Is it OK to use stolen data? What if it's scientific research in the public interest?
- Reference: 1631883727
- News link: https://www.theregister.co.uk/2021/09/17/unethical_data_research/
- Source link:
A [1]paper published in Nature Machine Intelligence this week is an effort to help guide data scientists and researchers through the ethical dilemmas which present themselves when considering using information obtained from data breaches.
To kick off, Marcello Ienca, a research fellow at the Swiss Federal Institute of Technology, and Effy Vayena, deputy head of the Swiss Institute of Translational Medicine, offered the definition that "hacked" data is "data obtained in an unauthorized manner through illicit access to a computer or computer network." They claim it is increasingly being used in scientific research such as conflict modelling studies based on WikiLeaks datasets, and studies on sexual behaviour based on data leaked from [2]Ashley Madison , a dating website whose database was pilfered by a group of attackers calling themselves The Impact Team in 2015.
[3]
But basing studies on such ill-gotten datasets presents problems analogous to previous debates on research that uses data of unethical origin, such as data obtained from Nazi medical "experiments."
[4]
[5]
Even though "it may be lawful for researchers to use hacked data if they are publicly available, responsible research practices still require clear ethical justification for doing so," the paper argues.
Researchers might argue they are justified in using publicly available purloined datasets because they offer public value, save resources, offer a unique source, and might present cross-domain consistency. On the other hand, using such data may lack consent from people mentioned or implicated in the data, using the data might cause secondary harm, it could represent a privacy breach, and might lower quality of scientific standards.
[6]Leaked: List of police, govt, uni orgs in Clearview AI's facial-recognition trials
[7]1.5 BEEELLION sensitive files found exposed online dwarf Panama Papers leak
[8]You tried to hide your extramarital affair … by putting it on the web?
[9]Why Nobody Should Ever Search The Ashley Madison Data
The authors propose six ethical and procedural requirements that need to be addressed before going ahead with the use of stolen or leaked data for a project.
Firstly, they encourage researchers to consider uniqueness. Can they demonstrate that the leaked data could not have been collected using conventional methods? Next, can they show that their intended research is of high social value, and that the benefits clearly outweigh the possible harms? If hacked data is personally identifiable, researchers should obtain explicit and informed consent from those individuals.
[10]
If that's impossible, the research should only go ahead if the risk is minimal and the benefits obvious. They should also make sure they have a record of how and where all data has been obtained. Researchers should clearly state when they have accessed identifiable data without the subjects' consent, and say what they have done to ensure the data subjects' privacy and security. Those five conditions lead into a sixth: that Institutional Review Boards (IRBs) or analogous bodies such as Research Ethics are utilised.
Datasets made public via WikiLeaks or the [11]Panama Papers can offer insight for the public good, but there are also risks and unintended consequences involved in researching illegally accessed datasets. Ienca and Vayena have offered an approach to getting some of those benefits while minimising the potential harm. ®
Get our [12]Tech Resources
[1] https://www.nature.com/articles/s42256-021-00389-w
[2] https://www.theregister.com/2015/07/20/ashley_madison_hacked/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YUS7t8yMg3xnqrLdREcQTQAAAUY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YUS7t8yMg3xnqrLdREcQTQAAAUY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YUS7t8yMg3xnqrLdREcQTQAAAUY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/08/29/in_brief_ai/
[7] https://www.theregister.com/2018/04/05/billions_files_exposed_aws_ftp_wide_open/
[8] https://www.theregister.com/2015/09/05/extramarital_affairs_online_ashley_madison/
[9] https://www.theregister.com/2015/08/26/why_nobody_should_ever_search_the_ashley_madison_data/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YUS7t8yMg3xnqrLdREcQTQAAAUY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2018/04/05/billions_files_exposed_aws_ftp_wide_open/
[12] https://whitepapers.theregister.com/
Is it OK to use stolen data?
No.
What if it's scientific research in the public interest?
No either. From a wrong you cannot do it right, mainly because it would justify the wrong in some way.
I can't see how stolen data used for law enforcement action, or for research which assists subsequent law enforcement action and prevents future thefts of data in any way justifies the original wrong. It's a straightforward reaction to it.
Ethics and Use Case
Using stolen data will always be ethically challenging as Binrader noted. The better questions are why are is one using the data, what is the purpose of the use, and how will the results be used. They are interrelated. Also, one needs to go deep in when answering these questions. Often one is tempted to give a glib answer to the questions without careful examination of them. Just because you can do something does not mean you should do it. But we each have a bad habit of justifying our stupid behavior. And no, I do not have a very good answer to the issue.
I only do car analogies...
Wanted to some research on cars, so stole my neighbor's Lamborghini. He got mad. Told him it was purely for research in the public interest.
Re: I only do car analogies...
But your stealing your neighbours Lamborghini isn't really the issue here. The issue being discussed here is whether it is legal and ethical for someone interviewing you about your driving experience and then publishing the findings.
when is collected data stolen?
Phyllis Pearsall compiled the original London A-Z maps (in part) by trudging the streets and copying down their names. Was this breach of the copyright of whoever made the street name signs? Probably not. If someone else reproduces her index, is that breach of copyright? Yes. The difference is the "added value" of her legwork.
Cecil Sharp collected folk songs from the west of England and published them. Was that breach of copyright? I think there was a case against him. Did he do a cultural service? Yes, because otherwise those songs would have been lost.
"an effort to help guide data scientists and researchers through the ethical dilemmas"
It's actually all rather obvious if you just stop and think. Thirty-odd years back when I was doing research, pretty much everyone seemed to be able to make these judgements for themselves and they mostly got them right. Now it seems they need to be guided. I can only assume that the generation of researchers who grew up with an open web have had their personal ethics blunted by notional "freedom of information".
I'd have thoughts that data quality issues might loom at least as large as ethical. Provenance? Sample selection? Accuracy? Repeatability with independent data?
However, psychology, social sciences, AI - probably no problem.
This is not a new argument, and answers will always be legal grey areas.
Medical data acquired through absolutely horrific means in WW2 for example, remains in (limited) circulation. Some of it is incredibly specialised and has practical, life saving or improving applications. (Equally, some of it was utter garbage and an excuse to indulge in torture for the sake of it). The question of whether it is right to use it is ethically impossible to mandate. Yes, it was forcibly acquired. But it is also able to save or improve lives. Does using it mean you are disrespecting the victim and legitimising the crime? Does it mean you are honouring the victims loss? Absoutely impossible to mandate as you can make any number of arguments for or against.
The choice of whether it's right or wrong is at best, difficult to legislate for. Give people the informed choice as to what it means, but perhaps do not deny. This goes for other laws that have been making the news recently too, denying choice.