| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| practices:ethics [2026/08/21 14:50] – Boxes: <wrap> renders a span, use uppercase <WRAP>; one box per list, not per bullet karel.kubicek.claude | practices:ethics [2026/10/08 10:44] (current) – Extend online-group recording ethics; audit counts and refresh two stale claims; Authored by Claude karel.kubicek.claude |
|---|
| <WRAP todo>* 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 abstracts are not in OpenAlex, so those venue-years are under-represented by construction. See [[Literature:Corpus]].</WRAP> | <WRAP todo>* 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 abstracts are not in OpenAlex, so those venue-years are under-represented by construction. See [[Literature:Corpus]].</WRAP> |
| |
| In the last complete window, 85.2% of participant studies and 28.8% of participant-free crawls state an outcome. Put the two series on the same axis and the lag is measurable: **participant-free crawls reach in 2025–2026 (30.1%) a reporting rate participant studies had already passed before 2014** (28.6% in 2010–2013, 58.7% in 2014–2017). If you are writing a crawl paper, you are in the second column, and the second column is where the reviewers' patience is currently running out. | In the last complete window, 85.2% of participant studies and 28.8% of participant-free crawls state an outcome. Put the two series on the same axis and the lag is measurable: **participant-free crawls reach in 2025–2026 (30.1%) a reporting rate just above participant studies in 2010–2013 and below their 2014–2017 rate** (28.6% in 2010–2013, 58.7% in 2014–2017). If you are writing a crawl paper, you are in the second column, and the second column is where the reviewers' patience is currently running out. |
| |
| ==== Where the reviewers who have read one before are ==== | ==== Where the reviewers who have read one before are ==== |
| | TheWebConf '26* | Encouraged | Via ACM's human-participants policy | Not named | Not required | | | TheWebConf '26* | Encouraged | Via ACM's human-participants policy | Not named | Not required | |
| |
| <WRAP todo>* Six of the seven rows are the currently open cycle. TheWebConf is not: ''www2027.thewebconf.org'' does not resolve and ''thewebconf.org'' lists WWW 2027 (Dublin) with no call for papers yet, so that row is the **last published** cycle, WWW 2026, which was held in April 2026.</WRAP> | <WRAP todo>* This table records the cycles checked on **2026-08-18**. At that date the WWW 2027 website did not resolve and no call for papers was available, so its row uses the last published cycle, WWW 2026. **Update checked 2026-10-08:** the [[https://www2027.thewebconf.org/research-track-papers/|WWW 2027 research-track call]] is now available; it encourages an ethical-data-collection section when appropriate and refers to ACM's human-participants policy. The historical table above has not been relabelled as a fresh seven-venue policy audit.</WRAP> |
| |
| Four things to take from it. | Four things to take from it. |
| | ''humanAnnotation.agreementMetric'' | 3,318 papers that coded data by hand | 512 | 15.4% | | | ''humanAnnotation.agreementMetric'' | 3,318 papers that coded data by hand | 512 | 15.4% | |
| | ''crawlConfig.statefulness'' | 1,120 crawling papers | 219 | 19.6% | | | ''crawlConfig.statefulness'' | 1,120 crawling papers | 219 | 19.6% | |
| | ''crawlConfig.consentAction'' | 1,120 crawling papers | 349 | 31.2% | | | ''crawlConfig.consentAction'' (field populated; schema, not an audited paper claim) | 1,120 crawling papers | 349 | 31.2% | |
| | |
| | The consent row is a schema-completeness statistic: a populated non-sentinel field does not by itself show that the paper made the corresponding claim. The 2026-09-05 audit found **55 of 1,120 crawling papers (4.9%)** whose full text states a consent action; it also found **279 of 313 (89.1%)** ''no-interaction'' defaults unsupported. The two populations answer different questions. |
| |
| The reason it is unresolved rather than merely unreported is that the file does not answer the question a researcher has. `robots.txt` is a directive to *automated indexers*; a research crawl that loads a page once, in the way a browser would, and never republishes the content is not obviously the addressee, and a strict reading excludes exactly the pages a measurement is about (a `Disallow: /` on a site's tracking-heavy subpages removes the finding). There is no consensus in this literature, and inventing one here would be dishonest. What is not defensible is silence: **decide, do the same thing throughout the crawl, and write the sentence.** If you honour it, say what share of your sample it removed, because that is a bias in your denominator, not a footnote. If you do not, say why and what you did instead — most commonly a rate limit strict enough that the file's purpose (protecting the server) is served by other means. | The reason it is unresolved rather than merely unreported is that the file does not answer the question a researcher has. `robots.txt` is a directive to *automated indexers*; a research crawl that loads a page once, in the way a browser would, and never republishes the content is not obviously the addressee, and a strict reading excludes exactly the pages a measurement is about (a `Disallow: /` on a site's tracking-heavy subpages removes the finding). There is no consensus in this literature, and inventing one here would be dishonest. What is not defensible is silence: **decide, do the same thing throughout the crawl, and write the sentence.** If you honour it, say what share of your sample it removed, because that is a bias in your denominator, not a footnote. If you do not, say why and what you did instead — most commonly a rate limit strict enough that the file's purpose (protecting the server) is served by other means. |
