Cyber Ethics
CSEC 620

As one of the most uncertain and muddled aspects of any organization or company, Cyber Ethics are undoubtedly one of the most important in today’s technological age. Every organization or company operates with a Code of Conduct for its employees. This Code of Conduct outlines the “dos and don’ts” for an organization in hopes for “ethical” and “moral” operation of business. A typical code of conduct will outline an Acceptable Use policy, Internet Use policy, Security policy, and acceptable conduct policy for its employees that is supposed to be required reading. Like with any law, in cyber security there are always law-breakers waiting for the chance to exploit a weak firewall, a patch in the system, or a careless employee who leaves login information open for the wrong eyes to see. For this reason government and private sector alike must constantly update security measures and do thorough investigations of employees upon hiring. The internet is so large and open that it is a serious security threat for individual corporations and especially government agencies. The US government defends against countless internet attacks every day and because of the vast connections between private companies and government it is both the responsibility of private and public sector to insure everyone’s safety. Developing a widespread Code of Ethics in regards to Cyber Security is an increasingly difficult task. New advances in technology make it difficult to have up to date policies on cyber issues. In the US every state has different laws regarding cyber issues so it complicates how business is run on an interstate or even transnational level regarding customer data. The different state laws affect corporate transparency and what information is required to be shared with internal and external stakeholders, as well as, in the case of a security breach incident. For example in one state, following a security breach the company would only be required to tell company stakeholders or customers effected about the incident, where in another state the company would be required to tell ALL customers about the breach. “Like many other technologies of the past like airplanes, cars, and steam engines, the appeal and the benefits are so daunting that we often rush to adapt the internet to our daily lives despite serious safety problems. These problems are amplified by the global connectivity of infrastructure, because of the speed of internet, this means that geographical distance provides little to no extra protection. For those earlier technologies, safety came about through innovation driven by government mandates, and by agreements among nations. The same process of development using mandates and regulation is necessary to secure cyberspace.” (Lewis 2010) So the question is, how do we regulate cyberspace in order to protect national security without hindering business, and how do we get private and public sector to agree on those terms? This is one of the hardest questions to answer in many decades for law makers around the country and the world. In addition to national security threats, studies have shown that some businesses are losing up to $20 billion dollars a year due to cyberspace interruptions. There is a major problem between international business, companies, and the cyber laws. There are no uniform laws that protect the people from information theft over the vast global internet. Fear of the theft of financial information could be the biggest issue affecting businesses all over the world. Although it seems the world is more occupied with other political issues, such as war in the middle east, and the US economy, “The Law of Cyber-Space-An Invitation to the Table of Negotiations, by Ahmad Kamal, Senior Fellow at the United Nations Institute for Training and Research (UNITAR), is a new book laying down the foundation for discussions that can lead to the first convention on cyberspace. It details the types of cyberspace crime, describes national laws and their loopholes, offers solutions for further work and invites stakeholders—Governments, private sector and civil society—to negotiations leading to an international law.” (Szczerba 2006) Ahmad Kamal points out in his book all parties, government, private sector and civil society must all work together to develop, implement and enforce international policies on Cyber Security. “Statistics on Internet use show that the need for cyber law has become more critical than ever in the past. At the end of 2005, almost 973 million of the world's 6.4 billion people were using the Internet: 68 per cent in North America; 53 per cent in Oceania and Australia; 36 per cent in Europe; 13 per cent in Latin America and the Caribbean; 9 per cent in Asia and the Middle East; and 2.7 per cent in Africa.” (Szczerba 2006) Some may say it is impossible to create an international or even national, enforceable law on cyber security because of the vastness of the internet, and ultimately it all boils down to interpretation. What is actual Cyber Crime? Is it still crime to hack even without malicious intent? These are some of the questions asked to determine what is ethical and what is not in regards to cyber activity. How do you prosecute someone for a crime committed over the computer on a network, with no face to attach to the individual? A common defense for an alleged cyber criminal would simply be “it wasn’t me.” This is the dilemma that comes about when trying to determine a uniform LAW for ethical cyber space use. Like common physical crimes, according to the Constitution the prosecutors must be able to prove beyond a reasonable doubt that the individual is guilty. Back in 2003 Robert Liscouski and other homeland security officials urged tech companies to help improve the US’s ability to defend against cyber attacks or else there would be talks of regulation of industry coming soon. Since then there has been exponential growth in the number of cyber attacks per year and the amount of billions of dollars in damage. Surprisingly, we have not seen regulation yet although I feel as though it is not far off. The danger to national security is just too great, and every day we get closer to a point where major terrorist regimes move from bombs, guns, nuclear weapons, biological weapons, and other WMD’s to mass Cyber Attacks of mass destruction that could tear down US and Allied nations infrastructure with the click of a button. This leads us back to present day and the cyber threats that could be thwarted by a formal law passed regulating certain aspects of cyber space and how all business is conducted. “The creators of cyberspace wanted their creation to be a global commons, a free space that no one individual or governing body owns. The designers of the internet built the network to reflect their values, which were to a degree, antiauthoritarian and anti-government. One of the original cyberspace theorists was also a songwriter for the Grateful Dead, and it was he who issued the famous Declaration of Independence of cyberspace, saying there was no room or need for governments. Cyberspace would be a global free space where a self-organizing community could innovate and create new worlds of information. This was an ill-conceived notion that continues to distort our way of thinking regarding the internet. Cyberspace is an artificial construct produced by machines which are all owned by individuals or organizations and all exist in some physical location that is subject to the sovereign control of some nation.” (Lewis 2010)
