Cyberethics
Scenario I
• Consider the following question:
If you could use a computer to steal enough money so that you and no other member of
your family would every have to work again, and there was no chance that you would get
caught, would you do it?
• If you answered yes, then why?
• If you answered no, then why not?
• If there were a chance of being caught, does that
change your answer?
• If there were a good chance of being caught, does
that change your answer?
Cyberethics Defined
Scenario 1 is just an example of a much larger field of study called
Cyberethics
Wikipedia defines Cyberthics as “the philosophic study of ethics pertaining to
computers, encompassing user behavior and what computers are
programmed to do, and how this affects individuals and society.”
Cyberethics Examples
There are many examples that would fall under the heading of
cyberethics but here are a few such questions:
•
•
•
•
•
•
•
•
If it is on the internet, is it ok to copy it?
If you find an open port into a machine, it it ok to explore that machine?
Is it ok to post false information about another individual or group?
What is the definition of pornography and should access to it be limited on the
internet?
Where is the line between satire and blasphemy and who gets to decide?
Is it ok to create a program the purpose of which is to provide illicit access to other
people’s data?
Is it acceptable to write a program that provides guidance to a nuclear device?
Is it ok to hack if you are hacking for the “good guys?”
ACM Code of Ethics
These are not new questions. Many of these questions have been
around since the beginning of mankind, they are simply now applied to
the internet.
For folks new to this discussion, a reasonable place to start is the ACM
Code of Ethics.
• ACM stands for Association for Computing Machinery
• This is the parent professional organization for all of Information Technology (IT)
• For those that wish to be IT professionals, it is a good idea to know and follow the ACM
Code of Ethics but it is not just for IT professionals
ACM Code of Ethics
The ACM Code of Ethics is divided into multiple sections including:
•
•
•
•
General Moral Imperatives
More Specific Professional Responsibilities
Organizational Leadership Imperatives
Compliance with the Code
General Moral Imperatives
As an ACM member I will …
•
•
•
•
•
•
•
•
Contribute to society and human well-being
Avoid harm to others
Be honest and trustworthy
Be fair and take action not to discriminate
Honor property rights including copyrights and patents
Give proper credit for intellectual property
Respect the privacy of others
Honor confidentiality
More Specific Professional Responsibilities
As an ACM computing professional I will …
• Strive to achieve the highest quality, effectiveness and dignity in both the process and
products of professional work
• Acquire and maintain professional competence
• Know and respect existing laws pertaining to professional work
• Accept and provide appropriate professional review
• Give comprehensive and thorough evaluations of computer systems and their impacts,
including analysis of possible risks
• Honor contracts, agreements, and assigned responsibilities
• Improve public understanding of computing and its
consequences
• Access computing and communication resources
only when authorized to do so
Organizational Leadership Imperatives
As an ACM member and an organizational leader, I will …
• Articulate social responsibilities of members of an organizational unit and encourage full
acceptance of those responsibilities
• Manage personnel and resources to design and build information systems that enhance
the quality of working life
• Acknowledge and support proper and authorized uses of an organization's computing
and communication resources
• Ensure that users and those who will be affected by a system have their needs clearly
articulated during the assessment and design of requirements; later the system must be
validated to meet requirements
• Articulate and support policies that protect the dignity
of users and others affected by a computing system
• Create opportunities for members of the organization
to learn the principles and limitations of computer systems
Compliance with the Code
As an ACM member I will …
• Uphold and promote the principles of this Code
• Treat violations of this code as inconsistent with membership in the ACM
Scenario I
• Lets reconsider our first question:
If you could use a computer to steal enough money so that you and no other member of
your family would have to work ever again, and there was no chance that you would ever
get caught, would you do it?
• If you answered yes, then why would you assume that no one would do this to you?
• If you answered yes, then why would you ever place
your money in a bank, credit union, or other financial
institution?
• If you answered yes, then perhaps you should not be
an IT Professional!!