| |
| For a worked example of the same reasoning applied end to end, read El Hajj Chehade et al. {[chehade2025_forbidden]}, who test broken access control on 100 live web applications. Their ethics section is a **stakeholder analysis** in the Menlo sense — end users, operators, the research team — with the risks and benefits enumerated per stakeholder and each design decision traced to one of them (two accounts per site, both created by the researchers, swapping identifiers between them, so no third party's data is ever accessible). Copy the structure. | For a worked example of the same reasoning applied end to end, read El Hajj Chehade et al. {[chehade2025_forbidden]}, who test broken access control on 100 live web applications. Their ethics section is a **stakeholder analysis** in the Menlo sense — end users, operators, the research team — with the risks and benefits enumerated per stakeholder and each design decision traced to one of them (two accounts per site, both created by the researchers, swapping identifiers between them, so no third party's data is ever accessible). Copy the structure. |
| | |
| | ===== Registering or claiming names to receive misdirected traffic ===== |
| | |
| | Registering a typo, expired, NXDOMAIN or phantom domain can make you the recipient of someone else's mail, application traffic or DNS queries. Claiming a released cloud IP, hosting zone or nameserver slot does the same through a name its operator still uses. Availability is a measurement result; receiving the traffic is a separate intervention. [[Security:Domain abuse#Registering names to measure them|Domain abuse]] covers the measurement pipeline. The decisions here belong in your protocol **before** you take control. |
| | |
| | Among the **48 domain-abuse papers** hand-selected from this site's seven-venue corpus, **19** registered domains or claimed resources; only **7** logged arrivals meant for someone else. The other twelve include testbeds, parking experiments, brief takeover proofs and registrations with nothing deployed. Among those seven receivers, four retained content and three metadata; two report ethics approval (one explicitly IRB), two an exemption or not-human-subjects determination, one approval by another body, and two discuss ethics without naming a review body. These are paper counts from source-text hand coding, not estimates of the whole field. |
| | |
| | **The defaults below are recommendations for designing a new measurement, not a vote won by the most common historical method.** |
| | |
| | ==== First establish whether you need to receive anything ==== |
| | |
| | Default to measuring references, availability or demand without taking control. A registrar availability check answers registrability; an NXDOMAIN response alone does not. Passive DNS or cache snooping can establish evidence of demand, but neither tells you what application payload would arrive, and neither measures all users: name your provider or resolver coverage, observation window and counting unit. |
| | |
| | There are recent precedents for stopping there. Squarcina et al. (2021) checked registrar and provider availability without claiming live resources {[squarcina2021_subdomain]}; So et al. (2025) checked expired app dependencies and registered none {[so2025_lost]}; Hortea et al. (2026) used WHOIS, DNS, TLS and CT queries without re-registering names or claiming resources {[hortea2026_dead]}. Randall et al.'s cache-snooping study (2020) restricted probing to large public resolvers, avoiding small misconfigured resolvers whose caches could expose a few users {[randall2020_trufflehunter]}. These alternatives reduce interception; they still need a harm analysis. |
| | |
| | If your question requires arrivals, state the missing observable. Liu et al. (2023) needed application requests following successful resolution {[liu2023_dial]}; Saric et al. (2024) measured visits to phantom domains with a blank landing page {[saric2024_hyperlink]}. Registration can also be protective without collection: Li et al. (2024) registered typo mail domains, deployed no receiving services and offered free transfer to the correct-domain owners {[li2024_bounce]}. Akiwate et al. (2020) declined mass defensive registration because that step itself raised ethical issues {[akiwate2020_lame]}. |
| | |
