"Sticking their heads out above the parapets": Lived Experiences of Legal Risks in Research

Overbroad computer crime, intellectual property, and other laws are well known to create legal risks for essential research. Notable examples include the US Computer Fraud and Abuse Act and the UK Computer Misuse Act. Because such laws fail to distinguish malicious hacking from goodfaith testing and research, researchers face serious legal risks for public-interest research activity like identifying vulnerabilities or scraping data. Despite the research community's broad awareness of these risks, our understanding of their practical impacts is limited, as most of the community's knowledge comes from anecdotal evidence rather than systematic study.

We conduct the first qualitative study focused on researchers' lived experiences, to empirically document the impacts of legal risks and threats on research and researchers, and how researchers navigate legal risk situations. Our study engages two groups: researchers (N R = 36), who discuss 130 projects and incidents, and professionals that offer support to researchers navigating legal risks (N S = 8), who have supported thousands of researchers. We thus provide an unprecedented big-picture view of researchers' experiences with legal risks. We synthesise actionable strategies for researchers, and our findings provide evidence to support policy reform.