14 ms·

It's not just crime that you shouldn't use your skills for, it's all immoral or unethical activity. It's a surprisingly urgent problem in a field that enables

It's not just crime that you shouldn't use your skills for, it's all immoral or unethical activity. It's a surprisingly urgent problem in a field that enables mass government surveillance, dark patterns, big data aggregation, and cyber warfare. As an attorney, I wonder if software engineers should consider implementing some kind of rules for professional conduct and an organization to enforce it like the lawyers have.

jacques_chester 9y ago
There is such a code, jointly published by the ACM and IEEE CS[0]. It's simple and sound. In many ways anyone of ordinary decency can intuit the principles. It has no teeth and I expect it never will, despite numerous attempts by national bodies to entrench an accounting/legal/medical style of enforceable professional standards. [0] http://www.acm.org/about/se-code http://www.acm.org/about/se-code
- sevensor 9y ago
  This was entirely moderate, reasonable, and well thought-out! To be honest, I was expecting vague committe-written platitudes. I was wrong. This is well worth a read.
  - jasonkostempski 9y ago
    You'd need some insane malpractice insurance if you agreed to some of the things in there. The first rule alone is way too broad "Accept full responsibility for their own work."
    - sevensor 9y ago
      That's an interesting point. I wasn't reading this as a binding legal framework. That would be a recipe for disaster. This document is full of sound ethical advice. It's not unreasonable to say that you're morally responsible for the code you write. If you work for a bad company that does bad things, I'm going to judge you for that, just as I expect to be judged. And this document sets up a reasonable standard by which we can judge software developers. But legally? That's a whole other can of worms. Giving this document the force of law would just make it easier to shift the blame in a crooked organization onto the people writing its software. At most, I could see affirmation of this document and an oath to abide by it as the basis for membership in a voluntary professional organization.
      - dsacco 9y ago
        Yes, but who is doing the judging, and how? What does taking "moral responsibility" mean? Laws are not perfectly correlated with morality (regardless of your ideology), but they at least provide a methodology of implementation and disciplinary action. If I stand to gain from unethical software, and the worst thing that happens to me is some vague entity with no power holds me in disrepute, why do I care? It's not an effective code at all, it just feels good for its proponents.
        dvtv75 9y ago
        > Yes, but who is doing the judging, and how? What does taking "moral responsibility" mean? Hasn't this already been solved? Take a leaf out of Engineering or Medical licensing.
  - jnordwick 9y ago
    A little broad and opinionated at points I thought. > diminish quality of life, diminish privacy or harm the environment. Could you work at a targeted advertising company or at resource extraction (eg mining)? > Consider issues of physical disabilities, allocation of resources, economic disadvantage and other factors that can diminish access to the benefits of software. Seems like some economic SJW stuff, and would you break your oath if you didn't add blind accessibility to your GUI? > 3.03. Identify, define and address ethical, economic, cultural, legal and environmental issues related to work projects. This seems way outside the scope of a developer, especially if we are speaking of technical and deep fields like health care or finance. The rest isn't too bad. I often fear things are this would just be used to best people over the head that disagree with "best practices" in the industry or work in unfavored industries.
    - majewsky 9y ago
      > Could you work at a targeted advertising company or at resource extraction (eg mining)? You're on the right track. These moral codes are supposed to get people thinking whether their acts are really ethical, or just rationalized as such.
      - jnordwick 9y ago
        I work in high frequency trading - I'm sure many would try to disbar me if we had a bar. Since lawyers deal in argument, I think they are better at knowing where to draw lines like this. Reading HN or worse /. I don't think developers can do this well. I used to poke around legal forums a lot and their discussions were much better and well argued compared to dev forums
    - phahbeya 9y ago
      >> Consider issues of physical disabilities, allocation of resources, economic disadvantage and other factors that can diminish access to the benefits of software. >Seems like some economic SJW stuff, and would you break your oath if you didn't add blind accessibility to your GUI? If you forgot about maybe ensuring blind accessibility, then you goofed. If you were informed of this issue, and refused to seriously consider the matter, then you broke the code of conduct. If you seriously consider the matter, and decide not to implement blind accessibility after estimating the cost/time for doing so, then you are in agreement with the code. >> diminish quality of life, diminish privacy or harm the environment. > Could you work at a targeted advertising company or at resource extraction (eg mining)? Environmental: I would guess the typical example of unethical software engineering is the big VW diesel scandal. As far as I understood, the Bosch engineers who wrote the offending code clearly documented that it is for debug purposes only, and use in production would be unethical and probably illegal. Were these engineers in breach of the code-of-conduct? In my view this depends on whether there is a good debug justification for the code; if not, then they acted unethically by even writing it and should have refused. The code-of-conduct requires them to think about whether such a feature is justified for debug purposes. Did the VW people who put this into production break the code-of-conduct? Absolutely. >> 3.03. Identify, define and address ethical, economic, cultural, legal and environmental issues related to work projects. >This seems way outside the scope of a developer, especially if we are speaking of technical and deep fields like health care or finance. I think that the code-of-conduct just requires that you carefully think about these matters, and accept that your personal ethical responsibility cannot be discharged by "my boss/customer told me to do this".