| | ==== Set the collection ceiling before the first arrival ==== |
| | |
| | Default to aggregate counts. Keep identifiers, request paths or selected headers only when they answer the question, and retain bodies only when content is indispensable. **Headers and URLs can contain credentials and personal data too.** Strip unnecessary fields in the receiver before persistent storage; specify access, retention and deletion separately. Encryption and later deletion protect retained data but do not reduce what you initially intercepted. |
| | |
| | ^ Receiver and publication year ^ Retention choice and stated controls ^ |
| | | Szurdi and Christin, 2017 {[szurdi2017_email]} | Full mail for analyses beyond headers; sensitive strings removed before storage; encrypted mail with the key separate from the collection server | |
| | | Akiwate et al., 2021 {[akiwate2021_risky]} | Incoming DNS queries; never answered ordinary clients; deleted log data | |
| | | Kaleli et al., 2021 {[kaleli2021_human]} | Client IP addresses and request headers, although the published result is visit counts; no handling measure stated in these hand codes | |
| | | So et al., 2022 {[so2022_spots]} | Packet captures and additional attributes; explicitly acknowledge that fewer attributes could have been collected | |
| | | Pauley et al., 2022 {[pauley2022_ipreuse]} | Encrypted packet captures; restricted server access; chose not to decode a sensitive traffic stream | |
| | | Liu et al., 2023 {[liu2023_dial]} | IP addresses, ports and payloads; anonymised personal data and deleted it before publication | |
| | | Saric et al., 2024 {[saric2024_hyperlink]} | Web-server metadata; declined tracking JavaScript | |
| | |
| | A count-only result does not demonstrate count-only collection. Report both the fields that entered storage and the fields that survived into analysis. Do not validate intercepted credentials or try to access the services they refer to. |
| | |
| | ==== Decide whether and how to answer ==== |
| | |
| | Default to silence when it answers the question, or the smallest inert, identifying response that the experiment needs. Do not impersonate the former service, forward intercepted messages to guessed recipients, or add login prompts or tracking scripts without a separate justification and review. Explain how your answer changes client behaviour and which traffic your silence prevents you from observing. |
| | |
| | Akiwate et al. (2021) never answered ordinary incoming DNS queries and restricted live-test answers to their own client {[akiwate2021_risky]}. Saric et al. (2024) returned a blank page {[saric2024_hyperlink]}; Liu et al. (2023) returned a page explaining the experiment with contact details {[liu2023_dial]}. In contrast, So et al. (2022) used bot traps, fingerprinting JavaScript and credential-collecting honeypots {[so2022_spots]}, while the parking experiments served monetised pages {[alrwais2014_parking]} {[vissers2015_parking]}. |
| | |
| | Accepting mail is also an intervention: Szurdi and Christin's server accepted messages and sent no mail out {[szurdi2017_email]}. Successful acceptance can conceal a mistyped destination from the sender; include that effect in the review, even if your server never sends a reply message. |
| | |
| | ==== Plan the name's disposition before acquiring it ==== |
| | |
| | Default to an accountable handover, or budgeted defensive renewal while harmful residual traffic remains. Set a reassessment date, a responsible operator and a funded retention plan; do not promise renewal indefinitely without one. If a legitimate owner can be identified, offer a transfer through a verified contact channel. Renewal also excludes other prospective registrants, so justify continued possession. Letting a research name lapse is a decision about who may receive the traffic next. |
| | |
| | Among the **15 papers that registered domains**, **5** state a disposition for at least some of their names. Li et al. (2024) offered free transfer {[li2024_bounce]}; Szurdi and Christin (2017) offered surrender to a trademark owner on request {[szurdi2017_email]}; Akiwate et al. (2021) held a defensive registration pending outreach {[akiwate2021_risky]}; Liu et al. (2023) planned continued renewal {[liu2023_dial]}. So et al. (2022) let their expired-domain measurement names expire again {[so2022_spots]}; Chen et al. (2025) released and then repurchased a test domain to simulate resale; that intermediate step does not state its final disposition {[chen2025_cross]}. |
| | |
| | The risk behind the renewal default is historical evidence, **not a current drop-market rate**: Lauinger et al. (2017) found about **10% of deleted .com domains** re-registered on the day of deletion {[lauinger2017_game]}. Alowaisheq et al. (2019) documented expired sinkhole nameserver domains transferring control of traffic for taken-down domains to new owners {[alowaisheq2019_cracking]}. Neither paper establishes today's rate or harm caused by releasing research names. Treat publishing a still-available traffic-bearing name as an additional disclosure decision; coordinate remediation or disposition before identifying it publicly. |
