrifying, do these people not know how much infrastructure relies on stressed and overworked furries?

By my estimation it is real, the proprietorship (who I like and appreciate personally, and I think are operating on good faith) of this community has often made noises about how it should be better. It's not, and it should be.

Righteous indignation over something like this is dangerous, not least because it can lead to science being much harder (more bureaucratic and more expensive) to do by all scientists. “More oversight” or “dissolve the irb” all put too much responsibility on the institution.

Sometimes, we should just blame the people who did something rude and stupid not the institution.

There have been multiple examples of this going horribly, horribly wrong. (Naturally, the worst examples were government-funded and ran during the Cold War.)

As a society, we have since concluded that at bare minimum, people should know they are being experimented on--and even that isn't enough to stop things from going badly.

This is why the IRB exists in the first place. A major part of its purpose is to prevent this sort of thing from causing undue harm, i.e., by forcing people with limited incomes to seek legal counsel because they believe they're about to be sued into the ground. One of the rules generally agreed upon for this is that experiments with human test subjects must inform those humans up-front what they're getting into.

To say that the response to this "can lead to science being much harder" is an ethically wrong defense. We know it makes certain kinds of research harder; that's the point. There are certain kinds of research that directly harm their subjects, and we don't do that to people. More than that, people have a right to decide whether they want to be involved in a study, as they may personally feel endangered by it (i.e., someone who has a PTSD response to being sued may not want to deal with being fake-sued).

To say that calls to dissolve the IRB "put too much responsibility on the institution" is flat-out false. This IS the IRB's responsibility--they approve or reject studies like this specifically to avoid ethical problems like this one. To claim that this isn't the IRB's responsibility is like claiming that it's not the responsibility of the law to revoke a driver's license when someone has been driving drunk, or that it's not the responsibility of the Food and Drug Administration to reject approval for foods that contain dangerous contaminants.

So, to reframe this: "can you think of scenarios where institutional oversight could cause negative harms on society?" There are tradeoffs in ethical domains —and usually a lot of work has been done to find a middle ground.

Further, the study would still have worked if the researchers had simply asked for the information as researchers, instead of lying about their identity and making thinly-veiled threats of legal action if the subject doesn't comply.

I apologize for assuming that you were defending the study; I figured that was the topic of conversation, after all.

If there is nuance, but it does not apply to this situation, then it is worth saying that this nuance does not apply to this situation--so that I'm less likely to misinterpret what you're saying.

Ethical action involves nuance! It is very comforting to think that the world is black and white, good and bad. But it isn’t. Why is this so difficult to communicate?

So what happens when a site receives a CCPA inquiry from an actual person concerned about privacy instead of a researcher under a fake identity? The site still needs to determine if the law applies to them and if so what they must do to satisfy their obligations, so a real inquiry should be as costly and as stressful as a research inquiry.

Does this suggest that privacy laws such as CCPA (and GDPR) which create obligations for sites to deal directly with users on privacy matters are a bad idea? Should such laws instead require users to go through some state agency as an intermediary which would then only contact the site on behalf of the person if the agency determines that the user's data at the site is covered?

They conclude that it's a Princeton research study and throw it in the trash.

This is part of the harm this study has done; because the researchers were not upfront about who they were and what they were doing, they have introduced uncertainty about the CCPA process.

> Should such laws instead require users to go through some state agency as an intermediary which would then only contact the site on behalf of the person if the agency determines that the user's data at the site is covered?

That could be a good idea. It would depend, of course, on that agency being well-staffed and well-trained (both of which are separate from being well-funded, which can help). There's a giant pile of messy problems that can crop up due to negative influences from, say, corporations that want to sell more data.

That said, it would be nice to have an org that can do the minimum legal work necessary to figure out if the claimant has a leg to stand on. That would not only minimize the harm of this sort of ill-advised study, but also make it harder to use threats of legal force to coerce smaller site owners.

The CCPA applies to for-profit businesses that do business in California and meet any of the following:

Have a gross annual revenue of over $25 million; Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or Derive 50% or more of their annual revenue from selling California residents’ personal information.

It's not a very hard decision to make, the text is pretty clear. Especially if literally the fifth word of it - "for profit" - makes the further reading unnecessary.

> any of the following

OK

> Buy, receive, or sell the personal information of 50,000 or more California residents,

"receive" and "50,000" seem like a low bar if the definition of "personal" includes anything caught in typical web logging.

You see? It's not clear cut from reading the thing you just said was very clear and it's hard to be 100% sure it doesn't apply.

"For profit" and "business" and similarly wide nets. Business can include individual sole traders and "profit" could be "accepting donations" or "running AdWords"

I was wondering whether not logging could be an option. That's now quite clear.

The point of my original comment was that there is gray area here and people dismissing it outright as obviously bogus are not thinking very critically about it. I think this is a good example of that.

Further, logging an IP address has also been necessary for security--to detect DoS and DDoS attacks, for instance, as both involve many repeated connections from the same IP (though you can offload that to a service now).

You seem to be confusing temporarily holding information in the database (no matter whether in-memory or on persistent media) for operational purposes (be it networking or threat detection) and permanent storage of the same information way beyond the time it ceased to be useful for the purposes above.

Also, even if you only store the information for 24 hours--how many users are on Hackernews in a given hour? How many of them click through the top links? Certainly enough that some sites have crashed under the load, which makes me think that the number is higher than 50K. Congrats, you're now storing 50K IPs, despite having an automated system to delete them in a day.

