Working log for Ethics. Every query with its population and denominator, the report script with its unedited output, both folds with their residue printed in full, every quote with its verification verdict, the external sources with how each was checked, and what could not be established. Corpus-wide caveats — the venue scope, the selection funnel, the provisional 2025–2026 slice — are on Corpus and are not repeated here.

Voice here is a working log, not prose. It is read by somebody checking a number.

No ~~DISCUSSION~~ block: comments belong on the content page, following the convention set by the earlier provenance pages.

Every figure on the page names one of these. None of them is “of 5,859 papers”.

crawlOnly is this page's own construction and is not one of the corpus's named populations. It exists because the page's central claim is a contrast between two study kinds, and crawled alone conflates them: 149 of the 1,120 crawling papers also recruited participants, and those 149 report at nearly the human-subjects rate. Without splitting them the crawl figure reads 27.7% instead of 21.3%, and the contrast the page is about is diluted by a third.

ethics is an object, not an array, and it can be null. 4,472 of the 5,118 empirical papers carry one; 646 do not. This matters more than it sounds:

• scripts/site_queries.mjs --page ethics reports reviewOutcome against 5,118 but reports notifiedAffectedParties, regulatorContact and robotsTxt against 4,472. Mixing the two moves every share by about 13%.
• report_ethics.mjs therefore always prints no-ethics-record as its own visible row and never merges it into none-mentioned. Sections A, B and F use 5,118 or 1,120 (the full population, with the absent record shown); section H uses 4,472 and says so in the column header.

const OUTCOMES = ['approved', 'exempt', 'not-required', 'sought-outcome-unstated',
                  'explicitly-discussed-no-review'];
const statesReview = (p) => p.ethics !== null && OUTCOMES.includes(p.ethics.reviewOutcome);
const approved     = (p) => p.ethics !== null && ['approved','exempt'].includes(p.ethics.reviewOutcome);

explicitly-discussed-no-review is counted as stated. A paper that says “we considered the ethics and did not seek review” has said something checkable, which is what this page measures. It is 318 of 5,118 empirical papers, and every table that uses statesReview also prints the approved/exempt column so a reader who disagrees can subtract. The page says this in its limitations section rather than burying it here.

scripts/report_ethics.mjs — every figure on the page with its denominator, plus both folds' residue, the full-text sweeps, and a block listing every non-corpus number so check_page_numbers.mjs can run whole-page.

node scripts/report_ethics.mjs                  # plain text (below)
node scripts/report_ethics.mjs --wiki           # DokuWiki tables
node scripts/report_ethics.mjs --list <key>     # the papers behind a figure
node scripts/report_ethics.mjs --quotes <re>    # ethics evidence quotes matching a regex

--list keys: crawlonly-approved, crawlonly-silent, robots-stated, no-review-discussed, menlo, nhs, residential-proxy, aup, no-review-body, tos.

Unedited output, 2026-08-18:

report_ethics.txt

# practices/ethics — dataset queries
Corpus: 7 venues, 2010–2026, 5859 papers with full text.
2025 is thin at the edges and 2026 is provisional (CCS/IMC 2026 not yet held; IEEE S&P and WWW 2026 abstracts absent from OpenAlex).
 
Population       Definition                                                   Papers
---------------  -----------------------------------------------------------  ------
`empirical`      measured the world as it is                                  5118
`crawled`        `crawlConfig` fired or `studyTypes` has automated-web-crawl  1120
`humanSubjects`  `participants[]` fired                                       1357
`crawlOnly`      crawled **and** recruited nobody                             971
 
## A. Ethics review outcome, of the 5,118 empirical papers
 
`ethics.reviewOutcome`            Papers  Share of 5118  Sentinel?
--------------------------------  ------  -------------  ---------
`approved`                        994     19.4%
`exempt`                          157     3.1%
`not-required`                    179     3.5%
`sought-outcome-unstated`         80      1.6%
`explicitly-discussed-no-review`  318     6.2%
`none-mentioned`                  2744    53.6%          yes
`no-ethics-record`                646     12.6%          yes
 
**Stated something about review: 1728 of 5118 (33.8%).**
Of those, 1151 (66.6% of the 1728) report an approval or an exemption; the rest state a review was not required, was sought with no outcome given, or was explicitly discussed and not obtained.
 
## B. Who states a review outcome: participants vs no participants
 
Population                                      Papers  States a review outcome  Approved or exempt  Silent
----------------------------------------------  ------  -----------------------  ------------------  ------------
`humanSubjects` — recruited participants        1357    1022 (75.3%)             896 (66.0%)         335 (24.7%)
`crawled` — ran a crawl (any)                   1120    310 (27.7%)              188 (16.8%)         810 (72.3%)
  …of which also recruited participants         149     103 (69.1%)              95 (63.8%)          46 (30.9%)
  …**`crawlOnly` — crawled, recruited nobody**  971     207 (21.3%)              93 (9.6%)           764 (78.7%)
`empirical` — all empirical papers              5118    1728 (33.8%)             1151 (22.5%)        3390 (66.2%)
 
"Silent" = `none-mentioned` plus papers where no `ethics` record was extracted at all.
 
## C. Reporting a review outcome, over time
 
Window      `empirical` N  states  %      `humanSubjects` N  states  %      `crawlOnly` N  states  %
----------  -------------  ------  -----  -----------------  ------  -----  -------------  ------  -----
2010–2013   460            47      10.2%  84                 24      28.6%  89             6       6.7%
2014–2017   718            155     21.6%  155                91      58.7%  155            23      14.8%
2018–2021   1272           378     29.7%  329                230     69.9%  262            42      16.0%
2022–2024   1649           681     41.3%  486                414     85.2%  299            86      28.8%
2025–2026*  1019           467     45.8%  303                263     86.8%  166            50      30.1%
 
\* 2025–2026 is provisional; see the corpus caveat above.
Gap between the two study kinds, latest complete window (2022–2024): 85.2% vs 28.8%.
 
## D. Reporting a review outcome, by venue (empirical papers)
 
Venue            Empirical papers  States a review outcome  Share  Cites the Menlo Report  Share
---------------  ----------------  -----------------------  -----  ----------------------  -----
PoPETs           477               259                      54.3%  14                      2.9%
USENIX Security  1226              506                      41.3%  76                      6.2%
IEEE S&P         646               246                      38.1%  26                      4.0%
IMC              625               208                      33.3%  46                      7.4%
NDSS             586               189                      32.3%  29                      4.9%
CCS              818               197                      24.1%  24                      2.9%
TheWebConf       740               123                      16.6%  10                      1.4%
 
## E. What kind of body reviewed it (of the papers that name one)
 
1347 of 5118 empirical papers name a review body, in **595 distinct strings**.
The fold is single-label and ordered (most specific family first); 2 strings matched nothing, and 2 are a sentinel written into the free-text field ("not stated") and belong to no family.
 
Kind of body                                                   Papers  Share of 1347 naming one
-------------------------------------------------------------  ------  ------------------------
A US-style Institutional Review Board (IRB)                    986     73.2%
An ethics committee or ethical review board (non-IRB wording)  241     17.9%
The institution, named only as such                            47      3.5%
Data protection officer or data protection office              28      2.1%
Legal department, general counsel or compliance office         25      1.9%
A regulator or government body                                 7       0.5%
An internal company or partner review                          5       0.4%
An external or community safety board                          4       0.3%
 
Unmapped residue, in full:
  - internal review process
  - ethics and data protection review
 
Papers naming a network operations / services / management department among the reviewing bodies: 7.
  IMC/2014/forced-perspectives-evaluating-an-ssl-trust-enhancement-at-scale  —  university network services department
  USENIX/2016/website-targeted-false-content-injection-by-network-operators  —  networks' administration teams
  NDSS/2019/the-use-of-tls-in-censorship-circumvention  —  IRB and institutional networking and IT staff
  IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s  —  network management department and regulatory authority of Coremail
  NDSS/2024/on-precisely-detecting-censorship-circumvention-in-real-world-networks  —  campus institutional review board (IRB) and network operations staff
  NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services  —  network management department
  NDSS/2025/hades-attack-understanding-and-evaluating-manipulation-risks-of-email-blocklists  —  network management department
 
## F. robots.txt (population: the 1,120 papers that ran a crawl)
 
`ethics.robotsTxt`  Papers  Share of 1120
------------------  ------  -------------
`respected`         15      1.3%
`ignored`           9       0.8%
`discussed`         29      2.6%
`not-stated`        939     83.8%
`no-ethics-record`  128     11.4%
 
**Says anything at all about robots.txt: 53 of 1120 (4.7%).**
 
How the robots.txt reporting rate compares with the other low-reporting enums (each against its own population,
and counting `not-applicable` as a sentinel, which is how OVERVIEW.md counts them):
Field                                                                      Population N  Stated  Share
-------------------------------------------------------------------------  ------------  ------  -----
`ethics.robotsTxt`                                                         1120          53      4.7%
`crawlConfig.headless`                                                     1120          140     12.5%
`humanAnnotation.agreementMetric`                                          3318          512     15.4%
`crawlConfig.statefulness`                                                 1120          219     19.6%
`crawlConfig.consentAction (field populated; not an audited paper claim)`  1120          349     31.2%
`ethics.reviewOutcome`                                                     5118          1728    33.8%
Full-text cross-check: the literal string `robots.txt` appears anywhere in 55 of 1120 crawling papers (4.9%); 0 full-text files were missing.
The sweep is the upper bound (it fires on a reference-list title too); the schema figure is the lower one. Both say the same thing.
 
## G. What crawling papers say they did to limit harm
 
Like-for-like on the crawlOnly population: 585 of 971 (60.2%) state a mitigation, against 207 of 971 (21.3%) that state a review outcome.
697 of 1120 crawling papers (62.2%) give a free-text harm-mitigation step. The other 423 say nothing — which is not the same as doing nothing, and is not counted as such anywhere below.
 
The fold is **multi-label** — one sentence routinely names three steps — so shares do not sum to 100%.
 
Mitigation family                                                           Papers  Share of 697 that state one
--------------------------------------------------------------------------  ------  ---------------------------
Data minimisation — collecting less than you could                          180     25.8%
Rate limiting, pacing and load control                                      164     23.5%
Disclosure and notification of affected parties                             123     17.6%
Anonymisation, pseudonymisation and hashing                                 108     15.5%
Staying non-intrusive: no exploitation, no tampering, no logins             104     14.9%
Test accounts, synthetic identities and the researchers’ own assets         92      13.2%
Isolation: sandboxes, VMs, containers, lab-only deployment                  59      8.5%
Access control, encryption and secure storage                               53      7.6%
Deletion and retention limits                                               50      7.2%
Avoiding financial harm to operators and advertisers                        33      4.7%
Consent, opt-in and opt-out mechanisms                                      28      4.0%
Screening and handling of harmful or illegal content                        25      3.6%
Respecting robots.txt, terms of service and acceptable-use policies         17      2.4%
Formal review, legal advice and named legal regimes                         17      2.4%
Identifying the crawler and offering an operator an opt-out (hand-decided)  10      1.4%
 
Unmapped residue: 28 of 697 (4.0%). In full:
  - Stripped JavaScript and rewrote links to prevent malicious traffic reaching other sites.
  - Closed experimental Twitter accounts after 48 hours.
  - Advertised legitimate Chinese e-commerce sites and filtered search engines and bots.
  - Limited orders to three per day per campaign to reduce detection.
  - WHOIS queries were limited to a small percentage of domains.
  - Collected URLs without automated visits and avoided sending automated traffic to monetization services.
  - Stored only raced sessions and at most their last 30 packets.
  - They state that the attacks cannot automatically compromise devices at scale.
  - They decided not to contact affected app publishers about findings.
  - Used bucketing, daily writes, and rounding counters to protect anonymity.
  - Sent one email per provider and did not follow up.
  - Used static screening to focus later dynamic analysis on selected apps.
  - Limited clicks to fewer than 15 per app and advertiser visits to fewer than 25 on average.
  - Only scraped publicly accessible pages; landmarks could be removed and webcams were never accessed or controlled.
  - One visit per site per OS, with visits at different times and no concurrent visits.
  - Collected alerts were transferred to an EDR client for manual verification.
  - Registered unintended domains to prevent attackers from exploiting them.
  - Used anonymous expressions and did not focus on particular forum users.
  - Avoided residential IPs and used university addresses instead.
  - Avoided explicitly clicking ads; discussed ecosystem harms.
  - Only downloaded firmware images released to the general public.
  - Tested each API once, used 10 kB labeled beacons, uploaded 447 images totaling 4.4 MB.
  - They discuss potential sensitive-information leakage from sharing frontend URLs.
  - Contacted each address once, offered opt-out, explained recruitment, and stopped GitHub recruitment.
  - Avoided highlighting individual government strategies or security weaknesses.
  - Artifact warns that aggressive eviction may destabilize or crash systems.
  - Did not report sites to preserve observation of scam operations.
  - Crawler visits used a fresh browser and a dynamic pool of IPs.
 
Crawler identification and opt-out — a hand-decided family, because a bare
"opt-out" fires on participant and notification-recipient opt-out too.
Sweep and hand map agree on all 21 candidates.
 
Verdict      Papers  Share of 21 candidates
-----------  ------  ----------------------
operator     10      47.6%
participant  4       19.0%
telemetry    4       19.0%
recipient    2       9.5%
evasion      1       4.8%
 
**Directed at the party being measured: 10 of 697 papers that state a mitigation (1.4%).** This is the figure the page uses.
 
