{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,6]],"date-time":"2026-07-06T11:27:10Z","timestamp":1783337230855,"version":"3.54.6"},"reference-count":36,"publisher":"Emerald","issue":"3","license":[{"start":{"date-parts":[[2024,1,15]],"date-time":"2024-01-15T00:00:00Z","timestamp":1705276800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["ICS"],"published-print":{"date-parts":[[2024,6,11]]},"abstract":"<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Purpose<\/jats:title>\n<jats:p>This paper aims to discuss the ethical aspects of hardware reverse engineering (HRE) and propose an ethical framework for HRE when used to mitigate cyber risks of the digital supply chain of critical infrastructure operators.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Design\/methodology\/approach<\/jats:title>\n<jats:p>A thorough review and analysis of existing relevant literature was performed to establish the current state of knowledge in the field. Ethical frameworks proposed for other areas\/disciplines and identified pertinent ethical principles have been used to inform the proposed framework\u2019s development.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Findings<\/jats:title>\n<jats:p>The proposed framework provides actionable guidance to security professionals engaged with such activities to support them in assessing whether an HRE project conforms to ethical principles. Recommendations on action needed to complement the framework are also proposed. According to the proposed framework, reverse engineering is neither unethical nor illegal if performed honourably. Collaboration with vendors and suppliers at an industry-wide level is critical for appropriately endorsing the proposed framework.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Originality\/value<\/jats:title>\n<jats:p>To the best of the authors\u2019 knowledge, no ethical framework currently guides cybersecurity research, far less of cybersecurity vulnerability research and reverse engineering.<\/jats:p>\n<\/jats:sec>","DOI":"10.1108\/ics-10-2023-0182","type":"journal-article","created":{"date-parts":[[2024,1,12]],"date-time":"2024-01-12T10:12:23Z","timestamp":1705054343000},"page":"365-377","source":"Crossref","is-referenced-by-count":5,"title":["Ethical hardware reverse engineering for securing the digital supply chain in critical infrastructure"],"prefix":"10.1108","volume":"32","author":[{"given":"Arne Roar","family":"Nyg\u00e5rd","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sokratis K.","family":"Katsikas","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"140","published-online":{"date-parts":[[2024,1,15]]},"reference":[{"key":"key2024060713480957400_ref001","article-title":"Interviewee, enhancing cybersecurity in the power industry's digital supply chain: exploring procurement strategies","year":"2023"},{"key":"key2024060713480957400_ref002","doi-asserted-by":"crossref","first-page":"80","DOI":"10.4018\/978-1-7998-2325-4.ch005","article-title":"HCI and user experience design education: principles for ethical and responsible practices in inclusive research and application","volume-title":"UXD and UCD Approaches for Accessible Education","year":"2020"},{"key":"key2024060713480957400_ref003","unstructured":"Association for Computing Machinery (2018), \u201cACM code of ethics and professional conduct\u201d, available at: www.acm.org\/code-of-ethics (accessed 10 December 2023)."},{"issue":"1","key":"key2024060713480957400_ref004","doi-asserted-by":"crossref","first-page":"231","DOI":"10.1007\/s10677-021-10166-8","article-title":"An ethical framework for hacking operations","volume":"24","year":"2021","journal-title":"Ethical Theory and Moral Practice"},{"key":"key2024060713480957400_ref005","volume-title":"5G Hardware Supply Chain Security through Physical Measurements","year":"2022"},{"key":"key2024060713480957400_ref006","volume-title":"Cybersecurity Supply Chain Risk Management for Systems and Organizations","year":"2022"},{"key":"key2024060713480957400_ref007","doi-asserted-by":"crossref","first-page":"360","DOI":"10.4018\/978-1-5225-8516-9.ch018","article-title":"Strategic managerial communication in the digital era: implications for ethical-unethical behavior","volume-title":"Handbook of Research on Strategic Communication, Leadership, and Conflict Management in Modern Organizations","year":"2019"},{"key":"key2024060713480957400_ref008","article-title":"Crossing the line: ethics for the security professional","year":"2021"},{"key":"key2024060713480957400_ref009","volume-title":"The Ethics of Cybersecurity","year":"2020"},{"key":"key2024060713480957400_ref010","first-page":"233","article-title":"GATE teachers from the inside out: students' perceptions on gifted and talented teachers in the classroom","volume-title":"Identifying, Describing, and Developing Teachers Who Are Gifted and Talented","year":"2019"},{"key":"key2024060713480957400_ref011","unstructured":"Cycuity (2022), \u201cDetect and prevent security vulnerabilities in your hardware root of trust\u201d, available at: https:\/\/cycuity.com\/wp-content\/uploads\/2022\/06\/Cycuity_White-Paper_Detect-Security-Vulnerabilities-HRoT.pdf (accessed 7 October 2023)."