(I don't even wanna think about the headache it'd cause if you got dragged to court over this. I don't know how many judges will understand that you delete the list every 24 hours to avoid being liable for storing it, not to get rid of evidence.)

"Before the courts and on the high seas, we are in God's hands" isn't a proverb for no reason, and it's valid pretty much anywhere.

I don't think this is mocking (excluding the few obligatory spammers). It's a known fact that if you have a public e-mail, you will receive a lot of spam and threats. Also, an actual request could've very well taken a similar form - would you have been okay with this if they actually requested their data?

I'm not saying these actions were great. Sending out these mails was definitely not the nice thing to do. And yes, the threat of a lawsuit can be very scary. But, unfortunately, this is something you must be able to handle as a webmaster. It's also not great or nice that people try to log into my ssh server all the time, but this is just something you get when you have an ssh server on the internet. Same thing.

Based on the way the system works, especially the civil side, it's sometimes impossible to even answer this question.

If a Russian were able to file suit in California, wouldn't the defendant have a chance early on to ask a judge to dismiss it?

I'm trying to sound naive because I want some gory details.

a particularly foolish or over-confident defendent might represent themselves, but otherwise, I would not budget less than $2000-3000 to hire a lawyer to draft and file a response to statement of claim and show up in court to attempt to get it dismissed before it gets started.

Foolish, overconfident, or just "never have had $3000 in one place and time in my entire life."

For most people, if you pull them into the spot light, you will quickly shut them up. That does not make their legal threats baseless.

I think the core issue here is not being able to distinguish the two cases easily.

Personally I've told some expensive solicitors to get lost successfully, and for some I've engaged my own & spent tens of thousands. I suppose I tended to be aware of legal risks that I was running in my old business.

But lawyers are trying to get a result for their client as fast as possible. So if they've sent you something full of hand-waving jargon, they're either not very good at communicating (& not the kind of lawyer used to taking things further) or they're trying to intimidate because they've not got anything substantial to say.

Also (in my xp) it's rare that a lawyer won't clarify something they've written unless they're being paid to intimidate, and (in the UK at least) a judge will have short shrift with a plaintiff if pre-trial communications were insubstantial and intimidatory. You can't just be summoned to court with no idea what you did wrong.

Yes, it's a bad thing to do, it's pretty obvious that it'll scare the bejesus out of some people and even worse, have some chilling effect.

On the other hand the pendulum on ethical boards has gone waaaay in the other direction to the point where a lot of very useful research doesn't get done. The most vivid example being that we don't have human challenge trials with Covid, even now when it's crystal clear that actual risks to young healthy people are close to zero. Another example: https://slatestarcodex.com/2017/08/29/my-irb-nightmare/

So, what's my opinion? Well, an "opinion" would require me to chose one of those two perfectly valid points of view. But if I had to, I'd say the travesty that is "ethics boards" has become a bureaucracy so rotten it doesn't even perform its original function of stopping vaguely unethical research, and has instead gone completely the way of paper pushing. While, of course, still drawing a salary from making sure tens of thousands of people are dying needlessly.

FWIW, the author of the essay at the link you provided seems deeply ignorant of why IRBs exist. "Mere resident doctors weren’t allowed to do studies on their own. They would probably screw up and start building concentration camps or something. " really?

Human challenge trials. Hundreds of thousands of dead later, and we're still using statistics to answer questions like "is Omicron ignoring immunity", instead of answering them definitely in a few days with an absolute minimum of risk. I'd volunteer for that, btw, so would literally millions. But it's just not inside the Overton window. This isn't wisdom or caution. It's plain cowardice.

From the email:

>My questions are about your process for when I do submit a request.

It's really easy to read this as "I am going to be submitting a request."

>I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.

So I'd say there is some legal threat here.

Random blogger who's not a business does not have any connection to this. It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.

>These FAQs provide general consumer information about the CCPA and how you can exercise your rights under the CCPA. They are not legal advice, regulatory guidance, or an opinion of the Attorney General. We will update this information periodically.

I understand that someone can do cursory research and be overly confident in their understanding of a law that spans 46 pages. I hope you can understand that people can be underconfident in their understanding of a law that spans 46 pages, is bound by the entirety of a state’s statutes and case law, and feel overwhelmed by someone asking for a response on their compliance with said law. Regardless of what their interpretation of the original email should or shouldn’t be.

>It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.

Comparing a reasonable fear that one may not be in compliance with a complex legal system to something absurd does not invalidate that fear.

And, as someone also pointed out in that thread, being on Hackernews and having IP logging may be enough to trigger that requirement.

Further, with the absolute shitshow that is the US court system, if someone brings a frivolous suit you're looking at thousands of dollars in legal fees, because you're going to need a lawyer (or previous experience in law) to properly explain to the judge why this suit is utterly ridiculous. And there's no guarantee if you'll get compensated for that, even if you file counter-suit--and even if you do get compensation, it's likely going to happen several years later, after the guy who tried to sue you does everything in his power to avoid paying up, because he knows you're eventually going to run out of money.

There’s a reason patent trolls, copyright trolls, ADA trolls, etc. go after small entities: they’re more like to pay a small settlement out of fear than risk taking it to court and being bankrupted.

