Slashdot Mirror
Ethical Obligations
MaxwellStreet writes "There's a great editorial on msnbc.com about the ethical dilemma of whether or not a system administrator (or the business they work for) is obligated to disclose credit card number theft from their machines. What does everyone here think?"
Sorry but this is not an ethical dilemma - You should always disclose to the customers that you perceive a theft to have taken place.
The company has a duty to it's customers information. Demonstrating that your company is ignoring its duty is *far* more damaging than any reports of breached systems.
Also, if everybody knows about an insecurity then the company will HAVE to take remedial action.
Sadly many executives do not see it this way and some slimeballs will even punish those employees who tattle. In the UK we have the whistleblowing act that is designed to prevent loss of employment due to actions in the interest of the public good. I wonder if our stateside companions are as well protected.....
Remember kids! Guns don't kill people - Americans kill people.
Dealing with this kind of ethical quandry isn't an admin's job and yet it seems that they end up stuck. In other professions where we have similar possible ethical dilemmas (medical, legal, etc.) there are established and deeply entrenched codes of ethics to which practitioners are expected, even by employers and associates, to adhere. Why don't system administrators have such a thing?
I think the revelation in the article that a business would prefer to sweep such a theft under the rug is frightening and opens the door to all kinds of problems. Maybe making employers understand that their admins are obligated by their own professional standards to expose this kind of thing will effect a positive change. I can't imagine what hiding it will achieve. You don't have to think hard to come up with examples of past situations where hiding "undesireable" information caused more problems than it solved. We're seeing the end results of that very attitude playing itself out with Enron/Arthur Andersen as well as the Catholic church right now.
Admins should be expected to expose this kind of thing with the understanding that doing so will avoid bigger and worse problems down the road. It should be viewed as a service to the public which takes priority over protecting petty business interests.
We will either learn from history or repeat it... again.
--Rick
--Rick "If it isn't broken, take it apart and find out why."
While most people don't realize it there is more than an ethical problem here; there is a legal one. Assuming that an administrator works in the U.S. here is the legal situation:
Anyone who has knowledge of a Federal Felony in the U.S. is required by law to report it to the proper law enforcement authorities ( U.S. Attorney, FBI etc.). Failure to do so makes that person an indictable co-conspirator.
Computer break-ins and credit card theft are Federal Felonies; if 'Dana' is in the U.S. he has no choice but to report or become a criminal himself.
Federal whistle blower statutes apply once something has been reported to the legal authorities but not before; Dana could be fired now - but not once he reports the theft and invokes the whistle blower act.
Found out about this from some federal agents and attorneys I work out with after some bad personal experiences with a company.
I suggest that 'Dana' talk to an attorney and make a decision about how good his information is. Like Spider Man ignoring the theft of the gate receipts - a failure to act can come back to bite you; how does he know that this theft was not an Al-Qaeda action?
Also, if everybody knows about an insecurity then the company will HAVE to take remedial action.
That magic word "should". I should floss more often. I also should get on the treadmill (and off the PC) more often. I should do the dishes every night, should save more money for retirement, should take classes to finish my cert, should thank a veteran on Veteran's Day, should clean my garage, should mail Dad a gift, and should eat out less. A perfect world would be a busy world, to be sure.
That said, there's about a 1 in 6.02x10^23 chance that corporations will voluntarily disclose theft of sensitive data. If everyone knows about Company A's insecurity, the customers will go to Company B which doesn't disclose such information. Press releases are sent out about getting pantsed, competitors create disparaging ads, customers leave, investors get nervous, stock prices drop. And then companies learn it pays to keep your mouth shut.
In fact, I'd wager a company is more likely to pay other people to keep their mouths shut as well than it is to be open and honest and forthcoming. Remember, a public company has one -- and only one -- duty: increase or maintain shareholder value. If they don't do that, then the board can be sued, the chairman ousted, etc, etc. Yeah, I'd bet that not getting thrown off the board is worth some hush-up money in the right places. If I were The Chairman, for instance, I'd make damn sure my sysadmins and IT group had fairly hefty NDAs/non-competes as well as hefty bonuses for "resolving" security issues in a discreet way.
Here's a hypothetical example: Datek gets broken into every once in a great while, has an insecure setup, whatever. Confidential data gets lost or intercepted easily maybe, who knows. But it decides to be honest with everyone. It gets a web page going of all the recent compromises, sends email to people whose info was pinched, fixes the problems via the aforementioned remedial actions. E*trade keeps quiet, Datek starts looking sloppy and has a "history" of being insecure, E*trade gets more business even if they don't decide to smear Datek. Datek is soon a fading memory with secure business systems.
