  The computer security research community regularly tackles ethical questions.
The field of ethics / moral philosophy has for centuries considered what it
means to be "morally good" or at least "morally allowed / acceptable". Among
philosophy's contributions are (1) frameworks for evaluating the morality of
actions -- including the well-established consequentialist and deontological
frameworks -- and (2) scenarios (like trolley problems) featuring moral
dilemmas that can facilitate discussion about and intellectual inquiry into
different perspectives on moral reasoning and decision-making. In a classic
trolley problem, consequentialist and deontological analyses may render
different opinions. In this research, we explicitly make and explore
connections between moral questions in computer security research and ethics /
moral philosophy through the creation and analysis of trolley problem-like
computer security-themed moral dilemmas and, in doing so, we seek to contribute
to conversations among security researchers about the morality of security
research-related decisions. We explicitly do not seek to define what is morally
right or wrong, nor do we argue for one framework over another. Indeed, the
consequentialist and deontological frameworks that we center, in addition to
coming to different conclusions for our scenarios, have significant
limitations. Instead, by offering our scenarios and by comparing two different
approaches to ethics, we strive to contribute to how the computer security
research field considers and converses about ethical questions, especially when
there are different perspectives on what is morally right or acceptable.
