providing ethical it...

Reading: Maintain ethical conduct in IT

Maintain ethical conduct in IT

Inside this reading:

What is an ethical service? 2Legal and industry controls 3Your ‘ethical barometer’ 4Ensure correct representation 4Professional presentation 5Providing unbiased information 6Accurate quoting and estimating 6Acknowledging others’ work 7Protect client interests 10Reliability and security 10Confidentiality and proprietary rights 12Value for money 12Identify conflicts of interest 14A word on whistle-blowing 15Summary 15Feedback to activities 16

document.doc© State of New South Wales, Department of Education and Training 2006 1


What is an ethical service?The Macquarie Dictionary defines ethical, amongst other ways, as ‘in accordance with the rules and standards of a profession’.

To provide an ethical IT service is essentially to act in an honest and professional manner. IT professionals will ensure that they and their organisation are correctly represented, that their clients are advised of any conflict of interest, and that the interests of the client, internal or external, are properly protected.

Activity 1

You are probably familiar with the language used to describe ethical and unethical conduct. In a minute or so, how many words could you add to the list below?

Ethical Reputable, fair, reliable …

Unethical Corrupt, fraudulent, unscrupulous …

Check your answers against the feedback provided at the end of this document.

As an IT professional you should be able to recognise potential ethical problems and decide on the appropriate action needed. Before you act, you’ll need to know:

Who decides what is the right thing to do (eg does responsibility lie with the organisation, the client or customer, or the individual employee)?

How much influence do government, industry and others have in determining ethical behaviours?

What are the ethical concerns that apply to IT professionals?



Legal and industry controlsProfessional ethics are governed by legislation, industry standards and workplace policies and procedures. These controls usually reflect community expectations and commonly held personal values, although occasionally conflicts arise. For this reason it is important there are guidelines for professional conduct when dealing with clients and customers, and that employees understand their obligations.

Legislation

A range of commonwealth and state legislation governs Australians and Australian business. You can view current legislation online at:

http://www.comlaw.gov.au/ for commonwealth legislation

http://www.legislation.nsw.gov.au for NSW State legislation.

Some government agencies make important information more accessible by publishing guidelines in ‘plain English’ and a range of other languages.

Industry codes and standards

Many industry bodies and associations publish codes and standards that govern the conduct of their members. The Australian Computer Society (ACS) Code of Ethics and Code of Professional Conduct and Professional Practice for IT professionals are available from the ACS website at http://www.acs.org.au/.

Workplace policies and procedures

Workplace policies and procedures reflect the legislation, standards and values relating to the business operations. These may be available in print, on the company intranet, or on the company’s website.

Activity 2

Print a copy of the Codes from the ACS website or add them to your Favourites folder for later reference. You’ll find them at: http://www.acs.org.au/. Select ‘The ACS – The Society’ then ‘General Policies’ from the menu. You could also look for a code from your place of work or study too. If your workplace does not have a code, try an Internet search for codes published by a similar Australian organisation.


http://www.acs.org.au/

http://www.acs.org.au/

http://www.legislation.nsw.gov.au/

http://www.comlaw.gov.au/


Your ‘ethical barometer’The term ‘ethics’ comes from the Greek word ethikos, which describes the authority of custom or tradition, a form of common law. This can be far more complex than ‘right versus wrong’; it can be a topic full of dark corners, grey areas and divided opinions.

It may help to think of the people around you as an ethical barometer. Before you act, think about how others might react—or ask them directly. Consider:

What would a legal adviser say?

What would your client, colleagues or employers say?

What would others in your profession or the wider community say?

What would your family and friends think?

How do you feel about it?

If you rely on the advice of others, be aware that some unethical people may try to influence your thinking. Ethical decision-making is not based on peer pressure or coercion.

Ensure correct representationA qualification alone does not make you a professional. You must act like a professional, demonstrate honesty and fair play, and correctly represent yourself, your organisation and your products and services in all business dealings with clients.

A professional:

Dresses and acts appropriately

Respects others’ differences

Is fair and honest in their business dealings

Abides by legal, industry and workplace standards.

For the professional, correct representation means to:

Represent your capabilities, services, or products accurately

Offer unbiased advice and disclose all relevant information

To provide accurate quotes and work estimates.



The consequences of misrepresentation can be disastrous. There are industries that, as a whole, are perceived as unethical because of the behaviour of a few ‘professionals’. Businesses may fail and workers lose jobs because of unethical conduct on the part of others. And let’s not forget the often spectacular fall of corporate high-fliers whose dishonest dealings are eventually exposed.

Let’s take a closer look at correct representation for IT professionals.

Professional presentationProfessional representation is about presenting skills, knowledge and qualifications in an honest and professional manner. Create a good impression and you will inspire confidence in what you or your company have to offer.

