What are the ethical dilemmas and challenges faced by information security professionals?

JENNIFER KREIE AND TIMOTHY PAUL CRONAN

MAKING ETHICA DECISIONS

How companies might influence the choices one makes.

T oday's information technology makes vast amounts of data accessi- ble to businesses and their employ- ees. This accessibility provides great benefits but also creates the poten- tial for misuse of information tech-

nology. Businesses are concerned about the ethical behavior of their employees and the security of their information systems. Therefore, businesses are interested in whether they can infiuence their employees' decision to act ethically or unethically [1, 9]. One avenue of action for companies is to establish a code of ethics and there is evidence that having such standards does influence employees [7].

Some researchers [4, 8] believe there are certain sit- uations where external infiuences, such as company standards, are more likely to affect employees' behav- ior. This view of ethical decision-making is based on the concept of an individual's perceived importance of

an ethicaliyiE) issue [8]. When an ethical issue is per- ceived as very important, we are more likely to rely on our personal values in judging what is ethical or unethical. However, we are more open to external infiuences, such as business or professional codes of ethics or the opinions of peers, if we do not consider the ethical issue very important.

The results of a recent study support the idea that businesses can infiuence their employees' behavior particularly in certain situations. When a person feels the ethical issue in a situation is not especially impor- tant, that person is more likely to act based on what company standards say is acceptable or unacceptable behavior. This does not mean employees will ignore company standards when an ethical issue is important to them, but they are more likely to take their cue from the company when they do not feel an impor- tant ethical issue is involved. On the other hand, in a situation where a person feels the ethical issue is very

66 De<:ember2000/Vol.43,No. 12 COHMUNICAT1ONSOFTHEACM

important, that person may make a judgment based more on personal values than on business standards.

An ethics survey was given to just over 300 stu- dents' at a large university located in the midwest U.S. The survey participants were mostly from MIS classes but a few were in accounting or finance classes. Stu- dents participated voluntarily. Over three-quarters of the participants were juniors or higher—almost one- third were seniors or graduate students. The average number of years of work experience was 2.4 years. Interestingly, 45% of the participants said they had encountered an ethical dilemma at work.

The survey contained five scenarios that were adapted from [3]. The scenarios involve the use of

Q information technology and each describes an

^ Thf pa nit i pan IS induded 16 frt-shmtn, 55 sopliomores, 140 juniors, 53 seniors, and X 41 graduate students. The total number ot respondents varies tor each scenario because Q, oFsome incomplete responses.

employees actions in a particular situation. The sce- narios were chosen to represent possible ethical issues such as privacy, intellectual property, and accessibility. These scenarios have also been used in previous research conducted by the authors.'

During the survey the participants first read each scenario and judged whether what the person did was acceptable (ethical) or unacceptable (unethical).' Next, the participants were given a 7-point scale to rate the importance of the ethical issue in the scenario (very important to unimportant) and to rate the

^A ptevious Communicatiom article examined the ditTerences in ethical judgment between men and women [5|. This atEicle deals with a different data set collected with jn extended •iurvey. A stimmary of the ditTetences between men and women for the current and previous study is available on the Web at web, nmsu.edu/-jkreit7. Signifi- cant difterente.f were tound between men anii women tor some, bul not all, tesfHinses in the srudv on which rhij article ii based, -'The terms "acceptable" and "unacceptable" were used interchangeably with "ethical" and "unethical" when the survey was presented to the study parricipanis.

COMMUNICATIONS OF THE ACM December 2000/Vol, 43, No, \1 67

probability they would do the same as the person described (extremely probable to extremely improba- ble). The participants were also asked whether an established company policy against such behavior might affect the employee's behavior. Finally, partici- pants were asked to indicate the degree to which var- ious factors' influenced their judgment of the behavior described in each scenario.

The following five sections describe each scenario and highlight certain responses to survey: was the behavior acceptable or not; how important was the ethical issue; would survey respondents probably do the same; how probable is it that someone would do the same if company policy prohibited this behavior; and what percentage of respondents said personal val- ues were very influential in their judgment. The table appearing here provides an overview of the survey responses for each scenario.

Seven potenciail)' influenrial factors were discii.wed in a previous Commtinic/itions arti- de |5|: personal values, religious belief sysltm, personal environment, social envinin- menc. legal environment, husinty. environ men I, and professional environment.

