Enhanced legal clarity for cybersecurity investigators
In a groundbreaking move, the National Research Center for Applied Cybersecurity ATHENE, a leading research institution based in Germany, has conducted a mock trial to provide clarity for cybersecurity researchers operating in legally ambiguous areas. The case in question revolves around two researchers who were warned for allegedly violating the privacy of victims by downloading their photos.
ATHENE, a joint venture of the Fraunhofer Society, TU Darmstadt, Goethe University Frankfurt, and Darmstadt University of Applied Sciences, combines the cybersecurity research of the Fraunhofer Institutes SIT and IGD. The Saarland Informatics Campus at the University of Saarland has taken the lead in simulation studies for creating realistic legal rules for these researchers.
The primary factor in the verdict was the storage of photos in a location accessible to the six-member project team, as they should have been accessible only to the two researchers. The photos, made available for download with personalized links and password protection, were found to be easily accessible due to a vulnerability.
The conflict in this case was between academic freedom and the right to privacy. The researchers, in an attempt to alert the victim support center to the vulnerability, contacted the centre and provided recommendations on how to protect the sensitive images.
The mock court warned the researchers, each under the threat of a fine of 30 daily rates of 100 euros and a requirement to pay 500 euros each to the victim support center within one year. The detailed description of the fictional case and the comprehensive simulated court ruling will be published in the December issue of the specialist journal "Data Protection and Data Security (DuD)" and will also be available on a specific website from December.
The aim of the continued simulation study is to provide cybersecurity researchers with a better understanding of how to conduct their research in a legally compliant manner. Impressions of the simulation studies can be found on ATHENE's official website and social media platforms such as X, Bluesky, Mastodon, Reddit, Facebook, and Email.
It is important to note that ATHENE is one of the leading research centers for IT security worldwide and the largest center of its kind in Europe. The simulation study will continue over several years, providing invaluable insights for cybersecurity researchers navigating the complex landscape of data privacy and academic freedom.
