The following scenarios have been prepared for use in connection with the Debate System for CS 3604 -- Professionalism in Computing. They can be used for in-class discussions, or student assignments. There are not necessarily and "right" or "wrong" answers to these questions; it is far more important for students to use their critical thinking skills in responding to these scenarios. Moreover a user should be able to develop responses either for or against certain elements of these scenarios regardless of their own leanings or opinions.

Obviously some scenarios are reused over the years. They are not duplicated herein. If you have a scenario to add, please send it by e-mail to me.


Other Sources:

ACM Self Assessment Scenarios

From The Interactive Computer Ethics Explorer,

From Paul-Michael Agapow, Latrobe University Australia:

Hacking into a Computer to get Publicly Available Documentation

Dave hacks into the systems of the Enormous Telecommunications Company (ETC) and copies a file that describes certain details of ETC's delicate switching equipment. When Dave is nabbed by the Feds, they charge him with theft. Is this correct? What if the document is provided essentially for free by ETC to anyone for the price of postage?

Spring 1996

It's not getting better

A major publishing company -- Simons International -- has contracted with the Working Minds software development firm to design and build a customized publishing tool package. As worked out in the requirements, the package has two components, the desktop publishing functions for laying out, testing, and iterating all aspects of the final publication design, and a set of collaboration tools which support the splitting up of a single publication design job among various members of a group, the tracking of the contributing individuals' progress, interactions needed to coordinate related pieces, and the final merging of all the pieces into a final product. The notion of collaborative editing is a new strategy for Simons that they hope will improve both the productivity and job satisfaction of their employees.

The contract specifies that Working Minds will deliver an initial prototype of both components in 6 months, for the fee of $100K, and that for the following two years, Simons will pay a $3K/month maintenance charge for continued updates, fixes and enhancements to the two components. Although Working Minds has been in the desktop publishing software business for several years, this is the first time they have tried to include collaboration functionality. They are excited by the challenge and by the opportunity to move into the fast-growing area of collaboration tools; at the same time they are relieved that they will be able to deliver both sets of functionality gradually over the next 30 months.

At the 6 months deadline, Working Minds delivers on time two prototypes: Design-It contains the desktop publishing function, and Coordinate contains the collaboration tools. Simons eagerly begins working with the new software and finds Design-It to be an excellent product which immediately gives Simons a competitive edge in the publishing world. However, the Coordinate tool suite is highly problematic: its user interface is confusing, it is poorly integrated with Design-It, and it introduces new and unexpected communication overheads in the management of group projects. Both firms continue to struggle with the new software for several months, Simons providing user feedback and Working Minds making constant changes. Because Design-It was in good shape from the start, almost all maintenance activity is directed at Coordinate over these first few months.

However, the acceptability of Coordinate does not improve, and after six months, Simons carries out a thorough internal analysis of the situation. They conclude that the Coordinate software shows no sign of meeting their needs, and that it is creating more problems than it solves. In fact after careful consideration, they decide to drop the new collaborative editing model altogether, returning to their former work practices not involving collaborative project work.

Simons' financial officer recommends that they simply cut in half their monthly maintenance payments to Working Minds, asking that further development of Coordinate be discontinued, and arguing that the Coordinate component makes up approximately half of the code that was delivered. The manager of Simons' Information Systems agrees, though he suspects he will have a fight on his hands with Working Minds, who all along have viewed this project as their big chance to move into the hot software territory of collaborative systems.

Should Simons cut its maintenance payments in half?

Big Brother Bart

Bart is a systems analyst in the Information Systems department at a medium-sized investment company. His main job is trouble-shooting for other employees as they learn and use a variety of software packages. For most of his two years on the job, he has spent 80% of his time on the phone, trying to understand from users' descriptions what their problems are and what they should do to fix them. He tries to resolve as much as possible over the phone, but often the users are too far into a problem situation for him to understand how they got there, or how to get them out, and he must make a physical visit to their office. Of course such visits, along with the long phone calls, sometimes make him a difficult person to contact, with the unfortunate result that users will often simply keep trying to get themselves out of a mess and make it work.

Lately though, Bart has been able to catch and resolve problems much more effectively. He has a new piece of software that lets him monitor the computer screen of any employee on the company network. The software was designed to let him watch the employee's "problem" screen as a description was given, and it has proved very helpful in cutting down the physical trips. But Bart also uses the software in-between problems to just "keep and eye" on things, especially checking in on employees who often have trouble, or who he knows are working with new technology. In many cases he's been able to call up an employee and help to avert a potential problem. The employees felt a bit uncomfortable at first, but realize Bart is simply trying to help and have gotten used to the idea that "Big Brother Bart" is looking out for them.

One day Bart is called in by a high-level manager in Personnel. She tells him in confidence that the company believes that two of its employees are involved in drugs -- dealing crack and cocaine -- and that they think the deals are in many cases being carried out during working hours, possibly with the use of company computers. She has just recently learned of his monitoring software and asks him to help collect evidence against these suspected criminals, in other words to check in on their computer screens at random times to see what they are doing.

When Bart expresses some concern about the request, the manager points out that he is already monitoring employees. He counters that he is doing it only to help them out of jams, but that this monitoring would have a very different goal -- he'll be expected to look at and analyze the content of the two employees' work, not just keep his eyes open for software glitches. She notes that such monitoring is legal, and that the company has no policy against it. Bart knew this already, but he also knows that there is no policy alerting employees that the company will monitor their activities.

Should Bart participate in the monitoring of the suspects?

Couldn't help noticing

Linda is the computer support manager at a medium-sized marketing firm. She is well-known for her expertise with almost every software package the firm uses, especially the many graphics applications employees use to browse, create, and edit artwork for market pitches. So she was the first person Jim thought of when he found himself in a time crunch one Friday morning.

Jim was scheduled to present his design idea for a new brochure that afternoon at 3pm, to several of the top VPs in his area. He was excited -- this was his first chance to go solo on a design idea like this, and he had heard through the grapevine that the top brass was feeling very positive about him -- but of course he also wanted everything to be perfect. He had spent all morning looking around for artwork to convey just the right impression on the brochure jacket. At the last minute, he'd come across a rich library of clip art in EPS format that sounded like it had really great content. He had downloaded the entire directory, but for some reason his standard graphics viewer crashed every time he loaded one of the files, even the smaller ones. He knew he should have been able to use the viewer, he had certainly worked with EPS files before, but he had no time to fuss with it -- he had a staff meeting from 12-1:30.

So Jim called Linda. At first she suggested that he ftp the files so she could get to them, but he said that he was in such a rush he didn't have time. So he told her that he had downloaded them into an "EPS" directory on his Sun workstation and asked her to work on the problem in his office while he was at the staff meeting.

Linda came over immediately. Jim had left his workstation running, so she sat down and switched directories. But she mistakenly typed "EPF" and entered the wrong directory. She didn't realize her error at first, and took her next default step, which was to list the files. She was startled to see a list of filenames corresponding to people in the department scroll by. One of them jumped out at her; it was the name of one her "problem" staff members, and she couldn't resist looking at it. She was even more startled to see that it contained confidential personnel data concerning this employee's past few years at the company, dates and results of evaluations, raises, admonishments, etc. She quickly closed the file, switched to the correct directory, and moved on to her real task, a problem with file headers that she easily corrected.

Afterwards, Linda couldn't help but wonder about the files she had accidentally discovered. What was Jim doing with personnel data of that sort? He was clearly an up-and-coming market researcher, but surely he had no need for these data. On the other hand, she didn't know for certain how much confidential data he really had; perhaps this particular staff member was being treated as a special case -- they had been having some trouble with the employee, and it is possible that Jim had been asked by Linda's boss to help in evaluating this individual. But wouldn't her boss have told her if this was the case? Linda also felt guilty about violating Jim's privacy by looking at the file in the first place -- after all, who was she to make personal judgements about data in his private files?

Should Linda report her findings to her boss?

Something's fishy in Lower Tse Tse

(an adaptation of Scenario 1 in the Forester & Morrison book)

Phil Barreis works for a multinational corporation, Megatronics International Inc., whose wide-ranging interests include mining, agribusiness, petrochemicals, international finance, third world manufacturing, tourism and property development. After some time, Phil has begun to suspect that his company is involved in illegal and unethical activities, e.g., money laundering and tax avoidance.

Phil also is becoming increasingly concerned about the extent to which Megatronics' profit derives from sleasy manufacturing tactics in under-developed countries -- very poorly paid employees forced to operate in terrible working conditions, with out-dated equipment and little or no concern for the environment or worker safety. Worse, he discovers that the company has initiated an exploitative agreement with the despotic dictator of Lower Tse Tse, wherein government personnel receive cash payouts and other personal luxuries in exchange for ignoring the company's violations of working codes.