[1]https://youtu.be/rEcOzjg7vBU

This reads as a thinly vieled command to respond, not a mere request, citing legal code and (incorrectly) asserting it's applicability as a basis for the authority to give such a command, with the implication being the possibility of legal action if the demanded response is not provided.

It isn't. Being paranoid about lawsuits against some personal blog shows a lack of legal sophistication and this type of sensationalism promotes an irrational fear of being somehow financially vulnerable to almost any legal predation. That's simply not how the US system works. There have to be actual damages for a court case to go forward to the worst-case expensive end (depending on what most people consider "crippling"). Courts aren't pernicious and are very sensitive to anyone attempting to waste court time on exploitation (except in Texas courts supporting patent trolling, obv).

Any judge would have this resolved by giving the parties a 15 minute sidebar to come to an actionable resolution or sanction both sides in some motivating manner. The US legal system has a vested interest in not taking everything to a long drawn out fight, due to limited court time, even if it is presented differently in media (or the comments in these threads, which are laughable).

And yet, many people reacted just like this writer. Perhaps, given that the reaction was widespread, it could and should have been anticipated, instead of expecting every person to have your evident legal knowledge.

Nope. A legal threat is a statement by a party that it intends to take legal action on another party. GL with whatever.

Asking questions is an implied threat often enough that a question can indeed effectively be a threat.

Edit: It's not that hard to see that there are potentially some social problems here e.g. "the message is easily construed as a legal threat" or "the message was mass mailed in a spam-like nature". However, my comment is in response to the title of the blog post which implies that the webmaster believes there's an ethical problem that this "experiment" was even run in the first place. For the purpose of this thread, assume the email was worded perfectly and the university was very thoughtful and deliberate in who they contacted. I'm interested in discussing the ethics behind how a perfectly legal and reasonable thing can in one case be ethical and another case be unethical simply by virtue of the context in which the action was carried out.

When you say "If I as an ordinary citizen..." you essentially make this point. They are not an ordinary citizen making a data request, they are researcher who thinks it's ok to lie to collect data perhaps because they think people would give different responses when faced with a genuine data subject access request than when talking to a known researcher.

Put another way, is “right not to be observed (in public)” something we protect? If I write down my observations at a park as I watch humans interact is that unethical simply because I didn’t bring a megaphone and announce my intent? I think the problem is that despite what’s in vogue, I don’t understand how acting in a way that is not illegal even if it impacts somebody else and then observing the results is by default (unquestionably) unethical. Why is that bad? Are there some “case experiments” the research community looks to where humans where harmed that has shaped our modern understanding?

Secondly, you say you don't see who was harmed - the person who posted the original blog post was clearly harmed. She had a panic attack she was so stressed about the legal implications of the implied threat. The fact that someone else may perhaps have not found receiving this email stressful doesn't really matter - that was the effect on her and it was harmful on its face. Remember that people have different life circumstances which affect things like this - someone who was short of money may see a legal threat with implied financial consequences such as this as an existential threat.

Secondly the people who paid money for legal advice were very clearly also harmed. Their harm has a specific monetary value.

Your "put another way" extrapolation is just a complete straw man. Noone here other than you is talking about observing people in the park. This is about a research study which sent an email which some people saw as scammy or threatening in order to gather data about how small websites handle data subject access requests.

...and actually checking again the person said they "verged on" a panic attack, which is clearly less bad

https://blog.freeradical.zone/post/ccpa-scam-2021-12/

You can take framework of sales or management where lie is just being smart, but it is not applicable here.

https://research.oregonstate.edu/irb/research-involving-dece...

quotes:

a) Psychologists do not conduct a study involving deception unless they have determined that the use of deceptive techniques is justified by the study's significant prospective scientific, educational or applied value and that effective nondeceptive alternative procedures are not feasible.

b) Psychologists do not deceive prospective participants about research that is reasonably expected to cause physical pain or severe emotional distress.

c) Psychologists explain any deception that is an integral feature of the design and conduct of an experiment to participants as early as is feasible, preferably at the conclusion of their participation, but no later than at the conclusion of the data collection, and permit participants to withdraw their data.

a) -- Hell no

b) -- I can give the benefit of the doubt that they didn't foresee small website owners getting panic attacks from this threat, but their non-empathetic tone in that apology write up is appalling

c) -- Hell no

The more I think about this the more I'm furious that a supposedly top tier institution like Princeton approved all of this and the "researchers" seems to have 0 fucks to give on ethical experiment design.

For example, I would feel comfortable with this study if at the bottom it said "Just kidding, we're actually researchers. Can you explain what was going through your mind when you read this?" even though it's technically deceptive.

I'm a former pentester, and deceptions like this were run all day, every day, by a dedicated team. It's often phase one of phishing, since you end up assuming you're talking to a trustworthy source. So I'm wondering why we seem comfortable with that, but not this.

University researchers are required to abide by ethical standards to prevent abuse of test subjects. One would assume that this should also include not randomly targeting people with deceptive emails causing them mental suffering and unnecessary legal costs.

I don't know about you but I learned about deception in research and its ethical implications in high school. To me, grown-ass adults working in the field of STEM not knowing ethical research, let alone a god damn researcher failing spectacularly and causing harm to an ungodly amount of people through the use of automated means is woefully beyond "oopsie, I really shouldn't have done that"

>For example, I would feel comfortable with this study if at the bottom it said "Just kidding, we're actually researchers. Can you explain what was going through your mind when you read this?" even though it's technically deceptive.