Responsibility
In our discussion, we have returned often to the word Responsibility. Lets consider
what this word means.
Wiktionary defines responsibility as “the state of being responsible, accountable, or
answerable” OR as “a duty, obligation, or liability for which someone is held
accountable.”
For our purposes, lets consider four types of responsibility:
•
•
•
•
Role Responsibility
Causal Responsibility
Blameworthy
Liable
Role Responsibility
Role Responsibility describes a situation where a person is responsible simply
because of the position or role that they occupy.
Examples might include:
•
•
•
•
A parent’s responsibility for their child and the actions of that child
A teacher’s responsibility for their class room and the students in it
A firefighter’s responsibility to save lives and protect property
A software developer’s responsibility for the systems they develop/maintain
Causal Responsibility
Causal Responsibility describes a situation where a person has done
something or failed to do something that has caused an event to occur. Keep
in mind that there is no fault necessarily associated with causal responsibility.
Examples might include:
• A batter hitting a baseball over the outfield fence into a car windshield
• The wind of a passing car blowing a piece of trash up into the air that
gets stuck to the radiator of another car
• A store owner forgetting to turn out the lights when the store is closed
causing people to think that store is open
• A web developer creating a back door into a system for maintenance
that is eventually exploited in a hack
Blameworthy
Blameworthy describes a situation where a person has done something wrong
or failed to do something right that has caused an event to occur. Unlike
causal responsibility, there is fault associated with being blameworthy.
Examples might include:
•
•
•
•
A person intentionally throwing a baseball into a car windshield
Failing to secure a load on a truck or trailer that comes loose and hits another car
A restaurant employee forgetting to turn off the oven causing a fire
A software developer intentionally creating a back door without the consent of the client
for future malicious purposes
Liable
Liability describes a situation where a person is financially or criminally
responsible for something. Keep in mind that it is possible to be liable without
being blameworthy!
Examples might include:
•
•
•
•
A parent’s financial responsibility for the window their child broke
A drunk driver’s responsibility for the injuries or deaths of others
A company’s responsibility for the failure of a project
A software developer’s for their code allowing the theft of millions of dollars
Scenario II
• Consider the following question:
Eventually, as you learn about computers, operating systems, the internet and cyber
security, you may have the skills to attempt to penetrate other people’s systems. Lets say
that you successfully penetrate someone else’s computer without permission but that you
do not do anything malicious. Is this ethical or not?
• If you answered yes, then why?
• If you answered no, then why not?
• If there were a chance of being caught, does that
change your answer?
• If the law makes this clearly illegal, does that change your answer?
Scenario II (continued)
• Non-malicious hacking
Some hackers attempt to make the case that as long as they do not do anything
malicious, then they have not done anything wrong
Some even argue that they are helping to discover flaws in security or operating systems
However, doing so without permission is at best un-ethical and at most illegal
Scenario III
• Consider the following question:
Taken from the movies Ferris Bueller’s Day Off and War Games, let’s suppose that your
school’s computer system is not secure, that you have the ability to penetrate that system
and change grades, attendance records, etc. Let’s also suppose that you are .001 points
away from graduating with a GPA that would qualify you for thousands of dollars in
scholarships. It would only take changing one grade from a B to a B+ to qualify. Would
you do it?
• If you answered yes, then why?
• If you answered no, then why not?
• If there were a chance of being caught, does that
change your answer?
• If the law makes this clearly illegal, does that change your answer?
Scenario III (continued)
• Hacking for “good” cause
Some hackers attempt to make the case that as long as they are not hurting anyone and
their motives are “good”, then they have not done anything wrong
However, they may be missing the fact that by cheating their way to scholarship eligibility,
they may be taking money away from students that actually earned it
This kind of hacking is absolutely illegal
Scenario IV
• Consider the following question:
You are working on a paper for a class and you find a very similar paper on the internet.
You want to use significant parts of the paper in your paper but you are unsure how much
is too much. What do you do?