- gtirloni 9y ago
  There is a project to update it: https://ethics.acm.org https://ethics.acm.org https://cacm.acm.org/magazines/2017/5/216328-listening-to-professional-voices/fulltext https://cacm.acm.org/magazines/2017/5/216328-listening-to-pr...
- meej 9y ago
  For those of us who got degrees in college with the word "Engineering" in the name, there's also the Order of the Engineer, which is entirely about professional responsibility and ethics. https://en.wikipedia.org/wiki/Order_of_the_Engineer https://en.wikipedia.org/wiki/Order_of_the_Engineer In Canada it's known as the Ritual of the Calling of an Engineer. https://en.wikipedia.org/wiki/Ritual_of_the_Calling_of_an_Engineer https://en.wikipedia.org/wiki/Ritual_of_the_Calling_of_an_En... This is something of a tangent, but I have started to wonder if the push to teach "everyone" to learn to code has resulted in a growing population of software developers who are not acquainted with professional ethics. Does anyone know, does the typical coding bootcamp or hacker school curriculum cover ethics? IIRC, ethics education is part of the accreditation requirements for both computer science and computer engineering programs.
  - HarryHirsch 9y ago
    The Engineers Order was established after a very public bridge failure with loss of life, where engineers signed off plans that should never have been approved. Things got better, in the Western world bridge and building collapses are rare. But software on the other hand - data breaches are a common occurrence, and those who signed off on the weak security are never held accountable.
SomeStupidPoint 9y ago
Like the Bush lawyers and the torture enabling memos? Or the DoJ lawyers filing uncontested FISA warrants for inappropriate things? I know! You must mean the federal prosecutors who overcharge as a matter of course to have negotiating leverage for plea deals. Or maybe the patent trolls? Upstanding folks those are! Lawyers definitely don't (categorically) do anything besides what their client wants, externalities and ethics be damned.
- dmourati 9y ago
  My constitutional law professor Ron Rotunda got himself entwined in those torture memos, at least as far as being mentioned in connection with their authoring. What exactly his role is remains unclear but that shook me pretty deeply: https://www.emptywheel.net/2010/03/09/ronald-rotunda-yoo-sent-email-to-someone-else/ https://www.emptywheel.net/2010/03/09/ronald-rotunda-yoo-sen...
- gregwtmtno 9y ago
  It seems like you disagree with me. Can you please state your argument without the sarcasm?
  - SomeStupidPoint 9y ago
    Your proposed solution doesn't address the stated problem in the field you're discussing (law), why would it solve it in a different field (tech/software)? It just so transparently doesn't work in that field it's hard to even take the proposal as in good faith, since it has to ignore newsmaking and routine behavior. Rather, it comes across as a self-righteous comment: we have ethical standards (even if we routinely don't adhere to them and do terrible things as a matter of course) so clearly those engineers would be better if they were more like us! The sarcasm likely wasn't constructive, so I'll apologize for that.
    - gregwtmtno 9y ago
      I'll certainly agree that the rules of professional conduct in the legal profession don't prevent all unethical conduct, but that doesn't mean that they are completely ineffective. Having enforceable rules may improve ethical standards in the field without solving the problem entirely. I'd also like to point out that I did not propose a solution. I think it should be considered, but I'm a long way from supporting the idea fully. There are a lot of negatives that come with license requirements that attorneys have.
fragsworth 9y ago
Agreed, but it also goes even farther than just avoiding doing things that are immoral. We should be breaking laws that prevent us from doing the right thing. Snowden probably broke some laws, but we're all better off for it. Fortunately, most people in tech understand this!
