{"id":350,"date":"2026-06-11T15:11:54","date_gmt":"2026-06-11T14:11:54","guid":{"rendered":"https:\/\/blogs.bath.ac.uk\/pvc-research\/?p=350"},"modified":"2026-06-11T15:11:54","modified_gmt":"2026-06-11T14:11:54","slug":"lets-talk-about-ethics-in-digital-security-research","status":"publish","type":"post","link":"https:\/\/blogs.bath.ac.uk\/pvc-research\/2026\/06\/11\/lets-talk-about-ethics-in-digital-security-research\/","title":{"rendered":"Let\u2019s talk about ethics in digital security research"},"content":{"rendered":"<p>&nbsp;<\/p>\n<div>\n<p>I am delighted to introduce this timely and important blog from colleagues at the Bath Institute for Digital Security and Behaviour. There are many researchers using sensitive data in which research poses potential harms to participants, researcher wellbeing as well as potential misuse of findings and politically-charged challenge to results. The IDSB highlights how ethical reflection is a fundamental pillar of rigorous, responsible research\u2014essential in areas as complex and fast\u2011evolving as digital security.<\/p>\n<p>This piece demonstrates the leadership our researchers are showing in navigating ethical challenges around data, participants, researcher wellbeing, and the potential misuse of findings. It also underlines the University of Bath\u2019s commitment to fostering research, and supporting researchers that not only advances knowledge, but does so with integrity, care and societal awareness. Please do follow up the links in the blog post, ethics@bath.ac.uk, and be aware that we have media and comms support available for those publishing work in highly sensitive and contentious areas, <a href=\"https:\/\/www.sciencemediacentre.org\/wp-content\/uploads\/2019\/10\/Advice-for-Researchers-Experiencing-Harrasment-2019.pdf\">Advice for researchers experiencing harassment.<\/a><\/p>\n<p>I encourage colleagues across disciplines to engage with these insights and to see ethics as an enabler of excellent research\u2014supporting innovation while safeguarding people and communities<\/p>\n<p>Best wishes,<\/p>\n<p>Emma<\/p>\n<p>&nbsp;<\/p>\n<p>Ethics is recognised as a vital aspect of academic research. From research funders to journal publishers,\u00a0confirmation that ethics has been appropriately and formally considered is\u00a0now\u00a0a key requirement.\u00a0<a href=\"https:\/\/researchbriefings.files.parliament.uk\/documents\/POST-PN-0544\/POST-PN-0544.pdf\">Failure to do so can lead to publications being retracted,\u00a0funding\u00a0being\u00a0withdrawn, and a broad range of potential\u00a0harms<\/a>.\u00a0To some it might seem like a bureaucratic headache or a check-box exercise, but crucially,\u00a0ethics\u00a0is there to support\u00a0and\u00a0protect both researchers and participants.\u00a0This is the case for all types of research\u00a0but is particularly important in areas that deal with sensitive data or topics or where\u00a0findings\u00a0have the potential for misuse.<\/p>\n<p>Due to the nature of the work that\u00a0we\u00a0do, researchers at the Bath Institute for Digital Security and Behaviour\u00a0(IDSB)\u00a0are well versed\u00a0in considering the ethical implications of their\u00a0research.\u00a0From applying computational social science to explore\u00a0online extremism, to\u00a0developing\u00a0innovative\u00a0methods to\u00a0collect data from\u00a0personal devices,\u00a0ethics has been\u00a0top\u00a0of the agenda\u00a0across our activities\u00a0for many years. As a result, we have much to offer the broader research community,\u00a0from\u00a0the lessons we have learnt (sometimes the hard way) along the way. These include\u00a0appropriate consideration\u00a0and mitigation of\u00a0risks to researchers, risks to participants, and broader risks in the application of research to policy and practice.<\/p>\n<p><strong>Addressing risks to researchers<\/strong><\/p>\n<p>Digital security research often deals with\u00a0content\u00a0and communities that may be contentious\u00a0or extreme, meaning that researchers can be exposed to hateful language and abusive imagery at scale. Publishing or communicating research that\u00a0is\u00a0undertaken\u00a0in this area can also expose individuals to potential targeting from these communities, which can include doxing, threatening behaviour,\u00a0and being the target of hackers. This presents substantial risks to individual wellbeing that must be appropriately considered from an ethics perspective.