This is kinda what debriefing is, but it is usually more substantial than this. But that still feels extremely amateurish in my eyes. The stated research objective was to have a measure on CCPA/GDPA compliance and did not require deception whatsoever. Either the researcher was not imaginative, they didn't give a fuck, or they just wanted to try deception just for fun.

>I'm a former pentester, and deceptions like this were run all day, every day, by a dedicated team. It's often phase one of phishing, since you end up assuming you're talking to a trustworthy source.

I don't know about you but I hear news all the damn time where phishing emails go wrong--like I think I just saw a testimonial on reddit where fake phishing emails were so aggressive that it literally just ended up discouraging people from using email entirely to the point where people missed assignments and shit. Something similar happened in my company as well and a lot of people got furious.

Fake phishing things should also be heavily controlled, like for us, it is entirely voluntary.

Full disclosure: I’ve listened to at least 20 episodes of Darknet Diaries. I’m basically already in your network. ;)

Because pentesters get permission up-front. What the hell kind of pentesting operation are you running where trying to penetrate a site that isn't already one of your clients? You'd be in hot water, legally, if you did that--because the sites affected would have every reason to assume that you're malicious.

This is exactly the thing that was gone over last time, in the U of M case where researchers knowingly submitted exploitable code to see how the Linux kernel team would react. They were also compared to pentesters--but pentesters get permission first, and the U of M people didn't, which is why they were treated as malicious by the kernel team.

If you do not have rules of engagement that were agreed upon by the pentesting team and the client, you are not pentesting, you are committing some form of crime. Stop claiming that pentesters are allowed to phish/exploit things without permission, it makes everyone in that community look bad.

I agree with it, and I feel it's my duty to be well-informed on this. So I thought I'd ask you.

Everything I can find is only applicable for medical research, and not social research.

I've been seeing this a few times now. Extremely ignorant computer scientists and STEM folks skipping IRB and claiming "theyve never even heard of getting approval for social research". Pretty gross in my view honestly.

How do you explain research on placebos then?

The researchers did no (or very poor) screening.

I think the real ethical issue is actually that the email reads like it's coming from a lawyer. It's weirdly formal and cites that a response is legally required within 45 days. As other comments have mentioned, this has the real world consequence of heavy stress where most folks would (and should) lawyer up. This is the biggest ethical issue, since the study is costing its participants nontrivial money, and without consent.

Which the IRB missed because they didn't understand that, to ask questions about a website's policy, you must get an answer from a human.

The experiment is collecting more information than just survey results about CCPA policies. They're also collecting and evaluating information about how humans respond to their legal threats vs how they respond to less pointed inquiries from academics. If this study was merely ordinary survey methodology with questions that aren't asking about humans, it wouldn't be human subject research. But they have actually gone outside the bounds of a mere survey with the deception and threats.

In short, if lawyers asking people to follow laws are an ethical problem, then maybe we need to address that and not get enraged about a totally legal request for information about a website’s CCPA process.

> As part of the study, we are asking public websites about their processes for responding to GDPR and CCPA data access requests. We attempt to identify a website's correct email address for data access requests through an automated system.

You cannot "ask a website" and a website doesn't have a "correct email address". Given the targeted nature of the emails, I have trouble believing that these phrases were written in good faith by someone who understands that they are emailing the webmaster for a website, and expect an answer within a reasonable timeframe.

----------------------------------------

[1] https://ria.princeton.edu/Human-Research/Committee

[2] https://www.cs.princeton.edu/~kylej/

The police does that quite often to catch criminals. Sometimes they also target innocent people, is that ethical?

People on HN don't usually lie, I hope, but most "misrepresent" themselves using anonymous accounts, sometimes claiming to be more than they actually are (I know, shocking).

Emails you receive are more likely to be scams than not. If you're like the author and freaks out at legally-sounding emails (or phone calls, discussion forum comments etc) received from random people, you're going to be a really stressed, anxious person your whole life.

This should tell you something about your police, not about ethics.

These rules are not as established or strict for other professions.

So how is the board doing? Did its members face any consequences at all or are they still there ready to rubber stamp the next study with full approval and flimsy excuses?

Your country should crackdown on police behaviour.

Huh? Are we reading the same article? Because what I see is this:

> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia.

  envoiemail.fr
  novatormail.ru
  potomacmail.com
  princetondmarcstudy.org
  princetonprivacystudy.org
  yosemitemail.com

(The rest isn't a response to seanhunter's comment, but a comment on the discussion in general)

If we take a step back from the discussion; I'd have to say that this is in a gray area that kind of ends up being mostly in the "ok" region - or possibly in the "probably not worth giving a shit about" region. There is a simple litmus test you can make: how would people have reacted if this had been limited to large corporations you do not like? The response would have been very different.

Let us at least be honest enough to admit that to ourselves.

That this is part of academic research doesn't really change anything.

It also needs to be said that people tend to be too uptight about perceived small infringements on what they see as their inalienable rights. If we are going to label subjects of what is at best described as akin to consumer research as victims we are watering out the term to the point where every person who has accessed the web is essentially a victim.

Hence the victim blaming someone tried to call out in a comment, is needless douchebaggery and drama. There are real victims of real transgressions and this is belittling.

People need to take themselves a bit less seriously. You are part of human subject research studies every time you use the web. And yet you come back for more every day.