- kalmari 9y ago
  thats the grey area in a global network. your probably breaking some ones rules. you need a good foundation of what you believe and take resposonsibility and stand up for that.
wolly 9y ago
The problem aren't really rules so much as a lack of substance in the industry. Even in this case where the author takes a stand and says to "just say no" the top right menu says "domains for sale". Even if you don't consider the domain industry itself shitty there's a huge overlap between that industry and things that are ethically questionable online. If one wants to change things, the system has to change first.
- y_hn_blocks2 9y ago
  Then we need a code of conduct for tech folk. Don't build the next set of tools to spy on the populace, don't help build vast scale databases on innocent people. Walk away!
- glitcher 9y ago
  > If one wants to change things, the system has to change first. Isn't that a bit of a chicken and egg problem there? The way I see it, the system won't change if those who want change are waiting for the system to change first.
- cosinetau 9y ago
  > If one wants to change things, the system has to change first. Ha! Show me your mettle.
jvreagan 9y ago
You forgot the smiley at the end of your last sentence.
castratikron 9y ago
A lot of people think that laws and ethics are interchangeable. If something's illegal, it must be wrong; otherwise, it must be right. Laws don't define ethics. They're only an implementation of justice. It's up to us to decide what's right and what's wrong.
- knicholes 9y ago
  In my ethics and values class, I was told that law is the lowest form of morality.
  - coldtea 9y ago
    The law can also be totally immoral. (E.g. following a bad law like Jim Crow laws used to make profit or to exploit people etc).
  - iopq 9y ago
    The law is the implementation, it's not morality at all. Absolutely immoral things can be legal and absolutely moral things can be illegal.
    - jimmyk 9y ago
      What does it mean for something to be "absolutely moral" or "absolutely immoral"? What test can I perform to find out which bucket something falls into?
      - iopq 9y ago
        Sure, if 95% (or any percentage you wish to set) agree on something, then it's probably not a moral gray area. It can't be 100% because you will always find one person to disagree, but it can be close. For example, I would say that crossing the street on a red light when you can see that there are no cars for miles is going to be considered moral by a huge percentage of people. It will also be considered illegal in most places.
logicallee 9y ago
>some kind of rules for professional conduct and an organization to enforce it like the lawyers have. ... how's that working out for you guys? I mean, no offense, but the two professions require roughly the same mental acumen and amount of investment in learning materials (though lawyers go down a more academic path and must pass a bar exam, strictly there is more they "must" master) -- but out of "sleazy lawyer" and "sleazy programmer" which do you hear? Likely because lawyers must represent their clients - some if whom are sleazy. But I wouldn't take the ethical standard set by the legal profession as a paragon for other professions to emulate. Obviously it has severe limits.
- jnordwick 9y ago
  I wouldn't call those faults. What you call sleazy lawyers the software profession call those cowboy coders working in advertising, finance, or comp sec. They are just those outside the mainstream. The fact that those sleazy lawyers win cases should show they perform a valuable service from the ambulance chasers to the corporate defenders.
- titanomachy 9y ago
  > same investment in learning materials Don't you need to go to law school to become a lawyer in most places? That's a lot of money. You can learn to be a programmer using a cheap laptop and public library WiFi.
  - logicallee 9y ago
    I meant time investment - both need to master an objectively large body of knowledge. (By the way it is also possible to "read the law"[1] though not common.) [1] https://en.m.wikipedia.org/wiki/Reading_law https://en.m.wikipedia.org/wiki/Reading_law
    - dpc59 9y ago
      There are a lot of places where you can't take the bar exam through just reading the law, you need a degree.
jasonkostempski 9y ago
But then what, no one is allowed to own a compiler or interpreter until they get a degree?
- gregwtmtno 9y ago
  I think that would be one of the major issues. Here's how that situation is handled on the legal side in the US. Anyone is permitted to practice law for themselves, but to practice law on someone's behalf, you need to be admitted to the bar. I'm not endorsing it, but I can imagine a situation where anyone can write code on their own, but to get paid to do it, you need a license (subject to ethics rules). Again, I'm not supporting the idea, but it could work that way.
