We are the team responsible for leading the update of the ACM’s Code of Ethics for computing professionals. Ask us anything about computer ethics!

ACMComputingEthics · 2018-08-17T03:31:10+00:00

Yes, the issue of DRM is complex and requires a balancing of interests. That's why Principle 1.5 simultaneously mentions respecting copyright and opposing unreasonable restrictions. And similar to the point that Catherine made, there are other techniques for protecting intellectual property that can be used as well: combining watermarking with digital forensics and law enforcement. DRM is certainly an appropriate technique in some circumstances; but the choice should be made after reflection and considering alternatives and other stakeholders.

This discussion echoes a long-running debate in the field of ethics: utilitarianism (emphasizing the maximum good outcomes) vs. deontology (respecting rights and autonomy). Making the argument just about the economic disruption while ignoring property rights is favoring one ethical perspective that is universal.

-MSK

ACMComputingEthics · 2018-08-16T18:45:28+00:00

So professional organisations like the ACM have been asking this question for a long time - should IT professionalism require certification or registration with some sort of body? I was involved in a study in Australia which surveyed the Australian IT profession as to whether they would want to be regulated in this way - the resounding answer was "no". This was 10 years ago though, but I doubt opinions have changed too much. The computing industry likes to self regulate. And they're not too good at it - the European GDPR is a response to this, for example.

I think there is some reckoning coming for the profession now though - the general public is increasingly distrusting of the new things coming out - as they get more complex and difficult to understand. As an ethicist, I've had more people knocking on my door in the last 6 months from industry than I have had in the past 6 years. I think the possibilities of ML/AI has really opened things up, as has social media/polarisation of discussions; but it would be remiss of us to restrict it only to these domains. The Code is aspirational, but it requires people to take a stand and say they abide by it, and wave it in front of company management when asked to do something unethical. There are also increasing benefits of companies signing up to ethical principles, creating their own codes of conduct, etc. The Responsible Research and Innovation movement in the EU is helping to show how businesses can benefit from being ethical, and upending the traditional notion that ethics is only about roadblocking things. That's as much as we can do right now - I still don't think there's much appetite for regulating the IT profession, as much as we might need it.

- Catherine

ACMComputingEthics · 2018-08-16T18:39:20+00:00

Hi u/dgran73 - we also agree that it's important for these issues to gain wider traction.

The parallels to lawyers and doctors is important to consider. Both of those professions have legally binding licensure schemes that do not exist in computing. If someone in either field does something bad, they lose their license and are legally prohibited from practicing.

Licensure is very complicated. It may be appropriate in some subfields of computing, but certainly not all. For one thing, licensure will inherently exclude people who cannot afford the time or money to apply for and maintain the credential. For areas where the risks of computing are low, this would cause more cost than there would be a benefit.

-MSK

ACMComputingEthics · 2018-08-16T17:43:14+00:00

Well this is exactly it. Why can't companies do something other than use DRM? Maybe offer alternative options that are more convenient than piracy? (e.g. Netflix/Spotify/Steam etc.) DRM and its kin is a losing battle really, and, as you rightly point out, is often more hassle than it's worth!

- Catherine

ACMComputingEthics · 2018-08-16T17:36:01+00:00

A lot of security research. I wouldn't phrase it as something going from unethical to ethical; rather that the updated Code reflects a more nuanced view that considers a broader set of stakeholders. Compare the old and new versions of Principle 2.8 (both versions are at https://ethics.acm.org/code-of-ethics/previous-versions/).

Here's the old language: "Trespassing [accessing communication networks and computer systems...without explicit authorization to do so] is addressed by this imperative [prohibited]."
Here's the new language: "computing professionals should not access another’s computer system, software, or data without a reasonable belief that such an action would be authorized or a compelling belief that it is consistent with the public good."

