<div class="csl-bib-body">
<div class="csl-entry">Hantke, F., Roth, S., Mrowczynski, R., Utz, C., & Stock, B. (2024). Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research. In <i>2024 IEEE Symposium on Security and Privacy (S&P)</i> (pp. 4405–4423). https://doi.org/10.1109/SP54263.2024.00104</div>
</div>
-
dc.identifier.uri
http://hdl.handle.net/20.500.12708/203699
-
dc.description.abstract
Comprehensive and representative measurements are crucial to understand security and privacy risks on the Web. However, researchers have long been reluctant to investigate server-side vulnerabilities at scale, as this could harm servers, disrupt service, and cause financial damage. This can lead to operator backlash and problems in peer review, as the boundaries posed by the law, ethics, and operators' stance towards security research are largely unclear.In this paper, we address this research gap and investigate the boundaries of server-side scanning (3S) on the Web. To that end, we devise five typical scenarios for 3S on the Web to obtain concrete practical guidance. We analyze qualitative data from 23 interviews with legal experts, using German law as a case study, members of Research Ethics Committees, and website and server operators to learn what types of 3S are considered acceptable and which behavior would cross a red line. To verify our findings, we further conduct an online survey with 119 operators.Our analysis of these different perspectives shows that the absence of judicial decisions and clear ethical guidelines poses challenges in overcoming the risks associated with 3S, despite a slight majority (57%) of operators having a positive stance towards such academic research throughout the interviews and the survey. As a first step to mitigate these challenges, we suggest best practices for future 3S research and a pre-registration process to provide a reliable and transparent environment for 3S-based research that reduces uncertainty for researchers and operators alike.
en
dc.language.iso
en
-
dc.subject
law
en
dc.subject
research ethics
en
dc.subject
web security
en
dc.title
Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research
en
dc.type
Inproceedings
en
dc.type
Konferenzbeitrag
de
dc.contributor.affiliation
Helmholtz Center for Information Security, Germany
-
dc.contributor.affiliation
Helmholtz Center for Information Security, Germany
-
dc.contributor.affiliation
Helmholtz Center for Information Security, Germany
-
dc.contributor.affiliation
Helmholtz Center for Information Security, Germany
-
dc.relation.isbn
979-8-3503-3130-1
-
dc.description.startpage
4405
-
dc.description.endpage
4423
-
dc.type.category
Full-Paper Contribution
-
tuw.booktitle
2024 IEEE Symposium on Security and Privacy (S&P)
-
tuw.peerreviewed
true
-
tuw.researchTopic.id
I2
-
tuw.researchTopic.id
I4
-
tuw.researchTopic.id
X1
-
tuw.researchTopic.name
Computer Engineering and Software-Intensive Systems