| | |
| | ==== Obtain review beyond an IRB scope determination ==== |
| | |
| | Default to a documented review of the actual receiving design before acquisition. Where the IRB declines jurisdiction, ask a body that can assess the remaining risks; the IRB decision alone does not approve interception, data handling, answers or disposal. |
| | |
| | Akiwate et al. (IMC 2021) took their design and controls to campus general counsel when their IRB could not provide independent oversight, and obtained approval before active measurement {[akiwate2021_risky]}. Pauley et al. (IEEE S&P 2022) combined an IRB exemption with a data-handling plan approved by their institution's CISO office {[pauley2022_ipreuse]}. Li et al. (IMC 2024), at an institution without an IRB, obtained partner network-department and regulatory supervision {[li2024_bounce]}. These are precedents for specific remits, not interchangeable approvals or a guarantee that the same route exists at your institution. So et al. (2022) and Liu et al. (2023) describe ethics without naming a review body; Kaleli et al. (2021) report a not-human-subjects determination {[so2022_spots]} {[liu2023_dial]} {[kaleli2021_human]}. |
| | |
| | ==== Apply the same controls to claimed resources ==== |
| | |
| | For a takeover proof, default to your own testbed first. If a live claim is indispensable, predefine the shortest claim-test-release window, use an identifying TXT record instead of replacing production answers where possible, avoid receiving normal users, and verify rollback. A loopback A record avoids directing clients to your receiver but still changes resolution; it is not automatically harmless. |
| | |
| | Zhang et al. (IMC 2023) used loopback A records and identifying TXT records, then removed them after testing {[zhang2023_wolf]}. Zhang et al. (USENIX Security 2024) used an informational TXT record, set negative-cache TTL to **one second**, completed testing within **two minutes**, deleted records and checked that resolution returned to REFUSED; they also checked provider logs for normal-user requests {[zhang2024_cross]}. These controls come from related authors' studies, not an independently established field-wide standard. |
| | |
| | Pauley et al.'s cloud-IP telescope (2022) is the receiving variant rather than a takeover proof: each allocated address collected traffic for up to **ten minutes**, with no interaction above the transport layer, then the instance was replaced {[pauley2022_ipreuse]}. That window is their design choice, not a safe-duration threshold. Alowaisheq et al.'s nameserver-slot claim (2019) resulted in disclosure and registry intervention, but the hand coding found no stated response policy, holding window or review body {[alowaisheq2019_cracking]}. Report all three. |
| | |
| | ==== Currency and what to report ==== |
| | |
| | Receipt logging has precedents from 2017–2024; inert-record takeover proofs have precedents from 2023–2024. The hand-selected domain-abuse population contains **7 papers in 2025 and 2 in 2026 (both provisional)**, with **3 registration/claiming papers in 2025 and 0 in 2026**; none of these nine logged arrivals. Recent non-claiming studies provide alternatives, but this thin slice does not establish that reception has been superseded. The defaults above minimise intervention; they are not measured adoption rates in 2026. |
| | |
| | Report the candidate population and selection rule, acquisition dates and checks, names or resources acquired, observation time per resource, received traffic units, field-level collection ceiling, response behaviour, unexpected sensitive-data procedure, review body's remit and decision, disclosure route, and post-study disposition. Distinguish available names, acquired names, names receiving any traffic and names retained in analysis as separate denominators. For claimed resources, add production-record changes, TTLs, rollback checks and any normal-user traffic observed. |
| | |
| | The per-paper codes, every count query, verified source spans and real report output are in [[provenance:practices:ethics#Registration and claiming section 2026 10 08|the registration provenance log]]. |
| | |
| | ===== Entering and recording online groups ===== |
| | |
| | Joining a Telegram or WhatsApp group, a Discord server or a members-only forum puts you among people who joined a community, not a study. The same issue arises when you record a subreddit without joining anything. **Access, consent, interaction and subsequent disclosure are separate decisions.** A working invite link establishes an access route; it does not establish what members expected you to do with their conversations. For the discovery and collection mechanics, see [[design:platforms:messaging_channels]]. |
| | |
| | ==== What the corpus can tell you ==== |
| | |
