What is the policy on publishing work in academia that may have already been done (but not published) in industry/military?

Question

I am interested in pursuing an area of computer security that is very likely already being studied by security professionals in industry and perhaps the military as well. Some of it is published, but I imagine some of it could also be unpublished work that companies and the military might not want to share with the public.

I could see my research group independently developing some unpublished techniques that probably are already in use in some form or another by existing companies who don't wish to share those to the public. In this case, is it acceptable for me to publish this as my own research, given that I have no affiliation to the company in question (assuming such a company does exist, which could very well be the case)? If I do publish, can I be in trouble for publishing work which these companies/military don't want the public to be aware of (but which I developed independently)?

Answer 1

It is fully acceptable to work on, and to publish, results on topics als researched in secret by companies or security agencies. From an academic point of view, there is nothing wrong with that, and neither from the point of view of stealing intellectual property. (But I'm not a lawyer!) Whether those companies or agencies would be unhappy with you publishing some great new technique for breaking cryptosystems - probably not, but unless you believe in conspiracy theories, this is likely not be an issue. (They might try to hire you, though.)

There have been precedents, e.g., on the best algorithms to factor numbers, or some cryptographic algorithms. (I'd have to dig out references for that.)

Answer 2

What can be published is up to the journal editors and reviewers, though in some instances (national security...) the government will step in and put an embargo on publishing.

But the same thing is largely true for such things as trade secret internal things in commerce. As long as you work independently, you can write your papers and submit them. But it is up to others whether they are published.

If something "seems" innovative since all "known" uses are actually unknown then publishers will proceed as usual.

It would, however, probably be a mistake if you try to publish something that you know because of some relationships or employment but that hasn't been revealed publicly. You will probably be talking to a lot of lawyers in that case. Edward Snowden is an extreme case, of course.

Answer 3

In this case, is it acceptable for me to publish this as my own research?

Absolutely, positively, yes.

And it will indeed be your own research.

There's just a single caveat: The above is true as long as you're just suspecting "Oh, those secret government crypto researchers must surely be considering this too." If you actually got tipped off about their findings, then it's a different story.

If I do publish, can I be in trouble for publishing work which these companies/military don't want the public to be aware of (but which I developed independently)?

Ethically/morally - there is nothing wrong with this at all. On the contrary, it is laudatory, and I encourage you to write up your findings as accessibly to lay readers as you can, and publish not just in some obscure conference, but put your paper up on open-access platforms, and make posts to HackerNews, SlashDot, Reddit, or wherever is relevant.

Materially - the closer your publication is to thwarting concrete, specific commercial/military/governmental initiatives - the more likely is it that there will be some consequences to your publishing your work. That doesn't mean it is actually likely; a paper on breaking cryptographic protocols or devising new ones is probably safe enough though. But if your publication will lead immediately to embarrassing information or criminal behavior being exposed, then you cannot discount the possibility. Just look at what governments are doing to whistle-blowers and journalists these days.

Answer 4

Academically and legally speaking you are all good. But if you suspect that a thing you learned is sensitive in nature. National security type stuff.

I would urge you to submit your work to the NSA for prepublication review. https://www.nsa.gov/Resources/Prepublication-Review/

If your work is of concern to them they will likely offer you a very nice salary, and if you like this type of thing you will like working for them. I did.

And if they don't care you are likely to gain valuable feedback.

Answer 5

Any academic research ought to consider ethics as part of the decision on whether to conduct or publish results, both in how the research is conducted (e.g. human/animal experimental subjects, personal data, etc.), and the wider social consequences of the results. Techniques that could be used by criminals to more easily commit or get away with crime, terrorists and hostile states to kill people, authoritarian governments to oppress their populations, processes that cause harm to human health or the environment, or to violate human rights of privacy, free speech, right to a fair trial, etc. should be examined to determine whether publication of the results would do more harm than good. Where there are legal limits on the release of defence data (like the Official Secrets Act in the UK,) the test is generally on the basis of harm done to the national interest of this sort, and so should already have been considered as part of the academic ethics clearance.

On the question of whether you might get into specific legal difficulty, it depends on what legal jurisdiction you are operating in, and you (or your university ethics committee) should consult a lawyer locally. But if you consider the potential for social harm in your ethics process and act responsibly, you are much less likely to get into trouble with the law. As a rule, (in the jurisdictions I know about) if you have not been explicitly told that something is classified, you are not expected to know, and would not normally be prosecuted for innocently revealing something the military would rather not have revealed. But if it's something that obviously could do a lot of social harm, you could find yourself attracting a lot of unwelcome attention and criticism from the authorities that you and your university would much prefer to avoid. Check your ethics.