[ineedasername]

I'd love to see what they submitted to their IRB to get the determination of no human subjects:

It had a high human component because it was humans making decisions in this process. In particular, there was the potential to cause maintainers personal embarrassment or professional censure by letting through a bugged patch. If the researchers even considered this possibility, I doubt the IRB would have approved this experimental protocol if laid out in those terms.

[sonofgod]

https://research.umn.edu/units/irb/how-submit/new-study , find the document that points to "determining that it's not human research", leads you to https://drive.google.com/file/d/0Bw4LRE9kGb69Mm5TbldxSVkwTms...

The only relevant question is: "Will the investigator use ... information ... obtained through ... manipulations of those individuals or their environment for research purposes?"

which could be idly thought of as "I'm just sending an email, what's wrong with that? That's not manipulating their environment".

But I feel they're wrong.

https://grants.nih.gov/policy/humansubjects/hs-decision.htm would seem to agree that it's non-exempt (i.e. potentially problematic) human research if "there will be an interaction with subjects for the collection of ... data (including ... observation of behaviour)" and there's not a well-worn path (survey/public observation only/academic setting/subject agrees to study) with additional criteria.

[ineedasername]

Agreed: sending an email is certainly manipulating their environment when the action taken (or not taken) as a result has the potential for harm. Imagine an extreme example of an email death-threat: That is an undeniable harm, meaning email has such potential, so the IRB should have conducted a more thorough review.

Besides, all we have to do is look at the outcome: Outrage on the part of the organization targeted, and a ban by that organization that will limit the researcher's institution from conducting certain types of research.

If this human-level harm was the actual outcome means the experiment was a de fact experiment including human subjects.

[soneil]

I have to admit, I can completely understand how submitting source code patches to the linux kernel doesn't sound like human testing to the layman.

Not to excuse them at all, I think the results are entirely appropriate. What they're seeing is the immune system doing its job. Going easy on them just because they're a university would skew the results of the research, and we wouldn't want that.

[ineedasername]

Agreed: I can understand how the IRB overlooked this. The researchers don't get a pass though. And considering the actual harm done, the researchers could not have presented an appropriate explanation to their IRB.