Case 1: Ethics, Moral Dilemmas, Tough Decisions
The pervasive use of IT in organizations and society present individuals with new ethical challenges and dilemmas
If companies don’t set ethical policies and guidelines, or don’t make sure that employees know what they are and understand them, companies cannot hold workers accountable for their unethical behavior
Case Study Questions 1:
Companies are developing ethical policies and guidelines for legal reasons, but also to clarify what is acceptable and what is not
– Do you think any of the issues raised in the case required clarification?
– Would you take exception to any of them being classified as inappropriate behavior?
– Why do you think these things happen anyway?
Case Study Questions 2:
In the first example (Bryan’s), it is apparent that he did not believe justice had been ultimately served by the decision his company made
– Should he have taken the issue to the authorities?
– Or, was it enough that he reported the problem through the proper channels and let the organization handle it, as recommended by Linn Hynds?
Case Study Questions 3:
In the case, Gary chose not to stop his boss from installing unlicensed software, although he refused to do it himself
– If installing unlicensed software is wrong, is there any difference between refusing to do it versus not stopping somebody else?
– Do you buy his argument that it was not really going to hurt anybody? Why or why not?
What Bryan found on an executives computer six years ago still weighs heavily on his mind. He is particularly troubled that the man he discovered using a company PC to view pornography of Asian women and of children was subsequently promoted and moved to China to run a manufacturing plant.
To this day, I regret not taking that stuff to the FBI, says Bryan.
It happened when Bryan, who asked that his last name not be published, was IT director at the U.S. division of a $500 million multinational corporation based in Germany.
The company’s Internet usage policy, which Bryan helped develop with input from senior management, prohibited the use of company computers to access pornographic or adult-content Web sites. One of Bryan’s duties was to monitor employee Web surfing using products from Surf Control PLC and report any violations to management.
Bryan knew that the executive, who was a level above him in another department, was popular within both the U.S. division and the German parent. But when the tools turned up dozens of pornographic Web sites visited by the execs computer, Bryan followed the policy. That’s what its there for. I wasn’t going to get into trouble for following the policy, he reasoned.
Bryan’s case is a good example of the ethical dilemmas that IT workers may encounter on the job. IT employees have privileged access to digital information, both personal and professional, throughout the company, and they have the technical prowess to manipulate that information.
That gives them both the power and responsibility to monitor and report employees who break company rules. IT professionals may also uncover evidence that a co-worker is, say, embezzling funds, or they could be tempted to peek at private salary information or personal e-mails. But there’s little guidance on what to do in these uncomfortable situations.
In the case of the porn-viewing executive, Bryan didn’t get into trouble, but neither did the executive, who came up with a pretty outlandish explanation that the company accepted, Bryan says. He considered going to the FBI, but the Internet bubble had just burst, and jobs were hard to come by. It was a tough choice, Bryan says. [But] I had a family to feed.
Perhaps it would ease Bryan s conscience to know that he did just what labor attorney Linn Hynds, a senior partner at Honigman Miller Schwartz and Cohn LLP, would have advised in his case. Let the company handle it, she says. Make sure you report violations to the right person in your company, and show them the evidence. After that, leave it to the people who are supposed to be making that decision.
Ideally, corporate policy takes over where the law stops, governing workplace ethics to clear up gray areas and remove personal judgment from the equation as much as possible.
If you don’t set out your policy and your guidelines, if you don’t make sure that people know what they are and understand them, you re in no position to hold [workers] accountable, says John Reece, a former CIO at the Internal Revenue Service and Time Warner Inc. Having clear ethical guidelines also lets employees off the hook emotionally if the person they discover breaking the policy is a friend, a direct report or a supervisor, says Reece, who is now head of consultancy John C. Reece and Associates LLC.
Organizations that have policies in place often focus on areas where they had trouble in the past or emphasize whatever they are most worried about. When Reece was at the IRS, for example, the biggest emphasis was on protecting the confidentiality of taxpayer information, he says. At the U.S. Department of Defense, policies usually emphasize procurement rules, notes Stephen Northcutt, president of the SANS Technology Institute and author of IT Ethics Handbook: Right and Wrong for IT Professionals
Adding to the complexity, an organization that depends on highly skilled workers might be more lenient. When Northcutt worked in IT security at the Naval Surface Warfare Center in Virginia, it was a rarefied atmosphere of highly sought-after Ph.D.s. I was told pretty clearly that if I made a whole lot of Ph.D.s very unhappy so that they left, the organization wouldn’t need me anymore, says Northcutt.
Of course, that wasn’t written in any policy manual, so Northcutt had to read between the lines. The way I interpreted it was: Child pornography, turn that in, he says. But if the leading mathematician wants to download some pictures of naked girls, they didn’t want to hear from me.
Northcutt says that he did find child porn on two occasions and that both events led to prosecution. As for other offensive photos that he encountered, Northcutt pointed out to his superiors that there might be a legal liability, citing a Supreme Court decision that found that similar pictures at a military installation indicated a pervasive atmosphere of sexual harassment. That did the trick. Once they saw that law was involved, they were more willing to change culture and policy, Northcutt says.
When policies aren’t clear, ethical decisions are left to the judgment of IT employees, which varies by person and the particular circumstances.
That might be useful for Tim, a systems administrator who works at a Fortune 500 agricultural business. When Tim, who asked that his last name not be published, happened across an unencrypted spreadsheet of salary information on a managers PC, he copied it. He didn’t share the information with anyone or use it to his advantage. It was an impulsive act, he admits, that stemmed from frustration with his employer. I didn’t take it for nefarious reasons; I just took it to prove that I could, he says.
Tim actions point to a disturbing trend: IT workers justifying their ethically questionable behavior. That path can end in criminal activity, says fraud investigator Chuck Martell. We started seeing a few cases about seven or eight years ago, says Martell, managing director of investigative services at VERITAS Global LLC, a security firm in Southfield, Mich. Now were [investigating] a tremendous amount of them.