Ethical Issues For It Pratitioners

LEGAL AND ETHICAL ISSUES FOR IT PRACTITIONER

Introduction Ethics refers to principles of human conduct, or morals, and to the systematic study of such human values, often called moral philosophy, the study of theories of conduct and goodness, and of the meanings of moral terms. An act is considered to be 'ethical' if it is in accordance with approved moral behavior or norms. Ethics implies civic responsibility on the part of citizens and responsibility by society's institutions, including governments. Ethics is concerned with questions such as when is an action 'right' or 'wrong' and what standard separates 'good' from 'bad'. We propose to accept one of the basic tenets of modern moral philosophy that the authority invoked for 'good' conduct is the rule of reason and that moral behavior results from rational thought that does not harm the individual and leads ultimately to the greatest good for all individuals in a society. This definition and assumption equates well with the main issue of another debate driven partially by ethics, i.e. relating to public domain information, or more specifically public sector information that may not be in the public domain, as stated in recent UNESCO-backed guidelines regarding public sector information. "One of the ultimate goals of any society is the empowerment of all its citizens through access and use of information and knowledge. Every person and every nation must have equal opportunity to benefit from cultural diversity and scientific progress as a basic human right in the current information revolution and the emerging knowledge society"

CODE OF ETHICS Contents & Guidelines 1.

General Moral Imperatives.

2.

More Specific IT practitioners Responsibilities.

3.

Organizational Leadership Imperatives.

4.

Compliance/Implementation with the Code. 3

GENERAL MORAL IMPERATIVES. An IT Practitioner is expected to… 1. Contribute to society and human well-being. This principle concerning the quality of life of all people affirms an obligation to protect fundamental human rights and to respect the diversity of all cultures. An essential aim of IT practitioners is to minimize negative consequences of computing systems, including threats to health and safety. When designing or implementing systems, IT practitioners must attempt to ensure that the products of their efforts will be used in socially responsible ways, will meet social needs, and will avoid harmful effects to health and welfare. In addition to a safe social environment, human well-being includes a safe natural environment. Therefore, IT practitioners who design and develop systems must be alert to, and make others aware of, any potential damage to the local or global environment. 2. Avoid harm to others. "Harm" means injury or negative consequences, such as undesirable loss of information, loss of property, property damage, or unwanted environmental impacts. This principle prohibits use of computing technology in ways that result in harm to any of the following: users, the general public, employees, employers. Harmful actions include intentional destruction or modification of files and programs leading to serious loss of resources or unnecessary expenditure of human resources such as the time and effort required to purge systems of "computer viruses." Well-intended actions, including those that accomplish assigned duties, may lead to harm unexpectedly. In such an event the responsible person or persons are obligated to undo or mitigate the negative consequences as much as possible. One way to avoid unintentional harm is to carefully consider potential impacts on all those affected by decisions made during design and implementation. To minimize the possibility of indirectly harming others, IT practitioners must minimize malfunctions by following generally accepted standards for system design and testing. Furthermore, it is often necessary to assess the social consequences of systems to project the likelihood of any serious harm to others. If system features are misrepresented to users, coworkers, or supervisors, the individual IT practitioner is responsible for any resulting injury. In the work environment the IT practitioner has the additional obligation to report any signs of system dangers that might result in serious personal or social damage. If one's superiors do not 4

