Ethical Frameworks for Cybersecurity

Abstract

This chapter presents several ethical frameworks that are useful for analysing ethical questions of cybersecurity. It begins with two frameworks that are important in practice: the principlist framework employed in the Menlo Report on cybersecurity research and the rights-based principle that is influential in the law, in particular EU law. It is argued that since the harms and benefits caused by cybersecurity operations and policies are of a probabilistic nature, both approaches cannot avoid dealing with risk and probability. Therefore, the chapter turns to the ethics of risk, showing that it is a necessary complement to such approaches. The ethics of risk are discussed in more detail by considering two consequentialist approaches (utilitarianism and maximin consequentialism), deontological approaches and contractualist approaches to risk at length, highlighting the difficulties raised by special cases. Finally, Nissenbaum's 'contextual integrity' approach is introduced, which has become an important framework for understanding privacy, both descriptively and normatively. A revised version of this framework is proposed for identifying and ethically assessing changes brought about by cybersecurity measures and policies, not only in relation to privacy but more generally to the key expectations concerning human interactions within the practice.

A Discussion on Ethical Cybersecurity Issues in Digital Service Chains

“…The author identifies and discusses several value conflicts, not only between security and privacy, but also between privacy and fairness or accountability. The chapter of Loi and Christen [50] discusses several ethical frameworks for cybersecurity and creates a first methodology for the assessment of ethical issues. The methodology follows the privacy framework of Nissenbaum [68] that views privacy as contextual integrity and extends it with "social norms and expectations affecting all human interactions that are constitutive of an established social practice" [50].…”

“…The chapter of Loi and Christen [50] discusses several ethical frameworks for cybersecurity and creates a first methodology for the assessment of ethical issues. The methodology follows the privacy framework of Nissenbaum [68] that views privacy as contextual integrity and extends it with "social norms and expectations affecting all human interactions that are constitutive of an established social practice" [50]. When discussing ethical issues in the context of business, the book focuses more on specific domains, such as healthcare, or on ensuring cybersecurity for businesses (see [59,80]).…”

(Un)ethical behaviors of police officers in South Korea: a structural equation analysis

“…Principlism emphasizes adherence to both an organization's internal policies and procedures and external social rules to control individual members' ethical behavior. An organization with a strong principlistic perspective tends to maintain a higher level of ethical culture and to have a positive influence on ethical judgments and decisions among the members (Loi and Christen, 2020). An egoism-oriented organization, on the other hand, tends to postulate that individual members make decisions as a means to reap personal gain and benefits, which naturally impact judgment and promotes engagement in unethical acts.…”

A principlist framework for cybersecurity ethics

“…Van de Poel (2020) 1) security, 2) privacy, 3) fairness, and 4) accountability. The Menlo Report (2012) 1) respect for persons, 2) beneficence, and 3) justice Loi and Christen (2020) 1) privacy, 2) data protection, 3) non-discrimination, 4) due process and free speech, and 5) physical integrity Weber and Kleine (2020) 1) efficiency and quality of service, 2) privacy of information and confidentiality of communication, 3) usability of services, and 4) safety. Morgan and Gordijn (2020) 1) privacy, 2) protection of data, 3) trust, 4) control, 5) accountability, 6) confidentiality, 7) responsibility on business to use ethical codes of conduct, 8) data integrity, 9) consent, 10) transparency, 11) availability, 12) accountability, 13) autonomy, 14) ownership, and 15) usability.…”