Slashdot Mirror


When Ethics and IT Collide

jcatcw writes "IT workers have access to confidential data, and they can see what other employees are doing on their computers or the networks. This can put a good worker in a bad predicament. Bryan, the IT director for the U.S. division of German company, discovered an employee using a company computer to view pornography of Asian women and of children. He reported it but the company ignored it. Subsequently the employee was promoted and moved to China to run a manufacturing plant. That was six years ago but Bryan still regrets not going to the FBI. Other IT workers admit using their admin passwords to snoop through company systems. In a Ponemon Institute poll of more than 16,000 U.S. IT practitioners, 62% said they had accessed another person's computer without permission, 50% read confidential or sensitive information without a legitimate reason, and 42% said they had knowingly violated their company's privacy, security or IT policies. But in the absence of a professional code of ethics, companies struggle to keep corporate policies up to date."

25 of 414 comments (clear)

  1. Why bother keeping corporate policies up to date? by Eric+Smith · · Score: 4, Insightful

    and 42% said they had knowingly violated their company's privacy, security or IT policies. But in the absence of a professional code of ethics, companies struggle to keep corporate policies up to date."
    If 42% are willing to violate the existing policies and risk termination or worse, how would adding a professional code of ethics or keeping corporate policies up to date help? Those same 42% would likely ignore the code of ethics and violate newer policies as well.
  2. There *is* a code of ethics by Anonymous Coward · · Score: 5, Informative

    The ACM has done at least one thing right:

    http://www.acm.org/about/code-of-ethics

    1. Re:There *is* a code of ethics by BobMcD · · Score: 4, Insightful
      I'm not a member, and so do not know the code very well, but looking at the lines of text tells me that this DOES NOT HELP with the moral delema.

      Choose one of these two, and break the code both ways:

      1.3 Be honest and trustworthy.
      1.7 Respect the privacy of others.
      1.8 Honor confidentiality.
      2.6 Honor contracts, agreements, and assigned responsibilities.
      2.8 Access computing and communication resources only when authorized to do so.
      3.1 Articulate social responsibilities of members of an organizational unit and encourage full acceptance of those responsibilities.
      3.5 Articulate and support policies that protect the dignity of users and others affected by a computing system. OR

      1.1 Contribute to society and human well-being.
      1.2 Avoid harm to others.
      2.1 Strive to achieve the highest quality, effectiveness and dignity in both the process and products of professional work.
      2.3 Know and respect existing laws pertaining to professional work.
      3.2 Manage personnel and resources to design and build information systems that enhance the quality of working life.
      3.3 Acknowledge and support proper and authorized uses of an organization's computing and communication resources. Even with this code, you now still have a lose/lose situation...
    2. Re:There *is* a code of ethics by beheaderaswp · · Score: 5, Insightful

      Nice try.

      It has been posited by my legal department that IT workers are "mandatory reporters" in cases of cyber crime, child abuse, and terrorism.

      This opinion, which I have not seen tested in court, seems exceptionally relevant considering that like teachers (who are often the first to see child abuse), nurses/doctors (the first to treat physical abuse), and police (the first to intervene in domestic abuse) IT people are a first detector for a myriad of crimes.

      Thus, based on legal advice, my employees are instructed to notify law enforcement *before* notifying management. (In some states this may actually be law now)

      So yes, this code of ethics, as well as the LOPSA Code I linked below- do apply. Assuming of course the IT director isn't one of those management monkeys who likes to bury things "for the good of the company".

      --
      Another consultant who stuck it out.

      "We are the Priests, of the Temples of Syrinx..."
  3. So where is the "ethical dilemma"? by khasim · · Score: 5, Insightful

    You see the logs of some guy looking a kiddie porn and you report it to your HR department.

    Where's the ethical dilemma?

    If HR does nothing about it, you report it to the FBI.

    Where's the ethical dilemma?

    And ethical dilemma would be where there were two ethically valid choices with different consequences. If you have two kids and they're both drowning, which one do you save first?

  4. There is no Absence! by beheaderaswp · · Score: 4, Informative

    There is a professional organization, of which I happen to be a member, Called "LOPSA"- "League of Professional System Administrators".

    The code of ethics is found here:

    http://lopsa.org/CodeOfEthics

    While my IT department does not require membership in this organization, these rules of ethics are *posted* and violations of those rules are a fireable offense!

    --
    Another consultant who stuck it out.

    "We are the Priests, of the Temples of Syrinx..."
    1. Re:There is no Absence! by archen · · Score: 4, Interesting

      What kind of soulless bastard needs a written code of ethics to know what's right and wrong? Who really thinks that snooping around other peoples' data is the right thing to do?

