Welcome back, this will be our final lecture in looking at really a topic that really should be
enforced in every single session that we have, but is dealing with professional and personal
ethics and cyber forensics.
The, the, long time ago somebody challenged me said, said, hey look the only person that can
take away your integrity is yourself. And ultimately all these, all these activities, and how you
conduct yourself both personally professionally comes back to your personal integrity. Your
ability to stand, the scrutiny of any investigation, any counter dialogue, or, or, counter to your
position, counter to any investigation materials that you provided, is going to stand firm on your
integrity. On, on, the reputation you built on how you conduct yourself both personally and
professionally.
Your ethics are built around the core values of your personal beliefs. The values of the things
that you've grown up with, the values of the profession by which you work. And so the only
thing that we can do today is really talk a little bit about some of those things. I'm going to give
you exposure to that some of the values that are being presented underneath the code of ethics
that are put in place for those that are certified examiners. Talk about that just a little bit. And
then give you a couple scenarios that to think about with respect to an ethical dilemma that can
exist. Something you could find yourself involved with or having to look at as an investigator, or
as a participant in the computer industry, that you know, can help shape maybe how you think
and how you approach these things.
The first thing I need to do is just kind of give you an overview of some of the different items
that come out of certified examiners code of ethics. And I'm not going to spend a lot of time
talking about these things, but first off is a demonstrate a commitment and diligence of the
performance of your duties assigned. You want to maintain integrity and compiling your
professional assignment or completing your professional assignments. You want to maintain the
utmost objectivity in how you conduct your investigations. You want to accurately present your
findings. You want to buy abide by the highest moral and ethical standards that are available.
You want to always testify truthfully. You want to avoid actions that present a conflict of
interest.
Something that leads to your benefit, or benefit of others. You want to comply with all legal
orders that are provided, and you want to thoroughly exercise all evidence within the scope of
the investigation you've been assigned.
There are some don'ts in this in this code of ethics, and those don’t are withhold any relevant
information to the investigation. You don't want to reveal confidential matters unless it's been
explicitly provided to you by the court of law that allows you to be able to express it, or
expressly provided permission by the individual that's concerned with it. You don't want to
express your own opinion on the guilt or innocence of the party. Let the facts speak for
themselves. Your opinion is left to conjecture .so leave that out of the picture. And then the last
one is engaged in any unethical or legal, illegal behavior.
Now these are these are challenging in and of themselves leading up and how you conduct
yourself. Each one of them dictating that this is a professional abiding by very strict rules and
how to perform how you have been ducked and live both personally and professionally. It's a
reflection into both conditions, your professional testimony can be influenced can be undermined
buy any personal infractions that you can you have.
I want to just take a minute walk through a couple scenarios with you. Some stories and vignettes
that have been provided with respect to kind of reflecting on some personal professional ethic
conditions.
First story that I want to share with you is there was a, an industry corporation software
developer that basically built components to supported supply systems in the supply system
being pipeline, oil pipelines and transactions. Well the company was suspect of that an
individual within the company was actually pre releasing some of their software so that their
competitors was getting an advantage and basically moving forward and delivering some of the
same capabilities that that they were, and so they were losing some of the market share an some
of the revenue associated with it. They couldn't identify specifically who the people were but
they thought well here's another way we can handle it. They called it an engineering team they
asked their engineers to sit down a device basically as they look at building the software
applications that were being deployed to control these supply systems, that they're going to
withhold a specific module, the thing that actually makes it work correctly all the time, and only
apply that after, after, the actual sales transaction had taken place just prior to it being delivered
and employed to the client site.
So this engineers all graph, gravitated towards this. They all thought this was a great idea this
was a good way to help retain the, the, position of the company, developed this particular
application and then basically started producing the following software the same, same, step.
Well, year goes by and suddenly the competitors companies start having problems where, in this
particular case, remember this is an oil pipeline production company the their shutdown systems
failed, and therefore had an overflow and spillage of petroleum in the process of what they were
trying to do. And it was directly attributed really from the company knowing that their secret
had gotten out and these other companies were using their same software, the software they had
been designing and paid people to do but they did not get it after the corrected module had been
applied as they had planned from their engineering, engineering activities.
