Opening the book…
5.2.1. Information Systems Ethics
The term ethics is defined as “a set of moral principles” or “the principles of conduct governing an individual or a group.”
Since the dawn of civilization, the study of ethics and its impact has fascinated mankind.
But what do ethics have to do with information systems?
The introduction of new technology can have a profound effect on human behavior. New technologies give us capabilities that we did not have before, which in turn create environments and situations that have not been specifically addressed in ethical terms.
Those who master new technologies gain new power; those who cannot or do not master them may lose power. In 1913, Henry Ford implemented the first moving assembly line to create his Model T cars. While this was a great step forward technologically (and economically), the assembly line reduced the value of human beings in the production process.
The development of the atomic bomb concentrated unimaginable power in the hands of one government, which then had to wrestle with the decision to use it. President Harry Truman made the decision in 1945, launching two bombs, in Hiroshima and in Nagasaki, Japan.
| Other "ethical" issues | ||
 |
 |
 |
|
Dolly was a female sheep and the first mammal that was cloned from an adult somatic cell (in Scotland, 1996) using the process of nuclear transfer from a cell taken from a mammary gland. |
The Human Genome Project (HGP) determined the base pairs that make up human DNA. It identified, mapped and sequenced all of the genes of the human genome from both a physical and a functional standpoint. It took from 1990 to 2003. |
Neuralink’s mission is to create a generalized brain interface to restore autonomy to those with unmet medical needs today and unlock human potential tomorrow. Their brain-computer interface is designed to let you control a computer or mobile device. |
| Image by Toni Barros, CC BY-SA 2.0, from Wikimedia Commons | Image by Geralt from Pixabay | Image by Mike Cai Chen, Public Domain, from Wikimedia Commons |
Today’s digital technologies have created new categories of ethical dilemmas.
For example, the ability to anonymously make perfect copies of digital music has tempted many music fans to download copyrighted music for their own use without making payment to the music’s owner.
Many of those who would never have walked into a music store and stolen a CD find themselves with dozens of illegally downloaded albums.
Digital technologies have given us the ability to aggregate information from multiple sources to create profiles of people.
What would have taken weeks of work in the past can now be done in seconds, allowing private organizations and governments to know more about individuals than at any time in history.
This information has value but also chips away at the privacy of consumers and citizens.
Do you want to read more?
Ethical Issues in Information Technology (IT)
5.2.2. Code of Ethics
One method for navigating new ethical waters is a code of ethics.
A code of ethics is a document that outlines a set of acceptable behaviors for a professional or social group; generally, it is agreed to by all members of the group.
The document details different actions that are considered appropriate and inappropriate.
A good example of a code of ethics is the Code of Ethics and Professional Conduct of the ACM, an organization of computing professionals that includes academics, researchers, and practitioners.
Here is a quote from the preamble:
Commitment to ethical professional conduct is expected of every member (voting members, associate members, and student members) of the Association for Computing Machinery (ACM).
This Code, consisting of 24 imperatives formulated as statements of personal responsibility, identifies the elements of such a commitment. It contains many, but not all, issues professionals are likely to face. In the ACM’s code, you will find many straightforward ethical instructions, such as the admonition to be honest and trustworthy.
But because this is also an organization of professionals that focuses on computing, there are more specific admonitions that relate directly to information technology:
No one should enter or use another’s computer system, software, or data files without permission. One must always have appropriate approval before using system resources, including communication ports, file space, other system peripherals, and computer time.
Designing or implementing systems that deliberately or inadvertently demean individuals or groups is ethically unacceptable.
Organizational leaders are responsible for ensuring that computer systems enhance, not degrade, the quality of working life.
| You can also check PGCC's Student Code of Conduct. |
Advantages
One of the major advantages of creating a code of ethics is that it clarifies the acceptable standards of behavior for a professional group.
The varied backgrounds and experiences of the members of a group lead to a variety of ideas regarding what is acceptable behavior.
While too many the guidelines may seem obvious, having these items detailed provides clarity and consistency.
Explicitly stating standards communicates the common guidelines to everyone in a clear manner.
Drawbacks
Having a code of ethics can also have some drawbacks.
First of all, a code of ethics does not have legal authority; in other words, breaking a code of ethics is not a crime in itself.
So, what happens if someone violates one of the guidelines? Many codes of ethics include a section that describes how such situations will be handled. In many cases, repeated violations of the code result in expulsion from the group.
