Research Methodology

Sign in to save your progress, earn points, and unlock module exams.

Research Ethics and Intellectual Property Rights

Topic 5.5 of Research Ethics and Intellectual Property Rights

Responsible Disclosure and Dual-Use Ethics

The dual-use tension in security research, the coordinated disclosure lifecycle including Google Project Zero's 90+30 model, how bug bounty programmes formalise the disclosure channel for student researchers, why the NSA's decision to stockpile EternalBlue is an ethics failure under Project Zero's standard, and why documenting datasets and models with datasheets and model cards is itself an ethics obligation.

~25 min total·4 quadrants of structured content

By the end of this topic, you will

Define dual-use in security research and explain the core tension it creates between defenders and attackers
Describe the 90+30 coordinated disclosure lifecycle and explain what happens if the vendor fails to patch within the 90-day window
Explain how the EternalBlue case illustrates the downstream harm of stockpiling a vulnerability rather than disclosing it
State what a bug bounty programme is and when it is the appropriate disclosure channel for a student who discovers a genuine vulnerability during a project
Explain what datasheets for datasets and model cards require a researcher to document, and why this is an ethics obligation rather than optional metadata

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

1 video lesson 1 EZ Byte 12:18 total

Sign in to track your progress

EZ Bytes · quick recaps

Same Research. Two Uses. EternalBlue Shows the Cost of Getting This Wrong.

82s

Video lesson

Quadrant 2 · e-Content

Articles and case studies

Responsible Disclosure and Dual-Use Ethics

Security research carries a tension built into its subject matter: work that helps defenders — a working exploit, a detailed vulnerability write-up — can equally help attackers. Responsible disclosure norms exist to manage this tension. The EternalBlue case shows what happens at government scale when those norms are not followed.

Quadrant 3 · Web Resources

Downloadable material and curated external links

Downloadable reference material

EBook

Research Methodology — eBook

v1.0

Open resource

Cheatsheet

Research Methodology — Cheatsheet

v1.0

Open resource

Question Bank

Research Methodology — Question Bank

v1.0

Open resource

MCQ Bank

Research Methodology — MCQ Bank

v1.0

Open resource

Quadrant 4 · Self-Assessment

Test your knowledge, earn a certificate on first pass

Assessment coming soon.

Quadrant 5 · Play

Lock it in with a game

Ungraded practice for Responsible Disclosure and Dual-Use Ethics: games and hands-on Skill Labs that use this topic, plus the crossword for Research Ethics and Intellectual Property Rights. It never affects your unit assessment, and clearing a game or lab for the first time earns EZ Board points when you are signed in.

Crossword

Research Ethics and IPR

10 key terms from this unit. Free to play.

Play Leaderboard

Race

Integrity Expressway

6 checkpoints from this unit. Free to play. Earn 30 EZ Board points on your first clear.

Play

Discussion · 0 comments

Ask a question, share an example, help a classmate

Open in forum

This is the discussion thread for the lesson "Responsible Disclosure and Dual-Use Ethics" (Research Methodology, Unit 5). Ask questions, share real-world examples, and help classmates who are stuck. Conversation starters. Try explaining one of these in your own words: - Define dual-use in security research and explain the core tension it creates between defenders and attackers - Describe the 90+30 coordinated disclosure lifecycle and explain what happens if the vendor fails to patch within the 90-day window - Explain how the EternalBlue case illustrates the downstream harm of stockpiling a vulnerability rather than disclosing it

No comments yet. Start the conversation. Comments here also appear in the forum.

Open in forum

Check each objective once you feel confident about it.