lecture 02 –ethics - cs.uic.edu · pdf fileadapted from michael bailey’s ece 422....
TRANSCRIPT
![Page 1: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/1.jpg)
Lecture02– Ethics
StephenCheckoway
UniversityofIllinoisatChicago
CS487– Fall2017
AdaptedfromMichaelBailey’sECE422
![Page 2: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/2.jpg)
![Page 3: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/3.jpg)
![Page 4: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/4.jpg)
![Page 5: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/5.jpg)
![Page 6: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/6.jpg)
Thankgoodnessforsecurityexperts
![Page 7: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/7.jpg)
Security“Research”totheRescue!
• Researcherswanttohelp,tobenefittheinternetcommunity• …butoh,thetemptations!
Firsttopublish;dosomethingnew;showhow1337youare;fightfor
funding;endsjustifythemeans
• …andtheconflicts
Affectingotherresearch;impactingLEinvestigations;thwarting
mitigationefforts;protectingrights;helpingthebadguys;lessrisky
(andlesssexy)options?
![Page 8: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/8.jpg)
Whatareethics?
• “Thefieldofethics(ormoralphilosophy)involvessystematizing,
defending,andrecommendingconceptsofrightandwrong
behavior.”
• Normativeethics,isconcernedwithdevelopingasetofmoralsor
guidingprinciplesintendedtoinfluencetheconductofindividuals
andgroupswithinapopulation(i.e.,aprofession,areligion,or
societyatlarge).
– Consequentialism:Consequencesarethemostimportantconsideration
– Deontology(duty-basedethics):Followingrulesismostimportant
– Virtueethics:Anindividual’scharacterismoreimportantthaneither
actionsorconsequences
![Page 9: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/9.jpg)
Philosophy101-levelethicsproblem
• Situation:You’vebeencapturedalongwith10otherpeople
andyourcaptorsgiveyouachoice:Shootoneofthe10people
yourselfandeveryoneelselivesorshootnooneandyour
captorswillkillall10.
• Deontological(duty-based)ethicsmayhavearule,“donotkill”
sotheethicalthingtodoiskillnoone(butthen10peopledie)
• Consequentialismmaydictatethatonedeadpersonisabetter
outcomethan10deadpeoplesotheethicalthingtodoisto
shoot
![Page 10: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/10.jpg)
ComputerEthics
“Atypicalproblemincomputerethicsarisesbecausethereisa
policyvacuumabouthowcomputertechnologyshouldbe
used.Computersprovideuswithnewcapabilitiesandtheseinturngiveusnewchoicesforaction.Often,eithernopoliciesforconductinthesesituationsexistorexistingpoliciesseem
inadequate.Acentraltaskofcomputerethicsistodetermine
whatweshoulddoinsuchcases,i.e.,toformulatepoliciesto
guideouractions.”
-Moor
![Page 11: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/11.jpg)
Ethics!=Law
• “Lawcanbedefinedasaconsistentsetofuniversalrulesthat
arewidelypublished,generallyaccepted,andusually
enforced”
• Interrelatedbutbynomeansidentical(e.g.,legalbutnot
ethical,ethicalbutnotlegal)
– Adherencetoethicalprinciplesmayberequiredtomeetregulatoryrequirementssurrounding
academicresearch
– Alawmayilluminatethelinebetweenbeneficialactsandharmfulones.
– Ifthecomputersecurityresearchcommunitydevelopsethicalprincipalsandstandardsthatare
acceptabletotheprofessionandintegratesthoseasstandardpractice,itmakesiteasierfor
legislaturesandcourtstoeffectivelyperformtheirfunctions.
![Page 12: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/12.jpg)
IANAL
• ComputerFraudandAbuseAct(CFAA)
– "itisillegaltointentionallyaccessacomputerwithoutauthorizationorinexcessofauthorizationand
therebyobtaininginformationfromanyprotectingcomputer."
• DigitalMillenniumCopyrightAct(DMCA)
– “Nopersonshallcircumventatechnologicalmeasurethateffectivelycontrolsaccessto[aworkprotected
bycopyrightlaw]”
• ElectronicCommunicationsPrivacyAct(ECPA)
– WiretapAct
– PenRegisterStatute
– StoredCommunicationsAct
• StateandLocalLaws
– Illinois;720ILCS§ 5/17-50to-55(e.g.,Computerfraud,Computertampering)
• Computersandnetworksmaycarrydataforavarietyofinstitutionssuchashospitals,libraries,
universities,andK-12organizations
– FamilyEducationalRighttoPrivacyAct(FERPA)
– FederalStandardsforPrivacyofIndividuallyIdentifiableHealthInformation(implementstheprivacy
requirementsHIPAA)
![Page 13: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/13.jpg)
ContractsandPolicies
• EndUserLicenseAgreements(EULA)
– Donotcriticizethisproductpublicly– Usingthisproductmeansyouwillbemonitored
– Donotreverse-engineerthisproduct–Wearenotresponsibleifthisproductmessesupyourcomputer
• OrganizationalPolicies
![Page 14: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/14.jpg)
UICPolicyDocuments
• AcceptableUsePolicy
http://accc.uic.edu/policy/acceptable-use-policy
• UICStandardsofconduct
https://dos.uic.edu/docs/Standards%20of%20Conduct.pdf
![Page 15: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/15.jpg)
ExistingEthicsStandards
• 1947NurembergCode
• HelsinkiDeclaration1964
• TheIEEE,ACM,etc:CodesofEthics
• TheBelmontReport,theNationalResearchAct,andInstitutional
ReviewBoards(IRB)
– 45CFR46
• “RulesofEngagement”
– TheLawofArmedConflict
– Dittrich/Himma:ActiveResponseContinuum
• OtherOrganizationalCodes(Universities,Corporations,etc.)