},{"issue":"4","key":"key2024060713480957400_ref012","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1109\/MSP.2010.199","article-title":"Building an active computer security ethics community","volume":"9","year":"2011","journal-title":"IEEE Security and Privacy Magazine"},{"key":"key2024060713480957400_ref013","volume-title":"Directive (EU) 2022\/2555 of the European Parliament and of the Council","author":"European Union","year":"2022"},{"key":"key2024060713480957400_ref014","article-title":"Practical cybersecurity ethics: mapping CyBOK to ethical","year":"2023"},{"issue":"1","key":"key2024060713480957400_ref015","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s13347-018-0303-9","article-title":"Soft ethics and the governance of the digital","volume":"31","year":"2018","journal-title":"Philosophy and Technology"},{"issue":"6","key":"key2024060713480957400_ref016","doi-asserted-by":"crossref","first-page":"375","DOI":"10.1007\/BF00996717","article-title":"Medical data protection: a proposal for a deontology code","volume":"14","year":"1990","journal-title":"Journal of Medical Systems"},{"key":"key2024060713480957400_ref017","volume-title":"Hardware Supply Chain Security Threat Modelling, Emerging Attacks and Countermeasures: Threat Modelling, Emerging Attacks and Countermeasures","year":"2021"},{"key":"key2024060713480957400_ref018","volume-title":"Ethics Guidelines for Trustworthy AI","author":"High-Level Expert Group on Artificial Intelligence","year":"2019"},{"key":"key2024060713480957400_ref019","unstructured":"Information Systems Security Association (2023), \u201cISSA code of ethics\u201d, available at: www.issa.org\/issa-code-of-ethics\/ (accessed 10 December 2023)."},{"key":"key2024060713480957400_ref020","unstructured":"Institute of Electrical and Electronics Engineers (2020), \u201cIEEE code of ethics\u201d, June, available at: www.ieee.org\/about\/corporate\/governance\/p7-8.html (accessed 10 December 2023)."},{"key":"key2024060713480957400_ref021","first-page":"202","article-title":"Ethics in cybersecurity. What are the challenges we need to be aware of and how to handle them?","volume-title":"Cybersecurity of Digital Service Chains","year":"2022"},{"key":"key2024060713480957400_ref022","article-title":"An analysis of ethics as foundation of information security in distributed systems","volume-title":"Thirty-First HI International Conference on System Sciences","year":"1998"},{"key":"key2024060713480957400_ref023","volume-title":"The Huawei and Snowden Questions","year":"2018"},{"key":"key2024060713480957400_ref024","article-title":"Ethics in cybersecurity research and practice","volume":"63","year":"2020","journal-title":"Technology in Society"},{"issue":"2","key":"key2024060713480957400_ref025","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1109\/MSP.2010.67","article-title":"Ethics in security vulnerability research","volume":"8","year":"2010","journal-title":"IEEE Security and Privacy Magazine"},{"key":"key2024060713480957400_ref026","doi-asserted-by":"crossref","first-page":"230","DOI":"10.4018\/978-1-4666-6198-1.ch011","article-title":"Ethics in higher education","volume-title":"Handbook of Research on Higher Education in the MENA Region: Policy and Practice","year":"2014"},{"key":"key2024060713480957400_ref027","article-title":"Vendor security assessment. Assessing the security of network equipment","author":"National Cyber Security Centre","year":"2022"},{"key":"key2024060713480957400_ref028","article-title":"Ethical implications of security vulnerability research for critical infrastructure protection","volume-title":"15th International Conference on Wirtschaftsinformatik","year":"2020"},{"key":"key2024060713480957400_ref029","article-title":"SoK: Combating threats in the digital supply chain","volume-title":"Proceedings of the 17th International Conference on Availability, Reliability and Security","year":"2022"},{"key":"key2024060713480957400_ref030","article-title":"Leveraging hardware reverse engineering to improve the cyber security and resilience of the smart grid","volume-title":"20th International Conference on Security and Cryptography","year":"2023"},{"key":"key2024060713480957400_ref031","article-title":"Reverse engineering for thwarting digital supply chain attacks in critical infrastructures: ethical considerations","volume-title":"19th International Conference on Security and Cryptography (SECRYPT 2022)","year":"2022"},{"key":"key2024060713480957400_ref032","doi-asserted-by":"crossref","first-page":"852","DOI":"10.4018\/978-1-4666-5202-6.ch080","article-title":"Ethical issues of qualitative research","volume-title":"Encyclopedia of Business Analytics and Optimization","year":"2014"},{"key":"key2024060713480957400_ref033","unstructured":"Schwartz, A. (2019), \u201cImproving hardware component vulnerability disclosure\u201d, 4, available at: www.centerforcybersecuritypolicy.org\/insights-and-research\/improving-hardware-component-vulnerability-disclosure (accessed 7 October 2023)."},{"key":"key2024060713480957400_ref034","volume-title":"Responsible Conduct of Research","year":"2022","edition":"4th edition"},{"key":"key2024060713480957400_ref035","article-title":"A state-of-the-art reverse engineering approach for combating hardware security vulnerabilities at the system and PCB level in IoT devices","year":"2022"},{"key":"key2024060713480957400_ref036","unstructured":"Witteman, M. and Goncharov, K. (2023), \u201cThe roots of Riscure, device security, and pre-silicon\u201d, available at: www.riscure.com\/security-highlight-marc-witteman-on-the-roots-of-riscure-device-security-and-pre-silicon\/ (accessed 7 October 2023)."}],"container-title":["Information &amp; Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-10-2023-0182\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-10-2023-0182\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T01:23:16Z","timestamp":1753406596000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/ics\/article\/32\/3\/365-377\/1237028"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,1,15]]},"references-count":36,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2024,1,15]]},"published-print":{"date-parts":[[2024,6,11]]}},"alternative-id":["10.1108\/ICS-10-2023-0182"],"URL":"https:\/\/doi.org\/10.1108\/ics-10-2023-0182","relation":{},"ISSN":["2056-4961","2056-4961"],"issn-type":[{"value":"2056-4961","type":"print"},{"value":"2056-4961","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,1,15]]}}}