Whether or not it's surprising is perhaps the least interesting point for discussion. Universities have a responsibility to conduct human research ethically and I hope we hear a lot more about how this research in particular was conducted. This could have endangered lives depending on how it was done, and I'm quite sure the ends don't justify the means unless it was specifically done in a way which protected the anonymity of untargeted users.
>Universities have a responsibility to conduct human research ethically
which means little given the laws of nature, all that matters is what people end up doing and measuring that statistically. If statistically speaking most people aren't ethical then that's what we'll get. This whole idea that people are in control of their actions or have any freedom whatsoever given what we know about the laws of nature has to go.