Scenario One: Making Unauthorized Program Modifications The first scenario used in the ethics survey describes a programmer who modifies a bank's accounting system to bide his overdrawn account and avoid an overdraft charge. After making a deposit, the pro- grammer corrects his modification. A large majority (85%) of survey participants said it was unaccept- able for the programmer to modify the bank's accounting system, and the ethical issue was con- sidered very important by almost two-thirds (63%) of the respondents (see the table). In line with the PIE concept that people are more likely to rely on their personal values when judging an important ethical issue, many participants (72%) in this sur- vey said they relied heavily on their personal values in judging the programmer's behavior. Interestingly, 2 3 % said they would do the same as the program- mer in the scenario (a point we return to later). Thirty-seven percent believe the programmer would do the same despite company policy against such behavior.

Table 1. Summary of survey responses by scenario.

Judgment of this behavior

Unacceptable

Acceptable

Importance of the issue*

Very important

Not very important

Undecided

How probable is it that you

would do the same?**

Probable

Improbable

Undecided

If there were a stated company

policy against such behavior.

how probable is it someone

would still do it?

Probable

Improbable

Undecided

Personal values were very

infiuer)tial

Scenario 1 Programmer modifies

a bank's software to

avoid a fee.

85%

15%

63%

22% 15%

23%

66%

11%

37%

47%

16%

72%

Scenario 2 Employee keeps soft-

ware sent in error but

does not pay for it.

60%

40%

39%

40%

21%

56%

34%

)0%

54%

34%

12%

65%

Scenario 3 Programmer uses

company equipment

for personal use.

22%

78%

16%

66%

!8%

74%

15%

11%

16%

77%

7%

52%

Scenario 4

Employee uses

proprietary software

without paying fee.

75%

25%

61%

18%

21%

29%

54%

17%

41%

46%

13%

60%

Scenario 5

Employee copies

g o v e r n m e n t database

w h e n t o l d t o by boss.

73%

27%

74%

13%

13%

28%

61%

11%

25%

62%

13%

64%

* Based on a 7-point scale with responses grouped as very important ( I to 3) t o not very important (5 to 7). A rating of 4 was classified as undecided. ** Based on a 7-point scale with responses grouped as probable (1 to 3) co impmbable (5 t o 7). A rating of A was classified as undecided.

6 8 December 2000/Vol. 43, No. 12 COMMUNICATIONS OF THE ACM

Scenario Two: Keeping Something Not Paid For The second scenario presented a situation in which a person receives software ordered from a mail-order company but also finds another software package was sent in error. The extra software is not listed on the invoice. The person keeps the program without paying for it.

Table 1 shows that a majority of the study respon- dents (60%) said keeping the software was unaccept- able. In contrast to the first scenario, far fewer people (39%) said there was a very important ethical issue involved in this scenario. Many of the respondents (65%) still said personal values were very influential in their judgment (more so than any other factor). A lit- tle over half of the participants (56%) said they would also keep the software without paying for it. One explanation for this comes ftom past surveys when the

external factors such as company policy more likely to influence someone's judgment when no important ethical issue is perceived in the situation? The per- centages shown in the table appearing here lend sup- port to this proposition. Although three-quarters of the participants (74%) said they would do as the pro- grammer did, just over three-quarters (77%) said it was unlikely a person would still do so if there were a company policy against personal use of company computer equipment.

Scenario Four: Using Programs Without Paying the Required Fee The fourth scenario presents a person who was inad- vertently given access free of charge to a proprietary program. The person decides to use the program without paying the required fee. The table shows that 75% of the patticipants said it was unacceptable

People rely heavily on their personal values when deciding what is ethical or unethical behavior.

researchers have discussed the scenarios after conduct- ing the survey. Subjects have stated it is acceptable to keep the software because the mail-order company made the error and the customer is justified in taking advantage of the error. Of all five scenarios this one has the largest percentage, 54%, who believe a person would act the same despite what the company says is acceptable.

Scenario Three: Using Company Resources For Personal Purposes In the third scenario a programmer uses company computer equipment to write programs for his friends on his own time on weekends. The program- mer does not charge anything for his programs. This scenario is a good contrast with the other scenarios. It is the only scenario for which a majority (78%) said the behavior of the person was acceptable and the importance of the ethical issue was also the lowest, with only 16% of the respondents rating the issue as very important. Also, this scenario has the smallest number of people (52%) who said their personal val- ues were very influential in their decision.

Since the ethical issue wasn't very important to many, this scenario provides the opportunity to check for support of the PIE concept described here. Are

to use a proprietary program without paying the required fee and 6 1 % said this is a very important issue. Personal values were again most often rated (60%) as being very influential in the participants' decision. Fifty-four percent of the participants said they themselves would not do as the person did in the scenario, but less than half of the people (46%) feel company policy against such behavior would dissuade employees from doing this.