Every candidate with its verdict and deciding text:
  [participant] CCS/2014/private-by-design-advertising-meets-the-real-world
                 Opt-in participation and an easy opt-out mechanism — the opt-out is for the users of the advertising system, not for site operators.
  [telemetry  ] IEEE-SP/2015/the-attack-of-the-clones-a-study-of-the-impact-of-shared-code-on-vulnerability-p
                 Used opt-in telemetry and excluded user-identifiable information.
  [operator   ] CCS/2020/deploying-android-security-updates-an-extensive-study-involving-manufacturers-ca
                 did not obfuscate user agents or IP addresses.
  [operator   ] CCS/2021/out-of-sight-out-of-mind-detecting-orphaned-web-pages-at-internet-scale
                 customized opt-out User-Agent.
  [recipient  ] USENIX/2021/effective-notification-campaigns-on-the-web-a-matter-of-trust-framing-and-suppor
                 honored opt-outs — from the notification campaign, not from the crawl.
  [evasion    ] PETS/2022/setting-the-bar-low-are-websites-complying-with-the-minimum-requirements-of-the
                 Used legitimate User-Agent strings ... avoided detectable automation frameworks. This is the opposite of identifying yourself.
  [telemetry  ] USENIX/2022/online-website-fingerprinting-evaluating-website-fingerprinting-attacks-on-tor-i
                 opt-in entry circuits — consent from relay operators contributing data, not from a measured site.
  [operator   ] IMC/2023/thou-shalt-not-reject-analyzing-accept-or-pay-cookie-banners-on-the-web
                 Dedicated machines, informative rDNS, measurement website, and blocklisting option — the full set.
  [recipient  ] PETS/2023/comparing-large-scale-privacy-and-security-notifications
                 opt-out from the notification campaign.
  [participant] PETS/2023/privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part
                 offered opt-out, explained recruitment — study recruitment.
  [telemetry  ] USENIX/2023/rods-with-laser-beams-understanding-browser-fingerprinting-on-phishing-pages
                 participation was explicitly opt-in — the telemetry contributors.
  [operator   ] PETS/2024/a-black-box-privacy-analysis-of-messaging-service-providers-chat-message-process
                 warnings, opt-out — directed at the messaging providers under measurement.
  [participant] PETS/2024/what-does-it-mean-to-be-creepy-responses-to-visualizations-of-personal-browsing
                 participants could opt out or uninstall.
  [operator   ] CCS/2025/in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the
                 identifying header, opt-out link.
  [operator   ] IEEE-SP/2025/gptracker-a-large-scale-measurement-of-misused-gpts
                 opt-out offered to the measured GPT authors.
  [operator   ] PETS/2025/intractable-cookie-crumbs-unveiling-the-nexus-of-stateful-banner-interaction-and
                 Dedicated identifiable measurement machines; stakeholders could opt out.
  [participant] IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
                 opt-outs offered to the volunteers, per-website.
  [operator   ] NDSS/2025/hades-attack-understanding-and-evaluating-manipulation-risks-of-email-blocklists
                 opt-out information published for the measured mail operators.
  [operator   ] USENIX/2025/s-mine-collecting-and-analyzing-s-mime-certificates-at-scale
                 opt-out contact.
  [operator   ] NDSS/2026/one-email-many-faces-a-deep-dive-into-identity-confusion-in-email-aliases
                 opt-out notices.
  [telemetry  ] IEEE-SP/2021/trouble-over-the-air-an-analysis-of-fota-apps-in-the-android-ecosystem
                 Used anonymized, opt-in telemetry.
 
## H. Disclosure and regulator contact (context only — see the two sibling pages)
 
`ethics.notifiedAffectedParties`  Papers  Share of 4472 empirical papers with an ethics record
--------------------------------  ------  ----------------------------------------------------
`yes`                             1636    36.6%
`partial`                         524     11.7%
`no`                              194     4.3%
`not-applicable`                  1001    22.4%
`not-stated`                      1117    25.0%
 
`ethics.regulatorContact`  Papers  Share of 4472
-------------------------  ------  -------------
`yes`                      147     3.3%
`no`                       1982    44.3%
`not-stated`               2343    52.4%
 
## I. Full-text sweeps (upper bounds — a sweep fires on a reference-list title too)
 
Probe                                            Papers  Population        Share
-----------------------------------------------  ------  ----------------  -----
`Menlo Report`                                   225     empirical (5118)  4.4%
`Belmont Report`                                 36      empirical (5118)  0.7%
`IRB` anywhere                                   987     empirical (5118)  19.3%
a "not human subjects" determination             79      empirical (5118)  1.5%
`ACM Code of Ethics`                             6       empirical (5118)  0.1%
`robots.txt`                                     55      crawled (1120)    4.9%
terms of service / terms of use                  129     crawled (1120)    11.5%
`acceptable use policy`                          5       crawled (1120)    0.4%
`residential prox*`                              25      empirical (5118)  0.5%
data donation / donated data                     24      empirical (5118)  0.5%
opt-out signalling (rDNS, info page, blocklist)  63      crawled (1120)    5.6%
`Common Rule` or `45 CFR 46`                     32      empirical (5118)  0.6%
`Tor Research Safety Board`                      7       empirical (5118)  0.1%
a named ethics/REC committee of the venue        39      empirical (5118)  0.8%
**"our institution has no review body"**         20      empirical (5118)  0.4%
 
Of the 20 papers stating their institution has no review body: 16 recruited participants, 2 ran a crawl, and 10 name the Menlo Report.
 
Menlo Report citations over time (population: empirical papers in the window):
Window      Empirical papers  Cite the Menlo Report  Share
----------  ----------------  ---------------------  -----
2010–2013   460               0                      0.0%
2014–2017   718               7                      1.0%
2018–2021   1272              32                     2.5%
2022–2024   1649              84                     5.1%
2025–2026*  1019              102                    10.0%
 
## J. Sensitivity check: does the reporting gap survive dropping posters and short records
 
Population       N (all)  States review (all)  N (trimmed)  States review (trimmed)  Dropped
---------------  -------  -------------------  -----------  -----------------------  -------
`empirical`      5118     33.8%                4920         34.8%                    198
`crawlOnly`      971      21.3%                948          21.6%                    23
`humanSubjects`  1357     75.3%                1322         76.4%                    35
 
Trimmed = posters (slug `poster-*` or title `Poster:`) and records of 4 pages or fewer removed.
 
## K. Figures on the page that do NOT come from this corpus
 
Every number below is external and is cited on the page with its source and the date it was read.
They are listed here so a whole-page number audit does not flag them as unsourced corpus figures.
 
  Ramulu et al., CCS 2025 (in the corpus as a paper, but these are ITS figures, not ours):
    1154 papers reviewed; 839 with no ethics discussion; 315 with one; 270 with a dedicated
    section; 45 in the body only; 36 naming the Menlo Report; 251 mapped to Menlo principles;
    159 beneficence; 110 confidentiality; 89 informed consent; 79 compensation; 56 law;
    18 justice; 11 vulnerable persons; 257 mentioning vulnerability disclosure; 116 human-subject
    papers, of which 102 discuss ethics and 90 have a dedicated section; 17 of those 116 do not
    mention a review board; 52 non-human-subject papers that do; 24 interviewees.
 
  Load and cost figures quoted from individual papers, each verified against the paper by
  scripts/eth_quotecheck.mjs (all 34 quotes exact):
    2.7 URLs per second (Zhang et al., NDSS 2014); a 1 minute delay between page loads
    (Bashir et al., USENIX Security 2016); no more than ten queries per second (Almansoori
    et al., PoPETs 2022); no more than 4 visits per day (Zeng et al., IMC 2021); 256 parallel
    workers, pausing on HTTP 429 and HTTP 503 (Amos et al., TheWebConf 2021); about $400 in
    impressions (Datta et al., PoPETs 2015); USD 1.12 maximum and USD 0.04 average per landing
    domain (Subramani et al., IMC 2020).
 
  Hantke et al., IEEE S&P 2024 (its own study design, not ours): 23 interviews, 119 survey
    respondents, 5 scenarios; and the figure it reports for IEEE S&P 2022 — a Reject
    recommendation for 2 of 67 flagged papers out of 1,006.
 
  Venue policies, standards and legal instruments, each cited on the page with its URL and the
  date it was read (2026-08-18). The bare numbers they contribute, so a whole-page number audit
  can account for them:
    45 CFR 46.102, 46.104 (and the subsection numbers 1, 4, 6 inside them); the year 2012 for
    the Menlo Report and 2013 for its companion; GDPR Article 89; EU AI Act Article 2, and its
    paragraphs 6 and 8; DSA Article 40, its 49 applications received by 19 May 2026, and the
    delegated act of 2 July 2025; Van Buren v. United States, 593 U.S. 374 (2021); hiQ Labs v.
    LinkedIn, No. 17-16783 (9th Cir., 18 April 2022); Jisc MF-POL-007 Issue 5.1 and its 1
    working day of notice; ACM policy approved 15 August 2021; HTTP statuses 200 and 403
    encountered while fetching those sources; Mozilla Rally archived 29 July 2024; Citizen
    Browser last post October 2022; DataSkop 2022-2023; Tracking Exposed ended 2023;
    Bright Data residential KYC for zones created after 7 July 2026; arXiv:2511.10408 and its
    hiQ Labs v. LinkedIn district-court docket 3:17-cv-03301-EMC, entry 406, the $500,000
    consent judgment of 8 December 2022; Regulation (EU) 2016/679 Art. 89(1) and 89(2);
    Regulation (EU) 2024/1689 Art. 2(6), 2(8) and Recital 25; Swiss HRA SR 810.30 Art. 2;
    the European Commission ethics self-assessment guidance version 2.0 of 13 July 2021;
    HTTP 301 redirects on the DHS and Jisc pages; Hantke et al. interviewee composition
    (9 legal experts, 10 operators, 5 REC members); Ramulu et al. "all but 17" read as 99 of
    116 or 85 of 102; the Menlo Report companion of 2013; Azure dropping pre-approval in
    June 2017; Singh et al. 22 volunteers across 23 countries in 2025; Chehade et al. 100 live
    web applications; and the conference-cycle shorthands 26 and 27 (as in "USENIX Security
    '27"), which are years, not counts;
    16 interviewees; the rhetorical 100,000 sites in the introduction; Wu et al. NDSS 2025 own
    figures (1,407 scanner IPs, 28 honeypots, one year); Ramulu et al. 257 disclosure papers;
    Hantke et al. 100 web applications tested by Chehade et al.; and the derived ~1,038
    (1,154 - 116) non-human-subject papers in Ramulu et al.

scripts/harm_fold.mjs. ethics.harmMitigation is a free-text, at-most-20-word summary of the steps a paper says it took. Two design decisions, both load-bearing:

• It is not a name field. There is no canonical string to converge on, so a spelling fold (the name_fold.mjs approach used for tools and locations) is meaningless here. What is stable across two readings of the same sentence is the *kind* of step, so the fold maps a sentence to a set of mitigation families.
• It is multi-label. “Rate-limited requests, avoided off-limit information, and anonymized collected data” is three steps in one string. Single-labelling it would throw two away. So a string can match several families, each family is counted in papers, and the shares on the page do not sum to 100% — which the page states above the table.

A paper with harmMitigation === null is never counted as “took no steps”. It is counted as “did not say”, which is a different and larger set (423 of the 1,120 crawling papers).

14 regex families, ordered but not exclusive, plus one hand-decided family (below) that has no regex at all. 14 self-tests, each a real string from the corpus:

14 fold self-tests pass

Residue: 28 of 697 papers (4.0%), printed in full in section G of the report output above. Reading it: most of the 27 are genuinely idiosyncratic single-instance steps (“Registered unintended domains to prevent attackers from exploiting them”, “Advertised legitimate Chinese e-commerce sites and filtered search engines and bots”) rather than a family the fold is missing. Two near-misses were left unmapped on purpose rather than widened into: “Avoided residential IPs and used university addresses instead” (a vantage-point choice framed as harm mitigation) and “Crawler visits used a fresh browser and a dynamic pool of IPs” (the opposite choice, also framed as harm mitigation). A family for “vantage-point hygiene” would have two members pointing in opposite directions.

The first version of the anonymisation regex ended …|anonymised|/i — a trailing empty alternative, which matches the empty string, so every non-null harmMitigation string scored as anonymisation. The self-test caught it because two test cases asserted families that string did not contain and got anonymisation back instead. Recorded here because the failure is silent in every other respect: the family counts looked plausible (106 papers) and the residue went down, which is the direction that normally reads as an improvement.

The first complete run had a residue of 162 of 697 (23.2%). Reading the residue showed almost all of it belonged to families that already existed — the regexes were written from the first 60 strings and did not generalise (“Visited each page once”, “one request per URL per day”, “Time-gapped measurements” are all rate limiting; “Did not retain IP addresses” is data minimisation). Broadening the fourteen families cut it to 4.0% with no new family except one: crawler-identification, split out of consent-and-optout because identifying your crawler and offering an operator an opt-out is a different act from obtaining a participant's consent, and it is the one the page argues for. That family then turned out to need a hand map rather than a regex — see below.

The page publishes a count for identifying the crawler and offering an operator an opt-out and builds an argument on it (“the cheapest credible thing on the list”). The first version was a regex whose broadest alternative was a bare opt-?out, and it reported 17 of 697.

Reviewer 1 pulled the 17 and found that 7 of them recruited human participants, quoting four whose text is unambiguously about a study participant's right to withdraw. That is not the same act as telling a site operator who is crawling them.

The fix was to remove the family from the regex list entirely. What replaced it:

• CRAWLER_ID_CANDIDATES — a loose sweep (opt-out, opt-in, rDNS, measurement website, identifying header, legitimate User-Agent, …), deliberately over-broad.
• CRAWLER_ID — a hand verdict for every candidate, with the deciding text, in one of five categories: operator (directed at the party being measured), participant, telemetry (opt-in consent from people whose client data is reused), recipient (opt-out from a notification campaign — that is disclosure hygiene and belongs to Notifying websites), and evasion (a “legitimate” User-Agent chosen so the crawler is not identifiable, which is the opposite act).
• report_ethics.mjs fails loudly if the sweep returns a paper the map does not cover, or the reverse.

That guard fired on the first run, surfacing four opt-in-telemetry papers that neither the tightened regex nor the reviewer had found. Final split of the 21 candidates: 10 operator, 4 participant, 4 telemetry, 2 recipient, 1 evasion.

The published figure moved 17 → 10, and foldHarm() now takes an optional paper key so the table row comes from the hand map rather than from a string match. Without the key it simply does not emit that family — it is never guessed.

scripts/body_fold.mjs. ethics.reviewBody is free text naming who reviewed the study: 1,347 papers, 595 distinct strings. Single-label and ordered, most specific family first, because the question the page asks is “what kind of body signs a web measurement off” — a student in a department with no IRB needs to know what the alternatives are called.

Order matters and was set by the failures:

• dpo and regulator before legal and irb, because “data protection officer” and “CNIL” are more specific than the words around them.
• irb before ethics-committee, because “institutional ethics review board (IRB)” should count as an IRB.
• institution-unspecified last, because it is a catch-all containing institution|universit|department|board|office and would otherwise swallow everything.

