Ethical Concerns in Computer Security and Privacy Research Involving Human Subjects

摘要

In this panel statement I highlight four specific types of ethical concerns I've encountered when designing security and privacy human subjects studies. Increasingly, computer security researchers are employing human subjects studies, which raise additional ethical concerns that go beyond the typical concerns associated with vulnerability research, publishing security holes, and the double-edged sword of anonymity tools. Here I highlight four specific types of ethical concerns I've encountered when designing security and privacy human subjects studies. For government-funded researchers in the United States, human subjects studies require approval by an Institutional Review Board (IRB). Similar requirements exist in some other countries and some companies have internal review processes for human subjects studies. IRB review helps ensure that most ethical issues associated with security and privacy human subjects studies are appropriately addressed, for example, by minimizing data collection and quickly de-identifying data, obtaining informed consent from study participants, and debriefing study participants at the end of the study. However, computer security researchers are not always aware of the need to seek IRB approval, and IRBs do not always have the expertise to provide adequate review.