3 ms·

In the security research community, it's common for reviewers to expect discussions of things like responsible disclosures, informed consent, data confidentiali

In the security research community, it's common for reviewers to expect discussions of things like responsible disclosures, informed consent, data confidentiality, and the legality and ethics of research methods. I think it's a great thing for researchers to be cognizant of their work's broader impacts; not just for harm reduction, but because it makes your work so much more interesting to a wide variety people.

Permit 6y ago
I'm not familiar the security research community, is it common for papers to be rejected for the reasons you listed?
- the_snooze 6y ago
  It hasn't been common in the program committees I've served on, and I think that's mainly a function of people generally knowing what the expectations are. I've had my own papers get review comments like "good work, but we need you to include justification for why your approach isn't illegal under the CFAA." Authors (myself included) are generally very receptive to that kind of feedback because it helps keep us out of trouble down the road. Here's an example of a disclaimer that shows the authors were acting in good faith (not mine): >As performing a security analysis against a running election server would raise a number of unacceptable legal and ethical concerns, we instead chose to perform all of our analyses in a "cleanroom" environment, connecting only to our own servers. Special care was taken to ensure that our static and dynamic analysis techniques could never interfere with Voatz or any related services, and we went through great effort so that nothing was intentionally transmitted to Voatz’s servers. https://www.usenix.org/system/files/sec20-specter.pdf https://www.usenix.org/system/files/sec20-specter.pdf
moyix 6y ago
This is true – but at the same time the security research community doesn't require that every paper do this, only that if your paper has potential for harm that you discuss how it was managed. It definitely comes up in program committee meetings though (and it tends to provoke some of the most heated discussions).

Permit 6y ago

I'm not familiar the security research community, is it common for papers to be rejected for the reasons you listed?

the_snooze 6y ago
It hasn't been common in the program committees I've served on, and I think that's mainly a function of people generally knowing what the expectations are. I've had my own papers get review comments like "good work, but we need you to include justification for why your approach isn't illegal under the CFAA." Authors (myself included) are generally very receptive to that kind of feedback because it helps keep us out of trouble down the road. Here's an example of a disclaimer that shows the authors were acting in good faith (not mine): >As performing a security analysis against a running election server would raise a number of unacceptable legal and ethical concerns, we instead chose to perform all of our analyses in a "cleanroom" environment, connecting only to our own servers. Special care was taken to ensure that our static and dynamic analysis techniques could never interfere with Voatz or any related services, and we went through great effort so that nothing was intentionally transmitted to Voatz’s servers. https://www.usenix.org/system/files/sec20-specter.pdf https://www.usenix.org/system/files/sec20-specter.pdf

moyix 6y ago

This is true – but at the same time the security research community doesn't require that every paper do this, only that if your paper has potential for harm that you discuss how it was managed. It definitely comes up in program committee meetings though (and it tends to provoke some of the most heated discussions).