Two keyed exceptions, checked before the families. “Data Protection Inspectorate of Estonia” is a regulator, not a DPO, and the string for the first contains the string for the second. “Privacy and Security Board of Politecnico di Torino” is a university body, not a company one — the company family exists to catch corporate “privacy review board” language and fired on it first; caught in review, and it moved two published rows by one paper each. One sentinel rule: the extractor occasionally writes “not stated” into this free-text field; that is a non-answer, reported apart from both the families and the residue (2 papers).

17 self-tests:

16 body-fold self-tests pass

Residue: 2 of 1,347 strings — “internal review process” and “ethics and data protection review”. Both are real review bodies that no family names; neither was worth a rule.

The page says 4.7% is “the lowest reporting rate of any field in the extraction behind this site”. That is a claim about fields this page does not otherwise touch, so section F of the report computes them rather than quoting them, each against its own population and counting not-applicable as a sentinel:

All six reproduce data/extract/OVERVIEW.md's Where the field goes quiet table exactly, which is a useful independent check that this script's sentinel handling matches the corpus's own.

A first version of this table did not reproduce it, and the reason is the one this site keeps re-learning: it tested !== 'not-stated' instead of isSentinel(…), so not-applicable counted as an answer. That put consentAction at 52.2% instead of 31.2% and statefulness at 21.1% instead of 19.6% — plausible-looking numbers that would have been published with no way to notice. The fix was to use lib.mjs's isSentinel everywhere, which is why it exists.

Section I of the report. Every sweep is an upper bound: it matches the reference list and the related-work section as well as the methods, so a hit is not a claim that the paper did the thing.

Three of them are used on the page as evidence, and each is paired with a schema figure so the two can be read against each other:

Sweeps run but not published on the page, with why:

The page says “Seven papers in the corpus name a network operations, network services or network management department among the bodies that reviewed the study”. That is not a fold family — it came from reading the reviewBody residue and noticing a recurring institution kind that the family list treats as institution-unspecified. Section E of the report lists all seven with their exact strings. Two of the seven name an IRB as well, so this is “among the bodies”, not “instead of a board”, and the page says it that way.

An earlier draft said “four”, from an eyeball count of the reviewBody frequency table. The report now computes it.

scripts/eth_quotecheck.mjs checks every sentence the page quotes from a corpus paper against the rendering the extractor read, with the ligature / line-break-hyphen / smart-quote normalisation from le_quotecheck.mjs, and falls back to a pypdf re-extraction when paper.cols.txt fails — the two renderings defeat different sentences on two-column ACM PDFs.

exact    100%  [cols] IMC/2017/fifteen-minutes-of-unwanted-fame-detecting-and-characterizing-doxing
exact    100%  [cols] CCS/2020/censored-planet-an-internet-wide-longitudinal-censorship-observatory
exact    100%  [cols] IMC/2022/spfail-discovering-measuring-and-remediating-vulnerabilities-in-email-sender-val
exact    100%  [cols] IMC/2022/spfail-discovering-measuring-and-remediating-vulnerabilities-in-email-sender-val
exact    100%  [cols] USENIX/2017/i-have-no-idea-what-im-doing-on-the-usability-of-deploying-https
exact    100%  [cols] NDSS/2025/hades-attack-understanding-and-evaluating-manipulation-risks-of-email-blocklists
exact    100%  [cols] USENIX/2013/enabling-fine-grained-permissions-for-augmented-reality-applications-with-recogn
exact    100%  [cols] NDSS/2026/should-i-trust-you-rethinking-the-principle-of-zone-based-isolation-dns-bailiwick-checking
exact    100%  [cols] IEEE-SP/2024/digital-security-a-question-of-perspective-a-large-scale-telephone-survey-with-f
exact    100%  [cols] CCS/2017/why-do-developers-get-password-storage-wrong-a-qualitative-usability-study
exact    100%  [cols] PETS/2024/internet-users-willingness-to-disclose-biometric-data-for-continuous-online-acco
exact    100%  [cols] NDSS/2014/dspin-detecting-automatically-spun-content-on-the-web
exact    100%  [cols] USENIX/2016/tracing-information-flows-between-ad-exchanges-using-retargeted-ads
exact    100%  [pdf] PETS/2022/a-global-survey-of-android-dual-use-applications-used-in-intimate-partner-survei
exact    100%  [pdf] IMC/2021/polls-clickbait-and-commemorative-2-bills-problematic-political-advertising-on-n
exact    100%  [cols] WWW/2021/privacy-policies-over-time-curation-and-analysis-of-a-million-document-dataset
exact    100%  [cols] WWW/2021/privacy-policies-over-time-curation-and-analysis-of-a-million-document-dataset
exact    100%  [cols] PETS/2015/automated-experiments-on-ad-privacy-settings
exact    100%  [cols] IMC/2020/when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [cols] IEEE-SP/2024/where-are-the-red-lines-towards-ethical-server-side-scans-in-security-and-privac
exact    100%  [pdf] IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
exact    100%  [pdf] IMC/2025/where-in-the-world-are-my-trackers-mapping-web-tracking-flow-across-diverse-geog
exact    100%  [cols] NDSS/2025/revealing-the-black-box-of-device-search-engine-scanning-assets-strategies-and-ethical-consideration
exact    100%  [cols] CCS/2025/ethics-in-computer-security-research-a-data-driven-assessment-of-the-past-the-pr

34 quotes: 34 exact, 0 partial (>=60% of 5-word windows), 0 below threshold.

34 of 34 exact. Four quotes across three papers needed the pypdf fallback (Almansoori et al. PoPETs 2022; Zeng et al. IMC 2021; Singh et al. IMC 2025, two quotes), which is the expected rate and the reason the fallback exists.

External quotes — venue calls for papers, statutes, court opinions, vendor documentation, network AUPs — are not in this checker. They are cited on the page with the source URL and the date they were read, and the load-bearing ones were re-fetched by hand; see External sources below.

Both were headed for the page's rate-limiting list and were cut. Recorded because the failure mode — a plausible harmMitigation summary that the source does not support — is invisible unless you open the paper.

Five papers are attributed by author name on the page (in the rate-limiting table). All five were checked with scripts/check_attributions.mjs against the bibliography: 5/5 match.

One was wrong in the draft and is recorded here because it is the exact failure that guard exists for: the PoPETs 2022 dual-use-apps paper was first attributed to “Chatterjee et al.” — Rahul Chatterjee is its last author. First author is Majed Almansoori, confirmed from Crossref for DOI 10.56553/popets-2022-0102. PoPETs index records in this corpus carry no authors, so the name had to be fetched rather than read.

Authors fetched from a landing page rather than the index, because PETS and USENIX records have neither authors nor DOIs:

The page leans on [1Ramulu, Harshini Sri; Schmitt, Helen; Rerich, Bogdan; Rodriguez, Rachel Gonzalez; Kohno, Tadayoshi; Acar, Yasemin (2025): "Ethics in Computer Security Research: A Data-Driven Assessment of the Past, the Present, and the Possible Future", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] for an independent count. Its figures are its own, not this corpus's, and they are listed in section K of the report so a whole-page number audit does not treat them as ours: 1,154 papers hand-read across CCS, IEEE S&P, NDSS and USENIX Security 2024; 839 with no ethics discussion; 315 with one; 270 with a dedicated section; 45 in the body only; 36 naming the Menlo Report; 116 human-subject papers of which 102 discuss ethics and 90 have a dedicated section; 17 of those 116 not mentioning a review board; 52 non-human-subject papers that do.

The two counts are not directly comparable and the page does not present them as such. Theirs is “does the paper discuss ethics at all”, read by hand over one year and four venues. Ours is “does the paper state a review outcome”, extracted over seventeen years and seven venues. They agree on shape (the apparatus tracks participants, not harm) and on nothing numerically.

The ~1,038 figure the page quotes (“52 of the ~1,038 papers without human subjects”) is derived by arithmetic: 1,154 − 116. Their paper gives 52 and 116 but not the complement. The tilde is doing real work and is deliberate.

Required by the corpus notes: 138 posters and 251 records of ≤4 pages have their methodology compressed out, so they bias every silence figure upward. Section J of the report re-runs the headline with them dropped.

The gap the page is about — 75.3% against 21.3% — is 76.4% against 21.6% after trimming. It survives. The page reports the untrimmed figures and states the check in its limitations section.

Every external claim on the page was fetched on 2026-08-18. A sonnet sub-agent did the first pass into notes/ethics_external.md under instructions to give a primary-source URL, a fetch date and a verbatim quote for every claim and to mark anything else UNVERIFIED. The load-bearing claims were then re-fetched by hand before they reached the page.

Used as cited, each with the source URL and read-date on the page: the IEEE S&P '27, NDSS '27, CCS '26, PoPETs '27, IMC '26 and TheWebConf '26 CFP text; ACM's 2021 human-participants policy; 45 CFR 46.102(e) and 46.104(d)(4)(i) from the eCFR renderer API; GDPR Art. 89; EU AI Act Art. 2(6) and 2(8); the Swiss HRA and Dutch WMO scope clauses; the Jisc, SURF and Internet2 policies; Verisign's WHOIS and RDAP terms; the AWS and Azure penetration-testing policies; the Menlo Report and companion, including their DHS “Archived Content” banner; Mozilla Rally's GitHub archive date; the Citizen Browser, DataSkop and Tracking Exposed / AI Forensics status; the DSA Art. 40 delegated act and the 49 applications; Bright Data's and Oxylabs' consent claims; and EWDCI's membership and audit mechanics.

Three of those carry a caveat the page reproduces rather than hides:

• dhs.gov, acm.org and jisc.ac.uk all return HTTP 403 to scripted clients. The Menlo pages resolve in a browser; the ACM policy and the Jisc security policy were read from Wayback captures (2025-12-02 and 2026-08-14). The page says so in the footnote in each case, and gives script-friendly CAIDA mirrors for the Menlo PDFs.
• The EWDCI claim was tightened. The sub-agent's own note flagged that the accrediting body and the auditor are the same trade association and that the audited companies are its paying members. The page says that in those words rather than calling it a third-party audit.
• arXiv:2511.10408 is a preprint and the page labels it as one.

• Whether any of this changes behaviour. The page measures what papers report. A silent paper may have done everything right, and the corpus cannot tell the difference. Every framing on the page is about disclosure, deliberately.
• The recall of the harm-mitigation fold. Reviewer 1's spot check found real misses — “respected the 40-interaction limit” does not match the rate-limiting family because the regex expects limit(ed) <object> word order, and “controlled rates” matches nothing. These were not fixed: each is another phrasing-specific alternative rather than a rule, and the residue is already published in full. The consequence is directional and should be stated wherever these figures are reused: every family count on the page is a lower bound.
• What the 423 crawling papers with no stated mitigation actually did. Nothing in the schema distinguishes “did nothing” from “did not write it down”, and the page never counts them as the former.
• How often measurement papers disclose LLM use in the pipeline. There is no schema field for it, and the venue requirements are newer than most of the corpus. The page states the requirements and marks the measurement as not done.
• Whether copyright or database rights have ever been asserted against an academic crawl. Not searched. The page's licensing bullet is about practice, not about case law, and says so.
• The precision of the terms of service sweep. 129 papers, unread. A hand pass separating “we complied” from “the service's ToS says” would make that a real figure.
• Whether venue policy causes the reporting rate or tracks it. PoPETs states an outcome at 54.3% and mandates an ethics section from the 2027 cycle — the mandate is later than the behaviour, so the page describes the correlation and claims no direction.
• Non-US, non-EU ethics regimes. Only the Swiss and Dutch statutes were checked, and both turned out to be biomedical-only. A German (DFG) counterpart was not checked against a primary source. The page's claim is scoped to “most of the world has no equivalent standing body”, supported by the 20 papers that say so, not by a survey of national law.
• Whether the 20 “no review body” papers are representative. They are the papers that said so. Institutions without a board that simply wrote nothing are invisible to this sweep and are certainly more numerous.

1. Extend the stub, not write a sibling. practices:ethics was a skeleton whose own headings matched the material almost exactly. Broadening it was the obvious call; the only real question was whether the pre-measurement material deserved a separate page from Notifying websites, and it does — that page is 59 KB about a channel, this one is about a decision made before any measurement runs.
2. Lead with the participants-versus-crawls split rather than the headline reporting rate. 33.8% of empirical papers is a fact about a mixed population and reads as an indictment of the whole field. 75.3% against 21.3% is the actionable version, and it is the one that tells the reader which column they are in.
3. Count explicitly-discussed-no-review as stated. Argued above. A reasonable person would exclude it; the page prints the approved/exempt column beside every such figure so they can.
4. Publish the robots.txt non-answer as a non-answer. The literature has no consensus and inventing one would be dishonest. The page says decide, be consistent, and write the sentence — and specifically asks for the share of the sample an honoured exclusion removes, because that is a denominator change and nobody reports it.
5. Give the venue table a read-date and a warning rather than presenting it as stable. Two of its seven rows moved within twelve months, in opposite directions.
6. Do not write a proxy-vendor consent checklist. The sub-agent established that no such checklist exists anywhere and explicitly declined to fabricate one. The page reports the absence and gives three rules of thumb clearly framed as such, rather than presenting original synthesis as an established standard.
7. Name the volunteer platforms that are dead. A student reading a 2021 paper will find Mozilla Rally and plan around it. Reporting its archive date is more useful than listing only what is alive.
8. Publish “the contract claim is what the final judgment rests on” rather than “what ended the company”. The draft said the latter; the docket supports the former and nothing cited supports a causal claim about hiQ's business. Flagged by the generic reviewer.
9. Put “What the venues require” third, not seventh. It was drafted after the harm and vantage-point sections, on the logic that practice comes before paperwork. It was moved ahead of them before publication because it is the section a reader arrives looking for, and because the <WRAP important> box at the top forward-references it.
10. Keep the corpus's “Legal aspects of crawling” heading from the stub, but move the substance to Legal enforcement. The stub listed fraud, trespass and breach of contract. This page carries only what a crawler's ethics section needs — the CFAA narrowing and the surviving contract exposure — and points at the sibling for enforcement.

Four reviewers, all told explicitly that the author's context may not be exhaustive, and all handed the page text, the report script and its output, the folds, and these notes. The three focused passes ran in parallel first; the generic pass ran after their findings were applied.

Re-ran report_ethics.mjs and confirmed byte-identical output to the committed file, then checked every table cell and percentage, audited both folds, and spot-checked 15 random harmMitigation strings by hand.

