3.2 Ethical and Unethical Computing Practices and Their Implications
Key Takeaways
- Legal and ethical are different tests: some practices are legal but unethical (manipulative dark patterns), and whether an act is legal often depends on authorization, consent, or license terms.
- The U.S. Computer Fraud and Abuse Act makes it a crime to access a computer without authorization or to exceed authorized access.
- Security testing is legitimate only with explicit, written authorization that defines scope; the same scan without permission can be illegal.
- The ACM Code of Ethics (2018) asks computing professionals to contribute to society, avoid harm, be honest, be fair, respect others' creative work, respect privacy, and honor confidentiality.
- The Children's Internet Protection Act (CIPA) requires schools and libraries that receive E-rate discounts to adopt Internet safety policies that include filtering.
What this competency asks
ETS asks you to understand ethical and unethical computing practices and their social, economic, and cultural implications:
- Identify ethical and unethical computing practices in context.
- Describe the social, economic, and cultural implications of those practices.
- Identify the conditions under which a given computing practice is ethical or legal.
The third point is the one most often tested. Many computing actions are neither always right nor always wrong. What matters is authorization, consent, purpose, license terms, and honesty.
Ethical is not the same as legal
| Legal | Illegal | |
|---|---|---|
| Ethical | Authorized security testing; using CC-licensed media with attribution; collecting data with informed consent | Rare, contested cases; do not assume an illegal act is justified |
| Unethical | Manipulative "dark patterns" that trick users into subscriptions; misleading (but technically accurate) privacy notices; ignoring accessibility where no law requires it | Unauthorized access (hacking); distributing malware; software piracy; wiretapping without consent |
Test questions often hinge on this distinction. A practice that complies with a website's terms of service can still be deceptive. A practice done with good intentions can still be illegal if it lacks authorization.
Common unethical or illegal practices
| Practice | Why it is wrong | Typical implications |
|---|---|---|
| Unauthorized access (breaking into accounts or systems) | Violates the owner's control and privacy; a crime under the Computer Fraud and Abuse Act (CFAA) and state laws | Data exposure, identity theft, cost of breach response |
| Creating or spreading malware | Intentionally damages systems or steals data | Economic losses, loss of trust, disrupted services |
| Software piracy and infringement | Uses creative work without permission or payment | Lost income for creators; legal liability |
| Plagiarism of code or text | Misrepresents authorship; academic dishonesty | Unfair grading; damaged reputation |
| Cyberbullying, harassment, doxxing | Uses technology to intimidate or expose people | Psychological harm; school discipline or criminal charges |
| Collecting personal data without consent | Violates privacy expectations and often law | Regulatory fines; erosion of trust |
| Dark patterns (confusing cancellation flows, pre-checked boxes) | Manipulates users against their interests | Consumer harm; enforcement actions |
| Deliberately spreading misinformation or deepfakes | Deceives the public | Damage to civic discourse and reputations |
| Unsafe e-waste disposal | Exposes workers and communities to toxic materials | Environmental and health harms, often in low-income countries |
Conditions that make a practice ethical or legal
| Condition | Example where it decides the outcome |
|---|---|
| Authorization | A penetration tester scans a district's network under a signed agreement that defines scope. That is legal and professional. The same scan by a curious student without permission can violate the CFAA and school policy. |
| Informed consent | An app that clearly explains its location tracking and asks permission acts ethically. Silent tracking does not. |
| License terms | Reusing GPL code in a closed-source product you distribute violates the license. Reusing MIT code with its notice kept does not. |
| Purpose and proportionality | Monitoring school accounts for security under a published acceptable use policy differs from reading students' private messages out of curiosity. |
| Honesty and attribution | Using a classmate's code with permission and credit, as the assignment allows, is collaboration. Submitting it as your own is plagiarism. |
| Responsible disclosure | A researcher who finds a vulnerability reports it privately and gives the vendor time to fix it before publicizing. Publishing an exploit immediately puts users at risk. |
U.S. laws worth recognizing
- Computer Fraud and Abuse Act (1986): criminalizes accessing a computer without authorization or exceeding authorized access. In Van Buren v. United States (2021), the Supreme Court read "exceeds authorized access" narrowly: it covers entering parts of a system you are not entitled to access, not misusing data you are allowed to see.
- Electronic Communications Privacy Act (1986): restricts intercepting communications and accessing stored communications without authorization.
- CAN-SPAM Act (2003): sets rules for commercial email, such as honest headers and a working opt-out.
- Children's Internet Protection Act (CIPA, 2000): schools and libraries that receive E-rate discounts must adopt an Internet safety policy that includes technology protection measures (filtering).
- Copyright law and the DMCA (Section 3.1) and privacy laws such as FERPA and COPPA (Section 3.3) also shape what is legal.
Professional codes of ethics
The ACM Code of Ethics and Professional Conduct (2018) lists general ethical principles for computing professionals. Its first seven are:
- Contribute to society and to human well-being, acknowledging that all people are stakeholders in computing.
- Avoid harm.
- Be honest and trustworthy.
- Be fair and take action not to discriminate.
- Respect the work required to produce new ideas, inventions, creative works, and computing artifacts.
- Respect privacy.
- Honor confidentiality.
When a question asks what a responsible developer should do, the best answer usually protects the people affected, is honest about limitations, and respects privacy and others' work, even when a shortcut would be legal.
A decision process you can apply to any scenario
- Identify the stakeholders, including people who are not users.
- Check authorization, consent, and license terms. Is there permission?
- Check laws and policies, such as the CFAA, copyright, privacy laws, and the school's acceptable use policy.
- Weigh benefits and harms, including social, economic, and cultural effects.
- Consult a professional code (ACM) and choose the option you could justify openly.
Implications by category
- Social: Unethical practices erode trust in technology and institutions. Ethical design builds trust and broadens participation.
- Economic: Breaches, ransomware, and piracy impose large costs. Privacy violations bring regulatory fines. Ethical practices protect reputation and long-term value.
- Cultural: Norms of digital citizenship, such as crediting creators, respecting privacy, and speaking honestly online, spread through classrooms and communities. Misinformation and harassment can silence groups and reshape public conversation.
In the classroom
Schools typically publish an acceptable use policy (AUP) that students and families sign. CS teachers reinforce digital citizenship by discussing real cases, requiring attribution in projects, teaching students to test only systems they own or are authorized to test, and setting clear rules about collaboration and AI-assisted work.
A student runs a network-scanning tool against the school district's servers "to see what would happen." A security firm runs the same tool against the same servers the following week. What most clearly makes the firm's scan legitimate and the student's scan potentially illegal?
Which practice is legal in many situations but still widely considered unethical?
A developer discovers that the district's app stores students' home addresses in plain text and could expose them. According to the ACM Code of Ethics, what is the most appropriate first step?