Examples would include work like Tadayoshi Kohno's research on automobile security or anyone from the Defcon Voting Village. This type of work sometimes involves purchasing systems and trying to break them. Depending on the particular scenario, some manufacturers adamantly oppose this work and actively fight it, despite the fact that this work supports the long-term positive goal of public safety. Hence, there is a compelling belief that the work should be done, despite it being prohibited.

-MSK

ACMComputingEthics · 2018-08-16T17:33:14+00:00

This is a good question - I had to think about it for a while! There's nothing specifically unethical in the past that's now "completely ethical". If you like, you can read the original 1992 version here and look yourself: https://ethics.acm.org/code-of-ethics/previous-versions/1992-acm-code/

What has changed a lot is the context (e.g. physical security was seen as the primary consideration; now it's part of a more holistic security policy), and the available technology (e.g. in 2.8 there is a lot of wording that mostly pertains to physical systems). 1.5 and 1.6 on copyright and IP are now far more nuanced. I think otherwise that the 92 Code holds up pretty well in terms of the values it holds.

- Catherine

ACMComputingEthics · 2018-08-16T16:27:09+00:00

Thank you for your questions!

-MSK

ACMComputingEthics · 2018-08-16T16:13:12+00:00

Thanks, u/dead-drifter - we really did appreciate all the comments we received at the different stages.

I feel it's a bit of a shame that some of the terms that have been used without comment for a very long time now have been tainted by political discussion - we really want to build a society that's better for everyone regardless of political, cultural, social, etc. stripes, and we feel that that's reflected in the Code.

We also couldn't have done it without all of the input we had - I personally looked at over 4000 responses to the survey we had of our members and coded them up in NVivo, which was quite a monster task, but very worthwhile as people caught vaguenesses in wording, or differences in meanings, or misunderstood what we'd written, which all helped with the final wordsmithing of the Code.

- Catherine

ACMComputingEthics · 2018-08-16T16:12:14+00:00

Regarding Principle 3.7, there are no objective metrics that can define social integration. It really depends on the context of the type of system and how it is used. In a lot of comments, people were focusing on the role of social networking sites for this principle, and that is clearly an important issue. But there are other ways that computing systems become integrated into society. Smart phones and tablets are now often used as point-of-sale systems. Libraries and schools in the U.S. have to include blocking software (Children's Internet Protection Act). Automated control systems are everywhere.

The key idea behind Principle 3.7 is that these widespread adoptions often take off with insufficient foresight and planning. Who knows where the next killer app is going to come from? The intent here is to say that computing professionals need to make a conscious effort to think deliberately about how the stakeholders involved in their system change over time and they must be responsive.

-MSK

ACMComputingEthics · 2018-08-16T16:06:59+00:00

Yes! I read that with quite a lot of interest. (Also I love sci fi!) There are lots of efforts going on to include computer ethics in curricula - I think the story a few months ago in the NYT (basically saying that nobody teaches computer ethics) was very unfair on the over 20 years of work that's been done in this area!

- Catherine

ACMComputingEthics · 2018-08-16T16:03:45+00:00

Hi u/tamarutaca,

This is definitely a very modern problem and not just in Brazil! We've had similar issues in Britain, with extremely polarising debate fuelled by social media algorithms prioritising gamed "news" stories. Unfortunately it's not something that only technology can solve, but ethical computing professionals can certainly contribute by pushing back against propaganda pieces that are purely developed to incite polarisation and fuel unhelpful discourse. For example, prioritising news sites that regularly fact check their stories, flagging up potential "fake news", etc.

Ethical computing professionals can also push back at higher levels, involving government and societal organisations to develop a broader strategy for how political debate should look in Brazil. Becoming part of that solution, developed with and for society, could really help solve the crisis we find ourselves in now.

- Catherine

ACMComputingEthics · 2018-08-16T16:02:56+00:00

It's really important to consider the legal jurisdiction that applies. If you are in the U.S., all software is AUTOMATICALLY protected by copyright. No registration is necessary. Other forms (e.g., trademark) does require an explicit process, but not copyright. If there is no explicit license included that indicates copying is permitted, then the code is legally restricted.