As a man with strong moral convictions, Phil decides to spend his own time trying to track down evidence of the company's wrong-doing. After much hard work, he is able to break into the confidential data files, and starts to plan his long-awaited "blowing the whistle" move. But the next day, an unmarked envelope containing several thousand dollars appears on his desk: he knows he's been found out, and sure enough discovers that the confidential data have been re-encrypted.

At this point, Phil is stymied. He knows if he simply keeps quiet, he'll be able to keep his job. He knows if he goes public, the powerful company will be able to cover its tracks, and he no longer has access to any damaging evidence. So instead he plots his own justice: he plans and implements an elaborate theft of company funds. The theft involves snooping a superior's password, logging on to her account, and setting up a program that begins siphoning funds from third world manufacturing installations. He sets up an anonymous account in Switzerland, resigns and travels to Europe to collect the money. Finally, in an act of poetic justice, he contacts a few third-world activist organizations and donates several million dollars to efforts directed against the dictatorship in Lower Tse Tse. Several years later, the work of these groups pays off, the dictatorship is overthrown, and the exploitative dealings with Megatronics come to an end.

Do you approve of Phil's response to his dilemma?

Spread the word

(adapted from a story in the February 14, 1996 Washington Post)

In February 1996, a college student posted a public Internet message accusing a local woman of mistreating her daughter and urged readers to call the family. The student's message reported that the teenage girl was a victim of abuse because for many years she was confined to home, except to go to school or work, was forbidden to use the phone or have friends, and was fed nothing but peanut butter and jelly sandwiches.

The message was circulated to at least 11 Intenet news groups devoted to child welfare, psychology, radical left-wing politics and civil liberties. Readers around the world who viewed the special-interest message were urged to call the girl's mother "at home and tell her you are disgusted and you demand that she stops." The family said the message generated a half-dozen subsequent threatening phone calls to the girl's mother. The girl's father described the family as sickened by the posting of the message and the resulting phone calls: "We can't stop the calls," he said. "I can't stop anything that goes over the's like a virus. How do you stop it?" The exposure exacerbated family tensions, the father said. "It could break up our family," he said. "It could very well break up our family. It's close."

The incident demonstrates how easy access to communication technology, in the form of computers and modems, can outpace users' sense of responsibility: "You're going to see tons and tons of cases just like this," said Dale Herbeck, an associate professor of communication at Boston College. "In the old days...I had to have access to some kind of printing press. Some newspaper or editor or correspondent would act as a gatekeeper. Now, there's no editing function. It's maybe too spontaneous...You just sit down and, Boom! It's kind of wild. You type it out and hit Control-Z and, Boom! It's out. And all the traditional checks are gone."

The student made no effort to conceal his identity and was unrepentant: "You should be able to write what you want on the Internet, whether it's true or not." Although the student doesn't know the family or the girl, he felt compelled to intervene after a third party alleged the daughter was being mistreated. He denied that the information came from a confidential counseling session (he attended the same public schools as the daughter), "This came from [the girl], to friends of hers, to me. It came from nobody else at that counseling session."

The Internet changes the rules for publishing: authors do not need much money, any special means of distributing material, or anyone's approval to share their thoughts with thousands of readers. Of course just as for printed material, electronic messages can raise difficult legal and ethical concerns. "If this guy were going around and posting it on lamp posts or in all the 7-Elevens in town, what would one do about it?" said J.A.N. Lee, Virginia Tech professor of Computer Science.

The student argued his message had caused the intended effect, that the telephone calls prompted the mother to treat her daughter better. "It worked very well. It worked very quickly...the only trouble is, it takes some time to stop the phone calls." The student did send out follow-up messages asking readers to stop calling the family; he also reported with evident pleasure that the mother had experienced extreme stress as a result of the exposure. He thanked the "Internet community" for responding.

Was the student's behavior ethically sound?

Quid pro quo

Roland is a top student among sophomore CS students at Austin Polytech. He attended high school at a local magnet school where he was valedictorian, and has a straight A average in his CS classes so far. As a result, he has been offered and has accepted a position as an undergraduate teaching assistant for the one-hour Information Networks class. This class is normally taught in two sections, one for non-majors, which covers basic Internet literacy and HTML authoring, and one for CS majors, which also includes forms programming and some simple Java scripts. Roland thinks this is a great job, because using and working on the Internet is one of his favorite activities, and he loves to share his constantly-expanding skills with other students.

Because Roland takes a full schedule of courses, he normally holds his office hours in the CS lab in the evenings. This is a good time to be there, as this is when the other students have time to explore the Internet. The students often play impromptu games, someone proposing a topic, and all of them racing off to see who can find the most interesting tidbit. The atmosphere is relaxed, with much informal interaction and consulting support from Roland and other experts who happen to be there.

When he's not answering questions or giving demos or other help, Roland works on his own projects. He has developed a number of personal applications -- not just a constantly updated homepage, but also a simple discussion system that he uses to accept, answer and archive questions, as well as several other more experimental systems. The faculty are aware of his personal development projects and have encouraged them, recognizing that the department is already benefitting from the "free" work he has done. Roland simply enjoys playing around and knows he is acquiring skills that will be useful to him when he graduates and looks for a job.

Roland's personal projects have also caught the eye of others around the world. In particular, his experiments with Java have been noticed by many. As a result, he has begun receiving offers from companies to do ad hoc Web development projects. At first he declined, thinking he did not have the time, and that his first responsibility was to his studies and to his job as TA. But as the semester wore on, the students in both sections became competent and needed little help, so he often found himself with time on his hands while in the lab. Eventually, he decided to start accepting these offers, as long as they were short-term, e.g., could be done in 4-5 hours, and were accepted "as is" with no maintenance commitment. The companies were eager for quick results, and he was able to charge $50/hour for these projects. By the end of the semester, Roland was bringing in an extra $50-$100 a week through his little side projects.

At times Roland wondered whether he should be doing this: after all, he was being paid to work as a TA, and he was using university equipment and network connections. But he figured that he was learning more about the technology through these projects, which surely was a benefit to the department; he was also careful to put his TA duties, answering questions and so on, ahead of any commercial development. And besides, the equipment and network connections were just sitting there, why not put them to good use? As a student putting himself through college, the bit of extra income was really helping him out.

Eventually Roland's activities came to the attention of his course supervisor. The professor is torn: Roland is an excellent student, is well-regarded by faculty and peers alike, does his TA job well and is in general a great contributor to the department. However he is clearly violating department policy on use of equipment, software and so on for commercial gain.

Should the professor take any action (of what sort?) against Roland?

Profit not participation

Six months ago, Hans emmigrated to the United States from Sweden, where he worked as a software developer in the telecommunications industry for about 10 years. Hans enjoys his new job with a major cable TV company, and feels he is being exposed to a great deal of interesting new technology. He also enjoys the fact that his net pay is significantly greater than what he received in his former position. In Sweden, his income was taxed at a rate of almost 75%, whereas here his rate is less than 40%. Hans is healthy and single, and thus rarely made use of the extensive social services funded by the high tax rates in his native country; as a result he feels better served by the less socialistic practices of the US.

However, there are some aspects of this new culture to which Hans is still adjusting. One of these adjustments is in his work environment, where he is wrestling with his new company's approach to user involvement in design projects. In Sweden, he and everyone else in his company took it for granted that the design of new technology would involve an elaborate process of participatory design. User representatives were recruited from the very beginning of a design project and collaborated with the designers in many ways: they helped to build an analysis of their current work situation, to develop requirements for the new system from this analysis, to envision and prototype new system ideas, to explore the impact of the new technology on their work environment, and so on. At each point along the development cycle, the users were consulted and encouraged to express their opinions and concerns. As a result, the project sometimes ended up being less "flashy" than the designers might have hoped, but at least it usually provided technology that the users could relate to and that could be incorporated into their existing work practices.

In Hans' new company, user involvement is less extensive and systematic. To some extent this is due to differences in the business context -- often the software is intended for such a broad market that it is not clear how to find representative users. When there are obvious target users, they are normally brought into contact with the design ideas at the beginning of the process, where they are interviewed about their needs, and at the end, where they are asked to evaluate the final system. Ultimately however, it is assumed to be the responsibility of companies purchasing the software products to analyze, adapt and refine their employees' work practices as necessary.

