Ethical and Social Aspects of Computing

The primary consideration is your moral duty to universalize your actions, not the consequences (like getting fired or losing your job).

The 2nd formulation states you should treat others as ends, not merely as a means. By deceiving users to collect data, the company is using them as a mere means to gain profit. You have a duty to respect the users' rationality, which outweighs the contract's secrecy requirement.

Act Utilitarianism might justify keeping the secret if the immediate "good" (job security, company profit) outweighs the harm. However, a Rule Utilitarian would look at the long-term consequences of a rule like "Employees should never report the company's unethical behavior." If everyone followed that rule, societal trust in technology would collapse, creating massive long-term unhappiness. Thus, a Rule Utilitarian would likely support reporting the breach.

The focus is on the character of the agents (the company and you) and whether the action helps a human "flourish".

A virtuous company would do "the right thing at the right time for the right reason". If the company is exploiting the intern to avoid paying fair wages (a lack of justice or fairness), they are not cultivating excellence or genuine flourishing, but rather acting out of greed—a vice.

A Kantian would evaluate whether the rule "interns should not be paid" can be universalized without contradiction, or if it treats the intern as a "means" to save company money. Virtue Ethics would instead ask if the company's treatment of the intern is the action of a "virtuous person" (e.g., one who is honest, just, and fair) and whether it helps the intern develop their character and reach their potential.

Under the Agency model, the professional acts strictly as the client's agent, carrying out exactly what the client instructs, treating the client as the decision-maker. Under the Paternalistic model, the professional (Layla) would use her specialized technical knowledge to make the decision for the client, overriding the client's stated wishes because she believes it serves their best interest.

Blindly following the Agency model here is not automatically ethical — professional ethics holds that neither party in a relationship should take advantage of the other, and a professional's specialized knowledge creates a responsibility to warn the client of serious risks (like major data loss) even if the client is the one paying. Simply doing whatever the client wants without raising the security risk fails Layla's duty of honesty and competence toward the client, and could itself cause harm the client never knowingly consented to.

Social Contract Theory holds that clients implicitly trust professionals to use their expertise responsibly in exchange for payment; that mutual trust is the actual "contract" underlying the relationship, not merely following literal instructions. If Layla's manager tells her to blindly execute the client's insecure design without disclosing the risk, the company is breaking the implicit agreement that a professional will act competently and honestly on the client's behalf, even though no explicit rule was violated.

The slides describe system administrators as holding significant authority — they have the technical ability and legitimate access to monitor essentially all activity on the network — but that authority comes paired with a strict obligation to adhere to a code of ethics, since that same access can easily be abused.

Virtue Ethics asks what a person of good character (e.g., someone with integrity, discretion, and respect for others) would do, not just whether an act is against a written rule. A virtuous sysadmin would recognize that reading a colleague's private messages out of curiosity — even though it's technically possible and no one would find out — reflects a lack of self-restraint and respect for others' dignity, and is therefore not the action of a virtuous person, regardless of the absence of consequences.

Under the 2nd Formulation, Omar must treat his colleague as an end in themselves, not merely as a means to satisfy his own curiosity. Reading the private messages without any legitimate work-related reason uses the colleague purely instrumentally, denying them the autonomy to control their own private information — this is wrong under Kantianism regardless of whether the colleague ever finds out or is ever harmed by it.

Law represents only the minimum standard of behavior required in a given country, while ethics goes further — an act can be perfectly legal in the local jurisdiction (weak safety regulation) and still be ethically wrong, because ethical obligations toward worker wellbeing don't disappear just because local law permits cutting corners.

An Act Utilitarian might accept the weaker standard if this one contract produces more profit and jobs than harm in this single instance. A Rule Utilitarian instead asks what would happen if the rule "companies should adopt whatever safety standard is cheapest and technically legal in each country" were followed universally — normalizing that rule would lead to systematically unsafe workplaces and widespread injury across the industry, producing far less total happiness, so a Rule Utilitarian would reject the weaker standard.

Corporate Social Responsibility means the company's commitment to contribute positively to society beyond pure profit — including environmental protection, social equity, and ethical labor practices. Accepting the contract purely because it is technically legal, while ignoring worker safety, would violate the company's CSR obligations to protect the wellbeing of the people affected by its operations, regardless of where those operations are located.

The first issue is using open-source code without crediting the original authors, which falls under "unauthorized software" use / intellectual property misuse. The second issue is scanning a client's live production servers without prior authorization — regardless of good intentions, using tools against systems you don't have explicit permission to test on is a network security and legal violation.

Universalizing the maxim "I may use others' open-source work without credit whenever it saves me time under pressure" means every developer facing deadline pressure would do the same — which would destroy the entire open-source ecosystem's norm of attribution that developers rely on to share and reuse work, making the maxim self-defeating and therefore impermissible under the 1st Formulation.

Scanning a client's live production servers without explicit authorization is an ethical and legal problem regardless of good intent because it treats the client's infrastructure and consent as optional — even a well-meaning scan can crash services, trigger false security alerts, or expose sensitive data, and "ethical hacking" is only ethical when scope and permission are agreed upon in advance. Without that consent, the same action is indistinguishable from unauthorized access, which is itself a violation of professional ethics and, under cyber law, can carry criminal liability.