  - cookiecaper 9y ago
    >Here's how that situation is handled on the legal side in the US. Anyone is permitted to practice law for themselves, but to practice law on someone's behalf, you need to be admitted to the bar. Important caveat: companies must be represented by a licensed attorney. A non-attorney startup founder cannot represent his/her own company in court. This is technically legally compliant with "someone else" since the corporation is a distinct legal entity, but it means that if you can't afford a lawyer (and which of us working slobs can these days?) and someone sues your company you are SOL. Courts are seeing a massive rise in pro se litigants over the last 15 years, entirely because legal services are stretching to costs that put them outside the reach of non-millionaires. Law is a great example of the nightmare that software can become if we go overboard on regulation. There was once a time where becoming a self-taught lawyer was not all that different than becoming a self-taught programmer. You could learn just by "reading the law" and shadowing professionals, much like you can learn just by reading (and writing) code today. It was at least partially merit based and some of the best legal minds of the last generation came up this way. Now, you have to sacrifice 6 years of your life and easily half a million dollars to be allowed to even try to sell legal services, and the market is so flooded with low-end graduates who are stuck in this desperate situation that many of them can't even sell their services anyway, due to the extreme competition in the lower rungs (driven by student desperation to find work to pay down that massive debt and the artificially constrained supply by the ABA's excessive licensing requirements).
joncalhoun 9y ago
Any suggestions as to how those rules for professional conduct would be enforced? A lawyer can be disbarred, and this is easy to enforce because they can't go into a courtroom and defend or prosecute afterwards. Developers have no equivalent. There is no way to dictate who can and can't work as a developer. Perhaps you could create some sort of agency that every developer needs to be a part of to work, but I don't ever see developers all agreeing to give an organization that much power.
brilliantcode 9y ago
The laws, ethics, morality were all constructed by people who disregarded them and was able to build massive fortunes and influence before they invented the gun with force. Except we don't have kings anymore but hundreds of thousands f corporations writing the rules to benefit their shareholders who collectively act as the brain.
BjoernKW 9y ago
You're right in that you shouldn't use your skills for unethical activity. However, since you mentioned you're an attorney I'm wondering if an official professional code of conduct does really help with that. There are plenty of lawyers engaging in unethical behaviour and the Bar often doesn't bar them from doing so. Case in point: The way Aaron Schwartz was treated. The prosecution seriously overstepped the boundaries of what can be considered ethical behaviour. Even worse, they did it for shady political reasons and personal career considerations.
- aaron-lebo 9y ago
  It clearly doesn't help. Who are the most successful lawyers? Politicians. Try and think of an unethical one...too many to chose from. Hell, if religious laws don't prevent people from doing horrible things and then justifying it (and they don't), why would a code of conduct help anything? If the heart of a profession is greed (and tech is or is getting there), then your code of conduct means nothing. You just gotta justify your actions, and tech companies already do that. "We're changing the world for the better! (But don't mind us if we track, spy, manipulate, and price-gouge you along the way)." Is that unfair? It feels unfair, but the actions of too many tech companies are deplorable and yet we've got tens of thousands of people working for them. Where do you draw the line? When do you become complicit (someone abuses data because you've built systems which allows and encourages it)? It's really an argument of social norms, and how do you change those, especially (if like law was at one point), you are the industry to get into to make money? If that is the main reason lots of people get involved (from management on down), how do you build and maintain norms that say that quality and concern for the user comes before all else?
  - CJKinni 9y ago
    "Who are the most successful lawyers? Politicians" The most public ones, sure. But not necessarily the most successful.
  - will_brown 9y ago
    You think the most successful lawyers are politicians? It's usually the other way around the most successful politicians are lawyers. Obama, Clinton(s), Ghandi, Lincoln...none of whom were "successful" lawyers, but they all did just fine in politics. As to your point about laws/code not preventing horrible things...they often times do. But no one is claiming laws always eradicate behavior (they can and have) that's why we put people on notice and create penalties because we know people violate the laws/rules anyway. Say Bill Clinton lying under oath, he was caught and the only one who disciplined home was the Bar of his home state: totally disbarred him. In other cases, the law itself might be immoral -take the British colonial law against Indian's making salt, and Ghandi violating it and being arrested, even after, as a politician he was able to change the law and the norms.
tomjen3 9y ago
I would consider it immoral to be a member of such an organization.
maxxxxx 9y ago
Sorry, I have trouble seeing lawyers as example for professional conduct. In my view it's often lawyers that push the limits of ethical behavior to the absolute limits.
