20

I am working on a project in the area of IT security where we are analyzing a proprietary embedded system. While researching the system, we came across a confidential data sheet that was made publically available by a third party without the consent of the manufacturer of the system. The datasheet is marked confidential and usually only given out after an NDA is signed. It describes an outdated version of the system we are analyzing, but is partially relevant, as some parts of the system have not changed since then.

Is it ethical / acceptable to use and reference this resource in a paper?

"Related Work": this and this question ask about citing documents that aren't widely available (while my document can be found by anyone using Google, and none of the involved researchers have signed any NDAs).

Edit: To add some additional information that I added spread over a few comments:

  • The datasheet in question describes the security protocols used by an older version of a popular embedded security chip, current versions of which are being used in payment and access control systems

  • The manufacturer is aware that the data sheet has been leaked and is not happy about it, but has not gotten the datasheet removed from the third-party servers where it is located for the past two years. The reasons for this are unclear

  • The data is confidential (as in private-sector NDA-confidential), but not classified in a government sense.

  • The company has already stated that they would prefer if we did not publish based on this document, but that they would not be taking any legal action if we did, as long as all information was factually correct.

Improve this question
10
  • 1
    One thing to consider: you probably cannot include the data in the paper, and the document could be taken down because of the NDA issues.
    – Nick S
    Jul 31, 2017 at 17:50
  • @NickS In this specific case, the document has staid up for multiple years, so either the vendor (who is aware of it) is not pursuing it, or they can't get a legal handle on it. But yes, in general, that is definitely a consideration.
    – malexmave
    Jul 31, 2017 at 18:19
  • 7
    I am not a lawyer, but...ask a lawyer. Depending on where you are the legal implications may differ significantly. You may bear no legal responsibility at all, though that doesn't answer the question of how this would be received within the research community. There are questions invoked about reliability and trustworthiness of what you've found that are completely independent of ethics and legality. They're purely scientific problems.
    – zibadawa timmy
    Jul 31, 2017 at 20:49
  • 1
    You say that this involves "security protocols...used in payment and access control systems" and that you've found at least one vulnerability. If these systems are used by people outside the company and those vulnerabilities aren't public, the users have a right to know about them, at which point releasing the information may be morally required. (Although in such case you should give the company time to fix the vulnerability before public release, per Responsible Disclosure (which is admittedly more complicated for hardware than it is for software)). Arguments can be made both ways.
    – Ray
    Jul 31, 2017 at 21:53
  • 2
    In journalism, the distinction to publish is usually made based on if the information in question was offered unsolicited, and without any stipulations: it came in "over the transom". Unsolicited so that you couldn't have suggested or implied in any way to a source that "it would be nice if I had this", and without any stipulations (i.e. "you must publish this") to avoid blackmail concerns.
    – Nick T
    Jul 31, 2017 at 22:25

5 Answers 5

Reset to default
22

Sounds like you have found an interesting source and are considering the moral implications of using it. What I will say is based purely on personal opinion and probably what I would do unless instructed otherwise.

Leaks are a fact of life. With the proliferation of digital material they are commonplace. Look at Wikileaks, the Snowden revelations etc. Once material has become public there is - fortunately or unfortunately - no going back, regardless of how that information became public. It is the responsibility of the owner/creator of the material to ensure it says secure.

Dissemination of such material could be highly fruitful - but think of it this way - will your publishing research based on the material be ultimately constructive or destructive? Will it benefit just you or the wider world? Who is it really advantageous for? If the answer is just you, I would probably withhold your research based on it. If it has wider ramifications of great import, go with it. Also consider the reasons why it is confidential. Who does it serve - who does it protect? Was the confidentially because of financial reasons, incomplete research, company policy, or 'national security'?

There is a heavy moral tinge to this question, and you may have to do some soul-searching. But ultimately, if it serves the wider discipline in a positive way, and such servitude grossly outweighs the few individuals who it would ire, I would use it, as long as there are no legal implications for yourself [unlikely since a third party leaked it, but you can never be too careful].

Improve this answer
10
  • 6
    I completely disagree. This is not really only the author's decision to make. Think of it this way: if someone dropped on your desk some incredibly promising results of a drug testing on human subjects that were obviously illegally obtained, would you go ahead and publish it (or, if you were the editor, would you allow the data to be published), even if it could be proven that the author did not obtain the data him/herself? Unless the data has passed some sort of screening by a special body of specialists, I don't think it would be even remotely close to being morally justifiable to use it.
    – user63725
    Jul 31, 2017 at 17:50
  • 11
    @andorian If these results would save people's lives, then yes, I would publish them. Obtaining the results as you suggest is obviously unethical, and I would make that clear too, but withholding information that can save lives is even worse.
    – DividedByZero
    Jul 31, 2017 at 20:41
  • 7
    @andorian: I didn't think we'd get to Godwin's law so quickly. You really think using data leaked from a company is comparable to using data from Nazi human torture?
    – user541686
    Jul 31, 2017 at 21:00
  • 2
    @zibadawatimmy: It's "IT security" for an "embedded system". The kind of thing that could affect lives. Not saying it's necessarily happening here but it's a hell of a lot less of a stretch than data from Nazi torture.
    – user541686
    Jul 31, 2017 at 21:04
  • 1
    To give some context about the data in this specific case: It's a data sheet that defines how a certain embedded chip with security functionality behaves, and how to communicate with it. We are looking at the security of the protocols that are defined in there. More up-to-date versions of the chip are used in access control and payment systems, among other things.
    – malexmave
    Jul 31, 2017 at 21:26
3

I'm glad I'm not in your situation. It's tricky. While I can't really offer the ethics of scientific publication for this situation, a journalist, which is a constitutionally protected entity in the US, would probably publish after soliciting comment from the company.

You, however, would probably be sued, as would your university. If I were in your situation, I would probably consult university counsel, and abide by whatever they tell me to do. If the school won't cover my back, I wouldn't want to assume the personal liability.

I suppose another way to look at it is by how important the matter is. Is it worth the s***storm you're likely to find yourself in?

Improve this answer
2

Have you asked the editor of the journal? They might be unwilling to publish your paper because of the risk of being sued by the company that had its proprietary material leaked. They might also argue that the source shouldn't be cited because it might disappear at any time and wasn't really "published."

Improve this answer
1

The usual method is to find a paper or publication, use it's contents, and cite it properly. Maybe not in this case, but just consider your position if you publish your paper quoting this leaked material, and the company that allegedly produced the leaked material denies that they produced any of this material. That's not good news for your paper.

Improve this answer
0

If the company who had the document leaked said that they would prefer not publishing based on the leaked data, it means that it can be harmful for them.

So you are chosing between your benefit and their benefit. If you chose to publish it may be legal but less moral.

Maybe you can convince them to co-author the paper, given that the harm has already been done for them, and it puts them in a better light. If that does not work, you could see if they agree to review your paper and you can acknowledge them.

Basically, I think it's fair to take any action that would avoid doing more damage to the company with the leaked document.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .