There is a paper by Dhamija that explores phishing, however the authors don't actually phish the participants; instead they evaluate web pages for how believable they are and note what attributes students notice [1].  I would expect the difficult part of the study is the deception portion, which I haven't found a scholarly article on; however I do remember a DefCon presentation that "deceived" (there was a warning on the agreement) users of their system downloaded javascript for their purposes [2].

Dear Daniel

very much appreciate the two citations  - both for my work in respect to the first on successful scams and the second example were deception was used following a presumably a general consent strategy.  I have submitted to Ethics but these two would be worth adding and I am keen to look them up. Once again thanks for your help.

best

Rod

Dear Rod

In HKU, we allow minor deception (i.e. not full disclosure) for studies with minimal risk and informed consent where full disclosure would make the research impossible.

However, you must disclose fully later and allow withdrawal. You can see our procedures and forms (see link below)

Best

John

http://www.rss.hku.hk/integrity/ethics-compliance/hrecncf

Dear John

thanks for the HKU guidelines regarding "minor deception" which would be helpful in this situation indeed. We do fully disclose later and allow withdrawal at all times in the proposal. So on the surface it looks as if we might be OK. I am less sure about capturing browser data as this may be read as intrusive even if consented by the students.  There is a concern, hard to negate, that we might pick up illicit conduct -- since we are not looking at actual activity on the webpage it is hard to see how we would know...and we are not using any forensic type software.

many thanks for getting back to me. 

best

Rod

Hi Rod,

Good question. I think that today's machinery for research ethics approval has a substantive effect on what kinds of research can be done in a way that would have prohibited many earlier studies - eg Milgram's experiments on obedience to authority. I chair a research ethics advisory panel at UNSW and my panel would probably want some substantive changes, especially around spam and deception, which are also key features of the research design. Take a look at our ethics approval documentation at the UNSW website. It may be useful in crafting your request.

Cheers,

Colin

Hi Rod.

It depends from to which ethical perspective you and your institution subscribes to. I have actually done a full study on how social engineering can be measured on the three popular ethical perspectives namely deontological ethics, utilitarianism and virtue ethics. I have found that using a utilitarianism allows one to perform research on students, as the research is aimed to benefit group as a whole and thus this outweighs the impact of the harm done to the participants. However, in the same light, if you follow a deontological approach you will not be allowed to deceive the participants without their knowledge and informed consent (Which nullifies the ability to deceive them as they must be informed about it).

I have also linked the research paper to this answer. I am busy expanding this research by proposing more examples, but this is still undergoing publication. I can share with you some specific examples from it if it is required.I

I would also be really interested to know what the other respondents on this question think about the ethical views and how they influence the decision of the ethics panel. I think ethics approval is very dependent on the ethical viewpoint the panel subscribes to.

Kind Regards,

Francois

Conference Paper Social Engineering from a Normative Ethics Perspective

 Dear Franciois

many thanks for this feedback and the citation. It is highly relevant. Our national guidelines do allow for deception under some circumstances - so a rule based model is plausible. However, the need for consent is still important and this can impact on effectiveness and certainly the Ethics Committee and ANU would not approve. My assumption is that both deontological and utilitarian views are present. I feel that the "phishing' experiment would still work despite this "upfront" knowledge as fake attacks can be delayed and a "Hawthorne Effect" might still allow a deception to occur.

Anyhow good to have the papers to cite.

best

Rod

 Dear Colin

thanks for the follow-up and I did check your UNSW guidelines very similar to ours at ANU and of course draw of the national guidelines. The response to the initial submission suggested some helpful changes to improve trust etc., however, also included some concerns about accidentally stumbling on "illicit" stuff on the internet, although we are not looking at that but rather victimisation.  Although the way I want to design the browser data collection and the phishing exercise ideally would work well for the participants if we can give them specific feedback on risks if that occurs we good pool the data and give general feedback. In any event the data would be of course de-identified.  

Perhaps if your Committee had approved research involving deception this would help redesign and craft are helpful response to our committee's concerns.

Once again many thanks for getting back to me.

best

Rod

Colleagues, 

closing off this Q&A by informing readers that Ethics approval was granted for mock phishing attacks and browser observations of volunteers. Once it was agreed that volunteers would be recruited off-line and the details of the experiments and possible risks could be discussed face -to-face, including the risk of illicit activity by the volunteer can only be confidential to the extent the law allows.  

many thanks for the helpful comments.

best

Rod

Just adding some updated research to this question. I have finally published the journal article version of my SE research ethics. I have linked it in this post.

Glad you got ethical clearance Roderic, congratulations!

Article Necessity for ethics in social engineering research

Many thanks I have downloaded your most helpful paper --- we are about to pilot the experiments but will recruit face -to -face. I appreciate the follow-up.

all the best

Rod