<\/p>\n<p>We have\u00a0<a href=\"https:\/\/www.taylorfrancis.com\/chapters\/edit\/10.4324\/9781003349266-5\/qualitative-analysis-online-research-olivia-brown-julie-gore-adam-joinson\">published specific guidance<\/a>\u00a0on\u00a0the\u00a0qualitative analysis of sensitive, often harmful digital data,\u00a0a summary of which can be accessed\u00a0<a href=\"https:\/\/blogs.bath.ac.uk\/centre-for-qualitative-research\/2021\/05\/06\/qualitative-analysis-for-sensitive-research-how-to-protect-against-researcher-vulnerabilities\/\">here<\/a>. More\u00a0broadly,\u00a0our IDSB members\u00a0often access resources from\u00a0the\u00a0<a href=\"https:\/\/voxpol.eu\/researcher-welfare-1-privacy\/\">VOX-Pol research network<\/a>, who\u00a0provide\u00a0specific guidance on how to protect yourself when working\u00a0in especially extreme contexts,\u00a0where\u00a0it is possible that\u00a0malicious actors could target those involved.\u00a0We have also developed our own in-house protocols and practices and would be happy to provide guidance to colleagues undertaking similarly\u00a0sensitive work.<\/p>\n<p><strong>Addressing risks to participants<\/strong><\/p>\n<p>How we collect data, the type of data that we collect, and how participants have provided consent are all ethical, as well as methodological, questions.\u00a0At the IDSB, researchers may analyse\u00a0large amounts\u00a0of social media or other online data covering contentious topic areas.\u00a0This creates challenges around the topic of consent within secondary data collection, which has been the\u00a0subject\u00a0of\u00a0<a href=\"https:\/\/www.bps.org.uk\/event\/social-media-and-secondary-data-psychological-and-educational-research-confronting-key\">prior\u00a0discussion<\/a>\u00a0and\u00a0<a href=\"https:\/\/www.bath.ac.uk\/guides\/working-with-secondary-data\/\">previous guidance<\/a>.\u00a0The development of innovative data collection methods, such as using smart phone data to understand device usage over time, can also result in the collection of\u00a0originally unanticipated information related to individuals' general pattern of life. This creates challenges from\u00a0both an informed consent and data privacy perspective.<\/p>\n<p>The way that we choose to operationalise variables may seem like a purely methodological decision. But what about when that\u00a0impacts\u00a0whether\u00a0someone\u00a0might be viewed as\u00a0being\u00a0on a path to extremism or not?\u00a0Can the way that we label data have ethical implications? Absolutely!\u00a0In all research, there\u00a0can be a\u00a0blurred boundary between whether an issue\u00a0represents\u00a0a\u00a0purely\u00a0methodological choice or whether it\u00a0results in research that could be considered unethical.\u00a0This is particularly relevant for research that can have implications for future policy and practice, which is a key part of the work that we do at IDSB.<\/p>\n<p>As an example, we have\u00a0published\u00a0<a href=\"https:\/\/journals.sagepub.com\/doi\/epub\/10.1177\/01461672241266866\">research<\/a>\u00a0comparing online posts from\u00a0convicted right-wing extremists and\u00a0non-convicted right-wing extremists.\u00a0This research not only involved ethical\u00a0sensitives\u00a0in the access of\u00a0social media posts, but extensive labelling of the data to ensure that individuals were accurately identified as convicted or not, and to ensure\u00a0valid and\u00a0appropriate operationalisation\u00a0of variables.<\/p>\n<p>More broadly, researchers at IDSB have worked with colleagues at Lancaster University in the publication of the\u00a0<a href=\"https:\/\/journals.sagepub.com\/doi\/full\/10.1177\/25152459251361013\">DECIDE framework<\/a>.\u00a0The DECIDE framework is an\u00a0interactive tool to support researchers\u00a0in ethical reflections\u00a0at every stage of the research\u00a0process, specifically oriented towards digital research. The DECIDE framework\u00a0is\u00a0open access, updated\u00a0regularly and includes specific case examples throughout to aid researchers in decisions as\u00a0varied as consent in digital research,\u00a0the public\/private\u00a0distinction of the data and whether publishing the research is likely to cause harm.<\/p>\n<p><strong>The potential for intentional and unintentional misuse\u00a0<\/strong><\/p>\n<p>Even with the best intentions, findings from research can be discussed or applied in ways that were not originally\u00a0anticipated. This may be intentional\u00a0to\u00a0support a particular\u00a0agenda\u00a0or outcome\u00a0or unintentional due to misunderstanding or misinterpreting research findings.\u00a0At the IDSB\u00a0we consider\u00a0how we can most effectively\u00a0caution\u00a0practitioners and policy makers\u00a0regarding\u00a0potential interpretation of findings and any limitations, as well as how we can best reduce the chance that findings will be communicated\u00a0or used\u00a0in ways that we did not\u00a0anticipate.