In a personal reflection on the ethics of research, Colin Percival describes the 'duty of a scholar' as a moral obligation to ensure that knowledge reaches those who need it. Percival argues that while researchers create new knowledge, scholars are responsible for carrying that knowledge to the public. This duty is not merely about publishing in academic journals; it is about identifying the specific people—be they security teams, software users, or the general public—who must be informed to prevent harm or improve systems.
Percival illustrates this principle through his 2005 discovery of a side-channel vulnerability in Intel's Hyper-Threading technology. He identified that the feature could leak information between execution threads via cache states, potentially allowing for the reconstruction of RSA private keys. Rather than immediately publishing the findings, Percival spent six months working quietly with security teams to develop patches. This period of 'responsible disclosure' was made possible by his personal circumstances at the time, which allowed him to prioritize this ethical duty over immediate career advancement or financial gain.
The narrative also touches on the limitations and nuances of this duty. Percival notes that while there is a moral obligation to disclose hazards, there is no duty to become a 'Cassandra'—forcing knowledge upon those who refuse to hear it. He draws a parallel to professional engineering codes, which require professionals to disclose safety hazards regardless of personal connections. However, he distinguishes his view from the philosopher Fichte, who suggested that scholars owe a debt to society; Percival argues instead that the duty attaches to the knowledge itself. For Percival, the goal is to ensure that if everyone capable of acting upon a piece of knowledge has been made aware of it, the scholar's duty is fulfilled.
One significant practical constraint on this duty is the socio-economic reality of the researcher. Percival points out that his ability to act on this duty was facilitated by living in Canada with a social safety net; in a different economic environment, such as the United States, the need for immediate employment and medical insurance might have forced a choice between personal survival and the fulfillment of a scholarly duty. This highlights that while the ethical obligation to share knowledge is a personal choice, its execution is often bound by the material realities of the researcher's life.
Finally, Percival emphasizes a process of escalation in disclosure. He cites an instance where he reported a firewall bug in Amazon EC2 to the company directly. When the company failed to address the issue, he moved to a public blog to advise customers on how to fix the problem themselves. This approach balances the desire for efficient, private resolution with the ultimate goal of ensuring that the knowledge is shared when private channels fail to produce a result.