Half of you probably contribute code and time to an industry that turns human behavior into numbers that the is translated into cash. And proudly so. Hypocrisy just makes us all look like douchebags.

Those large corporations we do not like have lawyers on retainer specifically to deal with this situation (probably by suing the pants off of whoever sent the email).

It is acceptable to react differently when the victim is defenseless. That is why we would have a different reaction to a large corporation being struck by this, versus an individual who may not be able to afford legal counsel (and who certainly can't afford to pay legal counsel when the threat turns out to be baseless).

Also, "privacy laws create victims" is--to use your own phrase--a very tortured version of what's going on here. The people affected by this study were threatened with legal action. That is what they are victims of. Regardless of what law was used as an excuse, threatening someone with frivolous legal action is as bad as threatening someone with SWATting.

Stress aside, part of the problem is the very real possibility of a subject wasting money on hiring a lawyer.

Or even if there is a legal threat, do you take it seriously unless you know the source? People regularly get calls saying they are in violation of tax law and must pay.

I've received legit legal threats over email from very serious people. I'm certain they would have escalated to more "official" channels if the situation wasn't resolved to their satisfaction (if you're curious, it was a contractor billing issue that was being ignored by my HOA. I was caught in the crossfire).

The fact that random scammers are calling folks claiming they're violating tax law isn't a justification for researchers to engage in similar acts. Do you agree?

This is an interesting point you bring up, which merits diving into a bit further.

I think it's precisely because CCPA is so new that this experiment is more unethical than if they were just calling up people saying "you owe money to the IRS, send me gift cards". The IRS spends a ton of money every year telling people that these calls are scams; but Christine or the operator of freeradical.zone likely had no such public service announcements from the State of California. On the other hand, they probably did hear news items about this new data privacy law that California passed, and thought the emails were from actual individuals.

An email purportedly from an individual is not the same as a contract or terms of service issued by a corporation from which I am getting a service. If I, as an individual, were to send you an email asking, for example, if you are paying all the taxes you legally owe, am I just giving you "a reminder of existing laws"? Or are you going to start wondering who I am and why I am asking and wonder if something is going on behind the scenes?

> People regularly get calls saying they are in violation of tax law and must pay.

Yes, that's true. And people who make such calls are regularly considered unethical scammers who do not deserve any consideration. So why should we treat researchers who send similar emails any differently?

However I’m dubious that there was even a threat of a lawyer. The request simply asked for a prompt response as required by law. That’s quite a stones throw from “I’ll sue you and take you for everything you own if you don’t reply”.

BTW, if you are actually being threatened by a lawyer then they send certified mail or show up at your door. And in terms of the webmaster almost contacting one, no lawyer is going to take your money before talking for 5-15 min to even figure out what the issue is. And even if you paid for 30 min of a lawyer's time, then they would promptly inform you that you can ignore such requests since you’re not a business.

Again, what’s the ethical problem here?

The usual legal standard is whether a reasonable person could interpret the email as potentially threatening legal action.

> The request simply asked for a prompt response as required by law.

And such a request reads exactly like something written by a lawyer. Lawyers don't usually explicitly threaten a lawsuit in their first communication. They write something very similar to the email the researchers sent. I can easily see how a reasonable person could interpret those emails as potentially threatening a lawsuit if the request were not complied with, or if the sender did not think the response was sufficient.

I think you are expected random people operating websites to share your knowledge of the legal system. I know you're right, but most people who operate a website likely don't, and these emails make them spend unnecessary time, money figuring that out; not to mention mental distress.

I find this not dissimilar from a standard "I'm in prison, but know where a million dollars are buried, send me money" email scam; and if researchers were sending those around as tests to see who was gullible, they would be promptly end up on several blocklists. I don't see how this is different; and therein lies the ethical problem. Quite a few people seem to agree.

Sure, but if you haven't lawyered up by that point you're going to have a bad time. Doubly so if you aren't familiar with the amount of info-gathering and record-keeping involved in winning a suit--if you don't know what needs to be written down for when you do have to call a lawyer, waiting until the last second can easily shoot your entire case in the foot.

And if you do lawyer up, you're spending massive amounts of money--money that some people just don't have.

Search C&D samples on google and see for yourself.

“Your failure to abide by your Agreements will result in [redacted] pursuing any and all available remedies, including but not limited to injunctive relief and monetary damages.”

So, I don’t consider this very specific (you may, and that’s fine but then our disagreement is about something different).

Contrast that to the subject email. There’s no if you don’t respond then I will sue you. It’s not a threat, it’s a request and the requestor’s reference to a statute that they think might apply.

Yes, frequently. And throwaway.

About once a week, I pick an account in my LastPass collection, and initiate the following process:

1. Initiate a CCPA data request using a form or email, and I always include language about the timeline. I am not a lawyer, I'm just a person.

2. Then, once I have the data, I delete the account. I'm trying to purge my web presence before I move out of California. I have about 200 accounts left, and have done this with 50.

Admittedly, these are all large businesses, so far. Think Google, where I've worked myself, so I know they are equipped to handle it. But, I will be working my way down to small businesses eventually, and I am surprised to find out that simply quoting the statute (which is what I do) is considered anything but vaguely legally threatening. If the website doesn't fall under CCPA, or hell, if it does, I just expect it to be ignored. I mean no ill will.

