The legal risks of ethical hacking

24.04.2009

Dittrich and others spoke Tuesday during a panel titled "Ethics in Botnet Research" during the Usenix workshop on large-scale exploits and emergent threats (LEET). The topic is also being tackled on an ongoing basis by the Electronic Frontier . 

"We are studying criminal activity, and some of the things we do can't be distinguished from the criminals themselves," Dittrich said. "We're all trying to do good. Everyone in this room has their own ethical codes. I don't know if they totally overlap, but we're all trying to do good."

Security researchers may ultimately have no control over how law enforcement authorities view their actions, panelists said.

"We are at the mercy of prosecutors' discretion, but we are pushing some of these boundaries," said Jose Nazario, a network security researcher with Arbor Networks who has been investigating the .

Still, the ethical hacking community should collaborate to develop a set of ethical guidelines that can be shown to government when and if it starts taking a greater role in oversight, panelists said.