      Most of us do. But then again a LOT of us have lapses and moments of weakness. I mean if you know there is some really good dirt being shot back and forth via email and you log all email it's really tempting to just snoop through it to kill some boredom. Sometimes just reading a piece of paper on the wall can help you keep your focus.

      I'm an I.T. Manager and it's sort of tough sometimes. For me personally I'm having a bad time in my life and I have this vicious streak that emerges many times a day - and that isn't helping. I have the ability to see every website they visit, everything they do on their PC, and can see every email received and sent. I can also access pretty much every file on every machine in the company. That's a LOT of responsibility. And I honestly don't snoop through any of it - it's kept for security/legal reasons. Monthly I wrap it up an 256bit AES encryption on a DVD and that's it. I think most I.T. people are actually pretty honest as well as far as the ones I've met. I mean I'd hate to see what the assholes in sales would do if they had as much power over the company as I had. heh, I actually just cringed.

  5. Re:Why talk about Ethics by BiloxiGeek · · Score: 4, Insightful

    A poll? What's the point of that???
    5% of us would vote randomly
    6% will definitely be stuffing the ballot box
    7% Might be stuffing the ballot box

    Or worse yet:
    17% will choose the Cowboy Neal option

    --
    Do not meddle in the affairs of dragons, For you are crunchy and go well with ketchup.
  6. When my pay is ethical, I'll worry about the rest by cavehobbit · · Score: 5, Insightful

    I have an ethics problem every time I get a paycheck for 40 hours of work when I actually worked 60.

    Using company systems for your own needs? heck, the company is alreaady getting 40 grand worth of free overtime. Is that ethical?

    Never mind legal, is is ETHICAL?

  7. Re:Why bother keeping corporate policies up to dat by Nerdfest · · Score: 5, Funny

    That would weed out all those unethical assholes in IT.

    ... and send them back to management and marketing where they belong!
  8. Re:When my pay is ethical, I'll worry about the re by mark-t · · Score: 4, Insightful

    If you have an ethics issue with your current job, you should quit, and find a new job. The last thing you should ever want is to be thought of as a person who will compromise his principles for money.

    ... OR... you really don't have any sort of ethical problem with being exploited at work and you just wanted to whine about something that you figured people might be sympathetic to.

  9. Not me. by Zero_DgZ · · Score: 4, Insightful

    Sure, I have unmitigated access to everything that comes, goes, or happens in my company. And if I don't have access to some particular facet of the boss's operation it's pretty trivial to give myself access. But do I snoop through other employees' email or documents or browsing records or whatever? No. But, admittedly, not because of any particular integrity or high moral standards on my part.

    I just don't care. Yeah, it might be nice to intercept early the memo that says I'm going to get canned tomorrow (or whatever) but I have more than enough things on my plate and no time, motivation, or incentive to play Secret Squirrel with other people's stuff. I have news for you: 99.9999% of what happens on a business network is mind numbingly boring. Memos. Transmittals. Materials lists. Spreadsheets. Schedules. Business correspondence so packed with legalese and ass-kissing and meaningless paradigm shifting buzzword bullshit it makes my brain hurt just thinking about it.

    If I want to abuse my authority and misappropriate company time and network access, it's easier and less mind-frazzling to just delegate the job to somebody else and go read Slashdot.

  10. What privacy? There is no privacy at work. by WebHostingGuy · · Score: 5, Insightful

    That's where you are incorrect. There was never any privacy when someone was using their "work" computer for "personal" use. If you think you have any privacy using a computer provided by your employer, using your employer's resources to access the porn, you are mistaken. Courts have held numerous times employers own the equipment and have the right to view (i.e., spy) on your usage.

    There was no privacy here, therefore no ethical issue.

    --
    Quality Hosting e3 Servers
  11. At the end of the day, it's your reflection. by UncHellMatt · · Score: 4, Interesting

