Did University of Minnesota have any type of IRB? I sorta hope this can be the "come to Jesus moment" for academic CS to implement safeguards (such as IRBs) to prevent harm.
They did approve because the research is not a human study, which in my opinion is a correct decision. But, this decision does not endorse the study to be totally ethical, which is a totally different issue.
How can you categorize this as "not a human study"? They were experimenting on "the patching process" which is not some abstract concept, it's a system that humans designed and execute by individual action.
If it was not a human study, then why couldn't they just stimulate it on a computer where the maintainers are completely uninvolved? Obviously that's not possible. Why? Because they were studying the humans themselves. This is so clear even from the apology email that is the topic of this thread, I don't understand how people are still confused here.
This is not a US patent grant where simply adding "yeah that but on a computer" gives you an instant rubber stamp.