OpenCyber AcademyLesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Why CTI research needs its own integrity rules"]
N2["1.2 Can versus may"]
N3["1.3 Pre-registration"]
N4["1.4 The ethics file"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Why CTI research needs its own integrity rules"]
N2["1.2 Can versus may"]
N3["1.3 Pre-registration"]
N4["1.4 The ethics file"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Why CTI research needs its own integrity rules]
|
v
[1.2 Can versus may]
|
v
[1.3 Pre-registration]
|
v
[1.4 The ethics file]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) state the integrity obligations that apply to CTI and OSINT research; (2) separate data you may collect from data you merely can collect; (3) pre-register a question, a method and an analysis plan; (4) build an ethics file that a review board can approve.
1.1 Why CTI research needs its own integrity rules
Threat-intelligence research touches three sensitive populations at once: victims named in incident reports, analysts whose judgments are studied, and people who appear incidentally in open sources. A design that is statistically sound can still be unethical if it re-identifies a victim organisation from a sanitised report or scrapes a forum against its terms. Integrity in this field therefore combines ordinary research ethics — honesty, transparency, no fabrication — with data-protection law such as the EU General Data Protection Regulation and with the sharing restrictions the sources themselves carry, for example FIRST TLP 2.0 labels.
1.2 Can versus may
Public visibility does not equal permission. A profile page may be reachable without login, yet its platform's terms may forbid automated collection, and the person's data may still be personal data under GDPR. Tomas's rule: before any collection, write down the lawful basis, the terms that apply, the minimisation step and the retention period. If any of the four is blank, collection waits.
The forum corpus shows the rule working: its posts were reachable without login, but the forum's terms forbade research scraping and no permission was granted, so the "applicable terms" blank could not be filled honestly and the corpus was dropped before any collection.
1.3 Pre-registration
Pre-registering the research question, hypotheses, coding scheme and analysis plan before seeing outcome data protects against unconscious fitting. In CTI, where attribution narratives are seductive, this matters: once a group name such as APT29 (ATT&CK G0016) appears in a report, analysts tend to read every later artefact as confirming it. Heuer's Psychology of Intelligence Analysis documents this tendency in human judgment.
For Tomas, pre-registration fixes in advance the mapping of each estimative phrase to a probability and the rule for coding an outcome. If those were chosen after seeing which claims were confirmed, he could, without meaning to, place a phrase such as "likely" wherever it made the calibration curve look better.
1.4 The ethics file
The file holds: data inventory, lawful basis, TLP handling for each source, de-identification method, storage location, access list, retention clock, and a plan for incidental findings (for example, discovering an unreported live compromise in a sample). That last item is specific to security research and is often missing.
Tomas's file names a concrete route for that last item: if coding reveals evidence that a named organisation may still be compromised, he tells Dr. Sato, who contacts an appropriate coordinator through the sharing community, and he does not probe the organisation himself. The 200 TLP:AMBER+STRICT reports have their own line: lab-only analysis, no quotation, aggregate reporting.
Worked example
Tomas plans to study 1,200 CTI reports. Two hundred carry TLP:AMBER+STRICT from a sharing community. His ethics file records that those may be analysed only inside the lab, never quoted, and that results will be reported in aggregate. A further corpus of forum posts is dropped because the forum's terms forbid research scraping and no permission was granted.
Synthetic case. Larkspur CTI Lab, its corpus and Tomas's ethics file are invented.
Errors and limits
Assuming "public means free to use" is the commonest integrity failure. Pre-registration does not forbid exploratory work; it requires labelling it as exploratory. This chapter is not legal advice.
Exercises
- EX001 — Four blanks. List the four items Tomas must fill before any collection begins.
Show marking criteria
Rubric: 3 = lawful basis, applicable terms, minimisation, retention; 2 = three; 1 = one or two; 0 = none. - EX002 — Amber corpus. How may Tomas use the TLP:AMBER+STRICT reports in his thesis?
Show marking criteria
Rubric: 3 = analyse inside the organisation only, no quotation or redistribution, aggregate reporting; 2 = restricts sharing vaguely; 1 = quote freely; 0 = none. - EX003 — Forum refusal. Why is dropping the forum corpus correct even though posts are visible without login?
Show marking criteria
Rubric: 3 = terms forbid scraping, no permission, personal data concerns; 2 = one reason; 1 = visible means allowed; 0 = none. - EX004 — Incidental compromise. While coding a report, Tomas notices evidence that a named organisation may still be compromised. What should the ethics file have planned?
Show marking criteria
Rubric: 3 = pre-agreed escalation route (supervisor, CERT/coordinator) without self-investigation; 2 = tell supervisor only; 1 = investigate himself; 0 = none. - EX005 — Confirmation trap. Which bias does pre-registration help contain in attribution research, and how?
Show marking criteria
Rubric: 3 = confirmation bias; fixes hypotheses and coding before outcomes; 2 = names bias; 1 = unrelated bias; 0 = none. - EX006 — Exploratory label. Tomas finds an unexpected pattern not in his plan. How should he report it?
Show marking criteria
Rubric: 3 = report as exploratory, separate from confirmatory, propose follow-up; 2 = report with weak labelling; 1 = present as planned; 0 = none. - EX007 — Access list. Who should appear on the access list for the AMBER+STRICT subset?
Show marking criteria
Rubric: 3 = only named lab members with need-to-know under the sharing agreement; 2 = lab members generally; 1 = anyone at the university; 0 = none.
Synthesis
Write the lawful basis, terms, minimisation and retention before collecting; respect TLP; pre-register; plan for incidental findings.