Professional presentation means:

Representing your capabilities, services, or products accurately

Offering unbiased advice and disclose all relevant information

Providing accurate quotes and work estimates.

Activity 3

Consider the following scenario.

At an interview, you realise that the panel assume you have certain qualifications. You don’t, but their assumption will greatly improve your chances. Should you explain?


To lie about, over-exaggerate or misrepresent expertise and experience in order to create a good impression would be unprofessional. Nor would it be professional to create a poor impression through negligence, or to misrepresent another’s skills.



Providing unbiased informationA bias is a preference for or against a product, organisation or person, usually for personal or financial reasons. While a bias is not in itself unethical, clients may rely on your expertise to make the best decisions for their business. As a professional you must be careful to provide fair and unbiased information. What would you do in this situation?

Activity 4


Your manager asks you to research new learning management systems. Of four suitable products, the front-runner is hosted off-site, and could put jobs at risk if it were approved. You only need to put three forward for evaluation committee. What should you do?


Accurate quoting and estimatingAccurate quoting and estimating means providing an external client or an internal department or employer, with a realistic picture of the time, costs, equipment and people needed to complete a job.

You might use estimating worksheets and formulas based on past projects, or conduct detailed assessment of the project requirements to do this. Whatever method you use, you should aim to provide your client with figures that are as accurate as possible, and discuss with them anything that may affect this later.

Activity 5


The initial costing for your ‘pet’ proposal did not cover ongoing maintenance and updates, which could double the cost of the project over five years. If you advise the committee of the added costs the project may not be approved. Would you add this to your proposal?




Activity 6

Accurately documenting project scope, budget and progress could avoid problems further down the track. What documents might be useful to estimate and track projects and other work?


Experience is perhaps the best tool available for preparing accurate quotes and estimates. If you’re not sure that you have it right, ask someone more experienced to look over your figures first.

Acknowledging others’ workYou have a legal and ethical obligation to correctly acknowledge the work done by others. Source code and digital content are protected under copyright law, and giving credit where credit is due is an important part of teamwork.

When you use someone else’s work, or where they worked with you on a project, it is only fair to acknowledge their efforts. For example:

‘Graphics created by Sally Smith’, for unpublished works, or

‘Smith, S. Lifeworks (2001) Moss Publishing’, for published material.

You might also acknowledge assistance informally, or during a presentation. You must also ensure you do not misrepresent others’ work, or claim it as your own.

Activity 7


You have permission to use some diagrams for workplace training purposes. The sessions are so popular that you plan to publish them online. You’ll need to include the diagrams. What should you do?




Copyright

Copyright protects published and unpublished original works such as:

images, audio and video

source code

other original work.

You have a legal obligation to obtain copyright permissions and correctly acknowledge all products and services developed by others.

Activity 8

A workmate gave you the source code for a shareware product she developed in her spare time. After you’ve made a few changes and put it on your website a software developer offers good money for the right to develop the product commercially. What should you do?


Copyright and intellectual property (IP) is a complex legal issue.

Tip: For an overview of copyright law see the brochure: ‘Copyright Law in Australia - A short guide’ from the Attorney-General’s website: http://www.ag.gov.au. Use the search function to look up the word ‘copyright’ then choose ‘A short guide to copyright’.

If you are unsure about copyright, check with someone who knows.

Moral rights

Among other things, moral rights include the right to be acknowledged as the author of a work, regardless of who owns the copyright. This means that original work produced by an employee may belong to the employer or client, but they cannot claim authorship.

Intellectual property (IP)

Intellectual property includes copyright of publicly available material, but also extends to less tangible assets and knowledge, such as patents, trademarks, designs, trade secrets and ‘know-how’.


http://www.ag.gov.au/


Freeware and shareware

It is a common misconception that freely available web content, freeware and shareware are copyright free. This is rarely the case, for example:

Some websites allow restricted copying for non-commercial purposes as long as the material is correctly acknowledged.

Freeware and shareware is not necessarily free. Commercial use is often restricted, and you still need permission to copy any source code or content.

For commercial products you should seek written permission use or reproduce others’ work. It may be acceptable to use small examples or quotes as long as they are correctly attributed.

Activity 9

Look for copyright information and links on the websites you visit. These will set out the circumstances where the information can be used or reproduced, or provide contact details you need to get permission to use the material. If you find a good example, post the link to discussions for others to view.

Activity 10

Consider the following scenario. You might like to discuss it with others to get a different perspective.

Anya, a talented and knowledgeable software designer, arrives at a client presentation late and hung-over. Anya’s team have put together a solid proposal, but her last-minute notes are scribbled all over the paperwork. When the client notices a small error, Anya jokes that the team member responsible ‘got his qual from a cornflake pack’.

Points to ponder

How would you answer the following questions?

Did Anya convince the client that her team is qualified for the job?