Hans' current assignment has exacerbated his discomfort. He is working on a system to automate part of the cable TV scheduling process, essentially by tracking and balancing viewer preferences. If the software is successful, a scheduling job that had previously been done interactively in a group -- by a team of program designers-- will now be done by a single program designer. The company is excited about the project and hopes to market the resulting system to cable companies around the world. Hans knows that the original requirements came from a marketing survey of cable TV executives, and that a range of program designers were interviewed about typical scheduling activities and decision processes. However, he is worried that the system may change significantly the work practices of the many program designers now in the workforce. When he approached the project manager suggesting more active design participation by professionals from this community, he was assured that the problem was already well-understood, and that besides, it would cost too much and reduce the project's profit margin significantly. When Hans persisted with his concerns, the manager became defensive, and suggested that Hans find another project.

Should Hans take any action?

We know the score!

In 1984 two students taking an engineering course at CalTech devised as a course project a scheme for taking over the scoreboard of the Rose Bowl. This general concept had the approval of the professor, although apparently he did not know that the Rose Bowl was the target system until just before it happened. The students initially made modest intrusions, e.g., flashing "Go CIT!" but when these were ignored changed the team names to CalTech and MIT. Officials shut down the scoreboard. Months later, the students broadcast their account over the Internet:

Were all parties involved in this episode treated appropriately?

Bound to fail

Jasper Carlisle is a senior software engineer for a large software development company. The company has just completed their internal testing of one of the largest development projects in the history of the company, a patient monitoring system that will be sold to large private hospitals.

Jasper is proud of his work on the system; his focus has been on the user interface, and he feels confident that the system will be easily understood by the nurses, doctors and staff who need to refer to patient records. In fact, he was able to persuade his management to spend an extra $10K on user testing in the last few months, and thus to refine the interface even more. But he knows the system still has some bugs, and one in particular makes him very uneasy.

Every so often, when two patient records are accessed simultaneously, the system produces an unpredictable result: some sort of merged record is produced for both requests. The database interface crew has spent countless hours analyzing this problem but have not been able to track it down, or even to produce it consistently. The inside joke is that the system has a "goblin" somewhere in the database routines.

The project manager has been under great pressure to get the system out, and he finally agrees to a limited trial, just in one medium-sized hospital. Jasper argues against the trial, citing the mysterious bug, but his manager responds: "We don't even know if this is going to be a problem for a real hospital situation, and we can't know that unless we try it. You know how important realistic testing scenarios are! Besides, the hospital staff will be carefully instructed before and during the test, to be on the look-out for any unusual behavior." Jasper is still worried but he doesn't want to rock the boat; he already takes a lot of grief from his colleagues for being such a user's advocate.

The day before the software goes into use, Jasper hears a rumor that his company has purchased a new umbrella insurance policy just in case...he tries hard to ignore the rumor.

Two months later, a nurse mistakenly gives a large dose of penicillin to a man with a severe infection, but who has a known allergy to the drug. The man has a seizure and dies. The mistake is traced to partially incorrect patient information provided by the new system. The victim's family sues the hospital, who sues Jasper's company. Everyone settles out of court, and the software is withdrawn for further analysis.

Did Jasper behave appropriately?

You're not getting my microcents!

Margot is a graduate student in Computer Science at Southern University, working on a masters degree. Before entering the masters program, she worked for several years as a graphics artist, mostly developing logos or other promotional visual art; she became interested in the software she was using to create and manipulate her art, which is how she ended up in a CS grad program. Margot still does some free-lancing graphics design on the side to supplement her teaching assistantship.

Since she's been in grad school Margot has discovered that her art skills have made her very popular with her fellow students. One of the activities the grad students spend a lot of their free time on is developing and maintaining personal and departmental Web pages, and they quickly discovered that Margot excels at generating just the right drawing or picture to decorate a page or page section. It takes a lot of her time, but she likes it and especially enjoys the admiration and thanks she gets from her colleagues. Lately, she's been getting requests from folks all over the world to reuse bits and pieces of her designs. She has always given permission, though she does keep her own records of the requests.

One day while surfing the Web Margot runs across a commercial site -- Ultimate Movie Previews -- that has incorporated a couple of her designs. At first she's pleased to see more use of her work, but then realizes that this group did not contact her for permission. Worse, they are an experimental site for the new "microcents" charging scheme: anyone can get to the homepage, but to follow any of the content links, you must provide a major credit card against which a fractional charge is made for each link traversed. Margot is furious to see her designs appearing in this wholly commercial situation. She recruits one of her friends, an expert in network technology and security, and together they devise a scheme for selectively turning off the microcents charge for a given link for a given user; she delightedly visits the site often after this.

Without Margot's knowledge, her friend begins distributing the "fix" to other students in the department. Eventually word leaks out, and the faculty learn of the situation. They take action immediately, expelling Margot and her friend from the program, and severely censuring all other students using the program.

Were the faculty right in their treatment of Margot and her friend?

Fall 1996

Academic Freedom in Virginia at Stake.

Friday, July 5, 1996

RICHMOND -- The ACLU of Virginia announced today that it will soon challenge in court the constitutionality of a new law prohibiting state employees from accessing sexually explicit materials on the Internet. The ACLU says the state has the right to limit use of its computers to state business but that it cannot curtail academic freedom in the process. The new statute, which took effect on July 1, makes it illegal to use the state's "information infrastructure" to access or download materials with "sexually explicit content" as defined in an existing law restricting the sale or loan of such materials to juveniles. (The text of the new law follows.)

"This is the result of grandstanding by lawmakers at the expense of a core constitutional freedom," said ACLU of Virginia executive director Kent Willis. "If the state does not want its employees to access the Internet for personal use, then they should say so. Or, if the concern is the downloading of obscenity by state employees, that is already against the law. But to deny teachers, librarians, and researchers the right to view material the state has deemed to be inappropriate for juveniles is an insult to academic freedom and a dangerous precedent."

"If we applied the standard this law sets for the Internet to the Virginia Museum of Fine Arts or the University of Virginia library, many widely seen and respected paintings and works of prose and poetry would have to be removed."

"Private academic institutions can censor themselves, as can private employers, and even the privately operated media, but the very purpose of the state university is to promote unfettered inquiry and free exchange of ideas. In keeping with the traditions of Jefferson and Madison, Virginia should be the last state to even consider limiting access to the Internet, not one of the first."

The ACLU has already received complaints from state-employed teachers and researchers, some indicating they may be willing to serve as plaintiffs. The ACLU expects to file suit by the end of the summer.

How does this case differ from the earlier scenario regarding the use of the WWW for politicking? How does this affect you as students? Is this a form of censorship? Take a side -- on behalf of the Commonwealth of Virginia as employers or providers of education, on behalf of state employees, on behalf of students in State universities or community colleges, or on behalf of citizens of the Commonwealth.

NOTE: Since this scenario was originally posted, this case has steadily progressed through the Virginia Court System and the law has been upheld. The cumulative story has been collected as part of a project to compare the responses to scenarios in different countries regarding censorship.

The Toronto Resolution.

The Toronto Resolution, which provides guidelines for the development of "Ethical Codes", contains the following clause:

6. a code should recognize that actions designed narrowly to benefit humankind may in fact threaten the survival of all species, since the ecosystem is a seamless web;

This would appear to require a Deontological approach to ethics (see Bowyer, page 4) rather than a Utilitarian or Relativism approach.

Discuss whether it is appropriate for Codes of Ethics/Practice/Conduct to be so specific as to require a particular style of morality. How would one include such as clause as suggested above in a code relating to computers or information technology?






WHEREAS the Organization for Economic Cooperation and Development (OECD) is now considering the development of an international policy for the use of cryptography;

WHEREAS the use of cryptography implicates human rights and matters of personal liberty that affect individuals around the world;

WHEREAS national governments have already taken steps to detain and to harass user and developers of cryptography technology;

WHEREAS cryptography is already in use by human rights advocates who face persecution by their national governments;

WHEREAS the privacy of communication is explicitly protected by Article 12 of the Universal Declaration of Human Rights, Article 17 of the International Covenant on Civil and Political Rights, and national law;

WHEREAS cryptography will play an increasingly important role in the ability of citizens to protect their privacy in the Information Society;

RECOGNIZING that the OECD has made many substantial contributions to the preservation of human rights and the protection of privacy in particular;

FURTHER RECOGNIZING that decisions about cryptography policy may gives rise to communication networks that favor privacy or favor surveillance;

FURTHER RECOGNIZING that the promotion of key escrow encryption by government poses a direct threat to the privacy rights of citizens;

THE FOLLOWING NATIONAL AND INTERNATIONAL ORGANIZATIONS, concerned with matters of human rights, civil liberty, and personal freedom, have joined together to

URGE the OECD to base its cryptography policies on the fundamental right of citizens to engage in private communication;

FURTHER URGE the OECD to resist policies that would encourage the development of communication networks designed for surveillance; and

RECOMMEND that the OECD turn its attention to growing public concerns about the widespread use of surveillance technologies and the implications for Democratic Society and Personal Liberty around the world.


