Do not entertain these people's pony show. Do not give them attention. The only way for UMN to be redeemed is for them to expel all the researchers responsible and to fire all the staff tangentially responsible for letting it happen.
But what’s the appropriate proportional response?
I honestly have a hard time thinking firing a bunch of people over this would be a good outcome for anyone.
What’s the end goal? I feel like already there’s been enough action to deter this kind of sneaky research in the future.
But at some point you’re just going to scare away the ethical researchers too.
Determining how to conduct your research ethically is a core part of being a researcher. Basic research into pen testing and security research would have revealed how unethical this study was.
I see firing as completely justifiable given that was a failure in a core part of thier job, that not only caused a public relations mess, but has directly negatively affected other members of the research institute because they have been banned from Kernel contribution.
What further incompetence do you think is required to justify firing this academic?
Yes, only if it's unrelated to their jobs. People get hired, not fired, to do unethical research in industry labs. Ethics is breached all the time in industry - rarely even considered. Google tried to make amends, but decided caring too much about ethics was a roadblock to their goals. Tesla markets their "FSD" at the risk of other drivers in the road. The only difference here is that companies have a bigger, better legal and PR team. Comparing the moral compass between academia and industry is absolutely ridiculous.
If you are trying to argue that publicly funded research institutions don't think ethics are a core part of research, that seems like something that needs to be addressed.
And to be more precise, ethics IS a core part of research. There's an entire subfield dedicated to it in academic labs. Graduate research is very specialized, and researchers do not have the intuition for a difficult topic outside of their expertise. Then there are IRBs, who are most qualified, and yet we see it remains a problem for computing ethics because it's a completely different environment.
We can continue to blame this lab, fine. I agree, huge ethical blunder. But don't forget that this passed IRB, a responsibility of the university, and several phases of anonymous peer review for a major security conference. The security conference that most definitely has reviewers from industry. Was there a lapse of judgement on ALL the scientists and engineers, all with immense experience in their respective fields, who touched this paper and participated through the entire process? Do you seriously believe that? Should they all be fired? Is it really hard to believe that computing ethics is actually not as clear, communicated, and well understood to MANY? There are so many caveats, and not much policies of conduct exist for the breadth of situations.
[1] https://www.theatlantic.com/technology/archive/2014/06/every...