Hacked data—data obtained in an unauthorized manner through illicit access to a computer or computer network—are increasingly being used in scientific research. Examples include conflict modelling studies based on WikiLeaks datasets, and studies on sexual behaviour based on data leaked from Ashley Madison, a dating website hacked in 2015. Studies of this kind are prima facie lawful because the researchers who processed the data had no involvement in the data breach itself, and the hacked datasets were made publicly available. However, research integrity is not simply reducible to lawfulness. We contend that the ethical acceptability of using datasets of illicit origin cannot simply be presumed, but requires ethical justification. Therefore, the scientific community is urged to address a fundamental ethical question: whether, and under which conditions, conducting research using hacked data can be considered morally justifiable behaviour. This contribution will discuss and critically evaluate the ethical boundaries of research involving hacked data. This emerging ethical dilemma will be examined by analogy with previous debates on the ethics of research using data of unethical origin, such as research with data from Nazi medical experiments. Furthermore, we discuss the compatibility of research involving hacked data with current research ethics instruments such as the Belmont Report and the Oviedo Convention. We posit that research using hacked data should be deemed ethically problematic. However, exceptions may be acknowledged, depending on how the data are processed and the overall value of the study to society. To this end, we propose six ethical and procedural requirements for conducting research with hacked data in an ethically responsible manner.
This is a preview of subscription content, access via your institution
Subscribe to Nature+
Get immediate online access to the entire Nature family of 50+ journals
Subscribe to Journal
Get full journal access for 1 year
only $8.25 per issue
All prices are NET prices.
VAT will be added later in the checkout.
Tax calculation will be finalised during checkout.
Get time limited or full article access on ReadCube.
All prices are NET prices.
Thomas, D. R., Pastrana, S., Hutchings, A., Clayton, R. & Beresford, A. R. in Proc. 2017 Internet Measurement Conference 445–462 (Association for Computing Machinery, 2019).
Beecher, H. K. Ethics and clinical research. New Engl. J. Med. 274, 1354–1360 (1966).
Chohaney, M. L. & Panozzo, K. A. Infidelity and the internet: the geography of Ashley Madison usership in the United States. Geogr. Rev. 108, 69–91 (2018).
Arfer, K. B. & Jones, J. J. American political-party affiliation as a predictor of usage of an adultery website. Arch. Sex. Behav. 48, 715–721 (2018).
Griffin, J. M., Kruger, S. & Maturana, G. Personal infidelity and professional conduct in 4 settings. Proc. Natl Acad. Sci. USA 116, 16268–16273 (2019).
Linke, A. M., Witmer, F. D. W. & O’Loughlin, J. Space-time Granger analysis of the war in Iraq: a study of coalition and insurgent action-reaction. Int. Interact. 38, 402–425 (2012).
O’Loughlin, J., Witmer, F. D., Linke, A. M. & Thorwardson, N. Peering into the fog of war: the geography of the WikiLeaks Afghanistan war logs, 2004–2009. Eurasian Geogr. Econ. 51, 472–495 (2010).
Cambridge Analytica controversy must spur researchers to update data ethics. Nature 555, 559–560 (2018).
Ferretti, A. et al. Ethics review of big data research: what should stay and what should be reformed? BMC Med. Ethics 22, 51 (2021).
Franzke, A. S., Bechmann, A., Zimmer, M. & Ess, C. The Association of Internet Researchers. Internet research: Ethical guidelines, 3. https://aoir.org/reports/ethics3.pdf (2020).
Poor, N. & Davidson, R. The ethics of using hacked data: Patreon’s data hack and academic data standards. Internet Res. Ethics Soc. Age 278–280 (2017).
McCoy, T. H. Jr & Perlis, R. H. Temporal trends and characteristics of reportable health data breaches, 2010-2017. JAMA 320, 1282–1284 (2018).
Michael, G. J. Who’s afraid of WikiLeaks? Missed opportunities in political science research. Rev. Policy Res. 32, 175–199 (2015).
US Department of Health & Human Services. The Belmont Report: Ethical Principles and Guidelines for the Protection of Human Subjects of Research https://www.hhs.gov/ohrp/regulations-and-policy/belmont-report/index.html (1978).
Mansfield-Devine, S. The Ashley Madison affair. Netw. Secur. 2015, 8–16 (2015).
Baraniuk, C. Ashley Madison: ‘suicides’ over website hack. BBC News (24 August 2015).
Jones, S. Having an affair may shorten your life: the Ashley Madison suicides. Georgia State University Law Review 33, 455 (2016).
Boustead, A. E. & Herr, T. Analyzing the ethical implications of research using leaked data. Polit. Sci. Polit. 53, 505–509 (2020).
Post, S. G. The echo of Nuremberg: Nazi data and ethics. J. Med. Ethics 17, 42–44 (1991).
Ienca, M. & Vayena, E. Dual use in the 21st century: emerging risks and global governance. Swiss Med. Weekly 148, w14688 (2018).
Council of Europe. The Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine. Oviedo, Spain. https://www.coe.int/en/web/bioethics/oviedo-convention (1997).
Kahn, J. P., Vayena, E. & Mastroianni, A. C. Learning as we go: lessons from the publication of Facebook’s social-computing research. Proc. Natl Acad. Sci. USA 111, 13677–13679 (2014).
Eynon, R., Fry, J. & Schroeder, R. in The SAGE Handbook of Online Research Methods (eds Fielding, N. G. et al.) Vol. 2, 19–37 (2017).
Yee, A. et al. Ethical considerations in the use of Pernkopf’s Atlas of Anatomy: a surgical case study. Surgery 165, 860–867 (2019).
Prunkl, C. E. et al. Institutionalizing ethics in AI through broader impact requirements. Nat. Mach. Intell. 3, 104–110 (2021).
This work was partly supported by the Swiss National Science Foundation under award number 407540_167223 (NRP 75 Big Data).
The authors declare no competing interests.
Peer review information Nature Machine Intelligence thanks Ron Iphofen and the other, anonymous, reviewer(s) for their contribution to the peer review of this work.
Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
About this article
Cite this article
Ienca, M., Vayena, E. Ethical requirements for responsible research with hacked data. Nat Mach Intell 3, 744–748 (2021). https://doi.org/10.1038/s42256-021-00389-w