Let me try to understand your position a little better.<p>Are you saying the problem here is simply that the effects of the attack were observable by others? If this were not the case, you&#x27;d have been fine with it?<p>And since you seem to be arguing that researchers shouldn&#x27;t examine user traffic, do you also think that what Egerstad did was also wrong? Do you agree with his arrest?<p>And one more thing sort of related to this. What&#x27;s your opinion on research like Arvind&#x27;s Netflix deanonymization attack? Do you think the work that research involved was also unethical?<p>&gt; All researchers have an obligation to consider and mitigate possible harms that occur during their research<p>This is nice idealism and I&#x27;m totally in support of it. But I can&#x27;t help think this is pie-in-the-sky thinking, especially when organizations like the DoD are involved.