Scenario Five: Keeping Something Not Paid For The fmal scenario describes a marketing company employee who performs some data processing on contract for a government agency. The data concerns infotmation about children and theit patents. The employee is told by his boss to make a copy of the data for the company's tise. The contract with the government agency does not explicitly prohibit this, so the employee makes a copy of the data.

In the current survey 73% said copying the data

li k iiitL-icstLiig to noif ihat the siifijcas in the ^mdy on whiih this article i.i based judgfd itiis lith.iviot as acceptable by a mucb l.irger percentage than did the subjects in tbt 1991) survey. Sixiy percent of the students In tbe previou.s year said tbis was unatceptabic. One pos.sibie explanation is that recent news coverage of ways in which information tccbnology can tbrtaten personal privacy has heightened awareness and awareness and raised concern.

COMMUNICATIONS OF THE ACM December 2000/Vol. 43. No. \1 6 9

Reliance on personal values in many situations does not rule out that an established code of ethics

could affect what employees decide to do.

was unacceptable.^ Seventy-four percent said the eth- ical issue was very important—the largest majority of all the scenarios regarding the perceived importance of an ethical issue. Personal values were rated as a strong influence (64%), more so than other influ- ences. Twenty-eight percent said they would do the same as the employee in the scenario. Sixty-two per- cent said it was unlikely the employee would copy the data if there were a company policy against it, which may he contrary to the PIE concept.

Discussion This study offers support for the proposition that external factors, such as a company code of ethics, can he an influence when people do nor think an important ethical issue is involved. The responses to Scenario Three are of particular interest here because few felt an important ethical issue was involved. Most participants in the current survey said it was okay for a programmer to use company computer equipment for personal tise. They also said they would likely do the same. However, over three-quar- ters thought company policy against personal use of computer equipment would dissuade employees from doing as the programmer had done.

The personal use of company equipment may be an important issue for businesses even though most employees don't see it as an important ethical issue. It is important for businesses to loiow that the responses in this survey, as well as information from past research, indicate people are receptive to what the company tells them to do in this situation. Further, in discussions with participants of previous surveys, the subjects have often said companies should make it clear to employees if they do not want employees to make personal use of company equipment even on personal time.

Conversely, if companies are aware of the ethical issues important to the employee companies may want to use additional means to encourage compli- ance with company policy. For example, the company could notify employees that monitoring and detective

See web.nmsu.edu/-jkieie/ for responses and significance levels summarized by gender.

measures are tised by the company and there are con- sequences for certain unacceptable behavior. The authors' past research indicates that knowledge of spe- cific negative consequences for certain behavior may act as a deterrent and some past study participants have said the likelihood of getting caught would be a factor in how they act.

What people say they probably wouldn't do. Managers that are concerned about their employees acting ethically might take some comfort from what the majority of participants said they would not do themselves. A majority said they would not make unauthorized changes to a program for personal ben- efit (Scenario 1), would not take advantage of access inadvertently given (Scenario 4), and would not copy data that might itwade others' privacy (Scenario 5).'' It is also interesting to note that in all three instances there is a statistically significant difference between women and men. Consistent with previous research [5], a significantly larger number of women than men said they would not do what the employees did in these scenarios.

What people say they probably would do. There were two scenarios where the majority of respondents said they would do the same as the employee in the scenario. As noted earlier, 74% of the subjects said they would do the same as the programmer in Sce- nario Three—unless the company had a policy against using company equipment.

For Scenario Two a small majority (56%) said they would keep sofiware without paying for it. Well under half (39%) of the respondents felt the ethical issue in this scenario was very important but, unlike Scenario Three, over half of the people (54%) thought an employee would do the same even if com- pany policy prohibited such behavior. One possible explanation for this is that people see this as a situa- tion outside the realm of company policy. The mail order company made an error and it has no impact on the employee's company.

Another interesting point can be made about what some people said they would do. Scenarios One and Two, for instance, indicate some people will do what they say is unethical. In other words, some subjects

70 December 2000/Vol. 4J. No. 12 COMMUNICATIONS OF THE ACM

said what the person in a scenario did was unaccept- able but they themselves would do the same. For Sce- nario One only 15% of the respondents said is was okay for the programmer to modify the accounting program but 23% said they would do the same. This certainly prompts the question of why people would do something they consider wrong but no clear answer is apparent. When the researchers have dis- cussed this scenario with students, some justifications for the programmer's actions were: "It should be a perk of the job to not have to pay overdraft: charges," and "Its not hurting anyone." Some students also indicated they would do the same as the programmer if they thought they would not get caught. Perhaps any one these arguments is sufficient for some people to decide they would modify the program. In any case, the responses in this survey concur with some findings that people will sometimes do what they say is wrong.