RESPECTFULLY ENDORSED, * ALCEI (Electronic Frontiers Italy) * American Civil Liberties Union * Association des Utilisateurs d'Internet * CITADEL-EF France * Computer Professionals for Social Responsibility * cyberPOLIS * Digital Citizens Foundation in the Netherlands * EFF-Austin * Electronic Frontier Australia * Electronic Frontier Canada * Electronic Frontier Foundation * Electronic Privacy Information Center * Human Rights Watch * NetAction * Privacy International


The Clinton Administration has taken a slightly different approach to this question in the past and has even supported the prosecution of a US citizen who was accused of illegally exporting (via the WWW) an encryption system (PGP).

This is a case of the (potential) needs of the community overriding the rights of the individual. Which is more important? How would you solve this dilemma?

Control of the Internet.

Financial Times, September 4, 1996, p. 4.

Singapore looks to superhighway

By James Kynge in Kuala Lumpur

Singapore took another step toward its vision of becoming an "intelligent island" yesterday, announcing an initiative to link the city-state's main on-line networks.

Mr Goh Chee Wee, Singapore's minister of state for communications, said the "internetwork hub" would link service providers of the Internet, government on-line networks, commercial networks and some others.

Singapore's move follows an ambitious scheme announced by neighbour Malaysia last month to launch an "information superhighway" designed to attract the world's leading information technology companies to Kuala Lumpur.

The perceived advantage in Singapore's initiative is that users will be able to access all networks using a single leased line, rather than the separate lines currently necessary.

The hub will use a single set of national standards, meaning inter-operability between networks becomes easier.

Mr Goh said the hub should be up and running by the end of the year. A mechanism to identify users electronically would be incorporated into the hub network next year, paving the way for secure operations such as payments, banking and confidential correspondence.

The move is part of the Information Technology 2000 masterplan, a scheme which aims to accomplish the sometimes conflicting aims of exploiting the information superhighway to its full potential while continuing to insulate Singaporeans from undesired influences.

From September 15, the city-state will implement its first big attempt to police cyberspace. From then all Internet providers must channel more than 120,000 subscribers on the island through "proxy servers" before they reach the net.

These servers will check every Internet site a subscriber requests and block access to a about a dozen banned sites known to display pornography. The government has warned against material deemed politically subversive or inciting religious disharmony.


The US Government, early in 1996, passed the Communications Decency Act (CDA) that went half-way to providing regulation of the Internet, primarily to protect children from the less acceptable aspects of on-line communication. Which is appropriate? Full governmental control, as in Singapore, partial control as espoused by the US government, or reliance on "in-home" supervision? Or is this a non-problem?

Politicking on the WWW.

Consider the following memorandum:


PRINCETON UNIVERSITY Office of General Counsel 120 Alexander Street (609) 258-2525

TO: Faculty, Staff and Students July 19, 1996

FROM: Ira Fuchs and Howard Ende

RE: Internet use and Politics

Especially in this year of a presidential election, it is important to remember that the university is constrained by its not-for-profit status from any participation in, or intervention in, (including the publishing or distributing of statements), any political campaign on behalf of (or in opposition to) any candidate for public office. (501(c)(3)) This prohibition includes use of the internet. The publication and/or distribution of statements on the internet which fall within the foregoing definition will violate this provision of the Internal Revenue Code, which sets forth the requirements for tax exempt status. This restriction is also set forth in Rights, Rules and Responsibilities, p.11, Computer Use: "The computing and network resources of the University may not be used by members of the University community for commercial or political purposes or for financial gain;" and at p. 14-15, concerning the Tax-Exempt Status of the University and Political Activities. Violation of these rules will result in appropriate disciplinary action.


The ACLU responded:

Free Speech 101: ACLU Gives Princeton University an "F" for Barring Political Speech on its Network

FOR IMMEDIATE RELEASE Thursday, August 15, 1996

NEW YORK--In a letter sent today to Princeton University officials, the American Civil Liberties Union urged them to reconsider a policy barring students and staff from using the Internet for "political purposes."

The letter was sparked by complaints the ACLU national and New Jersey affiliate offices received over a recent memo from Princeton officials advising faculty, staff and students, "especially in this year of a presidential election," that the school's not-for-profit status barred it from allowing use of the Internet "for political purposes."

The ACLU called this conclusion mistaken, pointing out in its letter that the Internal Revenue Code specifies that only the University itself is barred from political activity -- not faculty, staff, or students acting independently. In fact, the ACLU said, the IRS has previously held that statements in support of political candidates appearing on the editorial page of a student newspaper would not be considered violations of a university's 501(c)(3) tax-exempt status.

"Because there exists no legitimate reason for Princeton's blanket prohibition of political speech over the computer network," the ACLU letter stated, "it is an unjustified content-based restriction on the free expression rights of students, faculty and staff. Therefore, the policy is not only unworthy of a great university like Princeton, it is in violation of the New Jersey State Constitution." The letter was signed by ACLU national staff attorney Ann Beeson and David Rocah, staff attorney of the ACLU of New Jersey.

"We understand the university's concerns regarding it's tax-exempt status," David Rocah said. "But this is free speech 101. Sadly, Princeton is not making the grade."

Rocah said the ACLU would consider legal action if the university refuses to drop its censorship policy.

"Traditionally, college campuses are the center of political discussion and debate," said national staff attorney Ann Beeson. "The fact that the debate is taking place on the Internet does not mean that the speech is any less deserving of protection."

Beeson said the policy could bar students and staff from a wide range of protected expression, including downloading position papers from the Dole or Clinton website; sending e-mail to their parents urging them to vote for Ralph Nader; and organizing online discussion groups for student chapters of politically active groups such as Greenpeace. In short, Beeson said, "Everything that would be acceptable, even welcome, off-line, becomes off-limits on the Internet."

In its letter, the ACLU called on the school to take a leadership role in the academic community: "As a school with a well-deserved reputation as a leader in American higher education, Princeton should be the first to promote and defend academic freedom and freedom of expression within its community, to the very limits of the law," the letter said.

Beeson added that the ACLU is working to develop model guidelines for colleges and universities to help sort out the confusion in academia regarding free expression on the Internet. Many schools have already put in place "Appropriate Use Policies" to police student and faculty computer use, some of which violate rights of free expression, Beeson said.

Is it a violation of the rights of free speech to limit the ways in which students, faculty, and staff use Internet, and especially in the use of the net for "political purposes"?

Spring 1997

Just a friendly little virus ...

(an adaptation of Scenario 3 in the Forester & Morrison book)

Dr. Markov is an up-and-coming young medical researcher interested in epidemiology, the study of the origins of epidemics. His particular interest is in the spread of diseases, and he is working on a theoretical model of this process. His research assistant suggests a novel experimental approach for testing and extending their model: develop a benign computer virus and study its infection patterns. If successful, their research group might consider using this as a general technique, for example varying the characteristics of the virus and how it gets initiated. Not only would they be able to evaluate and evolve their model, they'd get credit for a new research method.

The doctor is intrigued and works with his assistant to elaborate the idea: the virus would immediately alert users to the fact that their computer has been infected, but at the same time reassure them that the virus is benign, that it will do absolutely no damage to their systems, and that it will spontaneously self-destruct or disappear in a week. This alert message would also ask users not to get rid of the virus (because it isn't doing any harm) and to continue with their normal program sharing and trading (illegal though it might be) that they normally engage in. The doctor's name, address and digitized signature would be provided as documentation of the project's legitimacy, and as contact information in case anyone had any questions.

Of course the alert message would also include a description of the aim of the study -- to see how fast and along what paths the virus is communicated and to determine whether this pattern of development bears any relationship to the way in which typical human diseases are spread through a population. Finally, it would request that users send by email the various pieces of information needed to model the infection process: for example, the location of the computer infected, a best guess as to when the computer was infected with the virus, the most likely source of infection, and what if any virus-protection software was in place at the time.

Should Dr. Markov try out this new experimental technique?

Oops! You weren't supposed to know ...

