> The IRB of University of Minnesota reviewed the procedures of the experiment and determined that this is not human research. We obtained a formal IRB-exempt letter.

Is there anyone on hand who could explain how what looks very much like a social engineering attack is not "human research"?