So, so, here's the dilemma you've got you know business and business you've got activities going
on and, and, here you created a scenario that created somewhat of an ethical problem. It created a
problem that that this other company now has something bad that has an environmentally
damaged you know result. You know the spillage goes over lands into the ground. You know in
many cases that's hundreds of thousands of dollars or millions of dollars of recovery in terms of
pulling out the contaminated ground and space and, and, what other whatever other effects could
happen plus loss revenue for that company.
That ethical dilemma comes in is that really the right thing to do? And there are a couple of
things that come into play with this is one is you've got to you know did the company that owned
the original software have the right to make the change to help identity? Well they did they
certainly had some interest. But in the long haul there's other questions come in about is it for the
common good? Well in this particular case probably not for the common good because in the
long haul the result was damage to damage to environmental concerns, environmental hazards.
Certainly if the engineering activities were clever enough to do that a stopgap to stop the
software from functioning properly, they probably could've engineered another way of that
wasn't going to result in in a hazardous effect. Something that people could have been hurt,
could have been killed and or you know spillage into an environmental hazard.
So this is an ethical problem some people are going to wait or decide to say well now they really
they should have been able to do it, you know it is business it is industry. And, and, from the
position of those that are involved in in computer science is it really puts us in position say well,
you know, we need to stay to the heart of right do the right thing and be considerate toward the
full right of do you have the right is it for the common good and then moving forward in that
direction.
There's another case of a woman that she was a System Administrator and she bought some
software to help her to maintain her systems and in the process of looking at the software she
identified that, accidentally, that there was a vulnerability in the system ,that vulnerability would
actually jeopardize the security of the entire network and actually was a high risk high risk item,
now she actually was a proficient coder and developer, and she looked at the system and
identified that she actually created a patch, and so she was able to fix the system to prevent it
from having that vulnerability, now that vulnerability for corrected her system, but because of the
financial concerns associated in her knowing that many other businesses were using the same
thing, she decided that she felt that she needed to fix the fixing turn thing but she felt if she told
the company about the vulnerability, they didn't do anything, or the other companies that that
were involved in it that this vulnerability would actually potentially result in people breaking into
different banks, in different systems, as she had the ability to design basically a, a, worm and this
would technically called is an application that serves the net identifies the places where these
particular applications are running, and would actually patch the application itself.
And so she, she, designed and coded this particular worm to go through and make the corrections
and basically launch it on the Internet, and it went through and made all the corrections as it
bounced through and, and, established basically and secured all these different networks again.
Now in this case this was something that was done for the good, and the common good, as she
was looking at it from the perspective of how, how, did you know how to correct the system how
to make things more secure part of her responsibility, yet she, she, violated the couple of things.
One she didn't have the right to go into other peoples systems and make those changes, she didn't
have the right to make the decision for the competent make that correct correction on the
vulnerability. And so there was sort of a you know the question comes in well, for the common
good yes, but, you know the, the, right to be able to do this wasn't there so therefore it was it
seemed to be unethical on her part to have done it.
And these each one of these situations sort of give you an expression of some of the conditions
that would exist within a corporate environment where an ethical dilemma in computer
engineering can result. Your responsibility lie in your personal professional contact your ethics,
to not entrap people. The conduct that you used to help use computers to for the benefit of the
case the prosecutor, investigator, otherwise. These are the things that you want to abide by. If
you become a certified examiner, then you will subscribe to a code of ethics. And, and, those
code of
ethics you need to, to, live to learn by, lived, learn to live by them as, as, you proceed through
you know the work you do with computer forensics.
I've enjoyed being part of this class I hope you've learned a little bit about computer in cyber
forensics. It's, it's, an emerging field. This has been an introductory course. I would encourage
you to continue to pursue this this field look at a certified examiner's is the next step. Getting into
that the Nelson manual will actually be a good starting point to that. If you proceed through that
on self-learning basis could actually go off and pursue it. Or if you can join another class that be
awesome. Exciting field and I hope to see you all in it someday in the future. Take care.