<\/p>\n<p>For example,\u00a0we published\u00a0a\u00a0<a href=\"https:\/\/psycnet.apa.org\/fulltext\/2023-45613-001.html\">study<\/a>\u00a0exploring how\u00a0online interactions might be indicative of mobilisation and attendance at protests. In the study, we present a model for using\u00a0digital trace data\u00a0to predict attendance at protests. While the core focus of the study was\u00a0to\u00a0demonstrate\u00a0how online\u00a0interactions are fundamental to understanding\u00a0peaceful, lawful, collective\u00a0action, we note in the implications of the work\u00a0that\u00a0findings should not be applied to predicting illegal, harmful action.\u00a0And further,\u00a0\u201c<em>that our results should be used to\u00a0<strong>safeguard rather than limit lawful protest<\/strong>\u00a0mobilization, by providing first responders with information about the potential size and scope of<\/em><em>\u202fcrowd<\/em><em>\u202fprotests<\/em>\u201d.<\/p>\n<p>This broader proactive reflection is a vital\u00a0component\u00a0of effective ethics consideration\u00a0and\u00a0demonstrates\u00a0how researchers need to go beyond a purely reactive, tick-box approach to considering the ethics of their work.\u00a0The publication and potential misuse of research is culturally embedded within\u00a0the\u00a0IDSB\u00a0and this is an area where we continue to proactively develop policies and practices that others can learn from, regardless of the specific specialism that they work within.\u00a0This continuous reflection throughout and across the research process is embedded within our published\u00a0<a href=\"https:\/\/journals.sagepub.com\/doi\/10.1177\/25152459251361013\">DECIDE framework<\/a>\u00a0and we invite other researchers to help us build and develop this agenda.<\/p>\n<p><strong>So, what next for ethics?<\/strong><\/p>\n<p>In today\u2019s increasingly complex digital world, understanding the broader implications of the research that we do is vital. Whether considering potential impacts on researchers, participants, or broader members of the public, ethics should be top of mind\u00a0throughout any research process.\u00a0Potential misuse of research findings, including by AI systems, also presents a\u00a0substantial\u00a0and growing risk,\u00a0meaning that a thorough consideration of ethics\u00a0is\u00a0particularly\u00a0important\u00a0for those working in more sensitive or contentious areas.\u00a0Ultimately, ethics\u00a0processes\u00a0and approaches\u00a0are there to protect everyone and\u00a0to\u00a0help researchers do what they do best \u2013 great research that has the potential to help society.<\/p>\n<p>The\u00a0IDSB\u00a0takes\u00a0a multi-disciplinary\u00a0approach to researching digital security topics and\u00a0continues to\u00a0evolve\u00a0its approach to ethics\u00a0in response to an ever-changing digital context.\u00a0We are particularly\u00a0keen to share\u00a0our learning and experiences in the application of ethics to the digital security space\u00a0with the broader research community.<\/p>\n<p>If you would like to get involved\u00a0in these activities as we continue to develop our work in this area,\u00a0please\u00a0email\u00a0<a href=\"mailto:IDSB@bath.ac.uk\">IDSB@bath.ac.uk<\/a>\u00a0and one of the team will get back to you.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p class=\"x_elementToProof\" data-olk-copy-source=\"MessageBody\">\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; I am delighted to introduce this timely and important blog from colleagues at the Bath Institute for Digital Security and Behaviour. There are many researchers using sensitive data in which research poses potential harms to participants, researcher wellbeing as...<\/p>\n","protected":false},"author":501,"featured_media":353,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[12],"tags":[],"class_list":["post-350","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-institutes"],"acf":[],"jetpack_featured_media_url":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-content\/uploads\/sites\/108\/2026\/06\/IDSB-image-1-1.jpg","_links":{"self":[{"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/posts\/350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/users\/501"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/comments?post=350"}],"version-history":[{"count":0,"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/posts\/350\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/media\/353"}],"wp:attachment":[{"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/media?parent=350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/categories?post=350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.bath.ac.uk\/pvc-research\/wp-json\/wp\/v2\/tags?post=350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}