Kimberly has worked as a programmer for a medium-sized software company for several years. She enjoys her job a great deal: she is a good programmer, has good work habits, and has a good record of getting her assignments done on time. She is especially pleased with the good relationships she has developed with her co-workers. When she joined her group, she was a bit anxious about fitting in -- the rest of the group consists of four guys who have been working together for over five years and are all good friends both inside and outside of work. However, they observed and respected her technical ability and made an effort to include her in their informal discussions at work, at lunch, and so on. She became one of the gang.

Over the past year, Kim's personal relationship with Mark, one of her co-workers, has become more intense. Of course, it has been impossible to hide this development from their friends, and both Kim and Mark take their share of wisecracks and jokes. The other guys have come to seem a bit like older brothers to Kim and she takes the teasing in stride, even though she feels they get carried away sometimes. She can tell that they are happy for her and Mark, though perhaps envious too (Mark's three friends are unattached).

One Friday evening Kim and Mark were watching a video, and Mark blurted out, "A dead ringer for our latest Web-shot!" When Kim looked at him uncomprehendingly he quickly corrected himself, "Oops, you weren't supposed to know about that!" Kim would not let it pass, however, and Mark finally confessed to the longstanding game he plays with his friends at work: They surf the Web during the week looking for provocative photos, each submits his favorite find, they take a vote at the end of the week, and whoever submits the winning contribution gets a point. They haven't decided yet how they will cash in their points, but plan some sort of big reward for the first to reach 50.

Kim was furious. All of a sudden, a few of the jokes and asides she had taken in stride up until now had new meaning, not to mention the occasional smirks and side glances when other women passed them in the hall. She tried to persuade Mark that the game was juvenile, but he refused to listen. She then tried a legalistic approach, reminding him of company policy regarding proper use of computing resources. Mark agreed that they were technically in violation, but argued that it was okay because they kept the information to themselves, and didn't spend very much time or resource on the game; in fact, he even postulated that the game benefited the company by increasing the closeness of the team. He also implied that their manager knew about it but had let them alone. Kim didn't give up, though, and eventually persuaded Mark to withdraw from the game. But he begged her not to mention it to the other guys; he didn't want them to know he had accidentally let the cat out of the bag.

Kim felt better, knowing that Mark was no longer involved, and tried to forget about the whole thing. But as the days went on, she began to wonder if she really could forget. She began to take offense at comments that she had never thought twice about before. Yet she held back, not wanting to jeopardize her relationship with the other guys or with Mark. She kept promising herself that this was a temporary thing, it would all blow over.

Should Kim take some action?

To toad or not to toad ...

(adapted from the account by Shirky [1995] of Julian Dibbell's "Rape in Cyberspace" article for the Village Voice, December 1993).

LambdaMOO, one of the earliest and most popular MOO communities on the Internet, was also the scene of one of the MOO world's most famous incidents -- a virtual rape. The incident was perpetrated by Mr. Bungle, a resident of LambdaMOO who wrote a "voodoo doll" program that could create the illusion that other users were doing and saying things they were not really doing and saying. Mr. Bungle could have used this program to "fake" a variety of harmless, even fun, behaviors, e.g., trying to put two "lurkers" in shy conversation with each other. Such activity is known as "spoofing" and is normally harmless. But in this instance the program was used to simulate an assault.

Specifically, Mr. Bungle singled out two LambdaMOO users, and while they were in a "room" full of friends, created text that described them committing overtly sexual acts. The acts were not merely sexual in nature but also included sadistic overtones. Thus a woman logged on from Haversford, PA read text describing an explicit sexual assault on her MOO character, apparently initiated by another player. Needless to say the event caused much trauma, and the shedding of many real tears, on the part of the two characters as well as other users privy to the faked episode.

The incident generated much discussion concerning the definitions of crime and punishment in this virtual setting, and whether and how the MOO community should exert power over its residents in enforcing such definitions. Mr. Bungle was widely perceived as crossing the line from a practical joke to committing a virtual crime. Many argued for having him toaded, i.e., to have his character erased from the system by one of the MOO's wizards (the maintainers of the software environment). However this contradicted the founding principles of this MOO community; the wizards were charged to make as few interventions as possible, so as to let the community develop and evolve in its own way. While everyone agreed that Mr. Bungle's action was beyond the pale, many members also were distressed by what seemed like vigilantism in asking a wizard to carry out the protestors' bidding. In the end no group decision was made, but a lone wizard took it upon himself to toad the offender.

Did the lone wizard do the right thing?

Freedom of Home Page Speech ...

During the Christmas break 1996, it was brought to our attention by an alumnus who had taken the "Profesionalism in Computing" course that a freshmen student had a home page on CSUGRAD that was "interesting". An examination of the page revealed that the page had a background that was clearly marijuana plants, and the page contained several images that displayed drug paraphernalia and linked to off-campus pages that sold drug supplies. The student's account was immediately frozen.

Confronted the student gave two arguments in his defense: (1) This was basically the same home page that he had produced in high school, and which was approved by his teachers there, and (2) There were several other student home pages with similar messages. Questioned further, he agreed to provide the URL's of other students who has similar pages.

An examination of these pages showed that two of them had similar drug-related pages while one other was a built around the theme of "white supremacy" with several links to the home pages of organizations with similar leanings.

The accounts of each of these students were similarly frozen and the students were requested to come in for an interview. Each of these students claimed to be unaware of any regulations that would prohibit their use of such visual effects as parts of their home pages, and felt it was part of their "freedom of speech" to express such views.

Citing the university and departmental computer usage policies that prohibit "inappropriate use" of computer systems, and the university policies regarding drug and alcohol usage, and on racial activities, it was decided to recind the student's access to CSUGRAD for the remainder of the academic year and to require the student's to reapply for access in Fall 1997. The contents of the student's directories were archived.

The student who was originally identified as having an inapproriate home page was forgiven and his access was reinstated after a two month suspension, with the understanding that he will redo his home page.

Were the punishments just and appropriate?

CEO Blasts Sister Who Asked for Diverse Board

On July 15, 1996, the Wall Street Journal carried a front-page article entitled "Cypress CEO Blasts Sister Who Asked for Diverse Board" by Ellen Joan Pollock, a staff reporter. That article described an exchange of correspondence between Doris Gormley of the Sisters of St. Francis of Philadelphia and T. J. Rodgers, the CEO of Cypress Semiconductor.

The story has appeared on several newsgroup listings including David Farber's "interesting people" (from which the text here was culled). It appears as part of this scenario with the permission of Mr. T.J. Rodgers, President and CEO, Cypress Semiconductor Corp. My apologies to the debate teams that this is a LONG scenario:


The Sisters of St. Francis of Philadelphia 
Our Lady of Angels Convent--Glen Riddle 
Aston, Pennsylvania 19014 
(phone numbers removed) 
April 18, 1996 

Mr. Pierre Lamond 
Chairman of the Board 
Cypress Semiconductor Corporation 
3901 North First Street 
San Jose, CA 95134 

Dear Mr. Lamond 

The Sisters of St. Francis of Philadelphia, a religious congregation of approximately
1000 women, is the beneficial owner of 7,000 shares of stock in Cypress
Semiconductor Corporation. 

We believe that a company is best represented by a Board of qualified Directors
reflecting the equality of the sexes, races and ethnic groups. As women and
minorities continue to move into upper level management positions of economic,
educational and cultural institutions, the number of qualified Board candidates also
increases. Therefore our policy is to withhold authority to vote for nominees of a
Board of Directors that does not include women and minorities. 

It appears from the proxy statement which does not include pictures that Cypress
Semiconductor Corporation has no women or minority Directors. We have voted our
proxy accordingly, and we urge you to enrich the Board by seeking qualified women
and members of racial minorities as nominees. 


/Doris Gormley OSF 

Doris Gormley OSF
Director, Corporate Social Responsibility 



May 23, 1996 

Doris Gormley, OSF
Director, Corporate Social Responsibility 
The Sisters of St. Francis of Philadelphia 
Our Lady of Angels Convent--Glen Riddle 
Aston, PA 19014 

Dear Sister Gormley: 

Thank you for your letter criticizing the lack of racial and gender diversity of
Cypress's Board of Directors. I received the same letter from you last year. I will
reiterate the management arguments opposing your position. Then I will provide
the philosophical basis behind our rejection of the operating principles espoused in
your letter, which we believe to be not only unsound, but even immoral, by a
definition of that term I will present. 

The semiconductor business is a tough one with significant competition from the
Japanese, Taiwanese, and Koreans. There have been more corporate casualties than
survivors. For the reason, our Board of Directors is not a ceremonial watchdog, but a
critical management function. The essential criteria for Cypress board membership
are as follows: 

* Experience as a CEO of an important technology company. 