| | A whole-corpus vocabulary scan, followed by candidate adjudication, identifies **168 papers analysing online-community member content or data**. Of these, 110 collected data directly, 11 combined collection with reuse or leaks, 43 reused existing data, three analysed leaked community databases, and one leaves the collection route unresolved. The platform families overlap: 75 involve Reddit, 56 forums, 24 Telegram and 10 Discord. This is a **detected population**, not an exhaustive census; minor uses, professional discussion lists and community Q&A are included. The full inclusion/exclusion ledger is on the provenance page. |
| | |
| | The review denominator is the **121 papers with direct collection or a mixed route**. Their extraction records 71 with a non-sentinel review label and 50 silent (43 with ''none-mentioned'', seven with no ethics record). This is a count of **extraction labels**, not independently verified review decisions. Some supporting quotes describe precautions rather than review, as in He et al.; others are damaged by column extraction. Even a real paper-wide approval may cover interviews instead of group collection. We therefore do not turn these records into a group-specific approval rate. {[he2025_unmasking]} |
| | |
| | ^ Year ^ Community-data papers identified ^ Direct collection or mixed route ^ |
| | | 2024 | 22 | 15 | |
| | | 2025 — provisional | 29 | 19 | |
| | | 2026 — provisional | 12 | 9 | |
| | |
| | These rows locate the recent evidence; they are not a growth or decline trend. Earlier years and all candidate verdicts are logged in the report. The provisional years are under-represented by construction (see [[literature:corpus]]). |
| | |
| | For the narrower **26 messaging group/channel collection papers**, re-running the existing hand codes gives 10 reporting approval, one exemption, two a determination that review was not required, two invoking institutional standards without naming a board, one naming approval for a different study component, and 10 saying nothing about review. Seven explicitly state passive collection. These are reporting categories, not evidence that the other papers interacted or failed to obtain approval. The approval for {[yu2024_listen]}'s recruited user study does not establish approval for its Discord scraping. Counts describe these seven venues and this detected population, not all online-community research. |
| | |
| | ==== Defaults to take into your study design ==== |
| | |
| | These are recommendations derived from the cases below, **not a claim that a majority of papers follows them**. Methods are dated so that an old collection precedent does not become permission to repeat it under today's terms. |
| | |
| | ^ Decision ^ Default and its boundary ^ Papers showing the choice or a different one ^ |
| | | Entry | Start with spaces accessible to an ordinary member without misrepresenting yourself, paying for admission or obtaining a personal vouch. Observe without posting or contacting operators unless interaction is necessary and separately assessed. Record how the invite circulated, whether approval was required and what members could see about your account. For a small or selectively admitted community, seek permission and an appropriate consent process, or omit it. Administrator permission helps with entry but cannot stand in for every member's consent to recording and reuse. | Marjanov et al. (2026) entered Telegram channels through advertised invites, including channels Telegram calls private, but ruled out deception, payments and vouching. Their “private” channels should not be equated with a small trusted group. He et al. (2025) communicated with wallet-drainer operators and acquired tools; this is interaction requiring its own assessment, rather than evidence for a passive protocol. {[marjanov2026_stayin]} {[he2025_unmasking]} | |
| | | Consent | Prefer transparent collection with consent where practicable. For large openly accessible communities where notifying everyone would itself intrude or disrupt, submit a **specific argument for collecting without individual consent**: necessity of the data, why consent is impracticable, expected audience, possible harms and mitigations. Record who accepted that argument and whether it is an ethics decision, an institutional human-subjects determination or a formal waiver. Reassess when entry becomes selective or you identify individuals. | Marjanov et al. (2026) argue from publicly accessible communities and collective patterns. Vu et al. (2025) argue that contacting everyone on forums/channels would amount to spam, then aggregate and paraphrase. These arguments do not automatically extend to invite-only support groups. Li et al. (2025) deliberately excluded Telegram groups and self-constructed forums while collecting publicly accessible Reddit discussions. {[marjanov2026_stayin]} {[vu2025_assessing]} {[li2025_investigating]} | |