Reviewer 1 also confirmed as correct, having recomputed them: sections A–J in full, the 149 + 971 = 1,120 arithmetic, the 4,472 = 5,118 − 646 arithmetic, the year-window and by-venue tables, the Menlo-by-window series, and the sensitivity figures.

Reviewer 2 confirmed as correct: all 23 citekeys resolve with no duplicates and no unused additions; all 15 added BibTeX entries against Crossref and venue landing pages; the rate-limiting table's five attributions; and the Singh, Chehade, Datta and Subramani figures.

Fetched every external URL on the page. Full inventory in the reviewer's report; the findings that changed the page:

Reviewer 3 confirmed verbatim: the Menlo four-principles quote, GDPR Art. 89, AI Act Art. 2(6)/2(8), 45 CFR 46.102(e)(1) and 46.104(d)(4)(i), the “publicly available” undefined-term claim, the DSA 49-applications figure as still current, Prolific's and MTurk's quoted wording, Bright Data's KYC date, the SURF, Verisign and Azure quotes, the Tor board, and the Rally / Citizen Browser / DataSkop / AI Forensics statuses. It also confirmed that User studies and Artifacts are genuine red links already promised by several other pages — a pre-existing gap, not one this page introduces.

No checklist; handed the page, the provenance page, the scripts and the stub, and told to look for whatever the focused three were not. It re-derived several figures independently and re-fetched the neighbouring pages.

Rejected: none. Every finding was accepted, which is itself worth recording — a generic pass with no checklist found the page's largest substantive gap (O) after three focused passes had gone over it.

Three of the four reviewers found something that changed a published number or a published claim. Reviewer 1's finding 1 was the expensive one: a figure the page built an argument on (“the cheapest credible thing on the list”) was inflated by 70%, and the defect was in code the page never shows. Reviewer 3's finding H was the one no corpus query could have produced: the page had a legally accurate but incomplete account of a case whose ending is the page's own argument. Reviewer 2's findings E and F are the ordinary kind — citations dropped in editing — and are the reason a citations pass is worth its slot even when nothing is wrong with the sources.

• Ethics — the page this log is for.
• Corpus — corpus-wide provenance: the venue scope, the selection funnel, the provisional 2025–2026 slice.
• notifying_websites and legal_enforcement — the two sibling logs; the disclosure figures on this page are recomputed here rather than copied from either.
• crawling_location — the vantage-point log, which carries the residential-proxy market research this page does not repeat.

Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with check_wrap.mjs and check_typography.mjs. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.

What was wrong. The reporting-completeness table presented 349/1,120 = 31.2% for crawlConfig.consentAction without distinguishing a populated extraction field from a claim supported by paper text. The number is correct as a schema statistic but was easy to read as the latter.

Command and real output. node scripts/report_ethics.mjs → crawlConfig.consentAction (field populated; not an audited paper claim) | 1120 | 349 | 31.2%. The companion node scripts/consent_action_noninteraction_audit.mjs output records 55/1,120 = 4.9% audited papers stating an action and 279/313 = 89.1% unsupported no-interaction labels.

What changed. The page and its embedded report output now label 349 as field population and explain that paper-claim support is a separate audit result; no schema figure changed.

Review. One model: 'sonnet' figures-vs-script pass re-ran report_ethics.mjs and checked the consent row plus the rows immediately before and after it. No mismatch was found. No citation pass was needed: no citekey or quoted claim changed.

Rejected finding. The 349 schema count was not replaced by 55 in this table: the table is intentionally a reporting-completeness/schema table, while the audited claim count belongs to consent.

Working log for the registration and claiming section. Corpus-level selection and provisional-year caveats: corpus. No discussion block: comments belong on the content page.

• Date: 2026-10-08. Author and verifier: Codex, GPT-6. Existing local code and reading notes from a 2026-09-28 Claude run were available, but its section and provenance additions were not on the live wiki. They were treated as leads, not completed publication or current figures.
• Extending, not creating or duplicating: fresh JSON-RPC exports of practices:ethics (revision 1790510868), provenance:practices:ethics (1789641906), security:domain_abuse and its provenance read before writing. The live ethics page had no receiving-traffic section; its account-registration bullet described a different intervention. A section here keeps review and harm decisions together; the measurement pipeline remains on the domain-abuse page.
• node scripts/sitemap.mjs ran first. Its existing colon-free-link guard failed on 21 links across six unrelated pages. The sitemap still supplied page/link inventory; this task does not repair those pages. Newly added links use explicit namespaces.
• Read data/extract/OVERVIEW.md, README.md, and the two frozen benchmark METHOD logs for audit-log format. No old benchmark figures reused.
• Orientation query: node /workspace/publications_dataset/scripts/site_queries.mjs --run /workspace/publications_dataset/data/extract/run1 --page ethics → ethreg/run20261008/site-queries-ethics.txt. Used to orient; no unfolded free-text tables pasted.
• Current mount: /workspace/publications_dataset/data. The report reads 5,859 extraction records and checks that every IN paper key is still present. This is a fixed hand-selected population, not a fresh exhaustive search for every receiver across all seven venues.
• Workspace is not a Git repository. Scripts are retained under scripts/ and reproduced below; a Git commit was not possible here.

• node scripts/report_domain_abuse.mjs > ethreg/run20261008/domain-output.txt: re-ran the neighbouring page's 149-candidate / 48-IN selection and PASS D hand counts. Its full selection rules and script live on domain_abuse. No selection threshold was changed in this task.
• node scripts/report_ethics_registration.mjs > scripts/report_ethics_registration-output.txt: select HAND rows with reg != 0 || claimed among those 48 IN identities. Denominator 19; registered-only and claimed-resource sets overlap. It asserts exact agreement between selected identities and CODES, and between purpose: logged and LOGGED_ARRIVALS. Denominator for retained content and receiving review counts is the seven logged-arrival papers, not all 19.
• review vocabulary: approved, exempt, other-body, discussed, none. Approval can cover any part of the study; it is not necessarily review of the registration itself. Pauley's CISO-office review is stated separately from its IRB exemption. Silence is a report about text, never misconduct.
• after is multi-label: some papers state a disposition for an IP or one defensive name but omit others. For registered-domain disposition, select the 15 reg != 0 papers and require an after code other than n/s or released-immediately (the latter denotes claimed resources). Result: five papers describe at least some registered names; this does not mean all their names had a documented lifecycle.
• Year table: group IN identities, registered/claimed identities and logged-arrival identities separately by the year component of their corpus key. Print every year, including zero rows. 2025–2026 remain provisional; the page uses these counts to limit its currency claim, not to infer abandonment.
• No automated free-text synonym fold is used for this section. Identity-based inclusion and a finite hand-code vocabulary replace name aggregation. Full code definitions, per-paper assignments and source spans follow. Unmapped residue is printed below: zero uncoded selected identities, zero extra coded identities, and invalid vocabulary values fail the run. These guards establish coverage of the fixed selection, not recall outside it.
• node scripts/report_ethics.mjs > ethreg/run20261008/ethics-output.txt; diff -u out/report_ethics.txt ethreg/run20261008/ethics-output.txt: empty diff. Existing corpus tables were regenerated unchanged. No old corpus number copied into the added section.

The codes predate this run and are not double-coded. Their 91 evidence spans were re-located in the current paper.cols.txt files. Mechanical matching collapses whitespace and normalises curly quotes and ligatures; a second dehyphenation path is available. The current run required no dehyphenation. This is localisation, not semantic validation of every code.

report_ethics_registration.mjs

// report_ethics_registration.mjs — every figure in the practices:ethics section "Registering or
// claiming names to receive traffic meant for someone else", with its denominator.
//
//   node scripts/report_ethics_registration.mjs > scripts/report_ethics_registration-output.txt
//
// Population: the 19 of security:domain_abuse's 48 IN papers that registered or claimed names
// (da_fold.mjs HAND: reg != 0 || claimed). Codes: ethreg_codes.mjs. Every quote in the codes is
// re-located in paper.cols.txt (whitespace collapsed; a second pass also joins a line-end hyphen
// split "re- register" → "re-register"/"reregister"); any quote not found fails the run.
import fs from 'node:fs';
import path from 'node:path';
import { dataRoot, table, loadExtractions } from './lib.mjs';
import { VERDICTS, HAND, LOGGED_ARRIVALS } from './da_fold.mjs';
import { FIELDS, CODES, DECLINED, OUTSIDE, MARKET } from './ethreg_codes.mjs';
 
const FT = path.join(dataRoot(), 'fulltext');
const h = (s) => console.log(`\n=== ${s} ===`);
const colsOf = (key) => {
  const [v, y, ...rest] = key.split('/');
  const f = path.join(FT, y, v, rest.join('/'), 'paper.cols.txt');
  return fs.readFileSync(f, 'utf8').replace(/\s+/g, ' ');
};
const norm = (s) => s.replace(/[‘’]/g, "'").replace(/[“”]/g, '"').replace(/fi/g, 'fi').replace(/fl/g, 'fl');
 
// --- population, both directions ---
const IN = new Set(VERDICTS.filter((v) => v[1] === 'IN').map((v) => v[0]));
if (IN.size !== 48) throw new Error(`expected 48 IN papers, got ${IN.size}`);
const handMap = new Map(HAND);
const POP = HAND.filter(([, x]) => x.reg !== 0 || x.claimed).map(([k]) => k);
const coded = new Map(CODES.map((c) => [c[0], c]));
const missing = POP.filter((k) => !coded.has(k));
const extra = CODES.map((c) => c[0]).filter((k) => !POP.includes(k));
if (missing.length || extra.length) throw new Error(`codes vs population diverge — uncoded: ${missing.join(', ')}; not in population: ${extra.join(', ')}`);
if (POP.length !== 19) throw new Error(`expected 19 registering/claiming papers, got ${POP.length}`);
for (const [k, , , c] of CODES) {
  const hand = handMap.get(k);
  if (hand === undefined) throw new Error(`no HAND row for ${k}`);
  if (hand.ethics !== c.review) throw new Error(`review code differs from da_fold.mjs HAND for ${k}: ${c.review} vs ${hand.ethics}`);
  for (const f of ['purpose', 'keep', 'answer', 'review']) if (!(c[f] in FIELDS[f])) throw new Error(`${k}: unknown ${f} code ${c[f]}`);
  for (const f of ['handling', 'after']) for (const v of c[f]) if (!(v in FIELDS[f])) throw new Error(`${k}: unknown ${f} code ${v}`);
}
const logged = new Set(LOGGED_ARRIVALS.map((x) => x[0]));
const codedLogged = new Set(CODES.filter((c) => c[3].purpose === 'logged').map((c) => c[0]));
for (const k of logged) if (!codedLogged.has(k)) throw new Error(`LOGGED_ARRIVALS has ${k} but its purpose code is not "logged"`);
for (const k of codedLogged) if (!logged.has(k)) throw new Error(`purpose "logged" for ${k}, which is not in LOGGED_ARRIVALS`);
for (const [k] of [...DECLINED, ...MARKET]) if (!IN.has(k)) throw new Error(`${k} is not one of the 48 IN papers`);
for (const [k] of OUTSIDE) if (IN.has(k)) throw new Error(`${k} is IN; OUTSIDE is for papers outside the 48`);
 
const extracted = loadExtractions();
const extractedKeys = new Set(extracted.map(p => `${p.venue}/${p.year}/${p.slug}`));
const absent = [...IN].filter(k => !extractedKeys.has(k));
if (absent.length) throw new Error(`IN keys absent from current extraction: ${absent.join(', ')}`);
h('CORPUS GUARD');
console.log(`extracted records: ${extracted.length}; IN keys absent from current extraction: ${absent.length}`);
h('POPULATION');
const yr = (k) => Number(k.split('/')[1]);
const regd = POP.filter((k) => handMap.get(k).reg !== 0);
const claimed = POP.filter((k) => handMap.get(k).claimed);
console.log(`security:domain_abuse IN papers: ${IN.size}`);
console.log(`registered or claimed (HAND reg != 0 || claimed): ${POP.length}  — registered domains: ${regd.length}; claimed third-party resources: ${claimed.length}; both: ${regd.filter((k) => claimed.includes(k)).length}`);
console.log(`of the ${POP.length}, received and logged traffic meant for someone else (LOGGED_ARRIVALS): ${logged.size} — years ${[...logged].map(yr).sort().join(', ')}`);
console.log(`years of the ${POP.length}: ${POP.map(yr).sort().join(', ')}  (2025–2026 provisional)`);
 
// --- tallies ---
const tally = (field, rows, multi = false) => {
  const out = [];
  for (const [code, meaning] of Object.entries(FIELDS[field])) {
    const ks = rows.filter((c) => (multi ? c[3][field].includes(code) : c[3][field] === code));
    if (ks.length) out.push([code, ks.length, ks.map((c) => c[1]).join(' ')]);
    else out.push([code, 0, '']);
    void meaning;
  }
  return out;
};
const LOG = CODES.filter((c) => c[3].purpose === 'logged');
for (const [field, rows, label, multi] of [
  ['purpose', CODES, `all ${CODES.length}`, false],
  ['review', CODES, `all ${CODES.length}`, false],
  ['review', LOG, `the ${LOG.length} that logged arrivals`, false],
  ['keep', LOG, `the ${LOG.length} that logged arrivals`, false],
  ['handling', LOG, `the ${LOG.length} that logged arrivals (multi-label)`, true],
  ['answer', CODES, `all ${CODES.length}`, false],
  ['after', CODES, `all ${CODES.length} (multi-label: a paper can state one disposition for some names and nothing for others)`, true],
]) {
  h(`${field.toUpperCase()} — denominator: ${label}`);
  console.log(table(['code', 'papers', 'citekeys'], tally(field, rows, multi)));
}
const afterStated = CODES.filter((c) => c[3].after.some((a) => a !== 'n/s'));
const afterFull = CODES.filter((c) => !c[3].after.includes('n/s'));
console.log(`\nstate a disposition for at least some of what they held: ${afterStated.length} of ${CODES.length}; for all of it: ${afterFull.length} of ${CODES.length}; for none of it: ${CODES.length - afterStated.length} of ${CODES.length}`);
const regAfter = CODES.filter((c) => handMap.get(c[0]).reg !== 0);
const regAfterStated = regAfter.filter((c) => c[3].after.some((a) => !['n/s', 'released-immediately'].includes(a)));
console.log(`of the ${regAfter.length} that registered domains, state what happened to (some of) the domains: ${regAfterStated.length} — ${regAfterStated.map((c) => `${c[1]}=${c[3].after.filter((a) => a !== 'n/s').join('+')}`).join(', ')}`);
const logNoBody = LOG.filter((c) => ['discussed', 'none'].includes(c[3].review));
console.log(`of the ${LOG.length} that logged arrivals, no review body: ${logNoBody.length} (${logNoBody.map((c) => c[1]).join(', ')}); IRB said exempt / not human-subjects: ${LOG.filter((c) => c[3].review === 'exempt').map((c) => c[1]).join(', ')}`);
 
h('PER PAPER');
console.log(table(['year', 'citekey', 'what', 'purpose', 'keep', 'handling', 'answer', 'after', 'review'],
  CODES.map(([k, ck, what, c]) => [yr(k), ck, what.slice(0, 60), c.purpose, c.keep, c.handling.join('+'), c.answer, c.after.join('+'), c.review])));
 