act to curtail or mitigate such dangers, it may be necessary to "blow the whistle" to help correct the problem or reduce the risk. However, capricious or misguided reporting of violations can, itself, be harmful. Before reporting violations, all relevant aspects of the incident must be thoroughly assessed. In particular, the assessment of risk and responsibility must be credible. It is suggested that advice be sought from other IT practitioners. 3. Be honest and trustworthy. Honesty is an essential component of trust. Without trust an organization cannot function effectively. The honest IT practitioner will not make deliberately false or deceptive claims about a system or system design, but will instead provide full disclosure of all pertinent system limitations and problems. An IT practitioner has a duty to be honest about his or her own qualifications, and about any circumstances that might lead to conflicts of interest 4. Be fair and take action not to discriminate. The values of equality, tolerance, respect for others, and the principles of equal justice govern this imperative. Discrimination on the basis of race, sex, religion, age, disability, national origin, or other such factors is an explicit violation of IT ethics and will not be tolerated. Inequities between different groups of people may result from the use or misuse of information and technology. In a fair society, all individuals would have equal opportunity to participate in, or benefit from, the use of computer resources regardless of race, sex, religion, age, disability, national origin or other such similar factors. However, these ideals do not justify unauthorized use of computer resources nor do they provide an adequate basis for violation of any other ethical imperatives of this code. 5. Honor property rights including copyrights and patent. Violation of copyrights, patents, trade secrets and the terms of license agreements is prohibited by law in most circumstances. Even when software is not so protected, such violations are contrary to professional behavior. Copies of software should be made only with proper authorization. Unauthorized duplication of materials must not be condoned. 6. Give proper credit for intellectual property.

5

IT professionals are obligated to protect the integrity of intellectual property. Specifically, one must not take credit for other's ideas or work, even in cases where the work has not been explicitly protected by copyright, patent, etc. 7. Respect the privacy of others. Computing and communication technology enables the collection and exchange of personal information on a scale unprecedented in the history of civilization. Thus there is increased potential for violating the privacy of individuals and groups. It is the responsibility of professionals to maintain the privacy and integrity of data describing individuals. This includes taking precautions to ensure the accuracy of data, as well as protecting it from unauthorized access or accidental disclosure to inappropriate individuals. Furthermore, procedures must be established to allow individuals to review their records and correct inaccuracies. This imperative implies that only the necessary amount of personal information be collected in a system, that retention and disposal periods for that information be clearly defined and enforced, and that personal information gathered for a specific purpose not be used for other purposes without consent of the individual(s). These principles apply to electronic communications, including electronic mail, and prohibit procedures that capture or monitor electronic user data, including messages, without the permission of users or bona fide authorization related to system operation and maintenance. User data observed during the normal duties of system operation and maintenance must be treated with strictest confidentiality, except in cases where it is evidence for the violation of law, organizational regulations, or this Code. In these cases, the nature or contents of that information must be disclosed only to proper authorities. 8. Honor confidentiality. The principle of honesty extends to issues of confidentiality of information whenever one has made an explicit promise to honor confidentiality or, implicitly, when private information not directly related to the performance of one's duties becomes available. The ethical concern is to respect all obligations of confidentiality to employers, clients, and users unless discharged from such obligations by requirements of the law or other principles of this Code.

6

SPECIFIED PROFESSIONAL RESPONSIBILITIES. 1. Strive to achieve the highest quality, effectiveness and dignity in both process and products of professional work. Excellence is perhaps the most important obligation of a profession. An IT practitioner must strive to achieve quality and to be cognizant of the serious negative consequences that may result from poor quality in a system. 2. Acquire and maintain professional competence. Excellence depends on individuals who take responsibility for acquiring and maintaining professional competence. An IT practitioner must participate in setting standards for appropriate levels of competence, and strive to achieve those standards. Upgrading technical knowledge and competence can be achieved in several ways: doing independent study; attending seminars, conferences, or courses; and being involved in professional organizations. 3. Know and respect existing laws pertaining to professional work. IT practitioner must obey existing local, state, province, national, and international laws unless there is a compelling ethical basis not to do so. Policies and procedures of the organizations in which one participates must also be obeyed. But compliance must be balanced with the recognition that sometimes existing laws and rules may be immoral or inappropriate and, therefore, must be challenged. Violation of a law or regulation may be ethical when that law or rule has inadequate moral basis or when it conflicts with another law judged to be more important. If one decides to violate a law or rule because it is viewed as unethical, or for any other reason, one must fully accept responsibility for one's actions and for the consequences. 4. Accept and provide appropriate professional review. Quality professional work, especially in the computing profession, depends on professional reviewing and critiquing. Whenever appropriate, individual members should seek and utilize peer review as well as provide critical review of the work of others. 5 Give comprehensive and thorough evaluations of computer systems and their impacts, including analysis of possible risks. IT practitioners must strive to be perceptive, thorough, and objective when evaluating, recommending, and presenting system descriptions and alternatives. IT practitioner are in a 7