I'm personally pretty conflicted, since I actually fully agree with this [1] about the study being unethical, but if I send an email as an individual to a website with my data, quoting a California law, that doesn't seem wrong to me, even if it causes $10k in legal costs, since my request is truly genuine and not intended to cause harm.

I would agree that there is a distinction at the study level, but I'm not exactly sure why.

[1] https://news.ycombinator.com/item?id=29599553#29601020

If a business engages this type of activity, they need to have a scalable process for providing California residents with their data.

Describing a California law passed by a majority of voters as “idiotic hoops” is a miss.

(Same person, another throwaway, my bad.)

I imagine that for some companies it is difficult, and to the extent that I feel a 'sense of justice' about it, I would hope that my efforts help the organization (or single person, acknowledging that) set up a process to handle this.

I'm *genuinely* not trying to be abusive though. It's *extremely important* that consumers have the ability to exercise their data and privacy rights.

I'm not that old (mid 30s), but genuinely much of the data I have on the internet was put there when I was an actual child. And it's still there. This is actually one of the first times I've posted in *years* online. I really want to delete *almost everything*. Note in my OP, I said I worked at Google. I quit, because although I actually think ad targeting and the surveillance network are actually okay-ish, I wanted to opt-out myself, on both ends. So far, this decision has cost me 250k USD personally (if I calculate out the opportunity cost since I quit, just so far). And for the websites/apps I do still use, I donate some amount of money per year. OK, maybe I'm a freak, I really do think this stuff is important.

What would you suggest I do? Leave all my data online? As I said, in my cases, I was an actual child (those COPPA things did nothing to stop me), and this is, so far, a really effective way at getting places to delete my data. Maybe it's because they're "scared" of the law, but you know, then the law is working. Before, nobody responded to my deletion requests, and many websites had no option to delete. As a libertarian-ish person, this is a clear win for the consumer in terms of "coercive power of the state being used to create a framework that increases net freedom".

I am open to being wrong though! Let me delete all of my data first though so I don't have to do this again.

I'm soooo behind that (one reason I am disappointed in the ethical lapses here)—I've often considered publishing the steps I take for each website on a substack or whatever, to help other people. Sometimes, it can be hard to figure out (1) if your data can be requested-to-be-deleted, and (2) how to even do it.

Clearly, the deception was bad; I guess, just thinking out loud, how could this study have been done ethically? Perhaps, sign up real people to request the data, and transparently include a notice that this was part of a study?

The last bit is the tricky one; including that might skew the results in favor of websites being compliant.

I consider myself a normal citizen and I receive "legal" and "illegal" threats regularly, the very vast majority being scam attempts of course.

Recently e.g. scammers keep telling me that my website's imprint is not up to code[0], either threatening to sue or outright claiming they are in fact a law firm and want a cease-and-desist and compensation for their law work, of course.

I also noticed how the Indian and Pakistani "security researcher" scammers[1] telling me about "major vulnerabilities" in my website - aka missing DMARC/DKIM headers (which are not even missing) - also started telling me how one can be fined under the GDPR for "bad security".

As for the "illegal" threats... I, according to scammers at least, watch a lot of "bad" porn[2] and they know about it because they hacked me, and recorded me on my own webcam. But if I paid them some BTC/monero/whatevercoin ("Follow this link to learn how you can easily buy <coin>"), they wouldn't rat me out to my family/friends or the police. I guess I will just have to pay them, but then again I have a HUGE payday coming from that nice Nigerian prince and another from that fantastic Singaporean economic attaché... once I send them some bucks to cover processing fees, of course[3].

All joking aside tho, I get how some people may be scared by things like the CCPA emails, or the kind of emails I mentioned (if those didn't work enough times, scammers would have stopped by now). When I just read that particular email in the article, I didn't see a legal threat, but that's just me of course. Other people might read it differently, and I cannot fault them for that. I remember being concerned myself the first time one of those "imprint" scam emails made it through the spam filter.

[0] In Germany, commercial websites are legally required to have an imprint, and everybody can basically sue you if you mess that up, that much is true. It's also true that courts regularly rule that if you profit even from a private website, e.g. by displaying ads, then your website is in fact commercial and requires that imprint.

https://www.bmjv.de/DE/Verbraucherportal/DigitalesTelekommun...

[1] This isn't to denigrate all Indian or Pakistani people, of course. It's just that the "security researcher" scammers I encountered thus far all operated from these two nations.

[2] Ranging from "homosexual" to "child". I wouldn't consider adult gay porn "bad" myself at all (just not interesting to me), that's their definition. It's quite interesting to me to see how they try to phish for closeted gay people more often than for pedophiles, at least anecdotally from what makes it to my spam folder. My guess is that the number of people who actually watch gay porn and are ashamed of it largely exceeds the number of people watching child abuse porn.

[3] I received those "huge money - pay fee" scam emails more than 20 years ago, and I still receive them today. Cannot argue with success, I guess?

[0] https://privacystudy.cs.princeton.edu

Here’s an example. Your doctor calls to talk to you about you sexual health. You discuss at length about all the issues you’ve been having lately, and you break into tears when your doctor tells you it’s permanent. At the end of the call, your doctor explains that he/she was joking, and that you just have low vitamin levels. You find your anecdotal story in the front page of a medical journal the next year.

You can imagine similar situations where someone calls to tell you have cancer and observes for a month. Or that your significant other died in a car crash this morning. Or if someone claims they are suing you for a large amount of money. In all those cases, the person contacted may have a mental breakdown or worse.