* Direct expertise in the semiconductor business based on education and
management experience. 

* Direct experience in the management of a company that buys from the
semiconductor industry. 

A search based on these criteria usually yields a male who is 50-plus years old, has a
Masters degree in an engineering science, and has moved up the managerial ladder
to the top spot in one or more corporations. Unfortunately, there are currently few
minorities and almost no women who chose to be engineering graduate students 30
years ago. (That picture will be dramatically different in 10 years, due to the greater
diversification of graduate students in the '80s.) Bluntly stated, a "woman's view" on
how to run our semiconductor company does not help us, unless that woman has an
advanced technical degree and experience as a CEO. I do realize there are other
industries in which the last statement does not hold true. We would quickly embrace
the opportunity to include any woman or minority person who could help us as a
director, because we pursue talent--and we don't care in what package that talent

I believe that placing arbitrary racial or gender quotas on corporate boards is
fundamentally wrong. Therefore, not only does Cypress not meet your requirements
for boardroom diversification, but we are unlikely to, because it is very difficult to
find qualified directors, let alone directors that also meet investors' racial and
gender preferences. 

I infer that your concept of corporate "morality" contains in it the requirement to
appoint a Board of Directors with, in your words, "equality of sexes, races, and ethnic
groups." I am unaware of any Christian requirements for corporate boards; your
views seem more accurately described as "politically correct," than "Christian." 

My views aside, your requirements are--in effect--immoral. By "immoral," I mean
"causing harm to people," a fundamental wrong. Here's why: 

* I presume you believe your organization does good work and that the people who
spend their careers in its service deserve to retire with the necessities of life
assured. If your investment in Cypress is intended for that purpose, I can tell you
that each of the retired Sisters of St. Francis would suffer if I were forced to run
Cypress on anything but a profit-making basis. The retirement plans of thousands of
other people also depend on Cypress stock--$1.2 billion worth of stock--owned
directly by investors or through mutual funds, pension funds, 401k programs, and
insurance companies. Any choice I would make to jeopardize retirees and other
investors from achieving their lifetime goals would be fundamentally wrong. 

* Consider charitable donations. When the U.S. economy shrinks, the dollars
available to charity shrink faster, including those dollars earmarked for the Sisters
of St. Francis. If all companies in the U.S. were forced to operate according to some
arbitrary social agenda, rather than for profit, all American companies would
operate at a disadvantage to their foreign competitors, all Americans would become
less well off (some laid off), and charitable giving would decline precipitously.
Making Americans poorer and reducing charitable giving in order to force
companies to follow an arbitrary social agenda is fundamentally wrong. 

* A final point with which you will undoubtedly disagree: Electing people to
corporate boards based on racial preferences is demeaning to the very board
members placed under such conditions, and unfair to people who are qualified. A
prominent friend of mine hired a partner who is a brilliant, black Ph.D. from
Berkeley. The woman is constantly insulted by being asked if she got her job
because of preferences; the system that creates that institutionalized insult is
fundamentally wrong. 

Finally, you ought to get down from your moral high horse. Your form letter signed
with a stamped signature does not allow for the possibility that a CEO could run a
company morally and disagree with your position. You have voted against me and
the other directors of the company, which is your right as a shareholder. But here is
a synopsis of what you voted against: 

* Employee ownership. Every employee of Cypress is a shareholder and every
employee of Cypress--including the lowest-paid--receives new Cypress stock options
every year, a policy that sets us apart even from other Silicon Valley companies. 

* Excellent pay. Our employees in San Jose averaged $78,741 in salary and benefits in
1995. (That figure excludes my salary and that of Cypress's vice presidents; it's what
"the workers" really get.) 

* A significant boost to our economy. In 1995, our company paid out $150 million to
its employees. That money did a lot of good: it bought a lot of houses, cars, movie
tickets, eyeglasses, and college educations. 

* A flexible health-care program. A Cypress-paid health-care budget is granted to
all employees to secure the health-care options they want, including medical, dental,
and eye-care, as well as different life insurance policies. 

* Personal computers. Cypress pays for half of home computers (up to $1,200) for all

* Employee education. We pay for our employees to go back to school, and we offer
dozens of internal courses. 

* Paid time off. In addition to vacation and holidays, each Cypress employee can
schedule paid time off for personal reasons. 

* Profit sharing. Cypress shares its profits with its employees. In 1995, profit
sharing added up to $5,000 per employee, given in equal shares, regardless of rank
or salary. That was a 22% bonus for an employee earning $22,932 per year, the
taxable salary of our lowest-paid San Jose employee. 

* Charitable Work. Cypress supports Silicon Valley. We support the Second Harvest
Food Bank (food for the poor), the largest food bank in the United States. I was
chairman of the 1993 food drive, and Cypress has won the food-giving title three
years running. (Last year, we were credited with 354,131 pounds of food, or 454
pounds per employee, a record.) We also give to the Valley Medical Center, our Santa
Clara-based public hospital, which accepts all patients without a "VISA check." 

Those are some of the policies of the Board of Directors you voted against. I believe
you should support management teams that hold our values and have the courage to
put them into practice. So, that's my reply. Choosing a Board of Directors based on
race and gender is a lousy way to run a company. Cypress will never do it.
Furthermore, we will never be pressured into it, because bowing to well-meaning,
special-interest groups is an immoral way to run a company, given all the people it
would hurt. We simply cannot allow arbitrary rules to be forced on us by
organizations that lack business expertise. I would rather be labeled as a person who
is unkind to religious groups than as a coward who harms his employees and
investors by mindlessly following high-sounding, but false, standards of right and

In conclusion, please consider these two points: First, Cypress is run under a set of
carefully considered moral principles, which rightly include making a profit as a
primary objective. Second, there is a fundamental difference between your
organization's right to vote its conscience and the use of coercion by the federal
government to force arbitrary "corporate responsibilities" on America's businesses
and shareholders. 

Cypress stands for personal and economic freedom, for free minds and free markets,
a position irrevocably in opposition to the immoral attempt by coercive utopians to
mandate even more government control over America's economy. With regard to
our shareholders who exercise their right to vote according to a social agenda, we
suggest that they reconsider whether or not their strategy will do net good--after all
of the real costs are considered. 


/T.J. Rodgers 

T.J. Rodgers
President CEO 


(This text has been slightly abbreviated, but the content is unchanged.) 

Debate question: With whom would you side in this dispute and why? Obviously President Rogers put a lot of thought into his response, but are reasons appropriate and reasonable? Are the "essential criteria for Cypress board membership" given appropriate for a corporation such as Cypress (or even any other large corporation in this business)? Would it make a difference if this were a corporation is some less technologically based product?

Is this plagiarism?

(From a current case):

A graduate student (A) had created a home page with a link to his resumé for the purposes of (1) having a place where prospective employers could look for information, (2) as a location where it would be easy to make updates and corrections, and (3) as a site from which he would print copies as needed.

Graduate student B, having open access to the home pages of his colleagues, examined the resumé of student A, liked what he saw, and downloaded a copy of the source document to his system. He then replaced all the information with his own, keeping nothing that was there before except the html tags.

Student A turned student B into the Honor Court for alleged plagiarism. He pointed out that the format and layout of the second resumé was equivalent to his original, and even the background color (there was no graphical background) was the same. Point: the resumé of student A did not include any "copyright" statement, though it did include a note about the person who created it and the date of the last update.

Comment: There may perhaps be a precedent in law to consider: In the 1980s there was a dispute between two developers of spreadsheets for personal computers. While there were some differences in operation, the visual look (and feel) of the two systems were very similar. In response to a claim of copyright infringement, the court found that "look and feel" were not within the bounds of copyright, and thus the case was dismissed. There was a similar case involving the patent rights over icons in a window. In that case it was also ruled that the concept (idea) of an icon could not be copyrighted or patented, only the actual icon was intellectual property.

Take positions on the side of the Honor Court who would prosecute the case of Student B above and for his defense. Is he guilty of plagiarism? Is student B guilty of a non-ethical action?

