Computer Security Education and Research: Handle with Care

Many computer security researchers are actively seeking ways to detect attackers and their malicious code and tools to protect computing systems from hackers' activities. Sharing these research findings with practitioners and students magnifies the impact. In pursuing these goals, however, researchers, educators, and their students must ensure that their own computing activities remain legal and ethical. Computer security professionals should be equally cautious in assisting corporate or government computer resource owners with investigations. Advances in technology often outstrip the legal system's ability to create statutes and experience case law to test them - a process that can take many years. In this column, we outline specific areas where those in academic security roles should tread carefully, particularly with regard to US laws