Ethical and Legal Guidelines for Dark Web Research
Summary
The article explains ethical and legal risks in dark web threat-intelligence research, drawing on DOJ guidance and recommending passive monitoring, written rules of engagement, thorough records, data minimization, and legal review before active engagement.
Key points
- The DOJ’s 2020 guidance addresses legal considerations for companies gathering cyber threat intelligence and interacting with illicit online sources; it is not legally binding or comprehensive.
- Passive monitoring of publicly accessible forums and marketplaces is described as posing little risk of federal criminal liability, provided researchers do not exploit vulnerabilities or misuse credentials.
- Active communication, stolen credentials, and purchasing illicit data can create legal risks; researchers should seek legal counsel and document their purpose and actions.
- The article recommends written operational plans, rules of engagement, and detailed records of tools, sources, timestamps, and research activity.
- Researchers should minimize storage of sensitive or stolen data, avoid supporting criminal activity through purchases, and treat attribution as probabilistic.
Article Details
- Topic
- Ethical, legal, and operational best practices for dark web research, including DOJ guidance on passive monitoring, active engagement, data purchases, documentation, and legal review.