![Page 16: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/16.jpg)
IRBandtheBelmontreport
• TheprimarygoaloftheInstitutionalReviewBoard(IRB)istoassurethat,inresearch
involvinghumansubjects,therightsandwelfareofthesubjectsareadequatelyprotected.
• "EthicalPrinciplesandGuidelinesfortheProtectionofHumanSubjectsofResearch”,United
StatesDepartmentofHealth,Education,andWelfare,April18,1979(BelmontReport)
• Respectforpersons
– Individualsshouldbetreatedautonomously
– Informedconsentshouldbefreelygiven
• Beneficence
– Donoharm
– Maximizepossiblebenefits/minimizerisks
• DistributiveJustice
– Equitableselectionofresearchsubjects
![Page 17: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/17.jpg)
ProfessionalEthicalCodes
• IEEECodeofEthics(2006)
– commitsmembers”tothehighestethicalandprofessionalconduct”.
Membersagreetoavoidconflictsofinterest,behonest,engagein
responsibledecisionmaking,acceptcriticismofwork,etc
• ACMCodeofEthicsandProfessionalconduct(1992)
– “contributetosocietyandhumanwell-being”,“avoidharmto
others”,alongwithsixotherprinciples(e.g.,don’tdiscriminate,be
honest,respectprivacy).
![Page 18: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/18.jpg)
![Page 19: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/19.jpg)
CaseStudy:Botnets
• Botnets,briefly
– Botsarecompromisedcomputersunderthecontrolofsome3rdparty
– Collectionofbotscompriseabotnet
– Botscommunicatewithcommand&controlserverswhichprovide
instructions,e.g.,DDOSahost,sendspam,findnewmachinesto
infect
– (Almost)everymajorsecurityincidenttodayinvolvesbotnets
![Page 20: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/20.jpg)
CaseStudy:Botnets
• Aresearcherconstructsabenignbotnetoutofcompromised
routersandusesittomeasuretheentireInternet;data
releasedpubliclyandanonymously
• Isthisethical?
• Whatarethepotentialissues?
![Page 21: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/21.jpg)
CaseStudy:Honeypots
• Researcherscreatearesearchtestbeds,connectedtothe
Internet,whichenablestestbedmachinestobecomeinfected.
Honeypot
![Page 22: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/22.jpg)
CaseStudy:Honeypots
• Why?Capturemalware,seeexactlywhatfilesit
creates/modifies/deletes,seeitsnetworktraffic,findits
commandandcontrolservers
• Isthisethical?
• Whatarepotentialissues?
![Page 23: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/23.jpg)
CaseStudy:Hackback
• Organizationsgethackedallthetime.Sometimestheonly
(feasible)waytoidentifytheattackersorpreventfuture
attacksistohackback
• Isthisethical?
• Potentialissues?
![Page 24: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/24.jpg)
CaseStudy:ReverseEngineering,Vulnerability
Disclosure?
• Researchersreverseengineerasystem,discoveravulnerability,
andgenerateaworkingexploit(attack).
• Lotsofdebateabouthowandifoneshoulddisclosethe
vulnerability
– Fulldisclosure:gopublicimmediately
– Givevendoradeadlinebeforedisclosure– Coordinatedisclosurewiththevendor– (lotsofotheroptions)
![Page 25: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/25.jpg)
![Page 26: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/26.jpg)
![Page 27: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/27.jpg)
![Page 28: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/28.jpg)
![Page 29: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/29.jpg)
![Page 30: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/30.jpg)
![Page 31: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/31.jpg)
![Page 32: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/32.jpg)
![Page 33: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/33.jpg)
CaseStudy:ReverseEngineering,Vulnerability
Disclosure?
• Isthissortofreverse-engineeringworkethical?
• Potentialissues?
![Page 34: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/34.jpg)
WirelessEavesdropping
• Astudentinclasscreatesawirelessnetworkaccesspointwith
noencryptionorauthenticationandobservesuserswho
connecttoit.
• Isthisethical?
• Potentialissues?
![Page 35: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/35.jpg)
Movingforward
• Inthisclassyouwillnotbeaskedtodoanythingthatisillegal,
unethical,oragainstuniversitypolicy,somaybeyoushouldn’t
…
• Askpermission notforgiveness
• Principleofleastsurprise
![Page 36: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/36.jpg)
ToLearnMore…
• http://www.icir.org/vern/cs261n/papers/burstein_legal_leet.pdf
• DavidDittrich,MichaelBailey,SvenDietrich.BuildinganActive
ComputerSecurityEthicsCommunity.
• Dittrich,DavidandKenneally,ErinandBailey,Michael,Applying
EthicalPrinciplestoInformationandCommunicationTechnology
Research:ACompaniontotheMenloReport
• https://www.acm.org/about/code-of-ethics
• http://www.ieee.org/about/corporate/governance/p7-8.html
• https://www.eff.org/pages/grey-hat-guide
• http://www.cam.illinois.edu/viii/viii-1.1.htm
![Page 37: Lecture 02 –Ethics - cs.uic.edu · PDF fileAdapted from Michael Bailey’s ECE 422. ... –Virtue ethics: ... Contracts and Policies •End User License Agreements (EULA)](https://reader034.vdocuments.site/reader034/viewer/2022051600/5aa2505c7f8b9a46238ced3c/html5/thumbnails/37.jpg)
Questions?