Disabuse yourself of the notion that you will know who got what and when. It is not in a company's best interest to let you know your privacy and financial security was compromised, no matter how much grandstanding they do over security and trust. Just don't use a Visa/Mastercard debit card or your SSN online and everything will be fine.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
Whether or not the merchant is required to disclose credit card theft from their files should be covered by their agreement with the card issuer.
Why?
Because THAT is who the cards and numbers belong to. It's right there on the back of my cards.
"THIS CARD IS THE PROPERTY OF AND ISSUED BY *** AND MUST BE RETURNED ON REQUEST"
and..
"ESTA TARJETA ES PERSONAL, INTRANSFERIBLE Y PROPIEDAD DEL BANCO"
Let's all *please* remember what a credit card really is. It's a token, issued to the customer of a credit card issuer, used to identify yourself to merchants who are also using that credit system.
it is not yours. it is merely a token.
Many card contracts only hold you liable for charges if your card is physically stolen and you don't report it; you are not liable *at all* for fees charged to your card unless
a) You charged them yourself
b) Through your own actions permitted someone to charge them
c) Failing to report a stolen card.
In other words, if my card is in my pocket, and whatever merchant some gomer used my number at can't prove that it was ME who authorized the use... he gets no money, visa doesn't charge me.
If you card DOESN'T work this way, please shop around, you are getting screwed.
A lot of people here are simply saying "Yes, he has to disclose it." It's not that easy. There are two big problems to this that I can see. First, the customers are NOT the victims here. Second, the sysadmin clearly has ethical obligations to his employer; whether he has ethical obligations to his employer's customers is less clear.
When a credit card number is used fraudulently, the credit card company is the victim. The holder of the credit card (the consumer) has no responsibility to pay for fraudulent charges; he only has a responsibility to notify the credit card company that the charges are not legitimate.
Some may say that the consumer is ultimately the victim because the credit card company will pass losses from fraud to their customers in the form of higher fees. If you believe this then you probably also believe that copying a CD actually takes money out of the music industry's bank accounts. The credit company has the power to change their system to stop fraud -- it is simply more profitable for them to absorb the losses instead.
This is one of the reasons I've never been afraid to use my credit card number online -- why there was ever fear over this is beyond my understanding. If someone steals my credit card number (it happened to me once), I just call up the credit card company and tell them. I don't have to pay for something I didn't buy. Period.
Anyway, my point is that there is not an ethical obligation to the customer because the customer is not a potential victim here. Some have said there is a legal obligation but I do not believe that (i am not a lawyer). If a restaurant discovers a waiter has been stealing credit card numbers they are not going to notify their customers. They will fire the waiter and notify the credit card company and possibly the police.
The second part of this -- who the sysadmin has an ethical obligation to -- goes like this: As a sysadmin you have an ethical obligation to your employer to not harm your employer. You also have an ethical obligation to not use your employer's customer data to contact the customers directly -- you would be stealing data just like the credit card thieves and could face prosecution from your (by this point, former) employer. You also have an ethical obligation to understand your position in the company and operate within those bounds -- you are a sysadmin, not a lawyer, not a PR person, not a manager. You also have an ethical obligation to your employer to notify an appropriate person *within the company* when someone else is behaving unethically. The company has an ethical and probably legal obligation to notify the credit card company -- since the credit card company stands to lose money of the stolen numbers are used.
Credit card companies have entire departments to deal with fraud -- they have the expertise the handle this situation. Joe sysadmin doesn't. Joe sysadmin's employer doesn't. And the customers certainly don't. The credit card company is really the one that should be notified here -- and since the credit card company is the potential victim, it should be up to them to decide whether or not to involve law enforcement.
If I were the sysadmin in this situation I would first try to convince my manager to involve the company's legal dept to find out what our legal obligations and risks are. I would encourage them to notify the credit card company and offer my time to work with the credit card company to investigate whether or not something actually happened. If the company decides to keep quiet, I would put my objections in writing and make sure they are known, and I would look for another employer. In this case, though, I wouldn't take it upon myself to notify anyone outside the company. If the crime involved human victims rather than corporate ones, I think I would feel obligated to notify law enforcement.