position of special trust, and therefore have a special responsibility to provide objective, credible evaluations to employers, clients, users, and the public. When providing evaluations the practitioner must also identify any relevant conflicts of interest, as stated in imperative 1.3. As noted in the discussion of principle 1.2 on avoiding harm, any signs of danger from systems must be reported to those who have opportunity and/or responsibility to resolve them.. 6. Honor contract and assigned responsibilities. Honoring one's commitments is a matter of integrity and honesty. For an IT practitioner this includes ensuring that system elements perform as intended. Also, when one contracts for work with another party, one has an obligation to keep that party properly informed about progress toward completing that work. Practitioner has a responsibility to request a change in any assignment that he or she feels cannot be completed as defined. Only after serious consideration and with full disclosure of risks and concerns to the employer or client, should one accept the assignment. The major underlying principle here is the obligation to accept personal accountability for professional work. On some occasions other ethical principles may take greater priority. A judgment that a specific assignment should not be performed may not be accepted. Having clearly identified one's concerns and reasons for that judgment, but failing to procure a change in that assignment, one may yet be obligated, by contract or by law, to proceed as directed. The IT practitioner's ethical judgment should be the final guide in deciding whether or not to proceed. Regardless of the decision, one must accept the responsibility for the consequences. However, performing assignments "against one's own judgment" does not relieve the professional of responsibility for any negative consequences. 7. Improve public understanding of computing and its consequences. IT practitioners have a responsibility to share technical knowledge with the public by encouraging understanding of computing, including the impacts of computer systems and their limitations. This imperative implies an obligation to counter any false views related to computing.

8

8. Access computing and communication resources only when authorized to do so. Theft or destruction of tangible and electronic property is prohibited by imperative "Avoid harm to others." Trespassing and unauthorized use of a computer or communication system is addressed by this imperative. Trespassing includes accessing communication networks and computer systems, or accounts and/or files associated with those systems, without explicit authorization to do so. Individuals and organizations have the right to restrict access to their systems so long as they do not violate the discrimination principle. No one should enter or use another's computer system, software, or data files without permission. One must always have appropriate approval before using system resources, including communication ports, file space, other system peripherals, and computer time.

ORGANIZATIONAL LEADERSHIP IMPERATIVES. This section draws extensively from the draft IFIP Code of Ethics, especially its sections on organizational ethics and international concerns. The ethical obligations of organizations tend to be neglected in most codes of professional conduct, perhaps because these codes are written from the perspective of the individual member. This dilemma is addressed by stating these imperatives from the perspective of the organizational leader. In this context "leader" is viewed as any organizational member who has leadership or educational responsibilities. These imperatives generally may apply to organizations as well as their leaders. In this context "organizations" are corporations, government agencies, and other "employers," as well as volunteer professional organizations. 1. Articulate social responsibilities of members of an organizational unit and encourage full acceptance of those responsibilities. Because organizations of all kinds have impacts on the public, they must accept responsibilities to society. Organizational procedures and attitudes oriented toward quality and the welfare of society will reduce harm to members of the public, thereby serving public interest and fulfilling social responsibility. Therefore, organizational leaders must encourage full participation in meeting social responsibilities as well as quality performance.

9

2. Manage personnel and resources to design and build information systems that enhance the quality of working life. Organizational leaders are responsible for ensuring that computer systems enhance, not degrade, the quality of working life. When implementing a computer system, organizations must consider the personal and professional development, physical safety, and human dignity of all workers. Appropriate human-computer ergonomic standards should be considered in system design and in the workplace. 3. Acknowledge and support proper and authorized uses of an organization's computing and communication resources. Because computer systems can become tools to harm as well as to benefit an organization, the leadership has the responsibility to clearly define appropriate and inappropriate uses of organizational computing resources. While the number and scope of such rules should be minimal, they should be fully enforced when established. 4. Ensure that users and those who will be affected by a system have their needs clearly articulated during the assessment and design of requirements; later the system must be validated to meet requirements. Current system users, potential users and other persons whose lives may be affected by a system must have their needs assessed and incorporated in the statement of requirements. System validation should ensure compliance with those requirements. 5. Articulate and support policies that protect the dignity of users and others affected by a computing system. Designing or implementing systems that deliberately or inadvertently demean individuals or groups is ethically unacceptable. Computer professionals who are in decision making positions should verify that systems are designed and implemented to protect personal privacy and enhance personal dignity. 6. Create opportunities for members of the organization to learn the principles and limitations of computer systems. This complements the imperative on public understanding. Educational opportunities are essential to facilitate optimal participation of all organizational members. Opportunities must be available to all members to help them improve their knowledge and skills in computing, 10

