Public Welfare—Software Security

Case Number: 
Case 08-1
Year: 
2008
Facts: 

Engineer A is a recently hired software engineer recruited from college by HyTechCo, a global software company. As part of his first assignment, Engineer A’s supervisor, Engineer B, requests that he write software to provide security for e-mailed documents within HyTechCo. After completing the project, Engineer A learns on an IT industry news Web site about an individual with another company who had made similar software available to overseas clients and was being investigated by the government because of U.S. laws that require that such software not be sent overseas because of national security concerns. Engineer A learns that the software he developed for HyTechCo has been sent overseas by HyTechCo’s IT department for use by HyTechCo’s offices abroad. Engineer A informs Engineer B who tells Engineer A, without the benefit of consulting with legal counsel, that since HyTechCo is a U.S.-based company, not a threat to U.S. national security, will be using the software solely for internal purposes, and will not be selling it, there is no problem. Engineer A agrees but later learns that one of HyTechCo’s overseas offices has been permitting contractors to use the software to exchange secured e-mail documents.

Question(s): 

What are the ethical responsibilities under the circumstances of Engineer A and Engineer B?

Discussion: 

Engineers in their professional practice are frequently involved in highly sensitive issues and must exercise good judgment and discretion in providing professional services in these areas. Young engineers faced with these types of situations often do not possess the experience and background that is sometimes essential to understand and appreciate the implications of an action or a failure to act.

NSPE Board of Ethical Review Case No. 76-4 was one such case. There, the XYZ Corporation had been advised by a State Pollution Control Authority that it had 60 days to apply for a permit to discharge manufacturing wastes into a receiving body of water. XYZ Corporation was also advised of the minimum standard that must be met. In an effort to convince the authority that the receiving body of water, after receiving the manufacturing wastes, would still meet established environmental standards, the corporation employed Engineer Doe to perform consulting engineering services and submit a detailed report. After completion of his studies but before completion of any written report, Engineer Doe concluded that the discharge from the plant would lower the quality of the receiving body of water below established standards. He further concluded that corrective action would be very costly. Engineer Doe verbally advised the XYZ Corporation of his findings. Subsequently, the corporation terminated the contract with Engineer Doe with full payment for services performed and instructed Engineer Doe not to render a written report to the corporation. Thereafter, Engineer Doe learned that the authority had called a public hearing and that the XYZ Corporation had presented data to support its view that the present discharge meets minimum standards. In deciding that Engineer Doe had an ethical obligation to report his findings to the authority upon learning of the hearing, the Board acknowledged that the termination of Engineer Doe’s contract with full payment for services rendered is a business decision which the Board presumed was permitted by the terms of the engineering services contract between Engineer Doe and his client. However, the Board also concluded that Engineer Doe had reason to question why the corporation specifically stipulated that he not render a written report. Upon learning of the hearing, Engineer Doe was squarely confronted with his obligations to the public concerning its safety, health, and welfare and that his duty to the public was paramount.

Turning to the facts in the present case, following completion of the assignment from Engineer B, Engineer A learned that the company may be illegally using his work product under U.S. law. In view of these events, Engineer A has an obligation to discuss this matter with Engineer B and provide all of the facts and circumstances to Engineer B’s attention. While it may be anticipated that Engineer B will carefully look into this matter to verify Engineer A’s concerns, in the event that Engineer B  does not take this action, it would be ethically proper for Engineer A to either seek an appeal of this matter at a higher management level within HyTechCo or recommend that Engineer B seek a written opinion from HyTechCo’s legal department regarding this matter. Neither Engineer A nor Engineer B are in a position to make a legal judgment on this matter. Engineers A and B may want to consider documenting the actions and discussions taken by them.

The Board recognizes that for a young engineer just beginning his or her professional career, it is frequently difficult to challenge superiors in matters involving professional practice and that there is often a tendency to “go along,” “not question authority,” and “be loyal to the company.” However, it is the Board’s view that the most loyal action a young engineer or any engineer within a company can take is to communicate the fact that the company may be taking a risky path by pursuing an action that will fall outside of the bounds of the law or cause great embarrassment for the company.

NSPE Code of Ethics References: 

I.1.

Hold paramount the safety, health, and welfare of the public.

Subject Reference: 
Duty to the Public

I.6.

Conduct themselves honorably, responsibly, ethically, and lawfully so as to enhance the honor, reputation, and usefulness of the profession.

II.1.d.

Engineers shall not permit the use of their name or associate in business ventures with any person or firm that they believe is engaged in fraudulent or dishonest enterprise.

Subject Reference: 
Associating with Others
Firm Name

II.1.e.

Engineers shall not aid or abet the unlawful practice of engineering by a person or firm.

Subject Reference: 
Unethical Practice by Others

II.4.

Engineers shall act for each employer or client as faithful agents or trustees.

Subject Reference: 
Conflict of Interest
Faithful Agents and Trustees

III.1.

Engineers shall be guided in all their relations by the highest standards of honesty and integrity.

Conclusion: 

Engineer A and B’s ethical responsibilities are as follows:

  1. Engineer A is responsible to call to Engineer B’s attention to the possible violation of federal law;
  2. Engineer B has the responsibility to inform the company of Engineer A’s concerns and recommend that Engineer A pursue a legal opinion on the matter; and
  3. Engineer B has the responsibility to inform Engineer A that he has carried Engineer A’s concerns to management.