    Not too many years ago I worked for a "web startup" (i.e. small company founded by Harvard MBA who smoked lots of weed, drove a VW, and was out to "save the world") as IT manager. As the market tanked, the CEO became more and more concerned for the future of the company and with good reason! We'd gone from regular upper 6 figures per month to less than half that, with three locations whittled down to essentially one and a half. Many employees left for greener pastures. When things REALLY started to go down hill, the CEO asked me to intercept any emails between current and former employees, and then "hinted" that since so many of our clients had their email hosted on our email server, couldn't I do the same with them. I know that, legally, he had the right to get access to current employee email, and any former employee whom he had granted continued use of our email system (not sure on that last bit, IANAL). But asking me to, or suggesting I should allow him to, read client emails was a final straw. While he may have the "legal right" to read employee emails, it left a very bad taste in my mouth. Suggesting I allow him to read client's emails? It was like licking a rat. At the end of the day I had to go home and see myself in the mirror, and I knew that reading other people's personal, private emails was something so abhorrent. (Rimmer: "Lister, that is my private, personal, private diary; full of my personal, private, personal things." Cat: "It's gone public.") Now all that said, at another job, myself and some other IT workers suspected one of the devs of possibly being a pedo. We didn't read his emails, we didn't pour through his computer (which we could easily have done), but we did put google to good use, and at one point we did packet sniff where he was browsing. Was I proud of that? Well, actually yes. If he HAD been looking at kiddie porn, if he HAD been a sexual predator, being a father how could I stand back and not try to do something? It turned out he wasn't a diddler, just... Really really really really creepy. It is a very fine line between "ethical" and "non-ethical", it can be very hard to judge which is which, and everyone will have their own opinions. But in the end you have to live with yourself, and certainly I'm not qualified to decide right and wrong, nor pass judgment. If I had my way, anyone who sold a poorly made curry would be strung up and boiled in oil.

    1. Re:At the end of the day, it's your reflection. by mgblst · · Score: 5, Insightful

      If he HAD been looking at kiddie porn, if he HAD been a sexual predator, being a father how could I stand back and not try to do something? It turned out he wasn't a diddler, just... Really really really really creepy.


      This is why it is so scary to let certain people, delusional paranoids such as yourself, to have this power. It boggles the mind what someone would have done to convince you that they were a kiddy fiddler, wearing black clothes, taling quietly, maybe they just weren't that social - i am pretty sure that they didn't have disturbing pictures around the cubical. I guess he is just glad that you weren't so convinced that you dropped a few extra files onto his machine - all in order to protect your children from the non-existant menace. Congratulations, I am sure your witch hunting will be put to better use next time.
  12. Are you willing to pay the increasing salaries? by Colin+Smith · · Score: 4, Informative

    Because there are already professional certifications available for IT people. Speaking from personal experience they currently make bugger all difference to fees or salaries. If you were to require such certifications then the reduction in supply of IT personnel would cause the salaries of the certified to rocket... As it has for lawyers, doctors, accountants etc.

    No? Not willing to pay up? Oh well then, you can't really complain.

    --
    Deleted
  13. Re:Why bother keeping corporate policies up to dat by pegr · · Score: 5, Funny

    That would weed out all those unethical assholes in IT.
     
    Sticks and stones may break my bones, but I can read your email...

  14. Re:Why bother keeping corporate policies up to dat by trolltalk.com · · Score: 4, Insightful

    "Bryan, the IT director for the U.S. division of German company, discovered an employee using a company computer to view pornography of Asian women and of children."

    And how did he know this, if he wasn't LOOKING at the damned stuff himself?

    1. Someone looking at adult porn is not an "ethical problem", unless you got your ethics from the bible belt.

    2. Someone looking at kiddie porn isn't an "ethical problem" either - its a legal problem! Like in "against the law".

    3. Not reporting it because you would have to admit you were snooping on other people - priceless AND retarded.

  15. Re:Summary has 2 different ethical problems by NDPTAL85 · · Score: 5, Insightful

    You think your so much better than a plumber or electrician don't you?

    I bet you they have codes of ethics too concerning not stealing things in their clients homes and such.

    A jerk is a jerk no matter what industry they're in.

    --
    Mac OS X and Windows XP working side by side to fight back the night.
  16. Re:Not entirely ethics by trolltalk.com · · Score: 5, Funny

    Come off it ... 70% of ALL porn-viewing is during working hours.

    Your boss does it. Your coworkers do it. Get over it.

    As long as you get your work done, who gives a shit? Better they look at pr0n than some site that advocates that "Jebus is comiong soon" and they start putting bible tracts on your keyboard ... THAT is a real invasion of a person's "space".

  17. Actually, the most sensible thing is by Anonymous Coward · · Score: 4, Insightful

    "Thus, based on legal advice, my employees are instructed to notify law enforcement *before* notifying management"

    And who wants to fuss with that. My advice would be to (a) never look at anything that would cause you to be forced to report anything (b) if you do, make sure no one else knows and pretend it never happened (c) if caught in a dilemma, tell your boss anyway and say you weren't sure if this applied and you need his/her guidance.

    That's the only sensible thing to do, but I realize you can't give that as official advice.