// --- quote check ---
h('QUOTE CHECK — every quote in ethreg_codes.mjs located in paper.cols.txt');
let n = 0, exact = 0, dehyph = 0; const fails = [];
const check = (key, ck, field, q) => {
  n++;
  const t = norm(colsOf(key)), nq = norm(q);
  if (t.includes(nq)) { exact++; return; }
  const t2 = t.replace(/(\w)- (\w)/g, '$1$2'), t3 = t.replace(/(\w)- (\w)/g, '$1-$2');
  if (t2.includes(nq) || t3.includes(nq)) { dehyph++; console.log(`  dehyphenated match: ${ck} [${field}] "${q.slice(0, 80)}"`); return; }
  fails.push(`${ck} [${field}] "${q}"`);
};
for (const [k, ck, , , qs] of CODES) for (const [f, arr] of Object.entries(qs)) for (const q of arr) check(k, ck, f, q);
for (const [k, ck, , qs] of [...DECLINED, ...OUTSIDE]) for (const q of qs) check(k, ck, 'declined/outside', q);
for (const [k, ck, qs] of MARKET) for (const q of qs) check(k, ck, 'market', q);
console.log(`quotes: ${n}; exact: ${exact}; after joining line-end hyphens: ${dehyph}; NOT FOUND: ${fails.length}`);
for (const f of fails) console.log(`  NOT FOUND: ${f}`);
if (fails.length) { console.error(`FAIL: ${fails.length} quote(s) not located`); process.exit(1); }
 
h('DECLINED OR NEVER RECEIVED (comparison set, of the 48)');
for (const [k, ck, what] of DECLINED) console.log(`  ${yr(k)} ${ck}: ${what}`);
h('OUTSIDE THE 48 (pointer, not counted)');
for (const [k, ck, what] of OUTSIDE) console.log(`  ${yr(k)} ${ck}: ${what}`);
 
h('YEAR COUNTS — paper counts, 2025–2026 provisional');
console.log(table(['year', 'domain-abuse IN denominator', 'registered/claimed', 'logged arrivals'], Array.from({length:17}, (_,i)=>2010+i).map(y=>[y,[...IN].filter(k=>yr(k)===y).length,POP.filter(k=>yr(k)===y).length,[...logged].filter(k=>yr(k)===y).length])));
h('UNMAPPED RESIDUE — identity selection and finite hand-code vocabulary');
console.log(`uncoded selected papers: ${missing.length}; coded outside selection: ${extra.length}; unknown code values: 0 (invalid values throw); no free-text alias fold used`);

ethreg_codes.mjs

// ethreg_codes.mjs — hand codes behind the practices:ethics section "Registering or claiming
// names to receive traffic meant for someone else". Imported by report_ethics_registration.mjs;
// nothing here is computed, it is the audit surface.
//
// Population: the 19 of security:domain_abuse's 48 IN papers that registered domains themselves
// or took control of third-party names, zones, NS slots or cloud IPs (da_fold.mjs HAND:
// reg != 0 || claimed). The report script throws if this list and that set diverge in either
// direction, and if any `review` code here differs from HAND's `ethics` code.
//
// Coded 2026-09-28 by the author of the section from paper.cols.txt, after five sonnet sub-agents
// wrote structured reading notes with verbatim quotes (ethreg/read_0[0-4].md). Every quote below is
// re-located in the paper by the report script; a quote that cannot be found fails the run.
// Not double-coded.
// 2026-10-08 review correction: chen2025_cross releases then repurchases its test domain
// during the experiment; final disposition is not stated, so after=n/s, not released-test-domain.
 
export const FIELDS = {
  purpose: {
    logged: 'received the traffic, mail or queries meant for someone else and logged it (da_fold.mjs LOGGED_ARRIVALS)',
    parked: 'parked the names with parking services, so real visitors were monetised',
    'nothing-deployed': 'registered to protect or to prove the name was obtainable; deployed nothing on it',
    proof: 'claimed a live third party\'s resource (zone, NS slot) to prove the takeover works',
    testbed: 'names used only as the researchers\' own test infrastructure',
  },
  keep: {
    content: 'message content: full mail bodies, packet captures or payloads',
    metadata: 'request metadata only: IP, time, request line, headers, user agent, query names',
    none: 'nothing from third parties was collected',
    'n/s': 'not stated',
  },
  handling: {
    'scrub-before-storage': 'sensitive strings removed before anything was stored',
    'declined-extra': 'explicitly chose not to collect more than it could (no tracking JS, no decoding)',
    encrypted: 'stored encrypted or on restricted-access infrastructure',
    'deleted-logs': 'logs deleted after the analysis',
    'pii-deleted-before-publication': 'personal data anonymised, then deleted before publication',
    'regret-stated': 'the paper says, in retrospect, it collected more than it needed',
    'none-stated': 'no handling measure stated',
  },
  answer: {
    silent: 'never responded to anyone but the researchers\' own clients',
    'tcp-accept': 'accepted connections, non-interactive above the transport layer',
    'accept-all-mail': 'accepted every message and never replied or bounced',
    'blank-page': 'a zero-length page',
    'notice-page': 'a page explaining the experiment, with a contact address',
    'interactive-traps': 'a 404 page carrying bot traps and fingerprinting JavaScript, plus login honeypots',
    'inert-record': 'a minimally interactive record (loopback A or identifying TXT; changes can still affect clients)',
    monetised: 'parking pages serving ads or paid redirects',
    'nothing-deployed': 'nothing served',
    'testbed-only': 'answered only inside the researchers\' own testbed',
    'n/s': 'not stated',
  },
  after: {
    expired: 'let the names expire back into the pool',
    renewing: 'keeps renewing the names',
    'offered-to-owner': 'contacted the legitimate owner and offered a free transfer',
    'surrender-on-request': 'would surrender a name to a trademark owner on request (none asked)',
    'kept-defensively': 'kept a name as a defensive registration pending outreach',
    'released-immediately': 'released the claimed IPs, zones or records within minutes of the test',
    'released-test-domain': 'released a registered test domain back to the registrar',
    'n/s': 'not stated',
  },
  review: {
    approved: 'reports IRB or ethics-body approval, including unspecified ethics approval (any part of the study)',
    exempt: 'an IRB ruled it exempt / not human-subjects research',
    'other-body': 'approved by a non-IRB body (general counsel, the partner\'s network department)',
    discussed: 'ethics section, no review body',
    none: 'nothing',
  },
};
 
// [key, citekey, what they registered or claimed, { purpose, keep, handling[], answer, after[], review }, { field: [verbatim quote, …] }]
export const CODES = [
  ['USENIX/2014/understanding-the-dark-side-of-domain-parking', 'alrwais2014_parking', '23 purchased domains, parked with 7 services',
    { purpose: 'parked', keep: 'none', handling: ['none-stated'], answer: 'monetised', after: ['n/s'], review: 'discussed' },
    { purpose: ['der a number of top level domains and parked them with', 'the 7 services. The names of those domains were care'],
      answer: ['so the parking services can monetize the traf'],
      other: ['we avoid cashing in the revenues we earned from the 7 parking services hosting our parked domains ($81.06 in total)'] }],
  ['NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains', 'vissers2015_parking', 'one typo domain of stackoverflow.com, parked with each service in turn',
    { purpose: 'parked', keep: 'none', handling: ['none-stated'], answer: 'monetised', after: ['n/s'], review: 'none' },
    { purpose: ['With explicit permission of the authoritative company, we'],
      answer: ['typosquatting domain for at least a week, until we transferred', 'parking page was receiving visitors daily'] }],
  ['CCS/2017/client-side-name-collision-vulnerability-in-the-new-gtld-era-a-systematic-study', 'chen2017_client', 'one new-gTLD domain for a testbed',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'testbed-only', after: ['n/s'], review: 'none' },
    { purpose: ['we registered a real new gTLD domain to set up the name collision domain'],
      answer: ['we configure our DNS servers to only serve the IP addresses we control'] }],
  ['IMC/2017/email-typosquatting', 'szurdi2017_email', '76 typo domains of email providers, over seven months',
    { purpose: 'logged', keep: 'content', handling: ['scrub-before-storage', 'encrypted'], answer: 'accept-all-mail', after: ['surrender-on-request', 'n/s'], review: 'approved' },
    { keep: ['While we elected to keep emails accidentally sent to our domains to carry out deeper analyses than could be done by simply keeping headers'],
      handling: ['we automatically remove sensitive information using regular expression matching prior to storage', 'we encrypt all emails prior to storing them, using an encryption key kept separately from the server'],
      answer: ['which we configure to accept any email', 'Our collection server never sends any', 'email out, but ultimately forwards these emails to a processing and'],
      after: ['We agreed to surrender any domain we registered to the legitimate owner of a trademark it could potentially infringe upon simple request. To date, we have not received any such requests.'],
      review: ['The protocol was approved by our IRB, and our sponsor\'s IRB, before we started our experiments.'] }],
  ['NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs', 'alowaisheq2019_cracking', 'one FBI-seized domain\'s dangling Route 53 nameserver slot',
    { purpose: 'proof', keep: 'n/s', handling: ['none-stated'], answer: 'n/s', after: ['n/s'], review: 'none' },
    { purpose: ['After several attempts, we successfully acquired one such server on the NS record'],
      other: ['We recommended that they address the problem by placing ServerHold on the domain, which they did on 2018-10-11.'] }],
  ['CCS/2020/zombie-awakening-stealthy-hijacking-of-active-domains-through-dns-hosting-referr', 'alowaisheq2020_zombie', 'own test domains (count not stated)',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'testbed-only', after: ['n/s'], review: 'discussed' },
    { purpose: ['we first register a domain and then open two accounts with a provider: victim and attacker'],
      answer: ['we only conducted the experiments on affected resolvers on domains that we control and avoided affecting resolutions of the PVDs'] }],
  ['IMC/2021/risky-bizness-risks-derived-from-registrar-name-management', 'akiwate2021_risky', '5 sacrificial-nameserver domains; one live .edu delegation',
    { purpose: 'logged', keep: 'metadata', handling: ['deleted-logs'], answer: 'silent', after: ['kept-defensively', 'n/s'], review: 'other-body' },
    { purpose: ['we observed incoming queries for the domains, while being careful to never respond'],
      answer: ['to return an A record if and only if the request originated from our client IP address during a short testing window. All other queries received no response'],
      handling: ['we further mitigated that concern by deleting all log data'],
      after: ['The .edu domain is no longer hijackable due to our defensive registrations pending outreach'],
      review: ['they were in no position to give us independent oversight', 'we conferred with campus general counsel', 'received their approval for our experimental design and its controls, before any active measurements were conducted'] }],
  ['NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media', 'kaleli2021_human', '45 unintended-URL domains, registered within hours of the tweet',
    { purpose: 'logged', keep: 'metadata', handling: ['none-stated'], answer: 'n/s', after: ['n/s'], review: 'exempt' },
    { keep: ['we record information about each request including the client\'s IP address and request headers'],
      answer: ['we do not interact in any way with the users who click on those links and visit the web pages that we set up'],
      review: ['this research is not considered as human subjects research by our institution\'s IRB'],
      other: ['we argue that by registering these domains we are reducing potential harm'] }],
  ['IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust', 'so2022_spots', '201 expired domains',
    { purpose: 'logged', keep: 'content', handling: ['regret-stated'], answer: 'interactive-traps', after: ['expired'], review: 'discussed' },
    { keep: ['packet captures, we never engaged with clients to further advance', 'Thus, we stored only what the connecting clients'],
      handling: ['in retrospect, we could have collected fewer attributes from the'],
      answer: ['bot traps and JavaScript fingerprinting code', 'The Telnet and FTP services are low-interaction and collect only the credentials of the login attempts'],
      after: ['already expired and were returned to the pool of domains available'],
      other: ['we know that dropcatchers were not interested in them'] }],
  ['IEEE-SP/2022/measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clouds', 'pauley2022_ipreuse', '1.5 million AWS IPs, each held about ten minutes, over 101 days',
    { purpose: 'logged', keep: 'content', handling: ['encrypted', 'declined-extra'], answer: 'tcp-accept', after: ['released-immediately'], review: 'exempt' },
    { keep: ['records received traffic for up to 10 minutes', 'the collection server uploads received traffic in PCAP format to an encrypted log repository'],
      handling: ['were not made to decode this traffic for ethical reasons', 'Only one person in the team was given credentials to the server'],
      answer: ['the telescope is designed to be non-interactive above the transport layer'],
      after: ['Terminated servers are automatically replaced by new collection servers to maintain the server quota'],
      review: ['Our data collection was covered under an exemption from our institutional review board (IRB)', 'reviewed, and approved by the security team (CISO Office) of our home institution'] }],
  ['IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to', 'liu2023_dial', '19 NXDomains, six months of collection',
    { purpose: 'logged', keep: 'content', handling: ['pii-deleted-before-publication'], answer: 'notice-page', after: ['renewing'], review: 'discussed' },
    { need: ['we need to collect the real application requests (e.g., HTTP requests) that are supposed to be issued after the DNS queries can be correctly resolved'],
      keep: ['It also collects detailed information about incoming traffic, including IP addresses, port numbers, and payloads'],
      handling: ['PIIs has been permanently deleted prior to the publication of this paper'],
      answer: ['The web server displays a landing page with detailed information about our experiments', 'We also post our email addresses on the landing page'],
      after: ['we will continue monitoring and renew all 19 domains for further investigation'],
      other: ['Our selected NXDomains must remain in nonexistent status for at least 6 months', 'we have not received any complaints or communications for our registered domains'] }],
  ['IMC/2023/wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d', 'zhang2023_wolf', 'records for 30 domains on DNS-hosting providers, incl. five of the Tranco top 100',
    { purpose: 'proof', keep: 'none', handling: ['none-stated'], answer: 'inert-record', after: ['released-immediately'], review: 'discussed' },
    { answer: ['A records pointed to 127.0.0.1, and TXT records were with our intention and contact'],
      after: ['We removed the URs immediately following the conclusion of the'],
      review: ['ethical aspect carefully with the guide of ethical principles'] }],
  ['IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s', 'li2024_bounce', '30 unregistered recipient domains (typos of mail domains)',
    { purpose: 'nothing-deployed', keep: 'none', handling: ['none-stated'], answer: 'nothing-deployed', after: ['offered-to-owner'], review: 'other-body' },
    { purpose: ['we registered 30 domain names with the highest number of email receipts'],
      answer: ['For ethical and privacy reasons, we have not deployed any online services for registered domain names to monitor related traffic'],
      after: ['guaranteeing the transfer of our registered domain names free of charge'],
      review: ['While our institution lacks an Institutional Review Board (IRB), our research has been authorized and supervised by the network management department and regulatory authority of our partner'],
      other: ['This ensures that we do not discourage the public from registering domain names they are interested in'] }],
  ['USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure', 'zhang2024_cross', 'zones of inactive real domains on hosting providers, two per nameserver group',
    { purpose: 'proof', keep: 'none', handling: ['none-stated'], answer: 'inert-record', after: ['released-immediately'], review: 'discussed' },
    { answer: ['We select a harmless and informational TXT as the verification record', 'we set the negative cache\'s TTL to 1 second via SOA records'],
      after: ['Post-testing, we delete our configured records immediately and verify that the domain has returned to the REFUSED status', 'completing the entire process within 2 minutes to prevent client access during our tests'],
      other: ['we have checked query logs on hosting platforms and did not observe any requests from normal users during our test'] }],
  ['USENIX/2024/rethinking-the-security-threats-of-stale-dns-glue-records', 'zhang2024_glue', 'more than 15 own test domains; 27 cloud IPs',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'testbed-only', after: ['released-immediately', 'n/s'], review: 'discussed' },
    { purpose: ['we registered more than 15 new domain names under different TLDs'],
      after: ['We released IPs immediately after allocation, so there is no actual impact on domains'] }],
  ['WWW/2024/hyperlink-hijacking-exploiting-erroneous-url-links-to-phantom-domains', 'saric2024_hyperlink', '51 phantom domains plus a control',
    { purpose: 'logged', keep: 'metadata', handling: ['declined-extra'], answer: 'blank-page', after: ['n/s'], review: 'approved' },
    { need: ['it was necessary to evaluate traffic across a selection of phantom domains'],
      answer: ['serving a zero-length (i.e. blank) landing page'],
      handling: ['we chose to take a less intrusive path, complete with ethics approval'] }],
  ['NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild', 'wen2025_automatic', 'two test domains for a mail-client experiment',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'inert-record', after: ['n/s'], review: 'discussed' },
    { answer: ['We set the hostname to 127.0.0.1 to prevent users affected by this vulnerability from connecting to our server'] }],
  ['NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange', 'chen2025_cross', 'a test domain; a registrable CNAME target of a Microsoft domain',
    { purpose: 'nothing-deployed', keep: 'none', handling: ['none-stated'], answer: 'nothing-deployed', after: ['n/s'], review: 'discussed' },
    { purpose: ['bought qtlcdnect.com from Godaddy', 'siderations, we did not continue the exploitation'],
      other: ['We then released the domain, making it available to other customers', 'we acted as a potential victim and purchased the domain through Namecheap'] }],
  ['USENIX/2025/misty-registry-an-empirical-study-of-flawed-domain-registry-operation', 'zhang2025_misty', '80 test domains across four registrars, plus test IDNs',
    { purpose: 'testbed', keep: 'none', handling: ['none-stated'], answer: 'n/s', after: ['n/s'], review: 'discussed' },
    { purpose: ['we registered 20 domain names from each registrar under different TLDs and conducted DNS host configuration tests'] }],
];
 