In the case of ACM:
“Adherence of professionals to a code of ethics is largely a voluntary matter. However, if a member does not follow this code by engaging in gross misconduct, membership in ACM may be terminated.”
Expulsion from ACM may not have much of an impact on many individuals, since membership in ACM is usually not a requirement for employment. However, expulsion from other organizations, such as a state bar organization or medical board, could carry a huge impact.
Another possible disadvantage of a code of ethics is that there is always a chance that important issues will arise that are not specifically addressed in the code.
Technology is quickly changing, and a code of ethics might not be updated often enough to keep up with all of the changes.
A good code of ethics, however, is written in a broad enough fashion that it can address the ethical issues of potential changes to technology while the organization behind the code makes revisions.
Finally, a code of ethics could have also been a disadvantage in that it may not entirely reflect the ethics or morals of every member of the group.
Organizations with a diverse membership may have internal conflicts as to what is acceptable behavior. For example, there may be a difference of opinion on the consumption of alcoholic beverages at company events. In such cases, the organization must make a choice about the importance of addressing a specific behavior in the code.
Ethical Principles in Cybersecurity
They are the moral standards and practices that guide cybersecurity professionals:
- Confidentiality (Part of the CIA triad)
- Privacy protections (Safeguarding personal information from unauthorized use)
- Laws (Rules recognized by a community and enforced by a governing entity).
Hackers
A hacker is a person who uses technical skill to gain unauthorized access to computer systems, or an expert programmer who deeply understands computer technology.
| Hacker. Image by Mohamed_hassan from Pixabay. |
According to Mitnick Security, there are different types of hackers:
White Hat Hackers (Ethical Hackers)
White hat hackers operate on the side of defense. Whether they work as penetration testers, security consultants, or internal red teams, they use their expertise to find and patch system weaknesses.
Black Hat Hackers (Malicious Actors)
Black hats are the bad actors, motivated by monetary gain, disruption, or sabotage. They deploy malware, ransomware, credential theft, and other malicious tactics to exploit vulnerabilities, steal data, or damage systems. Their work often underpins cybercrime ecosystems.
Grey Hat Hackers
Occupying the gray area between hacker categories, grey hats may test systems without authorization, but without purely malicious intent. Sometimes they disclose vulnerabilities publicly, hoping to prompt a fix. Their actions may be controversial, but not definitively criminal in motive.
Hacktivists
Hacktivists leverage hacking to advance social or political causes, think cyber protests, data leaks, and digital disruption. Groups like Anonymous fit this category, balancing activism and cyber risk.
Script kiddies
Script kiddie is a derogative term that computer hackers coined to refer to immature, but often just as dangerous, exploiters of internet security weaknesses. They are typically motivated by simple, personal reasons -- to have fun, create chaos, seek attention or take revenge.
5.2.3. Acceptable Use Policy
Many organizations that provide technology services to a group of constituents or the public require agreement to an acceptable use policy (AUP) before those services can be accessed.
Similar to a code of ethics, this policy outlines what is allowed and what is not allowed while someone is using the organization’s services.
An everyday example of this is the terms of service that must be agreed to before using the public Wi-Fi at Starbucks, McDonald’s, or even a university.
Here is an example of an acceptable use policy from Virginia Tech:
…
Acceptable use is always ethical, reflects academic honesty, and shows restraint in the consumption of shared resources. It demonstrates respect for intellectual property, ownership of data, system security mechanisms, and individuals' rights to privacy and to freedom from intimidation and harassment.
…
Just as with a code of ethics, these acceptable use policies specify what is allowed and what is not allowed.
Again, while some of the items listed are obvious to most, others are not so obvious:
- “Borrowing” someone else’s login ID and password is prohibited.
- Using the provided access for commercial purposes, such as hosting your own business website, is not allowed.
- Sending out unsolicited emails to a large group of people is prohibited.
Also, as with codes of ethics, violations of these policies have various consequences.
In most cases, such as with Wi-Fi, violating the acceptable use policy will mean that you will lose your access to the resource.
While losing access to Wi-Fi at Starbucks may not have a lasting impact, a university student getting banned from the university’s Wi-Fi (or possibly all network resources) could have a large impact.
| PGCC AUP. Screenshot by Luis R Castellanos, Public Domain, Own work. |
5.2.4. Intellectual Property
One of the domains that have been deeply impacted by digital technologies is the domain of intellectual property. Digital technologies have driven a rise in new intellectual property claims and made it much more difficult to defend intellectual property.