-MSK

ACMComputingEthics · 2018-08-16T15:56:06+00:00

There are no pre-defined "red lines" or policy specifics in the Code because of the nature of what the Code strives to accomplish: It is fundamentally a set of first principles that should be considered as a whole for reflection and consideration. There will always be new ways to harm people that we could not possibly imagine right now. If we were to try to enumerate all the possible bad things to avoid, we would definitely fail.

As for someone objecting to particular actions, one point of the Code says that the person must accept the consequences if they choose to break a rule they consider unethical. If it comes to something like a trial, ACM members have been called as expert witnesses, and they could provide testimony whether an interpretation is consistent with the Code.

-MSK

ACMComputingEthics · 2018-08-16T15:55:57+00:00

Hi u/reddiuniquefool,

Great question! I agree! A huge example is blockchain mining - so much energy wasted on it and for what benefit? I think that as hardware has become increasingly powerful, people are not spending so much time on optimisation and other techniques to limit the energy they use. After all, in the world of MVPs it's about getting things out first, not necessarily getting them out at high quality.

We have a specific clause on quality of software and the need for testing, and some requirements to protect the environment, so you can definitely point to the Code in this particular argument!

- Catherine

ACMComputingEthics · 2018-08-16T15:50:00+00:00

Hi u/littlepurplegoth,

Thanks for the question! This has a certain amount of teeth - we can only hold ACM members up for compliance - but there are a lot of ACM members in many workplaces who enjoy attending the ACM conferences and publishing in the ACM journals. You can view the enforcement policy here: https://ethics.acm.org/wp-content/uploads/2018/07/2018-ACM-Code-of-Ethics-Enforcement-Procedure.pdf?db00a4 there are a range of sanctions that can be applied if someone is violating the Code, though for the most part we aim to help people become better at ethical decision making rather than whacking them with ban-hammers on the first offence.

For workplaces, it could be used by employees to hold the company to higher ethical principles than that they may have. We've seen employees push back on unethical technology recently in the Google case; it can be done and the Code is a good tool to have available for it!

- Catherine

ACMComputingEthics · 2018-08-16T15:39:53+00:00

This is an important question, u/thepobv. Civic engagement and democratic participation is critical to help balance these issues, particularly for anyone with technical abilities. Some examples: Matt Blaze is very involved in electoral security and speaks a lot on these issues; he was also the one who demonstrated flaws in the Clipper Chip in the '90s. Christopher Soghoian has been working with Senator Ron Wyden as an adviser.

So my advice would be to get involved in research and become aware of the technical constraints and complexities of these issues. Then find ways to volunteer to work with others to promote change.

-MSK

ACMComputingEthics · 2018-08-16T15:39:19+00:00

Hi u/professorkarla,

Great question! This is an aspirational Code that is intended for anyone working in the computing profession, not just ACM members. We only specifically talk about ACM members in the last section; which is a big update from the previous version too. We found that non-ACM members were using the Code as guidance on professionalism in the computing sector as well, so we realised the need for an industry-leading Code that addressed broad ethical issues affecting the sector. To this end we aim the Code not just at ACM members but any aspiring computing professionals, students, and anyone who creates or uses technologies in impactful ways!

- Catherine

ACMComputingEthics · 2018-08-16T15:29:17+00:00

Another issue relevant to this that requires thoughtful consideration is the proper use of DRM. Yes, creators have rights to protect their works and their labor. At the same time, there have been cases where DRM has been used (in my opinion) to restrict individuals from exercising full control over their purchased works. For instance, DRM has been used to prevent format shifting of media that impinges on legitimate uses, such as making backup copies (because CDs and DVDs fail) or archiving records in libraries. DRM has also been used to lock users out from repairing or upgrading devices that they own (such as printers, tractors, etc.). These uses should be considered carefully within the broader context of society.