// Papers in the 48 that found a receivable name and chose not to take it, or measured demand without
// receiving anything. Quoted on the page as the alternative to registering.
export const DECLINED = [
  ['IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations', 'akiwate2020_lame', 'would not defensively register the at-risk nameserver domains',
    ['we cannot defensively register all of them, which would raise its own ethical issues if we could']],
  ['USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps', 'so2025_lost', 'checked registrability with a registrar, registered nothing',
    ['We did not register any expired domains and therefore never interacted with potential users of the affected APKs']],
  ['PETS/2026/dead-domains-living-data-a-privacy-risk-analysis-of-domain-lifecycle-in-android', 'hortea2026_dead', 'WHOIS, DNS, TLS and CT queries only',
    ['We did not re-register expired domains, claim dangling cloud resources, or exploit any of the endpoints']],
  ['USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web', 'squarcina2021_subdomain', 'fingerprints and registrar availability, no claims on live sites',
    ['Due to ethical concerns, we did not mount attacks', 'We did not create any virtual machine or registered any service at cloud providers in this process']],
  ['NDSS/2025/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem', 'alhamdan2025_deno', 'disclosed; the affected project bought the name',
    ['Deno team decided to register the problematic domain in response to our disclosure']],
  ['IMC/2020/trufflehunter-cache-snooping-rare-domains-at-large-public-dns-resolvers', 'randall2020_trufflehunter', 'cache snooping at large public resolvers only',
    ['We refrain from probing caches of other "open" resolvers, since these are often misconfigured residential devices that may be serving only a few users']],
];
 
// Outside the 48 (malware infrastructure, not domain abuse): cited as a pointer, not counted.
export const OUTSIDE = [
  ['WWW/2016/no-honor-among-thieves-a-large-scale-analysis-of-malicious-web-shells', 'starov2016_honor', 'eight domains that web shells phone home to',
    ['returned HTTP 404 errors to all requests asking for content', 'For ethical reasons, we never attempted to validate any of the shell installations claimed in the Referer headers of the requests in our logs']],
];
 
// Residual-trust figures the "afterwards" paragraph leans on; located by the report script too.
export const MARKET = [
  ['USENIX/2017/game-of-registrars-an-empirical-analysis-of-post-expiration-domain-name-takeover', 'lauinger2017_game',
    ['We find that 10 % of all com domains are re-registered on the same day as their old registration is deleted']],
  ['WWW/2018/panning-for-gold-com-understanding-the-dynamics-of-domain-dropcatching', 'miramirkhani2018_panning',
    ['a domain that was malicious at the time of its expiration is twice as likely to be caught than the average domain']],
  ['NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs', 'alowaisheq2019_cracking',
    ['expired sinkholes have caused the transfer of around 30K takendown domains whose traffic is now under the control of new owners']],
];

Unedited output of node scripts/report_ethics_registration.mjs:

=== CORPUS GUARD ===
extracted records: 5859; IN keys absent from current extraction: 0

=== POPULATION ===
security:domain_abuse IN papers: 48
registered or claimed (HAND reg != 0 || claimed): 19  — registered domains: 15; claimed third-party resources: 6; both: 2
of the 19, received and logged traffic meant for someone else (LOGGED_ARRIVALS): 7 — years 2017, 2021, 2021, 2022, 2022, 2023, 2024
years of the 19: 2014, 2015, 2017, 2017, 2019, 2020, 2021, 2021, 2022, 2022, 2023, 2023, 2024, 2024, 2024, 2024, 2025, 2025, 2025  (2025–2026 provisional)

=== PURPOSE — denominator: all 19 ===
code              papers  citekeys
----------------  ------  --------------------------------------------------------------------------------------------------------------------
logged            7       szurdi2017_email akiwate2021_risky kaleli2021_human so2022_spots pauley2022_ipreuse liu2023_dial saric2024_hyperlink
parked            2       alrwais2014_parking vissers2015_parking
nothing-deployed  2       li2024_bounce chen2025_cross
proof             3       alowaisheq2019_cracking zhang2023_wolf zhang2024_cross
testbed           5       chen2017_client alowaisheq2020_zombie zhang2024_glue wen2025_automatic zhang2025_misty

=== REVIEW — denominator: all 19 ===
code        papers  citekeys
----------  ------  ------------------------------------------------------------------------------------------------------------------------------------------------------------------
approved    2       szurdi2017_email saric2024_hyperlink
exempt      2       kaleli2021_human pauley2022_ipreuse
other-body  2       akiwate2021_risky li2024_bounce
discussed   10      alrwais2014_parking alowaisheq2020_zombie so2022_spots liu2023_dial zhang2023_wolf zhang2024_cross zhang2024_glue wen2025_automatic chen2025_cross zhang2025_misty
none        3       vissers2015_parking chen2017_client alowaisheq2019_cracking

=== REVIEW — denominator: the 7 that logged arrivals ===
code        papers  citekeys
----------  ------  ------------------------------------
approved    2       szurdi2017_email saric2024_hyperlink
exempt      2       kaleli2021_human pauley2022_ipreuse
other-body  1       akiwate2021_risky
discussed   2       so2022_spots liu2023_dial
none        0

=== KEEP — denominator: the 7 that logged arrivals ===
code      papers  citekeys
--------  ------  -------------------------------------------------------------
content   4       szurdi2017_email so2022_spots pauley2022_ipreuse liu2023_dial
metadata  3       akiwate2021_risky kaleli2021_human saric2024_hyperlink
none      0
n/s       0

=== HANDLING — denominator: the 7 that logged arrivals (multi-label) ===
code                            papers  citekeys
------------------------------  ------  --------------------------------------
scrub-before-storage            1       szurdi2017_email
declined-extra                  2       pauley2022_ipreuse saric2024_hyperlink
encrypted                       2       szurdi2017_email pauley2022_ipreuse
deleted-logs                    1       akiwate2021_risky
pii-deleted-before-publication  1       liu2023_dial
regret-stated                   1       so2022_spots
none-stated                     1       kaleli2021_human

=== ANSWER — denominator: all 19 ===
code               papers  citekeys
-----------------  ------  --------------------------------------------------------
silent             1       akiwate2021_risky
tcp-accept         1       pauley2022_ipreuse
accept-all-mail    1       szurdi2017_email
blank-page         1       saric2024_hyperlink
notice-page        1       liu2023_dial
interactive-traps  1       so2022_spots
inert-record       3       zhang2023_wolf zhang2024_cross wen2025_automatic
monetised          2       alrwais2014_parking vissers2015_parking
nothing-deployed   2       li2024_bounce chen2025_cross
testbed-only       3       chen2017_client alowaisheq2020_zombie zhang2024_glue
n/s                3       alowaisheq2019_cracking kaleli2021_human zhang2025_misty

=== AFTER — denominator: all 19 (multi-label: a paper can state one disposition for some names and nothing for others) ===
code                  papers  citekeys
--------------------  ------  ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
expired               1       so2022_spots
renewing              1       liu2023_dial
offered-to-owner      1       li2024_bounce
surrender-on-request  1       szurdi2017_email
kept-defensively      1       akiwate2021_risky
released-immediately  4       pauley2022_ipreuse zhang2023_wolf zhang2024_cross zhang2024_glue
released-test-domain  0
n/s                   13      alrwais2014_parking vissers2015_parking chen2017_client szurdi2017_email alowaisheq2019_cracking alowaisheq2020_zombie akiwate2021_risky kaleli2021_human zhang2024_glue saric2024_hyperlink wen2025_automatic chen2025_cross zhang2025_misty

state a disposition for at least some of what they held: 9 of 19; for all of it: 6 of 19; for none of it: 10 of 19
of the 15 that registered domains, state what happened to (some of) the domains: 5 — szurdi2017_email=surrender-on-request, akiwate2021_risky=kept-defensively, so2022_spots=expired, liu2023_dial=renewing, li2024_bounce=offered-to-owner
of the 7 that logged arrivals, no review body: 2 (so2022_spots, liu2023_dial); IRB said exempt / not human-subjects: kaleli2021_human, pauley2022_ipreuse

=== PER PAPER ===
year  citekey                  what                                                          purpose           keep      handling                        answer             after                     review
----  -----------------------  ------------------------------------------------------------  ----------------  --------  ------------------------------  -----------------  ------------------------  ----------
2014  alrwais2014_parking      23 purchased domains, parked with 7 services                  parked            none      none-stated                     monetised          n/s                       discussed
2015  vissers2015_parking      one typo domain of stackoverflow.com, parked with each servi  parked            none      none-stated                     monetised          n/s                       none
2017  chen2017_client          one new-gTLD domain for a testbed                             testbed           none      none-stated                     testbed-only       n/s                       none
2017  szurdi2017_email         76 typo domains of email providers, over seven months         logged            content   scrub-before-storage+encrypted  accept-all-mail    surrender-on-request+n/s  approved
2019  alowaisheq2019_cracking  one FBI-seized domain's dangling Route 53 nameserver slot     proof             n/s       none-stated                     n/s                n/s                       none
2020  alowaisheq2020_zombie    own test domains (count not stated)                           testbed           none      none-stated                     testbed-only       n/s                       discussed
2021  akiwate2021_risky        5 sacrificial-nameserver domains; one live .edu delegation    logged            metadata  deleted-logs                    silent             kept-defensively+n/s      other-body
2021  kaleli2021_human         45 unintended-URL domains, registered within hours of the tw  logged            metadata  none-stated                     n/s                n/s                       exempt
2022  so2022_spots             201 expired domains                                           logged            content   regret-stated                   interactive-traps  expired                   discussed
2022  pauley2022_ipreuse       1.5 million AWS IPs, each held about ten minutes, over 101 d  logged            content   encrypted+declined-extra        tcp-accept         released-immediately      exempt
2023  liu2023_dial             19 NXDomains, six months of collection                        logged            content   pii-deleted-before-publication  notice-page        renewing                  discussed
2023  zhang2023_wolf           records for 30 domains on DNS-hosting providers, incl. five   proof             none      none-stated                     inert-record       released-immediately      discussed
2024  li2024_bounce            30 unregistered recipient domains (typos of mail domains)     nothing-deployed  none      none-stated                     nothing-deployed   offered-to-owner          other-body
2024  zhang2024_cross          zones of inactive real domains on hosting providers, two per  proof             none      none-stated                     inert-record       released-immediately      discussed
2024  zhang2024_glue           more than 15 own test domains; 27 cloud IPs                   testbed           none      none-stated                     testbed-only       released-immediately+n/s  discussed
2024  saric2024_hyperlink      51 phantom domains plus a control                             logged            metadata  declined-extra                  blank-page         n/s                       approved
2025  wen2025_automatic        two test domains for a mail-client experiment                 testbed           none      none-stated                     inert-record       n/s                       discussed
2025  chen2025_cross           a test domain; a registrable CNAME target of a Microsoft dom  nothing-deployed  none      none-stated                     nothing-deployed   n/s                       discussed
2025  zhang2025_misty          80 test domains across four registrars, plus test IDNs        testbed           none      none-stated                     n/s                n/s                       discussed