Intellectual property is defined as “property (as an idea, invention, or process) that derives from the work of the mind or intellect.”
This could include creations such as song lyrics, a computer program, a new type of toaster, or even a sculpture.
Practically speaking, it is very difficult to protect an idea. Instead, intellectual property laws are written to protect the tangible results of an idea. In other words, just coming up with a song in your head is not protected, but if you write it down it can be protected.
Protection of intellectual property is important because it gives people an incentive to be creative.
Innovators with great ideas will be more likely to pursue those ideas if they have a clear understanding of how they will benefit.
| Intellectual property. Image by Crazy Motions from Pexels. |
In the US Constitution, Article 8, Section 8, the authors saw fit to recognize the importance of protecting creative works:
Congress shall have the power . . . To promote the Progress of Science and useful Arts, by securing for limited times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.
An important point to note here is the “limited time” qualification.
While protecting intellectual property is important because of the incentives it provides, it is also necessary to limit the amount of benefit that can be received and allow the results of ideas to become part of the public domain.
The public domain is the realm of creative works that are not protected by copyright and are free for anyone to use, reproduce, distribute, and create derivative works from, without permission or payment to a former copyright owner.
Outside of the US, intellectual property protections vary. You can find out more about a specific country’s intellectual property laws by visiting the World Intellectual Property Organization.
5.2.5. Copyright
Copyright is the protection given to songs, computer programs, books, and other creative works.
Any work that has an “author” can be copyrighted. Under the terms of copyright, the author of work controls what can be done with the work, including:
- Who can make copies of the work.
- Who can make derivative works from the original work.
- Who can perform the work publicly.
- Who can display the work publicly.
- Who can distribute the work.
Many times, work is not owned by an individual but is instead owned by a publisher with whom the original author has an agreement.
In return for the rights to the work, the publisher will market and distribute the work and then pay the original author a portion of the proceeds.
Copyright protection lasts for the life of the original author plus seventy years.
In the case of a copyrighted work owned by a publisher or another third party, the protection lasts for ninety-five years from the original creation date.
For works created before 1978, the protections vary slightly.
You can see the full details on copyright protections by reviewing the Copyright Basics document available at the US Copyright Office’s website.
Obtaining Copyright Protection
In the United States, copyright is obtained by the simple act of creating the original work.
In other words, when an author writes down that song, makes that film, or designs that program, he or she automatically has the copyright.
However, for a work that will be used commercially, it is advisable to register for a copyright with the US Copyright Office.
A registered copyright is needed in order to bring legal action against someone who has used a work without permission.
First Sale Doctrine
If an artist creates a painting and sells it to a collector who then, for whatever reason, proceeds to destroy it, does the original artist have any recourse?
What if the collector, instead of destroying it, begins making copies of it and sells them?
Is this allowed?
The first sale doctrine is a part of copyright law that addresses this, as shown.
The first sale doctrine, codified at 17 U.S.C. § 109, provides that an individual who knowingly purchases a copy of a copyrighted work from the copyright holder receives the right to sell, display or otherwise dispose of that particular copy, notwithstanding the interests of the copyright owner.
So, in our examples, the copyright owner has no recourse if the collector destroys the artwork. But the collector does not have the right to make copies of the artwork.
Fair Use
Another important provision within copyright law is that of fair use.
Fair use is a limitation on copyright law that allows for the use of protected works without prior authorization in specific cases.
For example, if a teacher wanted to discuss a current event in his/her class, the teacher could pass out copies of a copyrighted news story to the students without first getting permission.
Fair use is also what allows a student to quote a small portion of a copyrighted work in a research paper.
The following four factors are considered when determining if something constitutes fair use:
- The purpose and character of the use, including whether such use is of commercial nature or is for nonprofit educational purposes;
- The nature of the copyrighted work;
- The amount and substantiality of the portion used in relation to the copyrighted work as a whole;
- The effect of the use upon the potential market for, or value of, the copyrighted work.
Copyleft
Copyleft is the practice of granting the right to freely distribute and modify intellectual property with the requirement that the same rights be preserved in derivative works created from that property.
Copyleft is an arrangement whereby software or artistic work may be used, modified, and distributed freely on condition that anything derived from it is bound by the same conditions.
Creative Common
A Creative Commons license is a public copyright license that enables the free distribution of an otherwise copyrighted "work".