| | | Fields, files and retention | Decide the minimum fields **before** collection: avoid member lists if message-level analysis suffices; replace identifiers at ingestion if linkage is needed; restrict access to any linking secret; set retention and deletion rules. Do not download stolen-data payloads merely because posts advertise them. If media is essential, specify allowed types, a size cap and isolated handling. | Hoseini et al. (2020) store hashes of phone numbers. Roy et al. (2025) avoid reading/downloading credential payload files while analysing posts and filenames. Marjanov et al. (2026) instead download selected file types subject to a size cap. That cap is a resource limit, not proof that the contents are safe. Plain phone-number hashes remain enumerable; do not describe them as anonymisation. {[hoseini2020_demystifying]} {[roy2025_darkgram]} {[marjanov2026_stayin]} | |
| | | Models and other recipients | Keep raw messages and identifiers on controlled infrastructure; use local models where classification needs sensitive text. Map every recipient, including scraper vendors, hosted classifiers and human annotators. Moving messages to a service creates a new disclosure even if the service does not train on them. Local processing reduces that disclosure but does not confer a platform licence. | Marjanov et al. (2026) explicitly choose local LLMs to avoid sending stolen and sensitive data to third parties. Roy et al. (2025) instead use Azure-hosted GPT-4 for classification of collected software and social-media-manipulation posts. Both routes appear in the recent corpus: the local-model default is a harm-minimisation judgement, not a demonstrated field consensus or a claim that hosted classification has been superseded. {[marjanov2026_stayin]} {[roy2025_darkgram]} | |
| | | Quotations and release | Prefer aggregate results, paraphrased examples and controlled data access. Removing a username does not remove searchability: a verbatim message, timestamp or named small group can identify its author. Check combinations of fields, and withhold sensitive raw messages from public artifacts. | Vu et al. (2025) paraphrase quotations to prevent attribution; Li et al. (2025) also paraphrase excerpts. Marjanov et al. (2026) provide access through institutional licence agreements rather than a public raw database. The broader privacy framework explains why aggregation, linkage and searchable quotations can undo de-identification. {[vu2025_assessing]} {[li2025_investigating]} {[marjanov2026_stayin]} {[beadle2025_privacy]} | |
| | |
| | **Where the public-community argument stops.** Albrecht et al. (2021) interviewed Hong Kong protesters who expected police monitoring of large public Telegram groups and distinguished these from small trusted groups. Arunasalam et al. (2024) report refugees' distress after an outsider entered an invitation-only WhatsApp group and sent offensive content. These are accounts of members' expectations, not experiments establishing that silent research observation causes the same harm. Together they make group purpose, vulnerability, audience and admission rules design variables; neither supplies a universal group-size cutoff. If consent, safe admission or adequate protection cannot be achieved, exclusion is a methodological choice worth reporting, as in Li et al. {[albrecht2021_collective]} {[arunasalam2024_security]} {[li2025_investigating]} |
| | |
| | ==== Platform permission is a separate question ==== |
| | |
| | Primary policies checked **2026-10-08**: |
| | |
| | * **Telegram:** its [[https://telegram.org/tos/content-licensing|content-licensing terms]] restrict access beyond ordinary intended use, with a limited client/bot/mini-app exception. They also expressly prohibit data use for AI development, benchmarking and deployment, and say exceptions may be granted where every relevant user gives explicit, continuing consent for that context. That consent is a prerequisite, not automatic permission. An official API and a locally hosted model do not by themselves satisfy those terms. |
| | * **WhatsApp:** the [[https://www.whatsapp.com/legal/terms-of-service|Terms of Service]] prohibit impermissible or unauthorised user-information collection, including through automated means. Identify the regional terms and authorisation covering your actual route; a published WhatsApp scraper is not that authorisation. |
| | * **Discord:** [[https://support.discord.com/hc/en-us/articles/115002192352-Automated-User-Accounts-Self-Bots|automating normal user accounts outside the OAuth2/bot API is forbidden]]. A legitimate bot installation resolves that account-automation issue; it does not settle whether members consent to recording, analysis or release. |
| | |
| | Do not merge these into “research is permitted” or “public collection is always illegal”. State the actual route, relevant clause, any permission obtained, your institution's legal assessment and your ethics decision separately. The existence of a publication establishes a precedent for a study design, not platform authorisation or a legal exemption. |
| | |
| | ==== Read before collecting; report before submitting ==== |
| | |