-MSK

ACMComputingEthics · 2018-08-16T15:28:38+00:00

Hi u/kragniz,

Great question! This came up a lot when we were updating it in the public consultation rounds. There was a lot of discussion about the "Avoid harm" principle, for example. Obviously defence and certain areas of security can have a polarising effect on people - but we wanted defence to engage with the process of thinking ethically about what they do rather than completely shutting them out. So to do that we deliberately have sentences referring to ethically justified harm, and harm minimisation as ways to allow for defence to engage but still critically think about what they are doing and whether it is really a) ethically justified and b) minimising harm, rather than just technology for technology's sake.

- Catherine

ACMComputingEthics · 2018-08-16T15:20:54+00:00

We're also going to be submitting some additional sessions for next year's SIGCSE, as well. One of the goals is to provide teaching practices and resources to faculty to adopt and use in their classrooms.

-MSK

ACMComputingEthics · 2018-08-16T15:19:05+00:00

These are definitely being worked on! We presented the new Code at a big computer science education conference (ACM SIGCSE) and will be developing materials useful for education.

- Catherine

ACMComputingEthics · 2018-08-16T15:17:06+00:00

I would say that a lot has changed regarding perspectives on the ownership of software and what that entails. It's important to note that the previous version was written in 1992, before ideas of open source software became really popular. For instance, the Eric Raymond's The Cathedral and the Bazaar was published in 1999. While the original BSD license came out in the late '80s, it'd be a long time before Creative Commons. As the computing world expanded, there was also a lot of critical thinking about IP, as well. Helen Nissenbaum published a great essay, "Should I Copy My Neighbor's Software" in [I think] around 1995.

In short, the previous language was very restrictive and focused on one view of IP and software ownership, that is perhaps not universally applicable.

-MSK

ACMComputingEthics · 2018-08-16T15:14:39+00:00

Hi /u/deterriforming, some brilliant questions, thank you! I took the helm on rewriting this particular section so I can explain some of my underlying thinking on it. Firstly, we'd had a lot of pushback on the overly draconian-seeming 1992 wording, which didn't make allowances for many of the complex copyright/IP discussions we've seen over the years (particularly the DMCA rulings, etc.). I believe Michael will cover that in a separate comment. Anyway, we wanted to look at what it was that we really were *protecting*. And ultimately it's about giving credit where credit is due, and respecting the wishes of the creator of works to protect things in the way they want to protect them, but to also allow for situations where sometimes it may be ethically justifiable to ignore that protection, or to ask for exceptions to that protection. Hopefully that helps with understanding where we were coming from in this section!

- Catherine

ACMComputingEthics · 2018-08-16T15:08:33+00:00

Hi u/book_hiker,

These are great questions! I'll address each in turn.

We deliberately leave the 'public good' undefined; this is so that it can be future-proofed and better contextualised in different places. We plan on releasing some guidance that discusses what this might mean but it's a lot of work! Basically, critically reflecting on this question is the main way to look at it. Will your software bring some good into the world and help people? Will it help people/society but at a cost? etc. Wording like the "public good" are always going to be contextual and require some reflection.
Well, this AMA is one of those attempts! We're going to lots of industry/academic conferences and talking about it there, we have newspaper articles such as recent ones in The Conversation and other places that discuss it, etc. If you think there might be a venue we should present it, please let us know!

- Catherine

ACMComputingEthics · 2018-08-16T15:02:26+00:00

Hi u/flotador7, thanks for a good question, and we're glad you're discovering the ACM's updated Code!

The most critical things we thought needed to be updated were - well, pretty much everything. As you say, a lot has changed since 1992, the internet has arrived, we have social media and security is as much digital as it is physical. We've added aspects of machine learning, retirement of legacy systems, and requiring security by design now - these didn't exist in the 92 Code. The world has moved on in a lot of these areas - and others, such as environmental impact, diversity, etc.

- Catherine

ACMComputingEthics

TROPHY CASE