Why? Did they not get consent? Getting that sort of information isn't terribly difficult. Even basic network monitoring and log parsing would provide a lot of insights into how someone is interacting with a computer.

Among other reasons, in any IRB-approved study people need to be able to withdraw consent with no adverse consequence. It is likewise practically forbidden to experiment on prisoners, which this has more in common with than a normal study.