Though it would be far from simple or easy, to regulate such a creation will take cooperation of many parties and on many levels. We will need regulation of international interaction, and infrastructure, while not restricting innovation and civil liberties. One major opposition that may arise from regulation would be the initial financial commitment needed from corporations and the government to fund the extended training of employees, certifications, as well as, the most advanced hardware and software to protect the systems. “No one ever disagrees with the idea of more education, but the aspect of the workforce development that raises the most opposition is the requirement for certification and extended training. Being able to certify that someone is skilled enough to retain knowledge in a field is a basic fundamental importance of professionalization. We do this for doctors, lawyers, electricians, barbers, surgeons many other trade specific careers. Some certification requirements are Federal, but most are mandated by individual states under the 10th amendment. Many in the IT industry believe that most are not ready for this step. Certification requires knowing what is useful and necessary and being able teach it and test it. What people disagree on is that we do not know what is necessary for cyber security because it is ever-changing.” (Lewis 2010) One nation that has passed major internet regulation is China. Since 2003 Chinese citizens using the internet are required to register with the police and other governing bodies. Although Americans may see this as a violation of rights, I must say that a measure like that would deter many illegal hacking activities that occur daily. In addition to registration of internet users, in 2003 China also hired 300,000 “internet police” to enforce its strict laws on internet service and use. India has also implemented some strict restrictions on internet content available to its citizens. While India is a democratic state and its laws regarding internet use are not as “strict” as China’s, they still have made leaps and bounds toward regulation. If the US could pass laws of this same level, or at least a happy medium, I believe billions of dollars could be saved from damage due to cyber attacks. Passing of even moderate regulation laws in the United States would be substantial in developing a national “firewall” to protect infrastructure and sensitive national security information that is linked to the national internet super-highway. Apart from regulation, cyber leadership is something that can also go a long way to insuring a better and safer cyber space. Many companies have placed cyber security as a secondary task when assessing how the company functions until a catastrophe happens and millions of dollars in damage are caused, like the recent Sony hacking incident. Companies need to implement thorough policies regarding cyber security from the top down, not just relegating these duties to the IT department. If employees see that management is stressing the importance of cyber ethics, and proper internet usage within the workplace it could lead to less “in house” issues resulting simply from carelessness. More employee recognition in turn would further protect the network from outside attacks because if everyone is more aware of threats, an employee may catch a virus or attempt to hack the network before it spreads and causes real substantial damage to the company and its relationship with the customers. Identity theft is a major concern of American citizens as is the fear of the theft of intellectual property. These cyber crimes might be more on the minds of US citizens now than ever before. This makes this the best time to take action to regulate cyber space. As with any law there will be certain interests that are opposed, but the facts tell it all. The fact remains that we see more cyber attacks than ever before in the United States, and not only does it affect corporations, or government agencies, but everyday people in their homes using their personal computers not knowing that if not properly protected they are placing their personal information out in the world for any hacker to grab and misuse. In closing I believe it is the utmost responsibility of both government and private sector to improve cyber security, both for individual good and the whole of national security. Although it is not easy it takes cooperation among both groups along with the support of citizens to implement and enforce better policies to better secure cyber space. Cyber space is seen as this free utopia where all ideas and innovations can flourish and grow, which to a certain extent is true. However, with all the freedom and innovation there is also room for hackers and cyber criminals to steal, warp, and destroy positive technological development. We have come to a time where it is necessary for regulation and balance to come to cyber space. As hard as it is to enforce cyber laws, policies, and to prosecute cyber criminals, we have seen evidence in other nations that regulation of cyber space does work if the proper measures are taken. At this time in 2011, 8 years after Homeland Security warned technological companies of regulation if there wasn’t a change in the amount of effort put into cyber security, it is only a matter of time before Weapons of Mass Destruction become Cyber Weapons of Mass Destruction and there is a reactive scramble for protection, rather than a proactive one.

References
Lewis, James (February 23, 2010). "Cybersecurity: Next Steps to Protect Critical Infrastructure." Testimony before the Senate Commerce Committee. Retrieved fromhttp://commerce.senate.gov/public/?a=Files.Serve&File_id=2f55c9dc-65bc-45cd-acd3-d8628324ca11 .

Szczerba, Patricia(2006) “The law of cyber-space “ UN Chronicle v. 43

Krim,Johnathan( DEC 2003) “Help Fix Cyber Security 0r Else,U.S. tells Industry” Washington Post