CCE STEM: Standard: Collaborative: The Development of Ethical Cultures in Computer Security Research

计算机安全研究人员预防、发现和修复设备和网络基础设施中的漏洞，从而影响国家安全、商业实践、信息隐私和个人安全。然而，这些研究人员还必须克服道德困境，比如如何使用大数据和共享的网络资源来发现漏洞；如何安全地暴露这些问题；以及如何最好地确保修复关键漏洞。在这个项目中，PI将分析计算机安全研究人员随着时间的推移而进行的学术话语和私人反思，以揭示关于人、技术变化和研究实践的变化如何塑造安全研究中的伦理文化，以及伦理如何塑造研究实践的见解。通过对一个重要和成熟的技术研究社区的分析，个人投资促进机构将展示道德文化是如何发展和维持的，并探索道德自律的局限性。他们将确定道德自律在这个社区的优势和劣势，并借鉴计算机安全领域的道德实践，为其他计算研究社区提供信息。项目成果还将改进信息和计算研究人员的伦理教育方法，案例研究将展示自我监管的最佳实践。为了实现他们的目标，私人投资机构将利用包括引文分析、内容分析和访谈在内的多种方法来说明和评估计算机安全研究的伦理文化。该项目提出了四个问题：r1)计算机安全界是如何形成伦理研究文化的？R2)研究人员之间如何沟通道德期望？R3)哪些社会技术因素支持和挑战可持续的道德实践？R4)道德自律在计算机安全研究中的有效性如何？研究将分四个阶段进行。第一阶段将通过引用和话语分析，通过分析过去二十年计算机安全研究中的关键伦理时刻，来审查伦理争议和社区反应的发展。第二阶段将采访不同的计算机安全研究人员，通过引用和话语分析来追踪社区如何随着时间的推移发展和改变其伦理方法。第三阶段将对计算机安全研究中道德自律的优势和劣势进行利益相关者评估。第四阶段将根据学生的经验研究结果以及为会议审查委员会和努力确定计算机安全伦理研究最佳做法的研究人员提出的政策建议，创建和评估教育案例研究。

Computer security researchers prevent, discover, and fix flaws in devices and cyberinfrastructures, thereby impacting national security, business practices, information privacy, and personal safety. However, these researchers must also navigate ethical dilemmas about how to use big data and shared networked resources to discover vulnerabilities; how to safely expose these problems; and how to best ensure that critical vulnerabilities are fixed. In this project, the PIs will analyze the scholarly discourse and private reflections of computer security researchers over time, to reveal insights about how people, changes in technology, and changes in research practices shaped ethical cultures in security research, and how ethics shaped research practice. Through this analysis of an important and mature technical research community, the PIs will demonstrate how an ethical culture was developed and sustained, and explore the limits of ethical self-regulation. They will identify the strengths and weaknesses of ethics self-regulation in this community, and draw upon ethical practices within computer security to inform other computing research communities. Project outcomes will also improve ethics pedagogy for information and computing researchers, with case studies that demonstrate best practices for self-regulation.To accomplish their goals, the PIs will utilize multiple methods, including citation analysis, content analysis, and interviews, to illuminate and evaluate the ethical culture of computer security research. The project asks four questions: R1) How has the computer security community formed an ethical research culture? R2) How are ethics expectations communicated among researchers? R3) What sociotechnical factors support and challenge sustaining ethical practices? R4) How effective is ethical self-regulation in computer security research? The research will be conducted in four phases. Phase I will examine the development of ethics controversies and community responses through an analysis of key ethics moments in the last twenty years of computer security research through citation and discourse analysis. Phase II will interview diverse computer security researchers identified by the citation and discourse analysis to trace how the community developed and changed its approach to ethics over time. Phase III will conduct a stakeholder assessment of the strengths and weaknesses of ethical self-regulation in computer security research. Phase IV will create and evaluate educational case studies based on the empirical findings for students, as well as policy recommendations for conference review committees and researchers struggling to identify best practices for ethical computer security research.