including courses that familiarize them with the consequences and limitations of particular types of systems. In particular, professionals must be made aware of the dangers of building systems around oversimplified models, the improbability of anticipating and designing for every possible operating condition, and other issues related to the complexity of this profession.

COMPLIANCE WITH THE CODE AND IMPLEMENTATION OF THIS CODE. Upholding and promoting the principles of this code, the future of the IT practitioner depends on both technical and ethical excellence. Not only important for professionals to adhere to the principle expressed in this Code, but each member should encourage and support adherence by other members i.

All practitioners providing central IT support, are required to read and sign the Employee Code of Ethics

ii.

All supervisors will ensure that they have reviewed the Code of Ethics with their employees and maintain one signed copy in their personnel files and provide one copy to employees or practitioners

iii.

The Information Technology Employee or practitioner Code of Ethics should then be reviewed on an annual basis with employees or practitioners.

I T PRACTITIONER CODE OF ETHICS In order to fulfill its mission of providing technological support to IT professionals, they must grant privileged access to the equipment to appropriate Information Technology (IT) employees or practitioners. This access imposes upon the practitioners the responsibility and obligation to use systems in an ethical, professional, and legal manner that is strictly within her or his authorized job functions. IT professional is committed to advancing the ethical and responsible use of all information technology resources. The goals of the IT Practitioner Code of Ethics are to create a culture that fosters trust and a commitment to responsibility, excellence, and institutional and personal integrity, while avoiding conflicts of interest and appearances of impropriety. IT professionals will not tolerate illegal, dishonest, improper, or irresponsible use of privileged access. 11

1) In exchange for the privileges granted and as a condition of profession, IT practitioner agree to abide by all professional IT policies with the understanding that professional administration may change, rescind or add policies with or without prior notice. I also subscribe to the following statements. 2) I will take reasonable precautions to prevent unauthorized access to passwords, user identifications, or other information that may be used to access information systems . 3) I will limit access to information contained in or obtained from the systems to

only

authorized people. 4) I will diligently protect all confidential information from unauthorized disclosure. 5) I will seek guidance from a supervisor or an appropriate administrator whenever I am unsure of the correct decision regarding appropriate use, confidentiality, or access, and will do so BEFORE I take any action on the support issue in question. 6) I will not share, record, copy, transmit, delete, or in any way alter information in these systems except when required to perform my duties. 7) I will abide by all licensing and copyright agreements. 8) I will transfer to another authorized IT employee any support request that might give me privileged access to my own academic records or to an electronic course in which I am enrolled, in order to avoid a conflict of interest. 9) I will immediately report any incidents of personal noncompliance or noncompliance of colleagues with the terms of this agreement to my supervisor or an appropriate administrator

12

10) If I am a practitioner, I will observe the practitioner’s policies on conduct and/or academic honesty. As an employee, I understand that if I violate this agreement, I may be subject to disciplinary action up to and including dismissal from the profession. Additional legal action may be taken if federal or state laws are violated. I have read and agree to abide by this practitioner Information Technology Employee Code of Ethics. Employee’s signature: ______________________________ Date: ____/____/____ I have reviewed the Information Technology Employee Code of Ethics with this employee and provided a copy of this signed document to the employee. Supervisor’s signature: ______________________________ Date: ____/____/____

BRITISH CODE OF PRACTICE The British Computer Society sets the professional standards of competence, conduct and ethical practice for computing in the United Kingdom. The Society was incorporated by Royal Charter in July 1984, with the following: i.