Should colleges teach Computer Science students courses on HACKING? (Courtesy, Glenn Rioux, Jason Andresen, Shawn Buck, James Whited, Alan Young, members of Group 6, Fall 1998.)
Dr. Lee has proposed that a course on HACKING be taught and announces his plans to his current class. All the students are excited about the possibility and plan to register for it. Dr. Lee takes the proposal to the department, but it is rejected without much thought. De. Lee schedules a debate on the topic to increase the awareness of the topic, and so that the department may see the advvantages of his teaching this class. In the debate it is argued that although there is a greater risk of students learning how to hack into computer systems, few will take advantage of the knowledge to do harm or wrong with their newfound capabilities. Although the number of positive reponses to the debate outweighed the negatives, the department still declined to approve the course offering, taking the stand that they were afraid that they would be consciously training those who could be a threat to society. After graduation, a government official approaches a student and the head of the department to inquire of they know anyone who can hack. The official explains that they have a strong need for such a person, and would like to do some recruiting. However since the college does not offer the subject, the school does not gain the acknowledgement and a student from that institution does not get the job. Should the department allow the teaching of a course on hacking?

Was it his fault?

(From Group 4, Fall 1998).
John and Sally live in suburban America. They have a 14 year old son, Billy, of whom they are losing control. He has dyed his hair black and always wears morbid clothes. His grades have gotten worse and worse, and all he seems to do is play computer games throughout the day. Billy doesn't hang out with the friends he used to, in fact he doesn't hang out with anyone any longer. He just plays computer games as soon as he gets home from school until he goes to bed. John and Sally try and get him to do his homework, but he never does. His favorite games are Blood, Carmageddon, and Postal. One day, John came into Billy's room and watched him play Postal for a while. John was appalled at how violent the game was. It actually scared him how violent and graphic the game was. He took the game and all the other violent games away from Billy and wouldn't let him play them anymore. Billy was very upset and yelled at his parents all night. The next day John got a call at work, something had gone wrong at Billy's school. Apparently Billy had brought a gun to school and had just started shooting in the middle of class. He killed four students and a teacher and wounded several others before taking his own life. John was stunned, what could make his son do this? What could put the idea in his head? Was it the video games?

Another factual incident from our class.

Cultural Differences

Adapted from E.A. Kallman & J.P. Grillo, (1996). Ethical Decision Making and Information Technology, 2nd edition, McGraw Hill.

To Modify or not to Modify: a Credit Bureau's Question

When Annabelle and Jean Tigana made an offer on their dream house, and the sellers accepted their offer, the delighted Tiganas dashed down to DaBank and applied for a mortgage. DaBank immediately requested a credit check from CreditSwift, one of the major nationwide credit bureaus. After an anxious three days, the Tiganas received a call from DaBank. CreditSwift's report had arrived and showed that Jean had an outstanding lien on a fishing boat in Baton Verde, Louisiana. Therefore, DaBank could not approve their mortgage application. The Tiganas were incensed - neither of them had ever set foot in Louisiana, or fished, let alone bought a boat anywhere. They were advised that if they wanted their dream house, they have to clear their problem fast since another potential buyer wanted to make an offer and the seller couldn't wait longer than 48 hours. Jean knew that the law allowed anyone to get details of his or her credit reports and suggest corrections. He immediately contacted Marcio Santos at CreditSwift who researched the problem and discovered that another Jean Tigana, a man from Rouxville, Louisiana existed in their file. This Jean was 72; the other Jean was 36. By the time Marcio corrected the database and issued a new report to DaBank, the Tiganas dream house had been sold to the other buyer. Annabelle and Jean were left with uneasy feelings. Their record at CreditSwift had been fixed, but what about their record at the other credit bureaus? Marcio was also concerned and told the story to his good friend Bryan Robson, the director of systems analysis and design at CreditSwift. Bryan approached his superior, the chief information officer (CIO), and suggested that while the simple coding scheme used to identify a record for retrieval worked fine for a small database, it was clearly inadequate for the large database that existed now. It needed to be modified so that the mistakes of the type faced by the Tiganas are eliminated. Upon the CIO's direction, Bryan conducted a full cost benefit analysis and found that the cost of modifying the system was around $1 million. The modification would save the company $125,000 per year mostly in the form of reduction of lawsuits and claim settlements resulting from the system's errors. Bryan concluded that the gain in reputation and increased customer satisfaction was enough to justify the modification. The CIO, on the other hand, considered the errors a small problem, and based on the cost-benefit analysis, he was against the change. Besides, he pointed out, the whole system was going to be upgraded in five years anyway. The dispute is referred to the Steering Committee.

University warns against e-mail sales Tech tackles student scalpers

by ISAK HOWELL, THE ROANOKE TIMES, Saturday, December 11, 1999: In the future, the school may consider a contract requiring lottery winners to keep tickets in the university's community. Is this a case of violation of appropriate use rules or e-commerce? Is this any different from posting notices on bulletin boards in the building hallways? After all students (and staff) post a lot of notices about things they want to sell (cars, computers, etc.) What about someone advertising to BUY and ticket rather than sell?

Scenarios from the ACM Self-Assessment Procedures

Professional Standards, Obligations, and Accountability

Scenario II.5


A professor of computer science applied for and received a grant form the Strategic Defense Initiative Program to engage in a software assurance research project of a theoretical nature. The goal was to determine the methods by which error-free software might be produced on a large-scale basis. The professor does not believe that SDI is a viable Department of Defense program. She does believe, however, that her work could add measurably to the body of scientific knowledge concerning the development of error-free software. Thus, she accepted the grant money.


Professional Standards, Obligations, and Accountability

Scenario II.6


A software professional was assigned the task of developing software to control a particular unit of a large system. Preliminary analysis indicated that the work was well within the state of the art, and no difficulties were anticipated with the immediate task.

To function properly, or to function at all, however, the software to be developed required inputs from other units in the system. Someone gave the professional an article by an eminent software specialist that convinced him the inputs from other units could not be trusted. Thus, neither the software he was designing nor the unit his company was providing could correctly accomplish their task. The professional showed the article to his supervisor and explained its significance. The supervisor's response was, "That's not our problem; let's just be sure that our part of the system functions properly." The software professional continued to work on the project.


Professional Standards, Obligations, and Accountability

Scenario II.11


Company XYZ has developed the software for a computerized voting machine. Company ABC, which manufactured the machine, has persuaded several cities and states to purchase it; on the strength of these orders, ABC is planning a major purchase from XYZ. XYZ software engineer Smith is visiting ABC one day and learns that problems in the construction of the machine mean that one in ten is likely to miscount soon after installation. Smith reports this to her superior, who informs her that that is ABC's problem. Smith does nothing further.


Property Ownership, Attribution, Piracy, Plagiarism, Copyrights, and Trade Secrets

Scenario III.1


Without malicious intent, a computer hacker was scanning telephone numbers with his microcomputer and identifying those numbers that respond with a computer tone. He accessed one of these computers, using a telephone number he had acquired. Without entering any identification, he received a response welcoming him to an expensive and exclusive financial advisory service offered by a large bank. He was offered free of charge, a sample use of some of the services if he would give his name and address. He provided someone else's name and address and used the free promotional services. This stimulated his interest in the services that bank charged for and gave him sufficient knowledge of access protocol to attempt to use the services without authorization. He gained access to and examined the menus of services offered and instructions for use. However, he did not use the services. By examining the logging audit file and checking with the impersonated customer, bank officials identified the computer hacker and claimed that he had used the services without authorization.


Property Ownership, Attribution, Piracy, Plagiarism, Copyrights, and Trade Secrets

Scenario III.3


A microcomputer user purchased and legitimately used numerous commercial software packages protected by a typical license agreement. He wrote his own programs that called for the use of the commercial packages. Because his friend wanted copies of his programs, the programmer copied them and inadvertently, without noticing, also copied the commercial program onto diskettes. His friends proceeded to use his program and, without knowing, also used the commercially available programs.


Property Ownership, Attribution, Piracy, Plagiarism, Copyrights, and Trade Secrets

Scenario III.5


Searching for new product ideas, an independent commercial programmer purchased a highly popular copyrighted software package and studied it thoroughly. He concluded that he could produce a new package that would be faster, have greater capacity, and offer additional features. He also concluded that the market would be users of the commercial package that he had studied; his new product would replace the older one. The programmer realized that in some respects he could not improve the existing product and that compatibility between his product and the existing one would attract users and minimize the transition to his new product.

The programmer went ahead and developed the new product, meeting the higher performance and new feature capabilities that he had envisioned. The keyboard codes and screen formats (except for the additional features) for the new product were the same as those for the existing product. The computer program, however, was different and independently produced. The new manual was also entirely different form the existing product manual in content and style. The programmer gave his product a new name but advertised the value of its compatibility with the exiting product.

The new product was highly successful. The company that produced the existing product, however, complained that the programmer had acted unethically in producing the new product. Although the company threatened criminal and civil and legal action, it never followed through litigation.


