Ethical issues in research using datasets of illicit origin

Conference Object
Change log
Thomas, DR 
Pastrana Portillo, Sergio Pastrana  ORCID logo
Beresford, AR 

We evaluate the use of data obtained by illicit means against a broad set of ethical and legal issues. Our analysis covers both the direct collection, and secondary uses of, data obtained via illicit means such as exploiting a vulnerability, or unauthorized disclosure. We extract ethical principles from existing advice and guidance and analyse how they have been applied within more than 20 recent peer reviewed papers that deal with illicitly obtained datasets. We find that existing advice and guidance does not address all of the problems that researchers have faced and explain how the papers tackle ethical issues inconsistently, and sometimes not at all. Our analysis reveals not only a lack of application of safeguards but also that legitimate ethical justifications for research are being overlooked. In many cases positive benefits, as well as potential harms, remain entirely unidentified. Few papers record explicit Research Ethics Board (REB) approval for the activity that is described and the justifications given for exemption suggest deficiencies in the REB process.

ethics, law, leaked data, found data, unintentionally public data, data of illicit origin, cybercrime, Menlo Report
Journal Title
Proceedings of IMC '17
Conference Name
ACM Internet Measurement Conference (IMC)
Journal ISSN
Volume Title
Engineering and Physical Sciences Research Council (EP/M020320/1)
Daniel R. Thomas is supported by a grant from ThreatSTOP Inc. All authors are supported by the EPSRC [grant number EP/M020320/1]. The opinions, findings, and conclusions or recommendations expressed are those of the authors and do not necessarily reflect those of any of the funders.