A CC license is used when an author wants to give other people the right to share, use, and build upon a work that the author has created.
CC protects the people who use or redistribute an author's work from concerns of copyright infringement as long as they abide by the specified conditions.
 |
 |
 |
 |
| Copyright logo. By Emoji One, CC BY-SA 4.0, from Wikimedia Commons | Fair Use logo. By Tkgd2007, Public Domain, from Wikimedia Commons | Copyleft logo. By Zscout370, Public Domain, from Wikimedia Commons | Creative Commons logo. By Quibik, Public Domain, from Wikipedia Commons |
| Creative Commons licenses. Image by Tvvshy, CC0, from Wikimedia Commons |
5.2.6. Patents
Another important form of intellectual property protection is the patent. A patent creates protection for someone who invents a new product or process. The definition of invention is quite broad and covers many different fields. Here are some examples of items receiving patents:
|
|
Once a patent is granted, it provides the inventor with protection from others infringing on his or her patent.
A patent holder has the right to exclude others from making, using, offering for sale, or selling the invention throughout the US or importing the invention into the US for a limited time in exchange for public disclosure of the invention when the patent is granted.
As with copyright, patent protection lasts for a limited period of time before the invention or process enters the public domain.
In the US, a patent lasts twenty years. This is why generic drugs are available to replace brand-name drugs after twenty years.
| Generic medicine. By Tima Miroshnichenko from Pexels |
Business Method Patents
Most patents protect a physical object. However, a business method patent is a type of utility patent that protects a process such as one created in a software program. It has proved especially useful to online companies that use software for their business.
Protection through a business method patent, also known as an Internet patent, allows the owner to control rights to that business method during the life of the patent. This means that they can prevent other companies from using the process, or they can license the process to other companies for a fee.
There are five main requirements for patenting a business method.
- The business method must be patentable subject matter rather than an abstract idea.
- It also must meet the usefulness requirement, but this is a low threshold to meet.
- The method only must produce a concrete result.
- Show that the method is novel and
- Show that it is not obvious.
A novel business method must be different from any previous method or invention, and it must not have been exposed to the public. A method is exposed to the public if it was used publicly or described in a publication before the application was filed.
A business method that is non-obvious must produce a result that is new or unexpected to someone in the relevant field. This is often determined by assessing whether someone in the field would have seen the new method as a natural evolution of previous methods.
Two examples of patented business methods are: Hay Job evasluation method, and Six Sigma.
The Digital Millennium Copyright Act
As digital technologies have changed what it means to create, copy, and distribute media, a policy vacuum has been created. In 1998, the US Congress passed the Digital Millennium Copyright Act (DMCA), which extended copyright law to take into consideration digital technologies.
Two of the best-known provisions from the DMCA are the anti-circumvention provision and the “safe harbor” provision.
- The anti-circumvention provision makes it illegal to create technology to circumvent technology that has been put in place to protect a copyrighted work.
- The “safe harbor” provision limits the liability of online service providers when someone using their services commits copyright infringement. This is the provision that allows YouTube, for example, not to be held liable when someone posts a clip from a copyrighted movie.
5.2.7. Privacy
The term privacy has many definitions, but for our purposes, privacy will mean the ability to control information about oneself. Our ability to maintain our privacy has eroded substantially in the past decades, due to information systems.
Personally Identifiable Information
Information about a person that can be used to uniquely establish that person’s identity is called personally identifiable information, or PII. This is a broad category that includes information such as:
|
|
Though recently, there has been used another category in the private information:
|
Personally Identifiable Information Any information that can be used to identify an individual directly or indirectly, such as a name, email address, Social Security Number or IP address.
|
Sensitive Personally Identifiable Information Any PII that if lost, stolen, or disclosed without authorization could result in significant harm to an individual.
|
Just because companies are required to protect your information does not mean they are restricted from sharing it. In the US, companies can share your information without your explicit consent, though not all do so. Companies that collect PII and SPII are urged to create a privacy policy and post it on their website.
While the privacy laws in the US seek to balance consumer protection with promoting commerce, in the European Union privacy is considered a fundamental right that outweighs the interests of commerce.
Restrictions on Record Collecting
In the US, the government has strict guidelines on how much information can be collected about its citizens. Certain classes of information have been restricted by laws over time, and the advent of digital tools has made these restrictions more important than ever. Let’s see some Privacy Laws in the US.