For Scenario Two a fairly large number of people, 40%, said keeping the software was okay, but an even larger number, 56%, said they would do the same. Students in the past have argued that since the mail- order company made the error it is okay for the employee to keep the software. The employee didnt steal the software and he or she is not obligated to cor- rect the company's error.

A company code of ethics. The results for Scenario Three indicate rhere are situations where companies can influence their employees' behavior. The impact of a company's written standards or code of ethical behavior is, of course, contingent on the company having such a code and on the employees knowing the code exists. However, some research indicates that companies may have a written code of ethics more for reasons of legal protection and public relations than internal use [7]. Employees may not be aware a com- pany code exists. In discussions of the survey's scenar- ios students clearly indicated they believe companies should have specific guidelines for employees to explain what is unacceptable behavior.

If a company wants to educate its employees about its code of ethics it could provide ethics training using ethical scenarios tailored to its business environment. Having employees evaluate and discuss ethical scenar- ios would help employees undersrand rhe complexity of certain ethical dilemmas and help employees learn company guidelines for ethical behavior. Managers, like many educators, could use scenarios and discus- sions to help people develop a better understanding of ethical issues, what possible actions there are to take, and the consequences of certain actions [2]. One study reported that workers felt studying ethics affected their views [7]. There is also empirical evi-

dence [6] that some students' moral reasoning bcne- fitted from peer-led discussion of ethical scenarios. Ethics training can also make employees aware of penalties for unethical behavior.

Conclusion The results of this survey indicate people rely heav- ily on their personal values when deciding what is ethical or unethical behavior. However, when the ethical issue in a given situation is not considered of great importance, people are more likely to consider what company standards say to do or to not do. Reliance on personal values in many situations does not rule out, however, that an established code of ethics could affect what employees decide to do.

Businesses can encourage ethical decision-making by having a written code of ethics and providing ethics training, such as discussion of ethical scenarios, to help employees understand what is expected. In addition, businesses should consider providing practi- cal support to employees for handling ethical issues. For instance, a support mechanism for a code of ethics should include procedures for an employee to follow who wants to talk to someone about an ethical issue or to report unethical behavior. B

REFERENCES 1. Behar, R. Who's reading your e-mail? fortwnf (Feb. 3, 1997), 57-70. 2. Cougar, J.D, Preparing IS studencs to deal wiiK ethical issues. MIS

Quarterly 13, 2 (1989), 211-216. i. Dejoie, R., Fowler, G. and Paradice, D.B. Ethical Issues in Information

Systems. Boyd and Fraser Publishing Company, Bosron, MA, 1991. 4. Jones, T.M. Echical decision making by individuals in organizations: An

issue-contingent model. Academy of Management Review 16, 1 (1991), 366-395.

5. Kreie, J. and Cronan, T.P. Judging what is echical or unethical: There arc differences between men and women. Commun. ACM 41, 9 (Sept. 1998).

6. Nelson, D.R. and Obremsld, T.E. Protnoting moral growth through intra-group participation. Journal of Business Ethics 9, (1990), 731-739.

7. Pierce, M.A. and Henr)', J.W. Computer ethics: The role of personal, informal, and formal codes. Journal of Business Ethics 15. (1996), 423^37.

8. Robin, D.P., Reidenbach, R.E. and Forresr, P.J, The perceived impor- tance of an echical issue as an influence on the ethical decision-making ok ad minagas. Journal of Business Research 35, (1996), 17-28.

9. Sala, R. What would you do? Computerworld (Mir. 16, 1996).

J E N N I F E R K R E I E ([email protected]) is an assistant professor of

Business Computer Systems at New Mexico State University. T I M O T H Y P A U L C R O N A N ([email protected],edu) is A professor

of Computer Information Systems and Quantitative Analysis at the University of Arkansas in Fayetteville.

Permission to make diffital or hard copies of all or part of this work for personal or class- toom use is granted without fee providetl that copies ate nni made or distributed for profit or commercial advanrige and that copies beat this ntrtice and the full citation on the first page. To copy otherwise, to tepublish, to post on server; ot to tedistribute lo lists, tequites prior specific permission and/or a fee.

© 2()(H) ACM 0002-0782/00/1200 $5,00

COMMUNICATIONS OF THE ACH December 2000/Vol. 43. No. 12 71