What specific concerns might the client have in relation to his project?

How would you feel if you were part of Anya’s team?

Could Anya’s conduct be defended or justified in any way?




Protect client interestsProtecting client interests is about doing what is best for your client’s business operations. This may be an external client, an internal department, or a colleague. It may also be an individual whose details are stored by your organisation.

Your client will expect:

Security and reliability

Confidentiality

Value for money

Professional service

Appropriate IT solutions.

Let’s take a look at some of the ways client interests can be protected.

Reliability and securityInterests such as data security, reliability and efficiency of systems, processes and equipment are obviously important to the client, as these are often the heart of their business operations. Two types of threat to the continuity of service are:

accidental loss of data or services resulting from system failure, human error or act of nature

deliberate or incidental loss or damage from hacking or other unauthorised actions.

In organisations that deal with sensitive information a security flaw, hacking incident or misuse of access privileges may also threaten continuity of service. Even if the system is otherwise intact it may need to be quarantined until the appropriate level of security can be re-established. Properly protecting your client’s interests and ensuring the continuity of service could include:

Software and data protection: Take all possible measures to prevent system crashes, viruses and other disasters, and to minimise downtime and loss of data should a critical incident occur.

Hardware: Ensure hardware is well-maintained and protected from power failure or surges. Forward planning will minimise disruption caused by old, obsolete or inadequate equipment.



Process: Develop efficient processes. Hardware and software solutions are only as good as the processes that support them.

People: Ensure that key staff and trained personnel are available to support computing services.

Activity 11

What are some strategies to help ensure reliability and security of data and services? Take a few minutes to see how many you can think of under the headings:

Software and data protection

Hardware

Process

People.


Firewalls, virus protection and system backups would be basic requirements for most IT functions. Further to this, client requirements for security and reliability should be discussed as part of the provision of IT services.

Activity 12

Consider the following scenario

Your client’s ageing system has had a few glitches recently, and when it crashed over the weekend, the support calls went unanswered. You then discover that backup device failed several weeks ago, and you cannot restore recent data.


As part of providing a professional service you may need to advise clients on what’s needed to ensure the security and reliability of their system. This will largely depend on the operational aspects of the client organisation, such as the sensitivity of the data, how much the organisation can afford, and any national and international standards that apply.



Confidentiality and proprietary rightsThe IT professional often has access to information that is confidential or commercially sensitive.

Confidentiality is about protecting the client’s proprietary rights. These are the patents, copyrights, trademarks, trade secrets, knowledge (know-how) and other intellectual property rights that belong to the client, and are not public knowledge. It is so important to some employers that they will require you to sign a confidentiality agreement or undergo security clearances before you can work for them.

Confidentiality covers business and operational information, such as tenders, data, systems, security, product details, financial dealings and product specifications. This is different from privacy, which protects the rights of individuals.

Activity 13


Your last employer permits you to briefly demonstrate parts of their new security program at job interviews. One interviewer asks for a copy of the CD to help make their final decision.

What do you do? What if the request came from a new employer who was so insistent that you felt your job was at risk if you didn’t comply?


Value for money

‘Wants’ versus ‘needs’

While pleasing your client is important, you should be aware that what the client wants and needs may not always be the same thing.



Activity 14


Your client has asked you to replace failed hardware with the same brand, but you have discovered a much cheaper product that will do the job. She has already accepted the quote, and would not notice the substitution.


Another aspect of protecting client interests is to ensure that the products and services provided represent value for money while at the same time meeting current and projected operational needs.

Finally, protecting client interests is also to ensure that the project remains within legal and ethical guidelines, and that the client is advised of any potential threats or conflicts in these areas.

Activity 15

Consider the following scenario. You might like to discuss it with others to get a different perspective.

Your project is on time and well under budget—until you identify a serious flaw that would affect a very small number of users. If you downplay the problem, the sponsor would agree to a patch after the release. Fixing the bug now could set the project back weeks.

Points to ponder

How would you answer the following questions?

Would the client interests be better served by delaying the product?

What specific concerns might the client have in relation to this project?




Identify conflicts of interestA conflict of interest is a situation where you or your organisation has goals or values that conflict with the client’s or employer’s needs. This situation may create an appearance that you are not acting in the best interests of the client or employer, whether or not you actually do so.

It is a professional responsibility to advise the employer or client of any conflict of interest as soon as possible. If the conflict cannot be resolved, it may be necessary to withdraw from a project or refuse a contract. Some examples of a conflict of interest include:

financial or personal gain at the client’s expense

professional or personal involvement with the client’s competition

non-professional relationships

involvement in a project for client’s business rival

an inappropriate business connection through a friend, partner or relative

personal or ethical bias against the client or their business.

Managing potential conflicts

There are two steps that may be taken when a conflict of interest is identified.

notify the client and employer as soon as possible

admit any bias when providing information.