The Code of Practice is directed to all members of The British Computer Society.

ii.

It consist of essential series of statements which prescribe the minimum standards of practice, to be observed by all members.

iii.

The Code is also concerned with professional responsibility. Responsibilities to clients, to users, to the State and society at large.

iv.

Those members who are employees also have responsibilities to their employers' customers and, often, to a Trade Union.

v.

In the event of apparent clash in responsibilities, obligations or prescribed practice, the Society's Secretary-General should be consulted at the earliest opportunity.

vi.

The Code is to be viewed as a whole: individual parts are not intended to be used in isolation to justify errors or omissions or commission.

vii. viii.

The Code is intended to be observed in the spirit and not merely the word. The BCS membership covers all occupations relevant to the use of computers (as computer practitioner, professionals etc)

13

NIGERIA CODE OF PRACTICE On the same code of practice on legal and ethical issues for IT practitioner, Nigeria is not left out. The body and the authoritative organization for IT Practitioner is the computer professional council of Nigeria (CPCN), established and operating under the Act NO.49 of 1993 constitution of the federal republic of Nigeria, gazetted august 9th of the same year. Functions and Duties of the Council The computer professional council of Nigeria (CPCN) is “a corporate body with perpetual succession and common seal”, a legal entity charge with the control and the supervision of the computer IT Practitioner in the country. In regard thereof, its duties include: (1) Set and improving IT standards To determine what standards of knowledge and skills are to be obtained by persons seeking to become member of the computing profession and improve those standard from time to time as circumstances may permit. (2) Publication of registered members To secure in accordance with the provision of the Act, the establishment and maintenance of a registered and those seeking to be register under the Act as computer practitioner and professionals, and the publication from time to time of the list of these persons. (3) Other functions bestowed upon the council by the Act are as follow To perform any other functions as bestowed on it (council) by the provision of the Act. Consequent upon the foregoing, the council has responsibilities for the following, among others; i.

Organization of IT practice in the country

ii.

Control of computing in the country

iii.

Screening individual seeking to be registered as computer IT Practitioner and Professional in Nigeria

iv.

Screening corporate bodies seeking to be registered to engage in the sale or use of computing facilities and/or the provision of professional services in computing in the country. 14

v.

Ensuring high computing professional ethics and professionalism-standards.

vi.

Local and international contacts (with relevant associations and bodies)

vii.

Reduced charges for some specific professional services and facilities.

viii.

Determining academic standards in computer science, computer engineering, information science, etc.

ix.

Accreditation of institution, courses and programs and the evaluation of certificate in computing.

x.

Conducting professional examinations in computing by liaising with associations/bodies external to the council.

xi.

Publicizing the activities of the council.

(xii) Publication of the register of computer professional and other computing professional works-journals, books, magazines, newsletters.

REGISTRATION The Act 49 of 1993 referred to above makes it mandatory for all persons and organizations seeking to engaged in the sale and/or use of computing facilities, and/or provision of professional services in computing in the country to be registered by the council and licensed to carry out such activities. It is definitely illegal to engaged in computing professional practice without satisfying the above condition-registration and possession of a current valid license. If application is successful, an applicant is requested to pay a once-for-all registration fee and the license fee for the current year, to have the applicant’s name inserted in the register and for the applicant to commence professional activities, respectfully.

BENEFITS. Persons and corporate bodies that are registered and hold current valid licenses, apart from being eligible to carry out their business, stand to enjoy benefits including but not limited to: i.

Raised professional standing / status (from recognition as a registered computing practitioner ).

ii.

Protection from the public (from exploitation, harassment, etc, in the course of performing bonafide, legitimate professional activities).

iii.

Right to use the council’s Insignia (e.g. individualized seal, crest/plaque, ties, clips etc.) 15

iv.

Meet and network new professional friends at our regular network meetings.

v.

Corporate business network and harnessing of business opportunities.

vi.

On-line business/professional discussions and exchange of ideas.

vii.

Non-stop training and development.

viii.

Access to and attendance at regular professional programs (conferences, seminars, symposia, workshop, continuing of professional education, training, etc.)

ix.

Entrepreneur development and workshops for startups.

x.