| | Start with Beadle et al.'s **2025 privacy framework** for research using social-media data, then Marjanov et al. (2026) and Roy et al. (2025) for contrasting pipelines. {[beadle2025_privacy]} {[marjanov2026_stayin]} {[roy2025_darkgram]} Outside the seven venues, **AoIR 3.0** (approved 2019, cited as 2020) remains listed on AoIR's ethics page when checked today. It covers privacy expectations in public and quasi-public fora, but has no dedicated messaging-group procedure. **Barbosa and Milan (2019)** address WhatsApp ethnography directly: iterative ethical reasoning, transparency, avoiding dishonest bypasses, controlled infrastructure and paraphrasing. Neither is a general waiver for undisclosed group scraping. {[franzke2020_aoir]} {[barbosa2019_privatechat]} |
| | |
| | Report the discovery frame and number of spaces found, joinable, admitted, excluded and actually recorded; access rules and account identity; interactions or their absence; whether you retrieved old history; fields and media retained; consent or the precise argument for its absence and the review body's remit; every third-party recipient; retention, quotation and release rules. Excluding small, paid or vouched groups changes your population: describe the result as a measurement of the accessible spaces you sampled, not the whole platform. See [[provenance:practices:ethics#Online groups section 2026 10 08|the section's queries, source checks and review log]] and [[literature:corpus|corpus-level limitations]]. |
| |
| ===== Where your traffic comes from is an ethics question ===== | ===== Where your traffic comes from is an ethics question ===== |
| |
| ===== A reporting checklist ===== | ===== A reporting checklist ===== |
| | |
| | For a registration or resource-claiming measurement, also report the acquisition, collection ceiling, response policy, review and post-study disposition listed in [[#Registering or claiming names to receive misdirected traffic]]. |
| |
| What to put in the paper. Every item here is something the corpus shows a large share of papers omitting. | What to put in the paper. Every item here is something the corpus shows a large share of papers omitting. |
| |
| ===== Related pages ===== | ===== Related pages ===== |
| | |
| | * [[Security:Domain abuse]] — availability, residual trust and misdirected traffic; the ethics of taking control are covered above. |
| |
| * [[Practices:Notifying websites]] — the operator-facing channel: contact discovery, response rates, embargoes, control groups. | * [[Practices:Notifying websites]] — the operator-facing channel: contact discovery, response rates, embargoes, control groups. |
| * [[Programming:Crawler]] — where the rate limit and the User-Agent actually get set. | * [[Programming:Crawler]] — where the rate limit and the User-Agent actually get set. |
| * [[Privacy:Consent]] — interacting with a banner is an interaction. | * [[Privacy:Consent]] — interacting with a banner is an interaction. |
| | * [[Privacy:Age assurance]] — **four questions this page does not currently answer**: crawling adult content, submitting a synthetic or a real identity document to a live vendor, publishing a working bypass, and measuring an age model without measuring children. That page states them as a gap here. |
| | * [[Design:Platforms:Messaging channels]] — discovery, admission and collection mechanics; see [[#Entering and recording online groups]] here for consent, minimisation and disclosure decisions. |
| * [[Design:Website selection]] — a robots.txt exclusion is a change to your sampling frame. | * [[Design:Website selection]] — a robots.txt exclusion is a change to your sampling frame. |
| * [[:Artifacts]] — what you can release once the data has people in it. | * [[:Artifacts]] — what you can release once the data has people in it. |
| * [[Statistics:Interrater agreement]] — hired annotators and crowdworkers are participants; 5.1% of the corpus's hand-coding papers use them. | * [[Statistics:Interrater agreement]] — annotation methods and reporting; distinguish paid annotation work from recruited study participants. |
| |
| ===== Methodology and limitations of these figures ===== | ===== Methodology and limitations of these figures ===== |
| |
| Every corpus figure above comes from ''scripts/report_ethics.mjs'' over ''data/extract/run1'' (5,859 papers, 2010–2026). Five limits carry directly: | The registration and claiming section uses ''scripts/report_ethics_registration.mjs'' and source-text hand codes inherited from the domain-abuse audit, rechecked against the current corpus. Its codes have one coder and are not an independent double-coded sample. Other corpus figures come from ''scripts/report_ethics.mjs'' over ''data/extract/run1'' (5,859 papers, 2010–2026). Five limits carry directly: |
| |
| * **Seven venues only.** EuroS&P, ACSAC, RAID, AsiaCCS, CHI and SOUPS are absent. CHI and SOUPS in particular are where the human-subjects methodology literature lives, so the picture here understates the field's ethics discourse and reports only what the security and measurement venues put in print. | * **Seven venues only.** EuroS&P, ACSAC, RAID, AsiaCCS, CHI and SOUPS are absent. CHI and SOUPS in particular are where the human-subjects methodology literature lives, so the picture here understates the field's ethics discourse and reports only what the security and measurement venues put in print. |
