CCE STEM: Standard: Collaborative Research: The Development of Ethical Cultures in Computer Security Research

计算机安全研究人员预防、发现和修复设备和网络基础设施中的缺陷，从而影响国家安全、商业惯例、信息隐私和个人安全。然而，这些研究人员还必须在如何使用大数据和共享网络资源来发现漏洞的伦理困境中导航；如何安全地暴露这些问题；以及如何最好地确保关键漏洞得到修复。本研究将分析计算机安全研究人员的学术话语和私人反思。我们的目标是揭示人们、技术的变化和研究实践的变化如何影响安全研究中的伦理文化，以及伦理如何影响研究实践。通过对技术研究社区的分析，本研究将展示道德文化是如何发展和维持的，以探索道德自律的局限性。它将确定道德自律的优点和缺点，并借鉴计算机安全领域的道德实践，为其他计算机研究团体提供信息。项目成果将有助于信息和计算研究人员的伦理教育学，并为学生和从业人员提供案例研究，以展示自我监管的最佳实践。本研究将运用引用分析、内容分析及访谈等多种方法，阐明及评估电脑安全研究的伦理文化。该项目提出了四个问题：R1)计算机安全社区如何形成道德研究文化？研究人员之间如何沟通伦理期望？什么社会技术因素支持和挑战维持道德实践？R4)计算机安全研究中的道德自律有多有效？研究将分四个阶段进行。第一阶段将通过引用和话语分析分析过去二十年计算机安全研究中的关键伦理时刻，研究伦理争议和社区反应的发展。第二阶段将采访通过引用和话语分析确定的不同计算机安全研究人员，以追踪社区如何随着时间的推移发展和改变其伦理方法。第三阶段将对计算机安全研究中道德自律的优势和劣势进行利益相关者评估。第四阶段将根据学生的实证研究结果，创建和评估教育案例研究，以及为会议审查委员会和努力确定道德计算机安全研究最佳实践的研究人员提供政策建议。

Computer security researchers prevent, discover, and fix flaws in devices and cyberinfrastructures, thereby impacting national security, business practices, information privacy, and personal safety. However, these researchers must also navigate ethical dilemmas about how to use big data and shared networked resources to discover vulnerabilities; how to safely expose these problems; and how to best ensure that critical vulnerabilities are fixed. This proposed research will analyze the scholarly discourse and private reflections of computer security researchers over time. The goal is to reveal insights about how people, changes in technology, and changes in research practices shaped ethical cultures in security research and how ethics shaped research practice. Through this analysis of a technical research community, the proposed research will demonstrate how an ethical culture was developed and sustained in order to explore the limits of ethical self-regulation. It will identify the strengths and weaknesses of ethics self-regulation and draw upon ethical practices within computer security to inform other computing research communities. Project outcomes will contribute to ethics pedagogy for information and computing researchers and develop case studies for use by students and practitioners that demonstrate best practices for self-regulation.The proposed research will utilize multiple methods, including citation analysis, content analysis, and interviews, to illuminate and evaluate the ethical culture of computer security research. The project asks four questions: R1) How has the computer security community formed an ethical research culture? R2) How are ethics expectations communicated among researchers? R3) What sociotechnical factors support and challenge sustaining ethical practices? R4) How effective is ethical self-regulation in computer security research? The research will be conducted in four phases. Phase I will examine the development of ethics controversies and community responses through an analysis of key ethics moments in the last twenty years of computer security research through citation and discourse analysis. Phase II will interview diverse computer security researchers identified by the citation and discourse analysis to trace how the community developed and changed its approach to ethics over time. Phase III will conduct a stakeholder assessment of the strengths and weaknesses of ethical self-regulation in computer security research. Phase IV will create and evaluate educational case studies based on the empirical findings for students, as well as policy recommendations for conference review committees and researchers struggling to identify best practices for ethical computer security research.