In regards to lying, I find such use of misdirection to be arguable ethical because 1) pseudo identities are entirely normal and expected on the internet so encountering one should not cause anybody undue stress, 2) it is not fraud, so it’s legal and does not cause harm, 3) because the experiment would not be possible without the appearance that the request came from an individual and not a research team, and 4) because if submitted to a corporation none of this discussion would even be happening. And 5) because California law requires organizations/websites to provide this information (in cases the law outlines) when it is requested which to me indicates these type of requests are supported/good/normal.

The text says: “this is not a CCPA request I just have some questions about the logistics if I were to file one” and includes a reminder that there’s possibly a legal obligation to provide these details. It’s not asking for personal details or information about a person.

For the deception, you have to weigh the pros and cons. The harm isn’t very high but 1) it undermines public trust of research and 2) includes the participant in a study they did not consent for. The participant is not getting paid for their time and is in fact getting indirectly threatened/coerced with legal action.

The IRB board of course makes all these calls. But it’s not “obvious” that the research is ethical. For example, research can be unethical _with participant consent_ if participants are offered too much money, because people will do _very_ bad things for large sums of money, so it’s basically coercion. In this case, there is an implication of legal action if the participant does not participate and they may not have an option to withhold their participation.

Consider the alternative: “Hi, I am a researcher from Princeton. For your time answering these 4 questions, you will receive $50 and an opportunity to advance our understanding of ____.”

[1] https://researchservices.cornell.edu/resources/irb-faqs

The ethical problem is that you can't do research on people without their consent. The fact that the researchers knew they were doing research, not actually asking a question as an ordinary user of the website, makes a difference. Intent matters.

But websites cannot answer questions.

If your study is simply "how do the servers of various websites respond to my HTTP requests", that doesn't require informed consent, because it's not involving humans.

Once your study moves into the realm of "how do the operators of websites respond to me legal requests", that requires informed consent, because website operators are humans.

It's really very, very simple. If you need responses from human beings, that's human subjects research, and it requires informed consent and greater scrutiny from the IRB.

No, some websites are tools used by businesses to help achieve their business goals.

Is the website on which we are having this conversation a business?

Websites are one or more servers that respond to the HTTP and/or HTTPS protocols with something a web browser can show. They may have a business involved. They do not necessarily have one involved.

They may simply be a goofy joke, such as https://zombo.com or http://www.abevigoda.com.

They may be a personal site, such as, well, https://christine.website. Which is a blog and a list of projects done by one person.

They may even be a front-end for a dynamic application but still not a business - I run a small Mastodon instance and it's just "a place for me and my friends to talk", not "a business"; having it grow to the size where I'd have to deal with stuff like the CCPA or the GDPR is something I absolutely do not want.

The experiment aspect is only a problem in as much as it being an experiment caused the researchers to do something they wouldn't normally have done, or been okay doing.

I hope it's obvious why that is a poor ethical standard for what constitutes acceptable research practice.

It is unacceptable to do something to a person so you can study the way they behave, without first obtaining their consent to participate in such a study.

You can observe how people behave when they are subjected to the same stimulus naturally; you can ask them if it’s okay to subject them to a stimulus to see how they react; but you can’t just do something to them and write down what happens.

"Someone can be sued, therefore a researcher making vague legal threats to see if people waste money on lawyers is ethical."

"Someone can get syphilis and not receive treatment, therefore infecting people with syphilis and denying treatment is ethical."

(By the way, 2 out of the 3 are real studies. The middle one is this one. The third one is the Tuskegee Syphilis Study.)

As an absurd example of something that is highly unethical, but perfectly legal: research into whether certain images or colors on protest signs are likely to elicit a response. You choose military funerals as the protest site. In the US the right to protest at a funeral has been confirmed by the courts. This would still be an unethical action.

Many companies, including ones that I’ve worked for, that received a message like this would take it VERY seriously and expend some expensive resources (lawyers and programmers) to discover that ccpa does not apply and that they aren’t required to respond.

A more ethical way to gather this data would have been to be honest about identity and purpose, Notify the recipient that their response would be anonymized and never used against them, and to inform them that a response is not required.

The bar is very high, and with good reason: you're experimenting on humans. One of the foremost requirements is the notion of informed consent: you can't experiment on people who don't know or understand, or who didn't give you permission.

This experiment very clearly involved human subjects and very clearly violated informed consent. If the student involved did not realize this, certainly his advisor did or he'd have to be considered incompetent. And if the experiment was indeed placed before the IRB and was given an exemption, as was implied, then Princeton's IRB made a glaring and incredible error.

Had this student simply sent out a questionnaire from his Princeton email address, rather than conduct an experiment, he might have reasonably obtained IRB exemption or permission. But as I understand it, he (1) hid behind aliases so they did not know they were being experimented on, and (2) threatened legal deadlines in responding to his questions. There is no way this was ethical by IRB standards.

One thing that really bothers me is that people are attacking the blogger for using the word "consent", suggesting it's hyperbole in the sense of date rape or whatnot. This is terrible: "consent" is the standard and correct term used in human subjects research, and is a factual description of exactly what occurred.

> The study aims to understand how websites would respond to real users, while accommodating websites that may have less capacity to respond.

That is, they're not interested in what the website's policies are via questionnaires. They're prodding them under false pretenses to see what would happen. This is definitely human subjects research.