Children’s Online Privacy Protection Act
Websites that are collecting information from children under the age of thirteen are required to comply with the Children’s Online Privacy Protection Act (COPPA), which is enforced by the Federal Trade Commission (FTC).
To comply with COPPA, organizations must make a good-faith effort to determine the age of those accessing their websites and, if users are under thirteen years old, must obtain parental consent before collecting any information.
| Children's Online Privacy Protection Rule (COPPA) Text of Rule |
Family Educational Rights and Privacy Act
The Family Educational Rights and Privacy Act (FERPA) is a US law that protects the privacy of student education records.
In brief, this law specifies that parents have a right to their child’s educational information until the child reaches either the age of eighteen or begins attending school beyond the high school level. At that point, control of the information is given to the child.
While this law is not specifically about the digital collection of information on the Internet, the educational institutions that are collecting student information are at a higher risk for disclosing it improperly because of digital technologies.
| Family Educational Rights and Privacy Act (FERPA) Text of Rule |
Health Insurance Portability and Accountability Act
Health Insurance Portability and Accountability Act (HIPAA) of 1996 is the law that specifically singles out records related to health care as a special class of personally identifiable information.
This law gives patients specific rights to control their medical records, requires health care providers and others who maintain this information to get specific permission in order to share it, and imposes penalties on the institutions that breach this trust.
Since much of this information is now shared via electronic medical records, the protection of those systems becomes paramount.
| Health Insurance Portability and Accountability Act (HIPAA) Text of Rule |
Non-Obvious Relationship Awareness
Digital technologies have given us many new capabilities that simplify and expedite the collection of personal information.
Non-Obvious Relationship Awareness (NORA) is a data analysis technology used to find hidden connections between people, places, and events across different databases, rather than a standalone legal statute.
It is a data-mining and entity-resolution process that combines separate pieces of information—like shared phone numbers, addresses, or transaction logs—to reveal relationships that are not immediately clear
Every time we come into contact with digital technologies, information about us is being made available. From our location to our web-surfing habits, our criminal record to our credit report, we are constantly being monitored. This information can then be aggregated to create profiles of each and every one of us.
While much of the information collected was available in the past, collecting it and combining it took time and effort. Today, detailed information about us is available for purchase from different companies. Even information not categorized as PII or SPII can be aggregated in such a way that an individual can be identified.
So, this process of collecting large quantities of a variety of information and then combining it to create profiles of individuals is known as Non-Obvious Relationship Awareness or NORA.
First commercialized by big casinos looking to find cheaters, NORA is used by both government agencies and private organizations, and it is big business. In some settings, NORA can bring many benefits, such as in law enforcement. By being able to identify potential criminals more quickly, crimes can be solved more quickly or even prevented before they happen. But these advantages come at a price: our privacy.
 |
 |
 |
 |
|
Children’s Online Privacy Protection Act (COPPA) logo By KeremMK6162, Public domain, from Wikimedia Commons |
US Department of Education logo By U.S. Army Heraldry Directorate, Public domain, from Wikimedia Commons |
Health Insurance Portability and Accountability Act (HIPAA) logo By GOV, Public domain, from Wikimedia Commons |
Non-Obvious Relationship Awareness (NORA) By David T. Bourgeois, CC BY 3.0, Libretexts |
.webp){kind=link}
Flock cameras
Flock Safety cameras—automated license plate readers (ALPRs) powered by AI—have sparked widespread debate among civil liberties groups, law enforcement agencies, and local governments. While marketed as crime-fighting tools to locate stolen vehicles or wanted suspects, critics argue that they create an invasive, warrantless mass surveillance network.
Read more in MalwareBytes portal
Recommended TV Show
Person of Interest (2011 - 2016) is a science-fiction crime thriller television series about a reclusive billionaire who builds a mass-surveillance AI to stop violent crimes.
Cast: Jim Caviezel, Taraji P. Henson, Kevin Chapman, Michael Emerson, Amy Acker, Sarah Shahi.
Mitnick Security. Types of Hackers. 2025. Link.
PGCC. INT1010: Concepts in Computing. Libretexts. 2021. Link.
| Banner image by Tima Miroshnichenko from Pexels |
This page titled 5.2: The Ethical and Legal Implications of Information Systems was last modified on Sat, 17 Oct 2026 17:10:20 GMT and is shared under a CC BY-SA 4.0 license and was authored, remixed, and/or curated by Luis Castellanos Hurtado.
The book could not be loaded just now.