  18. Re:Why bother keeping corporate policies up to dat by Lord+Apathy · · Score: 4, Funny

    Well reporting it to upper management is possibly one of the worst things you can do. In the example he said he knew about the kiddy porn and report it to upper managment. Well, that was your first mistake. First thing you did was single yourself out as a trouble maker and a snitch. People don't like snitches, even if it is for a good reason.

    Well he reported the shit and nothing happened. Well possibly nobody believed him so he outed himself for no good reason. Then most upper management blokes tend to run in packs. So odds are he outed his mark to a friend of his mark. The person he outed and the person he outed to could have booth been trading kiddy porn or the person he outed just simply said he wasn't to his frined. Who would you believe? So the only thing he did was paint a fat ass target on his ass.

    I would have anonymously figure out a way to rig his computer to send all his kiddy porn to a "public" printer. The biggest fucking color printer in the place. Maybe one of those big ass HP with paper rolls on it. For extra kick I would have set it to go off when the office prude or church lady was standing next to it. Then I would fire the bitch off and stand back and watch the fun.

    Mr Kiddy porn gets what's coming to him. I'm not on anyone elses shit list and I have a good laugh at someone elses expense. Of course the whole fuckign thing can backfire. I might not be as good as I think I am and the whole barking mess could fall right back in to my lap with a fat ass thund follwed by a clang.

    but I'm that good.. so no worries...

    --

    Supporting World Peace Through Nuclear Pacification

  19. Re:Why bother keeping corporate policies up to dat by ePhil_One · · Score: 4, Insightful
    and send them back to management and marketing

    Perhaps you know different IT folks than I do. Most of the IT guys I know would do very poorly in both of these roles.

    I think the point of a "Professional Association" is that it would raise the risk of unethical behavior. Right now you get caught with your fingers in the cookie jar & lose your job, you'll have a new one in a few months, and the old job will likely only "confirm employment" because of HR policy. If there was a professional society companies could refer to, they might able to inflict a more serious punishment. Of course, given the lack of success with similar professional organizations in Law & Medicine in policing their memberships, my confidence level is low.

    --
    You are in a maze of twisted little posts, all alike.
  20. Re:Why bother keeping corporate policies up to dat by Original+Replica · · Score: 4, Insightful

    Competition for labor drives down the wages of those paid above what is required to get someone to do it, and pushes up the wages where there are labor shortages.

    I agree with you that it is how it should work. I hope you don't think that's how upper management pay scale works in the real world. Given that the people in charge of the large organizations don't play by those rules, it makes little sense for the people that work for the large organizations to play by those rules.
    From my own personal experience: I'm a stagehand, I used to work Off-Broadway on for-profit commercial shows (multi-million dollars budgets). Most of the stagehands that work in those venues have college degrees in stagecraft. The pay scale works out to a lower lower middle class lifestyle in NYC. $20 an hour doesn't go far in NYC. Forget raising a family on that here. Forget health insurance. There was a high attrition rate, but there was always a new batch of college grads that would fill the ranks. Then I moved on to Broadway. Broadway stagehands are union. The job is really the same, but we make twice as much money as Off-Broadway. The attrition rate is pretty low. People have insurance and can afford to have kids. The tickets cost twice as much for the consumer. Yet strangely, Broadway is thriving, while the Commercial Off-Broadway scene is slowly vanishing, so your theoretical "blight on consumers" doesn't seem to be happening. Granted there are unions out there who don't honestly factor in profits (or lack there of) when they are making demands in a contract negotiation. Not only do those unions give other unions a bad name, but they destroy their own industry. However, there is plenty of room between "destroying the industry" and "the minimum that someone will accept for the job" It's that difference that keeps the attrition rate low and allows for stagehands with decades of high level experience, those experienced stagehands are well worth the price of two or three fresh from college employees. In the non-union Off-Broadway scene those experienced workers never emerge because of attrition, but there is always someone willing to do the job. Now be it a union or a professional licensing organization, keeping the labor cost/value above the bare minimum, but within what the industry will bear, results a healthier more sustainable work culture. As for end-consumer costs, those are always as high as the market will bear, the only difference is the internal distribution of the cash flow. By doing any job for less than the guy who was doing the job yesterday, are you really going to save the consumer money or are you just increasing the year-end bonus for someone already in the highest tax bracket? You seem to have some sort of pride in your willingness to do-more-for-less, as though that will somehow make life better for the common man or will earn you the love and respect of the company you work for. From my perspective: you are the common man, make life better for yourself by attaching a (carefully considered) high price to your labor. A paycheck that supports a high standard of living is how companies show respect.

    --
    We are all just people.
  21. Re:Why bother keeping corporate policies up to dat by ucla74 · · Score: 4, Funny

    So this professional association might be "Professional Information Technologists Association"? PITA, right?