=== QUOTE CHECK — every quote in ethreg_codes.mjs located in paper.cols.txt ===
quotes: 91; exact: 91; after joining line-end hyphens: 0; NOT FOUND: 0

=== DECLINED OR NEVER RECEIVED (comparison set, of the 48) ===
  2020 akiwate2020_lame: would not defensively register the at-risk nameserver domains
  2025 so2025_lost: checked registrability with a registrar, registered nothing
  2026 hortea2026_dead: WHOIS, DNS, TLS and CT queries only
  2021 squarcina2021_subdomain: fingerprints and registrar availability, no claims on live sites
  2025 alhamdan2025_deno: disclosed; the affected project bought the name
  2020 randall2020_trufflehunter: cache snooping at large public resolvers only

=== OUTSIDE THE 48 (pointer, not counted) ===
  2016 starov2016_honor: eight domains that web shells phone home to

=== YEAR COUNTS — paper counts, 2025–2026 provisional ===
year  domain-abuse IN denominator  registered/claimed  logged arrivals
----  ---------------------------  ------------------  ---------------
2010  1                            0                   0
2011  0                            0                   0
2012  0                            0                   0
2013  1                            0                   0
2014  2                            1                   0
2015  4                            1                   0
2016  3                            0                   0
2017  4                            2                   1
2018  3                            0                   0
2019  3                            1                   0
2020  3                            1                   0
2021  4                            2                   2
2022  2                            2                   2
2023  4                            2                   1
2024  5                            4                   1
2025  7                            3                   0
2026  2                            0                   0

=== UNMAPPED RESIDUE — identity selection and finite hand-code vocabulary ===
uncoded selected papers: 0; coded outside selection: 0; unknown code values: 0 (invalid values throw); no free-text alias fold used

The following checks use data/fulltext/<year>/<venue>/<slug>/paper.cols.txt, never .norm. The selected source spans and neighbouring text were exported to ethreg/run20261008/spotchecks.txt and read. No failure in the 91-span mechanical localisation run. No direct paper quotation is introduced in the new content section; its paper claims are paraphrases.

No new vendor/tool-status, law or contemporary drop-market claim is introduced. No industry listicle was sought or used. Venue/author primary pages fetched for publication identity or source verification during the currency review are recorded in the review log below. Historical academic results are explicitly dated; their present-day generalisation is not asserted.

The local 2026-09-28 draft's RDAP survey of names from So et al. was not reused: its mutable registration states would need new fetching, and one paper's current names cannot establish the harm from releasing research names. The section answers the disposal question using a dated market result plus named paper choices; no fresh intervention against the named domains is needed.

Recommendations: count-only collection where possible; silence or minimum necessary inert response; counsel/security-office review when the IRB declines; accountable handover or funded defensive renewal with reassessment. These are design judgments, not measured adoption rates. Continued holding also excludes other registrants; renewal is conditional, not a universal obligation. Publishing names is treated as a disclosure decision rather than categorically forbidden. Loopback DNS records and short windows are explicitly not guaranteed harmless.

• The inherited 48-paper selection excludes generic malware/DGA sinkholing and other namespaces. No overall count of interception studies is claimed. Its hand-code counts are reproducible, but not an independent measurement of the fixed population's recall or intercoder agreement.
• Reported approvals, non-responses and dispositions are what papers state, not observations of their actual conduct or the legal validity of their plans.
• No claim that receipt logging or historical controls are superseded: 2025–2026 are thin and provisional, and no recent logging paper was found inside this selection.
• During drafting the 2025/2026 IN split was accidentally typed as 6/3. The new year table caught this: corrected to 7/2 before review/publication; total nine was unchanged.
• Citation review caught that Chen's released test domain was repurchased within the experiment. Corrected its after code to n/s, retained both source spans under other, reran the report and changed the stated-domain-disposition count from six to five of 15. Also changed approval wording: Saric reports unspecified ethics approval, not explicitly IRB; Kaleli reports not-human-subjects, not necessarily Common Rule exemption.
• The initial citation check found chen2025_cross absent from the live bibliography. Generated with node scripts/bibgen.mjs NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange --key chen2025_cross, checked against the first page, and planned as the sole new shared entry. No new entry belongs only to this provenance page.
• The generic number-presence guard on the pre-edit ethics page reported 313 and 89.1 as absent from report_ethics.mjs. They belong to the pre-existing consent audit, not to this section. Reran node scripts/consent_action_noninteraction_audit.mjs; its current output reproduces 279/313 = 89.1%. These existing figures were left unchanged.
• Closed the linked domain-abuse page's obsolete question and corrected only the associated review labels and Kaleli retention cell. A matching append-only log is published on its provenance page; its report rerun is byte-identical, with no numeric change. This keeps the reading path coherent without starting another topic.
• No credentials or private intercepted traffic were read or printed. Public paper excerpts only.

The requested Sonnet/Fable model identifiers are not available through this environment's agent tool. Three focused reviewers used explicitly selected GPT-6.1-sol, with independent task contexts and an explicit warning that context might be incomplete; a fourth generic pass uses the same available model. This preserves the separate review scopes but does not provide the requested model diversity.

No focused-review finding rejected. The following reports preserve initial findings and correction rechecks; earlier 90-span and six-disposition descriptions are superseded by the rerun above (91 spans, five registered-domain dispositions).

review-figures.txt

Figure review — 2026-10-08
Reviewer: Codex figure-review agent. No content/script edits.
 
Reproduction
Ran node scripts/report_ethics_registration.mjs into review-registration-rerun.txt, and node scripts/report_ethics.mjs into review-ethics-rerun.txt. Both exit 0; diffs against registration-output.txt and ethics-output.txt are empty. Guard: 5,859 extraction records, all 48 IN identities present, 19 selected identities, zero uncoded/extra/invalid rows. All 90 evidence quotes locate exactly in paper.cols.txt.
 
New-section numbers and populations
- 48 IN; 19 registering/claiming; 15 registering and 6 claiming with overlap 2: correct.
- 7 logging arrivals; other twelve = 5 testbeds + 2 parking + 3 proofs + 2 nothing-deployed: correct.
- Four content and three metadata among seven: correct.
- Review split among seven: two approved, two exempt, one other-body, two discussed, zero none. Numeric split correct; IRB wording unsupported (below).
- 15 registered-domain papers, six with disposition for at least some domains: correct. Named six match report (Szurdi, Akiwate, So, Liu, Li, Chen). Exclusion of released-immediately is explained in provenance as a claimed-resource code.
- Publication years in receiver table and other cited examples match corpus keys.
- Logging precedent years 2017–2024: correct. Inert-record takeover proofs 2023–2024: correct (Wen 2025 is testbed).
- 2025 IN 7; 2026 IN 2; total nine. Registration/claiming 3 and 0, logging 0 and 0: correct. Both years marked provisional. Earlier draft's 6/3 is absent from content except as explicitly corrected provenance history.
- All spelled-out counts checked: other twelve, seven receivers, four content, three metadata, two approvals, two exemptions, one other body, two discussion-only, six dispositions, nine recent papers, none logging. Correct arithmetic.
 
Per-paper number/source context
Read paper.cols.txt directly for Zhang 2024, Pauley 2022, and Lauinger 2017. Zhang says negative-cache TTL 1 second; entire test within 2 minutes; immediate removal, REFUSED rollback and normal-user query-log checks. Pauley collects up to 10 minutes per collection server, then uploads, terminates and replaces servers. Content's one second, two minutes and up to ten minutes are accurate. Lauinger explicitly describes 10% of deleted com domains re-registered on deletion day; new content's denominator and historical framing are correct. These design durations are appropriately not presented as safe thresholds.
 
Must-fix in added section
Opening paragraph says “two report IRB approval”. Szurdi explicitly names IRBs; Saric only says “complete with ethics approval”. Full-text probe found no IRB/review-board passage for Saric. Code approved means IRB OR ethics board and cannot support an IRB-only count. Suggested replacement: “two report approval”. Do not invent Saric's approving body.
 
Untouched corpus figures vs regenerated report
Checked corpus 5,859/seven/2010–2026; empirical 5,118; all outcome table counts/shares; all participant/crawl population rows; all time-window cells; all venue cells; all body families and 1,347/595; robots counts/shares and next-four field table; all mitigation families and 585/971 vs 207/971; notification/regulator denominators; sweep figures and Menlo rates; trimming count and rate changes. All match ethics-output.txt.
Spelled-out summaries agree: one in three; two thirds; four in five; PoPETs more than three times TheWebConf (54.3/16.6); almost three times mitigation vs review (585/207); twenty no-board papers, sixteen participants, half Menlo; five AUP papers; seven network-department papers; ten operator-opt-out papers and twenty-one candidates. Notification yes+partial = 2,160/4,472 = 48.3%, supporting nearly half.
 
Flagged inherited interpretation, not a refreshed count
page.txt line 59 claims 30.1% is a reporting rate participant studies “had already passed before 2014”. The table has 28.6% in 2010–2013, BELOW 30.1%, and 58.7% in 2014–2017. It does not establish a before-2014 crossing. Counts match script; interpretation needs correction or annual evidence. Supported wording: “roughly the rate participant studies reported in 2010–2013”, or “a rate participant studies had passed by 2014–2017”. Treat as inherited discrepancy rather than automatic corpus refresh.
 
Scope limitations
Internal reproduction/arithmetic/identity and selected source context checked; independent recall of the 48-paper hand selection and full semantic recoding of nineteen papers were not performed. One-coder/not-double-coded caveat is appropriate.
Untouched external policy/legal/product dates, external paper counts, sister-page figures (26 messaging papers, 5.1% hand-coding crowdworker share), and consent-audit figures (55/1,120 and 279/313) are not outputs of report_ethics and were not independently re-audited here. No mismatch inferred from their absence in that report.
Regenerated extraction figures do not verify actual author conduct, validity/remit of reviews or present market conditions.
 
Final-update recheck
Parent incorporated review fixes and source-reviewer's Chen correction. Current page says two ethics approvals (one explicitly IRB); this accurately limits specificity. Existing rate comparison now says 30.1% is just above 28.6% and below 58.7%; supported. Chen CODES now after=n/s, with both release and repurchase spans under other; final disposition cannot be inferred from intermediate release. Current disposition count is FIVE of 15, not earlier six. Page lists the five appropriately and explicitly explains Chen's release/repurchase. Reran registration script after correction: exit 0, empty diff vs current registration-output.txt, 91 exact evidence spans and zero failures. Current report disposition totals: some 9/19, all 6/19, none 10/19; registered-domain disposition 5/15. Earlier ledger entries above describe the reviewed prior draft and are superseded by this final recheck. No remaining must-fix figures identified.

review-citations.txt

Citation/source review — 2026-10-08
Reviewer scope: proposed receiving-traffic section in page.txt and section.txt; appended registration provenance; report_ethics_registration.mjs, ethreg_codes.mjs, saved registration-output.txt; current read-only publications_dataset paper.cols.txt sources. No content edited.
 
Findings requiring correction
 
1. Review-category wording overstates Saric's approval and Kaleli's determination.
Location: page.txt:330, opening count paragraph.
Current wording: 'two report IRB approval, two an exemption'.
Saric et al. 2024 paper.cols.txt states only 'complete with ethics approval' (line 489); fulltext contains no IRB or review-board identification. Szurdi and Christin explicitly state IRB approval. The code's approved category means 'an IRB or ethics board approved', not IRB specifically. Kaleli says the institution's IRB did not consider this human-subjects research; that is not stated as an exemption. The later review paragraph already makes the latter distinction correctly.
Action: say 'two report ethics approval (one explicitly IRB), two an exemption or not-human-subjects determination, one approval by another body, and two discuss ethics without naming a review body'. Consider broadening the code-label explanation to unspecified ethics approval as well; do not infer Saric's approving body's identity from this text.
 
2. Chen test-domain release is an intermediate experiment step, not stated final disposition.
Location: page.txt:369; ethreg_codes.mjs chen2025_cross after code; provenance's 6/15 disposition count.
Current source says they registered an own test domain, issued a certificate, released it, then purchased it through Namecheap as a simulated victim and issued certificates again. Omitting repurchase while listing release alongside post-study dispositions can imply the domain was left available after the study. This is distinct from qtlcdnect.com, which they separately purchased and declined to exploit; no release of that target is stated.
Action: describe 'released and then repurchased a test domain to simulate resale; final disposition unstated'. For a count of final/post-study domain dispositions, exclude Chen and recalculate to 5/15; alternatively define and label a different metric explicitly that includes intermediate release/reacquisition and never present it as final disposal. The distinction from a demonstrated traffic receiver is correct but insufficient to disclose repurchase.
 