Confidentiality of Information and Personal Privacy

Scenario IV.6


An enterprising programmer used publicly available information stored in a variety of places or available by purchase from the Department of Motor Vehicles, mail order firms, and other sources to compile "profile" of people (shopping habits, likely income level, whether the family was likely to have children, etc.). He sold the profiles to companies interested in marketing specialized products to niche markets. Some of his profiles were inaccurate, and the families received a large volume of unsolicited, irrelevant mail and telephone solicitations. They did not know why this increase in their junk mail and calls had occurred and found it annoying and bothersome. Other profiles were accurate, and families benefited from receiving the sales materials.


Confidentiality of Information and Personal Privacy

Scenario IV.7


An instructor of a logic course decided to test a computer-assisted instruction (CAI) system under development. The large class was divided randomly into two groups. The instructor arranged a controlled experiment in which one group was taught in the traditional manner with a textbook, lectures, and tests, but with no CAI. The other group used the same textbook, lectures, and tests, but in addition used CAI. The grading practices were the same for both groups.

By the middle of the term, the instructor realized that the students in the experimental group who had access to CAI were doing much better than the students in the control group. Some students in the control group sensed this difference and complained that, although they paid the same tuition, they were being denied an educational opportunity offered to others. These students insisted that the instructor discontinue the experiment and allow them to use the CAI package for the remainder of the term. The instructor refused the students' request on the grounds that ending the experiment prematurely would vitiate the control group and, because free inquiry and research are the nature of the academic world, students should take part willingly in such experiments for the sake of advancing knowledge. At the end of term, the grades in the experimental group were significantly higher than the grades in the control group.


Confidentiality of Information and Personal Privacy

Scenario IV.8


Students at a university were each given small personal computer accounts on the university-owned mainframe. Through the student chapter of the Association for Computing Machinery (ACM), a forum system was set up. Any student with an account could sign on, read what had been entered into the forum, and add his or her comments. A discussion of sexual behavior developed. One student briefly described a pornographic questionnaire that had been distributed among students. The questionnaire asked in graphic detail whether the individual would or would not do certain things on a first date. The student also announced that he had put the questionnaire in one of his files and had authorized access under a particular sign-on ID. He revealed the sign-on ID only to those who wanted to see the questionnaire. He warned those who might be offended that the questionnaire was crude. Several weeks later, the student was called into the Dean of Students' office and threatened with expulsion. The university had heard about the questionnaire and had traced it to him through his comments in the forum.


Business Practices, Including Contracts, Agreements, and Conflict of Interest

Scenario V.2


A computer scientist was the manager and principal investigator of two related research projects. He worked hard on both projects, but the funds on one were depleted before the final report was written. Believing that each project benefited from the work done on the other, the computer scientist allowed his assistant to charge the time required to complete the first project to the second one, but did not inform his manager of this. Subsequently, the scientist also completed the second project by doing considerable unpaid overtime work. The results of both projects were well received.


Business Practices, Including Contracts, Agreements, and Conflict of Interest

Scenario V.6


A software developer produced an expert system shell and offered to hire a consultant to build an application of the systems in his field of expertise. The developer sold the expert systems application extensively among the consultant's potential clients. The expert system performed well enough that they did not have need for the consultant. As a result, the consultant lost his client market and had to terminate his business.

Question: Is it ethical for a software developer to take advantage of an expert in this manner, and then essentially put him out of business with the resulting product?

Variation: The consultant agreed to build the application, but purposely held back some of his expertise in order that the result of his work for the software developer would not destroy the future need for his consulting services.


Business Practices, Including Contracts, Agreements, and Conflict of Interest

Scenario V.7


A software development company has just produced a new software package that incorporates the new tax law and figures taxes for both individuals and small businesses. The president of the company knows that the program probably has a number of bugs. He also believes that the first firm to put this kind of software on the market is likely to capture the largest market share. The company widely advertises the program. When the company actually ships a disk, it includes a disclaimer of responsibility for errors resulting from use of the program. The company expects it will receive a certain number of complaints, queries, and suggestions for modification. The company plans to use these to make changes and eventually issue up-dated, improved, and debugged versions. The president argues that this is general industry policy and that anyone who buys version 1.0 of a program knows this and will take proper precautions. Because of bugs, a number of users filed incorrect tax returns and were penalized by the IRS.


Employer/Employee Relationships

Scenario VI.3


A supercomputer center research team has been working on an important problem involving computerizing air traffic control. A visiting computer scientist from an Eastern Bloc nation appears to have the requisite theoretical knowledge to be of great assistance; however, federal regulations prohibit his involvement. One of the team members discusses the problem informally with him, however, and gains important insight into potential solutions.


Employer/Employee Relationships

Scenario VI.7


An information worker in a large company performed her assignments on a workstation connected to the company's mainframe system. The company had a policy of allowing employees to use the computer services for personal purposes as long as they had the explicit approval of management. The woman had such approval to use the system for the extracurricular recreational activities of the employees in her department.

The company suspected a rising amount of employee unrest because of its potential acquisition by another company. Management had the security department monitor all computer service activities of the information worker. Memos, letters, mail messages, bulletin board notices, collections and expenditures of money, and budgets were all carefully scrutinized for evidence of employee unrest. In addition, the security department prepared reports detailing the information worker's uses of the computer services--both her regular work and her employee recreation work. These reports were read and analyzed by a wide range of company managers and were stored indefinitely in company vital records facilities. All of this took place unknown to the information worker.


Employer/Employee Relationships

Scenario VI.6


The information security manager in a large company was also the access control administrator of a large electronic mail system operated for company business among its employees. The security manager routinely monitored the contents of electronic correspondence among employees. He discovered that a number of employees were using the system for personal purposes; the correspondence included love letters, disagreements between married partners, plans for homosexual relations, and a football betting pool. The security manager routinely informed the human resources department director and the corporate security officer about these communications and gave them printed listings of them. In some cases, managers punished employees on the basis of the content of the electronic mail messages. Employees objected to the monitoring of their electronic mail, claiming that they had the same right of privacy as they had using the company's telephone system or internal paper interoffice mail system.

The next two scenarios are on-line with a set of follow-up questions with immediate feedback on responses.

From The Interactive Computer Ethics Explorer,

Enterprising author Jules Taylor, frustrated by repeated turndowns from publishers, decides to offer his first crime novel for sale over the Internet by posting the first chapter as a teaser to every Usenet news group and mailing list. Jules enlists the help of Rhonda Tucker, who charges Jules $100 to feed his message to a "spambot" that automatically submits his posting to each of 7000 different address lists. Jeremy Morgan, a self-appointed Usenet watchdog, discovers the spamming in progress. Knowing indiscriminate posting is against Usenet policy, Jeremy launches a "cancelbot" to remove Jules' (Rhonda's?) posting from the Net. Masquerading as Jules, the original poster, the cancelbot sends messages to the same 7000 address lists, requesting that Jules' posting be removed. Many are deleted automatically, but a substantial number reach individual list readers, who vigorously complain about the waste of bandwidth.

From The Interactive Computer Ethics Explorer,

SoftSupport, Inc. gives its employees full Internet access because they conduct normal business with clients over the Net. At the same time, to control suspected non-business use of the Net, the company installed a secret monitoring program on their enterprise network server, configuring it to continuously track the Internet activities of all employees. NetMonitor surveillance records show that one employee, Ryan Crawford, is using the company Internet gateway to do genealogical research on the Crawford family tree. Further analysis reveals his personal research is done only while connected to the gateway from his home, on his own time, using his own computer. Still, his unauthorized activities are sufficient to increase the company's overall Internet usage by about 5% on an average day. When supervisors ask him to stop, Ryan accuses the company of invading his privacy but the company claims it is within its rights.

Attempted Hacking is not a Crime

The question of whether an attempt to break into a computer system, whether it be by way of a network, by phone, or directly, is a crime of "hacking" is the subject of this debate. The 1984 Virginia Crimes Act says: A person "uses" a COMPUTER or COMPUTER network when he:

  1. .Attempts to cause or causes a COMPUTER or COMPUTER network to perform or to stop performing COMPUTER operations;
and then goes on to define "computer theft" as: "Any person who willfully uses a COMPUTER or COMPUTER network, with intent to obtain COMPUTER services without authority, shall be guilty..."

A recent case in Norway raises the question of whether a crime has not been committed if he attempt to access a computer system fails, and further suggests that unless every country and state has the same law, then any computer statute is meaningless.

The question for debate is: "This community of students believes that those portions of Federal and State Laws that criminalize failed attempts to use computers should be reperaled."

Last updated 2002/05/08
© (except as noted) J.A.N. Lee, 1996-2002.