Are you sure about this? Didn't these requests get sent to entities that didn't even fall under the categories in the statutes? Meaning they would in fact not have been normally dealing with these kinds of requests on a regular basis (if at all)?

It's that they:

a) did not get the people's informed consent to participate in human subjects research,

b) misrepresented themselves as being potentially-litigious parties interested in the handling of their own data under the CCPA, who further were misrepresenting the degree to which the CCPA applied to them, and

c) misled their IRB into believing this was not human subjects research, so that they did not get stopped from doing (a). (That, or the IRB itself is culpable for this aspect of the unethical behavior; I haven't seen specific information one way or the other.)

And to be clear about these requirements:

You may recall stories about psychological experiments during the Cold War, like the Milgram Experiments (where the participants were told to administer electric shocks to people), and the Stanford Prison Experiment (where they assigned a bunch of undergrads to be prisoners and guards). Due to wildly unethical experiments like those, the scientific institutions of our country developed the system of Institutional Review Boards (the aforementioned IRB), which have fairly clear standards that they hold researchers to (though, granted, those standards will naturally vary somewhat from institution to institution).

One of the primary purposes of IRBs is to ensure that all human scientific research participants give informed consent to participate in the study. That means, among other things, they have to be informed of the risks of the study—and those risks, by design, must include the mental distress that can be caused by the experiment. (That, after all, was the primary negative outcome of the Milgram Experiments and the Stanford Prison Experiment: they caused serious psychological distress.)

I don't work at Princeton, so I can't speak to the specifics of how they consider such things, but I do work for the psychology department of a university with a strong tradition of research—in fact, I built the web-based system the IRB here now uses to manage their workflow, so I've worked closely with them for over a decade now—and I can tell you with some certainty that letters like these would not in any way be considered acceptable without a signed informed consent form. They are very clearly designed to evoke an emotional response in the recipients—a fear response, specifically—and that absolutely requires the full scrutiny of the IRB.

https://news.ycombinator.com/item?id=29611305

"Second, our team is prioritizing a possible one-time follow-up email to recipients, identifying the academic study and recommending that they disregard the prior email. If that is feasible, and if experts in the email operator community agree with the proposal, we will send the follow-up emails as expeditiously as possible."

Did this study send automated emails in such volume that they can't work out how to send an apology without triggering spam protections? Or did they send email and not record it? What is he saying here?

"We screwed up by spamming a lot of people. We like to apologize and fix our mistake. We currently have two options:

1. apologize by sending a second email. This second email will contain an apology and the phrase 'disregard the prior email'

2. apologize by some other method (e.g. this website)

Option #1 pro: reaches everyone we're previously spammed

Option #1 con: we will be spamming people a second time. If the first round of spamming puts us in legal/ethical jeopardy, then this second round of spamming could make it worst

We have not performed Option #1 yet. We do not know whether we should perform Option #1 or not. We are taking the temperature of the 'email operator community' to see whether we should performed Option #1 or not. If Option #1 gets the green-light then we'll do it ASAP."

If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously?

I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.

Which even if it is completely nonsensical and has no basis in law, could cost thousands of dollars to hire a lawyer and file a response to a statement of claim.

If you have ever seen the experiences of people who have been sued by sovereign citizens/freeman-on-the-land/"this is an admiralty flag" people, it would help to better understand the context I'm viewing it in.

That statement is false. Please don’t provide incorrect legal information in this forum.

It doesn't need to be legally binding to be worrisome. Imagine I told you "I'm going to sue you. You don't need to do anything until you get the formal notice" and you found the statement credible. Would you go on with your life as normal, or would you be stressed and hire counsel if affordable?

yes it will, but a really determined person with an axe to grind will very often make known their intentions well in advance of that.

and no, it won't always come by snail mail, DMCA notices and similar with actual legal threats will arrive regularly via SMTP.

Perhaps you've never had thousands of people torrenting movies using you as a service provider before.

Serious lawyers don't use email.

And I consider DMCA notices to fall within the category of a certain specific type of legal threat. There are also some in the queue right now that don't read like typical DMCA notices such as you might receive for downloading the mandalorian, but look more like straight out attempts at extortion (pay us right now so that we won't sue you for torrenting backdoor sluts volume XII, etc).

As to what the ultimate end user recipients consider them to be, that's up to them and their counsel.

I don’t know where you “learned” this false information, but I would recommend going to whatever authority figures are spouting this nonsense and correcting them.

I call a lawyer any time I have a legal question for which I am not confident about the answer. If it’s not a real problem, a lawyer will be able to answer it a fraction of an hour’s worth of billable time.

Except that they will probably won't know the answer immediately an need more time than that: https://twitter.com/DanielleVEsq/status/1472105731474137094

And to those unaware that this is a possibility, disseminating this knowledge is our collective responsibility. Be part of the solution.

Responding to spam and then feeling like you've been the victim of some injustice that the spam didn't say "hey, I'm not really spam, I'm grad-student flavored spam" is quite a take.

Here's a tip for anyone not running a business: If your response is legally required, it'll come in the physical mail. Don't take legal advice from spam, me, or your sysadmin.

Yes. It's not hard.

Given that they were targeted here, this person has a public mail address, so it's very likely they receive similar spam. Given that and the observation that they seem to be stressed by spam, this seems like a plausible assumption.

[0] At least when we assume good faith.

Yes but you still need to be judicious and critical.