I would be very much interested in seeing the IRB submission/application that was submitted for this study. I wonder whether or not it was mischaracterized to the IRB, or written in such a way as to diminish the problematic aspects.
We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. The focus of the study is understanding website policies and practices, and emails associated with the study do not solicit personally identifiable information.
It really seems to me that people are conflating "annoying" with "unethical". Sure, spamming people is annoying. But how is it unethical? I had the same questions about the linux kernal security patches issue. Annoying waste of a few maintainers time, arguably yes for some definition of waste. But unethical? How so and can someone link me to literature detailing the ethical framework that disallows otherwise legal activity in good faith pursuit of knowledge because someone got annoyed in the process? I think that would be an interesting read.
This caused significant anxiety on the part of the individuals who received this email, since it implied they would be subject to legal action if they did not provide a sufficient reply. It caused them to take significant action -- e.g., to research the law (that they aren't subject to), to determine if/how they could comply with a CCPA data access request if they had to, to consider retaining legal representation, etc.
It came off as some kind of scam or mistake, but one that had to be taken seriously.
You could read some of the blog posts from people who received these emails to understand the effect it had on them. It might also help you to read the email they received and imaging receiving the same for a site for a personal blog or one-man shop.
I think what you are missing though, is that just because something passed a review board, that does not make it ethical. Review boards, like everything else, will make mistakes.
Other fields (e.g., psychology) have long since recognised inherent problems with the ethical aspects of deception research (in a very tiny nutshell: you harm your subjects' agency). Therefore, guidelines and protocols have been established (e.g., by the APA).
Roughly, those boil down to:
- don't do deception research unless no alternative method exists AND the outcome will have significant value
- inform the participants as soon as possible about the deception.
In this case, both IRB and researchers failed to recognise this as deception research. That is in itself a serious issue.
> who are we really to challenge that
We are not obligated to make the same ethical judgement as the IRB. We are all entitled to challenge that.
Making bogus legal threats is unethical, when being sued can realistically lead to completely altered life. Yes, it's an annoyance, after the subjects determined that the threat is bogus, but it could be legitimately distressing (even costly) when they first received the threat.
The researchers made no efforts to contain the negative impact of their email, either. The email contains no information about it being a bogus threat. The subjects weren't told in advance that they might be lied to. The subjects had given no consent to being scared.
It doesn't seem "good faith" to send mass threatening emails with deliberately misrepresented laws.
Remember that the Milgram experiment also involved no illegal actions, and were done in pursuit of knowledge.
Spamming is unacceptable, unwanted, illegal and unethical for quite obvious reasons, namely
(1) negative effects do not justify benefits (2) spammer gets benefits at cost of others (3) it is annoying (4) its is not needed.
Rare exceptions may apply, it is not one of them.