Verified support
 
- Re-ran node scripts/report_ethics_registration.mjs successfully against current fulltext. Output matched registration-output.txt byte-for-byte. All 90 coded source strings localized exactly; zero missing quotations. No direct quotation is introduced in the proposed content section.
- All 20 distinct citation keys used in section.txt resolve exactly once across the fetched bibliography.txt plus bib-addition.txt. chen2025_cross is the sole added key. Its title occurs only once in the combined bibliography. First page of current NDSS 2025 fulltext confirms the title, year/venue, and seven authors in the proposed entry's order: Pinji Chen, Jianjun Chen, Mingming Zhang, Qi Wang, Yiming Zhang, Mingwei Xu, Haixin Duan.
- Akiwate 2021 source supports general counsel approval of design and controls before active measurement, specifically because the IRB could not supply independent oversight; the page does not imply counsel is an IRB.
- Pauley 2022 supports IRB exemption separately from CISO-office approval of data handling; encrypted PCAP/storage, restricted access, ten-minute acquisition windows and no interaction above transport are supported. The page correctly limits this precedent's remit.
- Li 2024 supports partner network-management department and regulatory authority supervision at an institution without an IRB. No receiving online service was deployed on registered typo domains; free transfer was offered.
- Metadata classifications are supported by actual collection fields, not inferred from published counts: Kaleli collects client IP and headers, Saric logs IP/time/request/user-agent, Akiwate logs resolver queries then deletes logs. These remain potentially sensitive metadata; page cautions accordingly.
- Szurdi collection/scrubbing/encryption/IRB/accept-mail and no-outgoing-mail claims match source; Liu payload/IP/port collection, notice page, personal-data removal before publication, and renewal intention match source. So 2022 packet capture, fingerprinting, credential traps, overcollection admission and expiry-again claims match source.
- Zhang 2023 loopback A/TXT/removal and Zhang 2024 informational TXT, one-second negative-cache TTL, within-two-minute process, REFUSED rollback and no-normal-user log check match source. The page correctly treats short windows and loopback as design choices rather than proof of harmlessness.
- Lauinger 2017 supports 10% of deleted .com domains re-registered on deletion day, not 10% of all extant .com or all research names. Source explicitly uses a historical four-week 2016 dataset. The page's dated population qualifier and denial of a current market-rate claim are appropriate.
- Randall large-public-resolver limitation, Squarcina non-claiming availability approach, So 2025 non-registration and Hortea 2026 non-registration/non-claiming are supported. Their use as alternatives does not imply a field-wide cessation of receipt collection.
- Numerical counts other than the disposition interpretation in finding 2 reproduce the hand codes: 48 selected papers, 19 registrants/claimants, 7 logged-arrival papers, 4 content/3 metadata; 2025/2026 selected split 7/2, registration split 3/0 and no arrival logging among those nine.
 
Coverage limits
 
This review verifies local current primary fulltext and bibliography snapshots, not actual researcher conduct, legal validity, operational ownership today, or the external wiki's live post-publication state. The quote-localization pass is mechanical; contextual close reading focused on review remits, collection fields, disposition, historical denominator, resource-claim controls and the newly added Chen entry. It is not an independent recoding of all 48 papers or a corpus-recall audit. No mutable domain/RDAP/vendor assertion required new lookup. Recommendations are explicitly normative and do not need to be misrepresented as empirical adoption rates. Remaining publication verification should re-fetch the live page and shared bibliography after publication.
 
Correction re-review — same session
 
Both substantive findings are resolved in the current page.txt. Opening review counts now distinguish unspecified ethics approval from explicit IRB approval and distinguish exemption from not-human-subjects determinations. The disposition denominator is now 5/15; Chen is explicitly described as release followed by repurchase with final disposition unstated. Current Chen after code is n/s and the repurchase source span is included. Re-ran the report: 91/91 source strings localized exactly, zero failures, and output matched refreshed registration-output.txt. No remaining publication-blocking citation finding.
 
Optional documentation refinement: FIELDS.review.approved still says 'an IRB or ethics board approved'. Saric names neither an IRB nor an ethics board; change the label to 'explicit ethics approval (body may be unspecified)' or equivalent if this vocabulary will be reused. This does not affect corrected page counts or source attribution.

review-currency.txt

External currency review — 2026-10-08 UTC
 
Scope: added “Registering or claiming names to receive misdirected traffic” section in page.txt (also section.txt), registration provenance addition in provenance.txt, scripts/report_ethics_registration.mjs and ethreg_codes.mjs, and registration-output.txt. Unchanged venue-policy/legal material was outside this review. No edits to proposed content.
 
Result: PASS. No material currency correction required.
 
Findings:
1. The new section dates historical controls by publication year, presents them as precedents, and expressly denies that this thin selected population establishes supersession of receipt logging. Recommendations are described as design judgments, not measured 2026 adoption. No dated academic method is falsely represented as obsolete or a current universal standard.
2. So et al. is correctly identified as USENIX Security 2025. The fetched official PDF section 4.4 verifies availability via a registrar; section 9 explicitly states no expired domains were registered and experiments manipulated the authors’ testing environment. This supports the alternative without suggesting all network traffic collection ceased.
3. Hortea et al. is correctly identified as PoPETs 2026, issue 4. Appendix A on printed page 129 in the freshly downloaded official PDF states synthetic test-device profiles, no real-user interception, no expired-domain re-registration or dangling-resource claim, and external DNS/WHOIS/TLS/CT queries. The proposed paraphrase matches. The paper’s publication identity is current, while the dataset population remains correctly marked provisional.
4. The official 2017 Lauinger venue page and paper support the approximately 10% same-day .com re-registration result. The section explicitly limits it to the historical deleted-domain population and disclaims both a current drop-market rate and measured harm from releasing research names. Its use as historical motivation is appropriately qualified.
5. “None of these nine logged arrivals” is locally scoped to seven 2025 and two 2026 papers in the hand-selected 48-paper domain-abuse population. The report’s YEAR COUNTS agrees (7/3/0 and 2/0/0 for IN/registered-or-claimed/logged). Script guards define IN from the fixed VERDICTS selection and require CODES/LOGGED_ARRIVALS agreement. No field-wide no-recent-logging assertion is introduced.
6. The mutable RDAP survey is expressly omitted. No new vendor-status, contemporary market-rate or legal claim needs current verification in this addition.
 
Exact primary-source URLs fetched/read on 2026-10-08 UTC:
- https://www.usenix.org/conference/usenixsecurity25/presentation/so — web open; publication identity and abstract read.
- https://www.usenix.org/system/files/usenixsecurity25-so.pdf — web click/open/find; sections 4.4 and 9 read.
- https://petsymposium.org/popets/2026/popets-2026-0112.php — web open; title/authors/year/issue/DOI and abstract read.
- https://petsymposium.org/popets/2026/popets-2026-0112.pdf — web click initially returned 17-page PDF metadata; subsequent web find/open returned internal errors/timeouts. Same official URL freshly fetched successfully with curl, then Appendix A read using pypdf extraction. No cached local corpus text substituted for this external check.
- https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/lauinger — web open; year/identity and abstract result read.
- https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-lauinger.pdf — web open; paper fetched and historical result/context checked. The initial venue-page PDF click failed internally; direct official URL succeeded.
 
Rejected sources: none. No secondary/listicle sources sought or relied upon. Failed web fetches above were transport/tool failures, not rejected evidence. No current RDAP requests or unrelated external legal/venue-policy checks performed.

review-generic.txt

Generic review, 2026-10-08
 
Scope: current page.txt and provenance.txt, report_ethics_registration.mjs, ethreg_codes.mjs, registration-output.txt, adjacent exported domain-abuse page, proposed bibliography. Independent generic review after the three focused reviews; no content or code edits.
 
Publication-blocking issue
 
G1. The provenance final figures recheck contradicts its current real output. At provenance.txt:1373 it says “for all 5/19”; the embedded current report and a fresh rerun say “for all 6 of 19”. Five is the registered-domain some-disposition count (5/15), not the all-resources complete-disposition count (6/19). This is a provenance prose defect only: the new section does not use the latter figure. Correct or explicitly annotate that review sentence before publication. Its preceding blanket warning only supersedes earlier six registered-domain dispositions and does not clearly cure this reversed stale value in the later “final recheck”.
 
Optional improvements / adjacent consistency
 
G2. The linked live security:domain_abuse page still contains the open-question WRAP saying Ethics has no receiving-traffic section, blanket “2 IRB approval / 2 IRB exemption” labels, and Kaleli’s “visit counts only”. The current Ethics addition fixes all three issues in its own account. Replacing the stale question with a section pointer and aligning the short source descriptions would make the linked reading path coherent. This is outside the proposed Ethics page itself; do it if the authorized adjacent-page scope permits.
 
G3. The code vocabulary still defines inert-record as “a harmless record”, while the reader-facing section correctly says loopback changes resolution and is not automatically harmless. Use “limited identifying or loopback record” in the audit definition to keep the published codebook as careful as the prose. No numerical impact.
 
Checks and judgment
 
- Fresh node scripts/report_ethics_registration.mjs run succeeded; empty diff against registration-output.txt. All 91 spans exact; no failed localization. 48/19/15/6 with overlap 2, seven arrival loggers, four content versus three metadata, current review aggregation, five domain dispositions and year counts match the section. Quote localization is correctly distinguished from semantic validation and independent coding.
- Read the whole proposed section, source-code definitions and added provenance. Need, keep, answer, after and review defaults are concrete and explicitly recommendations; named contrary designs remain visible. Proof, passive availability, testbed and reception variants are distinguished. TTL/windows are author choices, not certified safe thresholds. Historical drop-market evidence and selected-population recent absence are appropriately bounded. No MDN/textbook detour.
- Corpus scope, fixed hand selection, provisional years, single coder, lack of double coding and unknown recall outside selection are stated plainly. The report and codebook are fully embedded, with dependency selection on the linked domain-abuse provenance; the published audit can be reproduced against the named corpus mount. No figure relies on an unreported string fold.
- Read-only JSON-RPC getPage of security:domain_abuse succeeded and found the exact “Registering names to measure them” heading. The new provenance heading exists in the proposed document. All 20 distinct section citekeys occur in bibliography-new.txt, including Chen. Final save/render/link verification remains the publisher’s completion step.
- Review-body statements are appropriately limited: unspecified Saric approval, Kaleli not-human-subjects determination, Pauley separate CISO plan, Li partner supervision. Chen’s intermediate release/repurchase is not counted as final disposal. No additional substantive overclaim identified.
 
Conclusion: publish after G1 is corrected/annotated and normal post-save verification succeeds. G2 and G3 are useful coherence improvements, not reasons to block this section.
 
Correction recheck, 2026-10-08
 
G1 resolved: original figures reviewer corrected its final recheck to some 9/19, all 6/19, none 10/19, with registered-domain dispositions still 5/15. Current provenance embeds that corrected review and the agreeing report. Fresh registration-report rerun succeeded with empty diff against registration-output.txt and 91 exact spans.
 
G2 resolved in proposed domain-new.txt: inspected full diff against live export. Obsolete open-question WRAP replaced with explicit namespaced link to the exact new Ethics heading; 19-paper approval labels and full-cohort category descriptions now permit unspecified ethics approval and not-human-subjects determinations; Kaleli now distinguishes client IP/header collection from visit-count results. No numerical changes or unrelated modifications in the diff. Parent will record this adjacent correction in its existing provenance page.
 
G3 resolved: current ethreg_codes.mjs and embedded provenance codebook describe a minimally interactive record and explicitly warn that changes can still affect clients. No numerical effect.
 
Final judgment: no remaining publication-blocking or optional review findings. Proposed source is ready to publish with its bibliography and provenance; normal post-save equality/render/link verification remains required.

Publication checks planned: guarded JSON-RPC saves using each read revision, then raw read-back and rendered citation/reference/anchor checks. Results are appended below after completion.

[1]

Ramulu, Harshini Sri; Schmitt, Helen; Rerich, Bogdan; Rodriguez, Rachel Gonzalez; Kohno, Tadayoshi; Acar, Yasemin (2025): "Ethics in Computer Security Research: A Data-Driven Assessment of the Past, the Present, and the Possible Future", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[2]

Akiwate, Gautam; Savage, Stefan; Voelker, Geoffrey M.; Claffy, Kimberly C. (2021): "Risky BIZness: risks derived from registrar name management", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[3]

Pauley, Eric; Sheatsley, Ryan; Hoak, Blaine; Burke, Quinn; Beugin, Yohan; McDaniel, Patrick D. (2022): "Measuring and Mitigating the Risk of IP Reuse on Public Clouds", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[4]

Zhang, Fenglu; Zhang, Yunyi; Liu, Baojun; Alowaisheq, Eihal; Ying, Lingyun; Li, Xiang; Zhang, Zaifeng; Liu, Ying; Duan, Haixin; Zhang, Min (2023): "Wolf in Sheep's Clothing: Evaluating Security Risks of the Undelegated Record on DNS Hosting Services", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[5]

Zhang, Yunyi; Zhang, Mingming; Liu, Baojun; Liu, Zhan; Zhang, Jia; Duan, Haixin; Zhang, Min; Shi, Fan; Xu, Chengxi (2024): "Cross the Zone: Toward a Covert Domain Hijacking via Shared DNS Infrastructure", in: Proceedings of the USENIX Security Symposium. (Link)

[6]

Szurdi, Janos; Christin, Nicolas (2017): "Email Typosquatting", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[7]

Kaleli, Beliz; Kondracki, Brian; Egele, Manuel; Nikiforakis, Nick; Stringhini, Gianluca (2021): "To Err.Is Human: Characterizing the Threat of Unintended URLs in Social Media", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[8]

So, Johnny; Miramirkhani, Najmeh; Ferdman, Michael; Nikiforakis, Nick (2022): "Domains Do Change Their Spots: Quantifying Potential Abuse of Residual Trust", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[9]

Liu, Guannan; Jin, Lin; Hao, Shuai; Zhang, Yubao; Liu, Daiping; Stavrou, Angelos; Wang, Haining (2023): "Dial "N" for NXDomain: The Scale, Origin, and Security Implications of DNS Queries to Non-Existent Domains", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[10]

So, Johnny; Sanchez-Rola, Iskander; Nikiforakis, Nick (2025): "Lost in the Mists of Time: Expirations in DNS Footprints of Mobile Apps", in: Proceedings of the USENIX Security Symposium. (Link)

[11]

Hortea, Gabriel; Girish, Aniketh; Vallina-Rodriguez, Narseo; Tapiador, Juan (2026): "Dead Domains, Living Data: A Privacy Risk Analysis of Domain Lifecycle in Android Apps", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[12]

Lauinger, Tobias; Chaabane, Abdelberi; Buyukkayhan, Ahmet Salih; Onarlioglu, Kaan; Robertson, William (2017): "Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers", in: Proceedings of the USENIX Security Symposium. (Link)

[13]

Chen, Pinji; Chen, Jianjun; Zhang, Mingming; Wang, Qi; Zhang, Yiming; Xu, Mingwei; Duan, Haixin (2025): "Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange", in: Proceedings of the Network and Distributed System Security Symposium. (Link)