Enjoy reciprocal registration with foreign computer professional bodies.

xi.

Awards and recognitions.

PROCEDURE FOR REGISTRATION i.

Applicant obtains registration application form.

ii.

The duly completed application form (together with ALL relevant supporting documents) is submitted to the secretariat.

iii.

On receipt of the application form in the previous step, the secretariat will dispatch an acknowledgment letter to the applicant.

iv.

Appropriate processing of the form then commences.

v.

Applicant is thereafter informed of the outcome of the application.

Every registered computer professional and corporate body is required thereafter to pay, annually, a

license fee (to renew the practitioner’s license) for computing professional

practice, by such professional or body for that year. 1. Personal Requirements i.

Keep yourself, and subordinates informed of such new technologies, practices, legal requirements and standards as are relevant to his duties.

ii.

Ensure subordinates are trained in order to be effective in their duties and to qualify for increased responsibilities.

iii.

Accept only such work as he believes, he is competent to perform and not hesitate to obtain additional expertise from appropriately qualified individuals where advisable.

16

iv.

Actively seek opportunities for increasing efficiency and effectiveness to the benefit of the user and of the ultimate recipient.

2. Organization and Management Requirements i.

Plan, establish and review objectives, tasks and organizational structures for himself and subordinates, to help meet overall objectives.

ii.

Ensure that any specific tasks are assigned to be identified individuals according to their known ability and competence.

iii.

Establish and maintain channels of communication from and to seniors, equals and subordinates.

iv.

Be accountable for the quality, timeliness and use of resources in the work for which he is responsible.

3. Contracting i.

Seek expert advice in the preparation of any formal contract.

ii.

Ensure that all requirements and the precise responsibility of all parties adequately covered in any contract or tendering procedures.

4. Privacy, security and integrity i.

Ascertain and evaluate all potential risks in a particular project with regard to the cost, effectiveness and practability of proposed levels of security.

ii.

Recommend appropriate levels of security, commensurate with the anticipated risks, and appropriate to the needs of the client.

iii.

Apply, monitor and report upon the effectiveness of the agreed levels of

security.

iv.

Ensure that all staff are trained to take effective action to protect life, data and equipment (in that order) in the event of disaster.

v.

Take all reasonable measures to protect confidential information from inadvertent or deliberate improper access or use.

vi.

Ensure that competent people are assigned to be responsible for the accuracy and integrity of the data in the data file and each part of an organization’s database.

17

CONCLUSION These General Moral Imperatives, Legal and Ethical Issues for IT Practitioners are summarized with these Ten Commandments. The Commandments are: 1. Thou shalt not use a computer to harm other people. 2. Thou shalt not interfere with other people's computer work. 3. Thou shalt not snoop around in other people's files. 4. Thou shalt not use a computer to steal. 5. Thou shalt not use a computer to bear false witness. 6. Thou shalt not use or copy software for which you have not paid. 7. Thou shalt not use other people's computer resources without authorization. 8. Thou shalt not appropriate other people's intellectual output. 9. Thou shalt sell while fault computer components. 10. Thou shalt not commit interment fraud (YAHOOZEE) .

18

REFFERENCES

1) COMPUTER PROFESSIONERS (REGISTRATION COUNCIL OF NIGERIA) www.cprcn.org (1993)

2) ADELMA, C (2000).

THE CERTIFI CATION SYSTEM IN INFORMATION TECHNOLOGY. (PARALLEL POSTSECONDARY UNIVERSE)

3) SHELLY, CASHMAN, VERMAAT

DISCOVERING COMPUTERS 2000

4) ALL EN, T AND M, MORTON

INFORMATION TECHNOLOGY (OXFORD UNIVERSITY PRESS)

5) AMA (AUSTRALIAN INSTITUTE OF MEDICAL SCIENTIST) 2008. http://domino.ama.com.au/DIRO103/MediaREL.nsf/Media.AHWeb (28/09/2008)

6) BADWIN, P.(2006)

HIGHER EDUCATION QUANTITY AND DIVERSITY IN THE 21ST CENTURY (CAMBERRA, AGPS.)

19

20