Let’s look at some examples of conflict of interest that might occur in the IT industry. What would you do in this situation?

Activity 16


You and your partner work for different IT companies. This does not present a problem until your partner asks you for help in developing a tender proposal – the same tender your boss has asked you to work on. You have signed a confidentiality agreement that includes not discussing tenders your company bids for.




A word on whistle-blowingYou may have heard the term ‘whistle-blowing’. This is when an insider to an organisation alerts the outside world about perceived wrongdoing within that organisation, rather than just reporting internally. As in real cases of whistle-blowing, the consequences for whistle-blowers can be severe, such as becoming very unpopular with other staff and even losing their job.

Activity 17

What should you do if you discover that your organisation or its senior members are engaged in systematic unethical behaviour?


SummaryIn this reading you examined a range of issues relating to ethical conduct, and the ethical concerns that may arise in your work as an IT professional. You were also introduced to the legal, professional and ethical responsibilities of IT professionals, including:

representing yourself and your organisation correctly

identifying and managing conflicts of interest

protecting the interests of your client.



Feedback to activities

Activity 1

How did you go? Some of the words below might help you to understand what ethical conduct entails.

Words relating to ethical conduct could include:

reputable, fair, reliable, principled, right, moral, decent, just, honourable, law-abiding, truthful, direct, sincere, open, upright, conscientious, rigorous, integrity, honesty, reliability, truthfulness

Words relating to unethical conduct could include:

corrupt, fraudulent, unscrupulous, unprincipled, dishonourable, disreputable, deceptive, misleading, untrustworthy, unreliable, sloppy, dishonesty, cheating, treachery, trickery

Activity 3

You should explain the situation. No matter what the subsequent decision, you will gain respect for your professionalism and honesty. Refer to the ACS Code of Ethics under the heading ‘Honesty’.

Activity 4

You must consider the best interests of the client, in this case your employer, regardless of personal interests. Refer to the ACS Code of Ethics under the headings ‘Honesty’ and ‘Competence’.

Activity 5

You should inform clients of ongoing costs. It would be unethical to misrepresent the true cost of a product or service by withholding information. Refer to the ACS Code of Ethics under the headings ‘Honesty’ and ‘Competence’.



Activity 6

Some of the documents organisations use to cost and manage projects include:

specification document

costing spreadsheet

estimating worksheet

contract

project management charts

change log.

Activity 7

Work should only be used in the context for which permission is granted, so you would need to go back to the copyright owner for permission. You should also check whether they have a preferred form of acknowledgment for the published work.

Activity 8

You must explain that the product is not your work, and discuss the offer with your workmate. As the creator she has copyright for the product, although your contribution should be acknowledged.

Activity 10

Anya has let her team down by failing to present the skills, knowledge and qualifications of herself and her team in a professional manner. The client may feel that Anya would be also sloppy and unreliable when working on his project. Her team members would most likely lost confidence in her as a team leader.

Activity 11

Strategies to ensure reliability and security of data and services could include:

Software and data protection

firewalls

virus protection



uninterrupted power supply (UPS)

controlled access

automated back-up

mirror sites

offsite archiving

security measures such as encryption and digital signatures

Hardware

backup devices.

uninterrupted power supply

spare parts

regular maintenance

Process

provision for software upgrades

replacement schedules for hardware.

risk management policies

backup and restore processes

managing internal and external security breaches

backup and storage of sensitive data

provision of access and administrative privileges

quality assurance and document control processes.

Personnel

client training

help desk facility

24/7 hotline

on-call rosters

Activity 12

You may have to work hard to keep this client! A maintenance and replacement program, backup processes and an on-call support roster could prevent disruption or minimise data loss. Sometimes the best thing you can do in a situation is learn from it.



Activity 13

You should politely refuse, explaining that your responsibility for confidentiality did not end with the contract. Your potential employer may be impressed with your integrity.

Activity 14

The client’s wants in this case do not match her needs; however you would still need to present the alternative rather than ignore the client’s directions.

Activity 15

You would need to advise the client of the options and clearly identify the risks, including the serious flaw, as this could affect the reputation of his business, and the potential costs of delaying the project.

Activity 16

This is a very tricky situation. You should certainly explain the situation to your boss, who may prefer to have the tender prepared by someone else. You would need to be careful about refusing your partner’s request, since admitting the conflict of interest may breach your confidentiality agreement.

Activity 17

This will depend on the policy of your organisation in relation to whistle blowing. If, like an increasing number of organisations, your employer has an explicit whistle-blowing policy, get hold of this and follow its procedures carefully. If your employer does not have an explicit policy the situation is more difficult. Such situations are too varied to prescribe a set approach; just proceed with caution and weigh the risk to yourself against the public interest involved in exposing the wrong doing.


providing ethical it...

Documents