Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations

Tadayoshi Kohno,Yasemin Acar,Wulf Loh
2023-08-05
Abstract:The computer security research community regularly tackles ethical questions. The field of ethics / moral philosophy has for centuries considered what it means to be "morally good" or at least "morally allowed / acceptable". Among philosophy's contributions are (1) frameworks for evaluating the morality of actions -- including the well-established consequentialist and deontological frameworks -- and (2) scenarios (like trolley problems) featuring moral dilemmas that can facilitate discussion about and intellectual inquiry into different perspectives on moral reasoning and decision-making. In a classic trolley problem, consequentialist and deontological analyses may render different opinions. In this research, we explicitly make and explore connections between moral questions in computer security research and ethics / moral philosophy through the creation and analysis of trolley problem-like computer security-themed moral dilemmas and, in doing so, we seek to contribute to conversations among security researchers about the morality of security research-related decisions. We explicitly do not seek to define what is morally right or wrong, nor do we argue for one framework over another. Indeed, the consequentialist and deontological frameworks that we center, in addition to coming to different conclusions for our scenarios, have significant limitations. Instead, by offering our scenarios and by comparing two different approaches to ethics, we strive to contribute to how the computer security research field considers and converses about ethical questions, especially when there are different perspectives on what is morally right or acceptable.
Cryptography and Security,Computers and Society
What problem does this paper attempt to address?
The main issue this paper attempts to address is the ethical decision-making in the field of computer security research. The authors explore moral dilemmas under different ethical frameworks by creating computer security scenarios similar to the classic trolley problem, thereby promoting ethical discussions among researchers. They do not seek to define what is right or wrong but aim to provide a deeper discussion framework for ethical issues in computer security research by comparing utilitarianism and Kantian deontology. Specifically, the three main scenarios in the paper are: 1. **Scenario A**: Researchers discover a vulnerability in a wireless implanted medical device, but the manufacturer has gone out of business and cannot fix the vulnerability. Assuming the likelihood of the vulnerability being exploited is zero, should the researchers disclose this vulnerability to the government and the public? 2. **Scenario B**: Discussing the ethics of researching stolen data, i.e., data that people originally did not want to be made public. 3. **Scenario C**: How should a project committee member handle a submission that contains undisclosed information about their company's product? By exploring these scenarios, the paper aims to help researchers engage in more systematic and informed discussions when facing complex ethical decisions. Additionally, the paper emphasizes that different ethical frameworks may lead to different conclusions, and thus should not be used to justify a path researchers have already decided to take, but rather as part of the decision-making process, accepting that sometimes the answer might be "no."