Using leaked proprietary information in scientific paper

Question

I am working on a project in the area of IT security where we are analyzing a proprietary embedded system. While researching the system, we came across a confidential data sheet that was made publically available by a third party without the consent of the manufacturer of the system. The datasheet is marked confidential and usually only given out after an NDA is signed. It describes an outdated version of the system we are analyzing, but is partially relevant, as some parts of the system have not changed since then.

Is it ethical / acceptable to use and reference this resource in a paper?

"Related Work": this and this question ask about citing documents that aren't widely available (while my document can be found by anyone using Google, and none of the involved researchers have signed any NDAs).

Edit: To add some additional information that I added spread over a few comments:

• The datasheet in question describes the security protocols used by an older version of a popular embedded security chip, current versions of which are being used in payment and access control systems

• The manufacturer is aware that the data sheet has been leaked and is not happy about it, but has not gotten the datasheet removed from the third-party servers where it is located for the past two years. The reasons for this are unclear

• The data is confidential (as in private-sector NDA-confidential), but not classified in a government sense.

• The company has already stated that they would prefer if we did not publish based on this document, but that they would not be taking any legal action if we did, as long as all information was factually correct.

Answer 1

Sounds like you have found an interesting source and are considering the moral implications of using it. What I will say is based purely on personal opinion and probably what I would do unless instructed otherwise.

Leaks are a fact of life. With the proliferation of digital material they are commonplace. Look at Wikileaks, the Snowden revelations etc. Once material has become public there is - fortunately or unfortunately - no going back, regardless of how that information became public. It is the responsibility of the owner/creator of the material to ensure it says secure.

Dissemination of such material could be highly fruitful - but think of it this way - will your publishing research based on the material be ultimately constructive or destructive? Will it benefit just you or the wider world? Who is it really advantageous for? If the answer is just you, I would probably withhold your research based on it. If it has wider ramifications of great import, go with it. Also consider the reasons why it is confidential. Who does it serve - who does it protect? Was the confidentially because of financial reasons, incomplete research, company policy, or 'national security'?

There is a heavy moral tinge to this question, and you may have to do some soul-searching. But ultimately, if it serves the wider discipline in a positive way, and such servitude grossly outweighs the few individuals who it would ire, I would use it, as long as there are no legal implications for yourself [unlikely since a third party leaked it, but you can never be too careful].

Answer 2

I'm glad I'm not in your situation. It's tricky. While I can't really offer the ethics of scientific publication for this situation, a journalist, which is a constitutionally protected entity in the US, would probably publish after soliciting comment from the company.

You, however, would probably be sued, as would your university. If I were in your situation, I would probably consult university counsel, and abide by whatever they tell me to do. If the school won't cover my back, I wouldn't want to assume the personal liability.

I suppose another way to look at it is by how important the matter is. Is it worth the s***storm you're likely to find yourself in?

Answer 3

The usual method is to find a paper or publication, use it's contents, and cite it properly. Maybe not in this case, but just consider your position if you publish your paper quoting this leaked material, and the company that allegedly produced the leaked material denies that they produced any of this material. That's not good news for your paper.

Answer 4

If the company who had the document leaked said that they would prefer not publishing based on the leaked data, it means that it can be harmful for them.

So you are chosing between your benefit and their benefit. If you chose to publish it may be legal but less moral.

Maybe you can convince them to co-author the paper, given that the harm has already been done for them, and it puts them in a better light. If that does not work, you could see if they agree to review your paper and you can acknowledge them.

Basically, I think it's fair to take any action that would avoid doing more damage to the company with the leaked document.

Answer 5

Have you asked the editor of the journal? They might be unwilling to publish your paper because of the risk of being sued by the company that had its proprietary material leaked. They might also argue that the source shouldn't be cited because it might disappear at any time and wasn't really "published."

Answer 6

I don't think it is justifiable to use the data at all.

Using leaked data raises several issues, besides morality, that are not easily addressed.

One of them is data reliability: what is the methodology employed to acquire the data? How can you guarantee that the data is not biased by an undisclosed factor? How can you guarantee that whoever leaked the data did not modify it (counciously or uncounciously)?

Additionally, you would be encouraging the use of illegal means to acquire data: I am not a lawyer, but in most jurisdictions it is illegal to leak private information. Using (and approving the use of) leaked data encourages others to break the law to acquire unlawful data. If the data is incredibly relevant, such as capable of curing cancer -- which, in most cases, it isn't --, there are other (and obviously far more difficult) means to acquire the data, such as seeking governmental support that will diplomatically negotiate with the involved parts.

Your situation is also analogous to using pirated software in research, which is not well received and often illegal.

Note that if the data includes human or animal data, it is considered scientific misconduct to gather data without the consent of an independent review board, even if you have personal authorization from the subjects.

The only way I would remotely consider having the data, or studies based on it, published is if it had been previously reviewed by a competent body of specialists (which should include lawyers, scientists and governmental bodies) that judged the data to be essential to significantly advance human knowledge. Otherwise, I don't see how the benefits can outweight potentially disastrous precedent-opening issues that using leaked data can have.

Even using papers from Sci-Hub, which is a much softer version of what you are suggesting, and which I believe has outstanding benefits to the advancement of humanity as a whole, is widely debated as being immoral.