Paper 2026/1207

"Sticking their heads out above the parapets": Lived Experiences of Legal Risks in Research (Extended)

Daniel R. Thomas, University of Strathclyde

Abstract

Overbroad computer crime, intellectual property, and other laws are well known to create legal risks that can discourage essential research. Notable examples include the US Computer Fraud and Abuse Act and the UK Computer Misuse Act. Because such laws fail to distinguish malicious hacking from good-faith testing and research, researchers face serious legal risks for public-interest research activity like identifying software or hardware vulnerabilities or scraping data. Despite the research community's broad awareness of these risks, our understanding of their practical impacts is limited, as most of the community's knowledge comes from anecdotal evidence rather than systematic study. We conduct the first qualitative study focused on researchers' lived experiences, to empirically document the *impacts of legal risks and threats* on research and researchers*, and *how researchers navigate legal risk situations*. Our study engages two participant groups: researchers with legal-risk experiences in the UK or the US ($N_R=36$), who discuss 130 projects and incidents spanning over three decades, and professionals that offer support to researchers navigating legal risks ($N_S=8$), who have collectively supported thousands of researchers. We thus provide an unprecedented big-picture view of researchers' experiences with legal risks. We synthesise actionable strategies for researchers, and our findings provide evidence to support policy reform.

Note: Added link to Lawfare post.

@misc{cryptoeprint:2026/1207,
      author = {Sunoo Park and Daniel R. Thomas},
      title = {"Sticking their heads out above the parapets": Lived Experiences of Legal Risks in Research (Extended)},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/1207},
      year = {2026},
      url = {https://eprint.iacr.org/2026/1207}
}