The guy seems completely unrepentant to even the idea that he might be violating people's privacy.
Their paper reveals that initially they designed a bot to scrape profile data, but that this first method was dropped because it was “a decidedly non-random approach to find users to scrape because it selected users that were suggested to the profile the bot was using.” This implies that the researchers created an OkCupid profile from which to access the data and run the scraping bot. Since OkCupid users have the option to restrict the visibility of their profiles to logged-in users only, it is likely the researchers collected—and subsequently released—profiles that were intended to not be publicly viewable.
So, yeah, at the risk of breaking my attempted objectivity, I'd be personally thrilled if the guy got sued.
I mean, sure, academics might get stopped by lawsuits. Russian social engineering hackers won't though.
"You should appreciate that all information submitted on the Website might potentially be publicly accessible. Important and private information should be protected by you. We are not responsible for protecting, nor are we liable for failing to protect, the privacy of electronic mail or other information transferred through the Internet or any other network that you may utilize."
This is of course a kind of "privacy by obscurity," and it is not at all secure. For example, if you want you can probably figure out people's answers to all questions, even the private ones, by having a separate bot for every question. Then the percent match between the bot and a user reveals the user's answer to that one question. (Possibly OkCupid introduces some noise in the matching algorithm to make this harder, but it can almost certainly be circumvented.)
However, the exposure of the data is no more [or less] a violation of privacy than what is typically reserved for operators under the terms and conditions of large websites. Neither is it more [or less] a violation of privacy than what is allowed by right when data is treated as a corporate asset [under US law] when ownership of the asset is transfered via sale or bankruptcy.
To put it another way, it is only to the degree that it is in OkCupid's business interest to limit disclosure of the same data points that OkCupid [insert other any other corporation here] refrains from releasing that data.
The only reason our visceral reactions are different is that we hold biologic people to a different standard of "doing the right thing" than the fictitious persons that are corporations. Legally, a person owned that data. That's why a breach was possible. It's the reification that creates the privacy problem.
Yeah, this is a grad student who fails the maturity test in a big way. I could perhaps kind of understand the position that repackaging publicly available sensitive data was just a lapse in taste (assuming, likely erroneously, that it was truly public and not harvested by posing as a mate-seeker). Now he's equating blowback from this lapse with "social justice warriors"? This person sounds like an absolute peach.