Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard-cite-them-right
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Anticipatory Ethics for Vulnerability Disclosure
Swedish Defence University, Department of Military Studies, Science of Command and Control and Military Technology Division, Military Technology Systems Section. School of Informatics, University of Skövde, Skövde, Sweden.ORCID iD: 0000-0002-7552-9465
Towson University; Hoffberger Center for Professional Ethics, University of Baltimore.
2020 (English)In: Proceedings of the 15th International Conference on Cyber Warfare and Security / [ed] Payne, Brian K.; Wu, Hongyi, Reading, UK: Academic Conferences and Publishing International Limited, 2020, p. 254-261Conference paper, Published paper (Refereed)
Abstract [en]

This article presents the ethical dilemma related to under what circumstances vulnerabilities should be disclosed. Vulnerabilities exist in hardware and software, and can be as a consequence of programming errors or design flaws. Threat actors can exploit these vulnerabilities to gain otherwise unintended access to information systems, resources and/or stored information. In other words, they can be used to impact the confidentiality, integrity and availability of information in information systems. As a result, various types of vulnerabilities are highly sought after since they enable this type of access. The most highly sought are so-called “zero-day”-vulnerabilities. These are vulnerabilities that exist but are unknown, and when exploited, enable one way of entry into a system that is not thought possible. This is also why zero-day vulnerabilities are very popular among criminal organizations, states and state-sponsored advanced persistent threats. The other side of the coin is when a state identifies a zero-day, and ends up in the ethical dilemma of whether to release the news and inform the vendor to patch it, i.e. close the vulnerability, or to use it for offensive or intelligence purposes. This article employs these distinctions to apply anticipatory ethics in the Stuxnet-case. Stuxnet was a computer software that was allegedly developed by the U.S. together with Israel to disrupt Iran’s development of uranium for their nuclear program. More exactly, it was developed to disable the uranium centrifuges used to enrich uranium. To achieve this, Stuxnet exploited four zero-day vulnerabilities and, according to some experts, managed to delay Iran’s nuclear program by one to two-years, forcing them to the negotiation table. Using vulnerabilities like zero-days presents opportunities but also risks. The results of the application of anticipatory ethics to the Stuxnet case are then compared with the “Osirak”-case and the “al-Kibar”-case. Osirak was the nuclear reactor in Iraq and was bombed in 1981; al-Kibar was the nuclear reactor being built up in Syria, also bombed in 2007.

Place, publisher, year, edition, pages
Reading, UK: Academic Conferences and Publishing International Limited, 2020. p. 254-261
Series
The proceedings of the international conference on information warfare and security, ISSN 2048-9870, E-ISSN 2048-9889
Keywords [en]
vulnerabilities, zero-days, information systems, ethical dilemma, Stuxnet, Iran Nuclear Program, anticipatory ethics
National Category
Social Sciences Interdisciplinary Information Systems Political Science (excluding Public Administration Studies and Globalisation Studies)
Research subject
Systems science for defence and security
Identifiers
URN: urn:nbn:se:fhs:diva-9099DOI: 10.34190/ICCWS.20.053ISBN: 9781912764525 (print)ISBN: 9781912764532 (electronic)OAI: oai:DiVA.org:fhs-9099DiVA, id: diva2:1415413
Conference
15th International Conference on Cyber Warfare and Security (ICCWS), 12-13 March, 2020, Old Dominion University, Norfolk, Virginia, USA
Available from: 2020-03-18 Created: 2020-03-18 Last updated: 2020-04-03Bibliographically approved

Open Access in DiVA

Anticipatory Ethics for Vulnerability Disclosure(240 kB)8 downloads
File information
File name FULLTEXT01.pdfFile size 240 kBChecksum SHA-512
c7c5a79be81f2d4f233e6111c7950de0c85742f8daf918672f3319ee74d53e2276129f3653f6ba0ae51a5b3e20336747aff7ad9906f25e6eb20c0f17f4556d68
Type fulltextMimetype application/pdf

Other links

Publisher's full text

Authority records BETA

Huskaj, Gazmend

Search in DiVA

By author/editor
Huskaj, Gazmend
By organisation
Military Technology Systems Section
Social Sciences InterdisciplinaryInformation SystemsPolitical Science (excluding Public Administration Studies and Globalisation Studies)

Search outside of DiVA

GoogleGoogle Scholar
Total: 8 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

doi
isbn
urn-nbn

Altmetric score

doi
isbn
urn-nbn
Total: 59 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard-cite-them-right
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf