Is security a technical or a social task? Anyone researching civil security in Germany will be confronted with this question at some point. The trivial answer is "both". But this does not solve the problems that arise at the interfaces between security technologies and social values. This raises another question: How does good security research actually work?