Hacker News Reader

“They are extremely careful about your concern” requires that we trust both their intentions and their competence, which should not be assumed.

“None of the researchers care about you” - strawman, no one said that or thinks that, and it’s irrelevant.

“Everyone involved promises not to identify anyone” - see response to first point.

I think the other points are valid though.

> “Everyone involved promises not to identify anyone” - see response to first point.

They legally promise via some form a non-disclosure agreement. A violation means they are liable in the case they are the source of a breach, which can both provide incentives and recourse. Certainly not ironclad, but it is stronger than just a vague "promise."

It's stronger, but still pretty weak. In my experience people willfully ignore NDAs all the time. I think it's only lawyers who take them seriously, or at least pretend to take them seriously.

First you have to care enough to go after the NDA breaker. Then you have to have enough evidence to legally demonstrate they broke the NDA. Then you have to pursue legal action. This all costs time and money, and even then there's a good chance you can't actually prove anything.

You have to seriously piss off someone (most likely a large corporation) with a lot of time and money for it to matter that you broke an NDA.

> strawman, no one said that or thinks that, and it’s irrelevant.

OP said he didn’t want to be de-anonymized. Either the researchers do that themselves or the data is stolen and someone else does it. For the first group, I tried to explain why the researchers themselves aren’t going to and why.

So I’m not sure no one thinks it and it’s not irrelevant.

Sorry, that came across a bit harsh. But…

> Either the researchers do that themselves

Has anyone suggested that? I don’t think anyone is concerned about the motives of MIT researchers.

> I don’t think anyone is concerned about the motives of MIT researchers.

Until you become a public figure with the wrong set of opinions, maybe.

> I have not heard of university data beaches myself.

Nearly every large organization has probably had a data breach, the only questions are if it was discovered and if so if it was reported. MIT can have the best cybersecurity team in the world and they will still be helpless against a 0-day.

Fair point. Nothing prevents mit from getting robbed tomorrow. Nothing prevents Vanguard from facing the same zero day. My claim only was that mit would take it seriously and that’s personally don’t hear about a lot of university data breaches.

It used to be that IRBs required AFFIRMATIVE CONSENT from participants. It doesn’t matter what just so story you tell yourself.

Research ethics 101: Don’t use people as lab specimens unless they affirmatively consent. Period.

We should go back to the days of actual ethics in research.

Banks and brokerages can do whatever they want with customer data, subject to relevant laws and contracts. Researchers who ever want a penny from the public should be held to higher ethical standards.

> It used to be that IRBs required AFFIRMATIVE CONSENT

This is (and has always been) waivable in cases (like this one) where either obtaining consent is impractical (which maybe applies here) OR you are making use of de-identified data (more likely to apply in this case). Affirmative consent still is required in many cases.

With health data (the case I know personally), it would not be feasible for me to find five million patients and ask them to participate in my boring study answering a question which wouldn’t interest them. Just mailing each of them a letter to ask would be cost prohibitive!

The value of research is frequently non-zero, whereas the risk to the participants is generally zero or extremely low. This is the balance the IRB is trying to strike.

And believe me, as someone who has gone through it, I think they err way way WAY too far on the side of being overly cautious!

IRB's do require affirmative consent, but the IRB is not required to analyze certain datasets. Moreover, the contract of investors with the trading firm probably already had language allowing this usage.

Dataset ethics review is becoming nore common. I'll be surprised if this "use corporate data without irb input" model survives the decade.

Corps can put whatever they want in tos, and researchers are free to use data from those corps. But federal agencies should refuse to fund those pis and their institutions.

I agree with what you're saying (except I have heard of university data breaches because I follow that sort of thing), but also the information in this study is extremely personal and sensitive.

While I'm sure there was a lot of attention on data security behind the scenes it is a little unnerving to hear someone say, when you aren't expecting it, "we looked at everyone's brokerage history and here's when they felt fear that they were about to lose everything."

I do wish there was a way to at least reduce the surprise factor. Perhaps put a note about the data collection protocol in the abstract on the article page.

It’s not about identifying you it’s more about using the data from you and Weaponized in it against you. Citadel Securities, the market maker, is known to do this kind of thing to rip off retail traders via data obtained from trading platforms such as Robinhood, webull etc. This is an uneven battlefield and it’s obviously wrong and that’s the reason why we don’t want our data to be shared, it amounts to spying on our behavior in order to control, profit or what other nefarious reasons.

Totally a fair point but Citadel does not need Andrew Lo’s (an author on this paper) help to do that. Nor is that what he gets out of it. Citadel can do it (and may try to do it?) itself without his input. The research angle is orthogonal to your concern.

That's why Robinhood is free no? Can't you choose a broker that doesn't sell your data?

Yes absolutely but people don’t realize how much it works against them; this kind of thing should be illegal in my oppinion. If we care about protecting the investors and making a fair market at least. This is beyond a hidden fee, this is almost stealing the customer’s purse

https://en.wikipedia.org/wiki/AOL_search_data_leak

https://techcrunch.com/2006/08/06/aol-proudly-releases-massi...

Cambridge analytica, containing all facebook data for 87M people?

Cambridge Analytica is a private political consulting firm, not a university or any other type of an educational institution.

Cambridge Analytica acquired their data from a research associate at the University of Cambridge, Aleksander Kogan.

MIT is not a single entity.

Good security in one group does not mean good security in another group - at all.

Thank you for the insightful comment. While there's similar concerns for health, I think financial circumstances are somewhat different.

Few people have any interest in finding out "who that person with cancer in that small town is", but "who is that unknown multi-millionaire in my parents' village" might be more tempting.

There's no political issue around individual health issues, but individual wealth is very political. I can definitely understand why someone wouldn't want identifiable information about their personal wealth given to third parties, especially not to US universities, which have a tendency to be rather left-wing and full of ideas of undeserved privilege that many don't share and would not feel comfortable knowing that their private information is shared with them. An angry research or student taking to Twitter to call out the evil capitalists isn't that crazy of an idea.