Cybersecurity research and society: considerations for researchers and human research ethics committees

Cybersecurity research often involves ‘smart’ digital systems, artificial intelligence (AI), machine learning (ML) and other technologies that entail legal, ethical, and social consequences. These diverse consequences are currently insufficiently and inconsistently addressed through traditional human research ethics review mechanisms. In this chapter, we identify gaps in traditional research ethics review processes relating to cybersecurity research and develop recommendations to improve the implications of cybersecurity research projects on society. Based on our review of large-scale collaborative cybersecurity research projects, we propose a cybersecurity responsible research and innovation (RRI) framework that includes four pillars: ethics, law, society, and security. The framework is designed to guide both researchers and human research ethics committees (HRECs) to identify the social implications of cybersecurity research projects and to develop a holistic, responsible, and socially responsive approach to evaluate cybersecurity research programs. Our structural recommendations include changes to HREC membership and expertise to provide a deeper review of advanced technologies and their potential effects on humans and society. Substantively, we propose that the review by HRECs should be enhanced to include broader social, ethical and legal considerations, including sustainability, explainability, and accuracy.