•
•
•
•
It is on the internet so it is fair game, copy it!
Since you don’t know how much is too much, don’t use any of it?
Use appropriate excerpts and quotes but with proper citation.
They are only saying what you would have said anyway, so what is the harm in using it.
Scenario IV (continued)
Copyright and Fair Use
Lets get some basics out of the way:
• All creative works are covered by Copyright law from the moment they are created
• Copyrights can be registered with the federal government but do not have to be
registered to be enforced as long as the authorship can be determined
• Plagiarism – claiming someone else’s work as your own – is simply wrong – period!
• There are exceptions to copyright and most of these are in the Doctrine of Fair Use
Scenario IV (continued)
Fair Use
The Doctrine of Fair Use provides limited exceptions to copyright:
• The purpose and character of the use, including whether such use is of commercial
nature or is for nonprofit educational purposes
• The nature of the copyrighted work
• The amount and substantiality of the portion used in relation to the copyrighted work as
a whole
• The effect of the use upon the potential market for, or value of, the copyrighted work
Scenario IV (continued)
The purpose and character of the use, including whether such use is of
commercial nature or is for nonprofit educational purposes
This means two things:
• You can use work covered by copyright for nonprofit educational purposes, but
• You cannot deprive the copyright holder from the right to profit from the copyright
This means, for example, that a professor may be able to share an excerpt from work but
they cannot simply copy an entire textbook and given it to their students.
Scenario IV (continued)
The nature of the copyrighted work
While some may interpret this as referring to the subjective quality of a creative work, it
actually refers primarily to the distinction between facts and expression.
For example, the fact that the Normandy D-Day invasion took place on June 6, 1944 is a
fact and is not covered by copyright. However, an expression of that fact such as the
book, and the movie, “The Longest Day’, is covered by copyright.
Scenario IV (continued)
The amount and substantiality of the portion used in relation to the copyrighted
work as a whole
An example of this would be copying a particular chart, graph, or algorithm out of a book
as opposed to copy the entire book.
While there is no set limit on the number of characters, words, or pages that is safe to
copy, the legal threshold falls back upon whether you may be depriving the copyright
holder from the right to profit. Thus if you copy an entire magazine article and distribute it
to your friends, you are most likely in violation. However, quoting a line or two with proper
citation is likely acceptable.
Scenario IV (continued)
The effect of the use upon the potential market for, or value of, the copyrighted
work
This is the standard of do not deprive the copyright holder of the right to profit from their
copyright.
However, there are some exceptions even to this. For example, a movie critic may blast a
movie causing a lot of people to not pay to see it. While this deprives the copyright holder,
parody and critique are expressly allowed under copyright law.
Scenario IV (continued)
Fair Use Examples
As reported in the 1961 Report of the Register of Copyrights on the General Revision of
the U.S. Copyright Law here are some typical examples of “fair use” exceptions to
copyright:
“quotation of excerpts in a review or criticism for purposes of illustration or comment; quotation
of short passages in a scholarly or technical work, for illustration or clarification of the author’s
observations; use in a parody of some of the content of the work parodied; summary of an
address or article, with brief quotations, in a news report; reproduction by a library of a portion
of a work to replace part of a damaged copy; reproduction by a teacher or student of a small
part of a work to illustrate a lesson; reproduction of a work in legislative or judicial proceedings
or reports; incidental and fortuitous reproduction, in a newsreel or broadcast, of a work located
in the scene of an event being reported.”
More Information
For more information:
• Copyright and Fair Use
• http://www.copyright.gov/fls/fl102.html
• http://en.wikipedia.org/wiki/Fair_use
• Terms and Definitions related to cyber-security and cyberethics
• http://niccs.us-cert.gov/glossary
• http://www.sans.org/security-resources/glossary-of-terms/
• Cyberethics
• http://en.wikipedia.org/wiki/Cyberethics
• Recommendations on best practices
• http://www.microsoft.com/security/online-privacy/cyberethics-practice.aspx