Computer security research with human subjects: risks, benefits and informed consent

Authors:
Maritza L. Johnson;Steven M. Bellovin;Angelos D. Keromytis
Affiliations:
Computer Science Department, Columbia University;Computer Science Department, Columbia University;Computer Science Department, Columbia University
Venue:
FC'11 Proceedings of the 2011 international conference on Financial Cryptography and Data Security
Year:
2011

Citing 7
Cited 0

Why Johnny can't encrypt: a usability evaluation of PGP 5.0

SSYM'99 Proceedings of the 8th conference on USENIX Security Symposium - Volume 8
What ought a program committee to do?

WOWCS'08 Proceedings of the conference on Organizing Workshops, Conferences, and Symposia for Computer Systems
IRBs and security research: myths, facts and mission creep

UPSEC'08 Proceedings of the 1st Conference on Usability, Psychology, and Security
School of phish: a real-world evaluation of anti-phishing training

Proceedings of the 5th Symposium on Usable Privacy and Security
Ethics in Security Vulnerability Research

IEEE Security and Privacy
A framework for understanding and applying ethical principles in network and security research

FC'10 Proceedings of the 14th international conference on Financial cryptograpy and data security
Ethical concerns in computer security and privacy research involving human subjects

FC'10 Proceedings of the 14th international conference on Financial cryptograpy and data security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Computer security research frequently entails studying real computer systems and their users; studying deployed systems is critical to understanding real world problems, so is having would-be users test a proposed solution. In this paper we focus on three key concepts in regard to ethics: risks, benefits, and informed consent. Many researchers are required by law to obtain the approval of an ethics committee for research with human subjects, a process which includes addressing the three concepts focused on in this paper. Computer security researchers who conduct human subjects research should be concerned with these aspects of their methodology regardless of whether they are required to by law, it is our ethical responsibility as professionals in this field. We augment previous discourse on the ethics of computer security research by sparking the discussion of how the nature of security research may complicate determining how to treat human subjects ethically. We conclude by suggesting ways the community can move forward.