ASinclair 9y ago
Like the ACM/IEEE Software Engineering Code of Ethics and Professional Practice [1]? The tricky part is enforcement because Professional Licensure in Software Engineering is relatively new and I suspect won't become widespread. We had to study this code in my Computer Science program's ethics course. [1] http://www.acm.org/about/se-code http://www.acm.org/about/se-code
sametmax 9y ago
Exactly. Plenty people complains about the state of our privacy right now. But when Google offered a job interview to me, I refused and my entourage though it was a bad move. Well, you live in the word you create.
djsumdog 9y ago
In my 20 years of IT, I've worked for a health insurance company (during the height of the 2008 debates), a defense contractor (I only made software licensing servers for them, but we still got e-mails about what bills we should support), multiple telecom companies, two governments, a news agency, a debt collection firm, a shoe shop, a University, etc. I don't think I've ever been asked to do anything illegal (to my knowledge) but I've seen tons of things that have been very unethical. No matter what field you are in, if you open your eyes, you'll see what your company does to stay on top, how their lawyers will stretch things and often settle out of court, and how your industry will lobby for laws that do not protect consumers. I've only written about health care because I think that was the most blatant and currently affects the most people: http://fightthefuture.org/article/returning-to-america-and-the-unaffordable-care-act/ http://fightthefuture.org/article/returning-to-america-and-t... You should always leave if you're asked to do something illegal (and luckily that's never happened to me), but even if your company isn't an Uber or Wal-Mart, they're probably still doing something questionable, even if it's just to compete with the bigger players. It is a reality we have to deal with. I'll say my favourite position was probably the University. I enjoyed working for a place that, although paid a lot less, was less about a product and more about supporting the staff, faculty and students. Don't get me wrong, I still saw a lot of problems and money wasted on stupid stuff, but overall it was a good, non-morally objectionable work environment.
- epalmer 9y ago
  I work at university now and agree. I worked as an IT person and a compliance person at a bak as well. Was never asked to do anything illegal or unethical. I have known people that do bookkeeping who see transactions that give them pause. Family trips written off as business trips and things like that.
closeparen 9y ago
> enables mass government surveillance, dark patterns, big data aggregation, and cyber warfare. It's far from obvious that these things are unethical or immoral. Sure, that's the consensus among a vocal segment of the readership of HN, but I imagine that the security services have no problem finding people who think surveillance and cyber warfare are necessary and patriotic duties, or that adtech companies can find people who think targeted advertising is a glorious expression of efficient free market entrepreneurship. You will find plenty of lawyers working for the Justice and Defense departments, and also defending tech companies against privacy-related lawsuits.
tptacek 9y ago
We are nowhere close to understanding our field well enough to define it as carefully as that. There have been lawyers since the Roman Empire. We've had software development for a few decades. Check back in 50 years or so.
- naasking 9y ago
  > We are nowhere close to understanding our field well enough to define it as carefully as that. There have been lawyers since the Roman Empire. We've had software development for a few decades. That's an important point, but even so, not knowing a lot doesn't mean we know nothing. We certainly know that using source control is important, we know some languages, some APIs and some practice are inherently unsafe, and projects using those should implement stringent security audits in particularly vulnerable deployments. They largely don't, and it's hard to argue that this isn't unethical.
  - tptacek 9y ago
    I guess I sort of agree with this, but you just "knew" virtually every mainstream OS, database, and web server into "unethically unsafe", and if you believe that: are you going to stop using them right now? Keeping up with the competition isn't a license to surrender your ethics. I'm just saying it's complicated, and part of that is because we don't really have a good grip on the problem.
    - naasking 9y ago
      It's unethical if there are any safer, viable alternatives. In systems programming, there is little reason not to use Ada for instance (hopefully Rust soon). Finally, classifying the creation of something as unethical doesn't necessarily entail its use is unethical. An unethically developed cure for cancer would certainly be widely prescribed and used, despite the long history of medical ethics.
batmansmk 9y ago
Engineer is a title in France, you sign an oath. In my eng. school, not following this oath later in your career condemn you to prison, lost of title and interdiction of practicing the job ever again. Does work pretty well.
OliverJones 9y ago
I'm married to an attorney. I like to think she's generally honest. She has put together some form contracts for software businesses I've been in, and they have the nice attribute that everybody says "this is a fair deal" and signs them. I can say that the legal code of ethics has some bright lines in it. If a client gives you funds to hold for some reason, and you put them into your own account, and you get caught doing that, you get disbarred : you lose the right to call yourself a lawyer and/or appear in court for your clients. If you give another lawyer money to induce him to tell his client to sue your client so you both get fees, you get hauled up before the bar overseers on charges. If you talk about your clients' business without their permission, you get hauled up on charges. To say "lawyers are unethical" is to fall prey to the availability heuristic. We all know about scumbag pols who happen to be lawyers. I think gregwtmnto has a point. If we software people had something like Professional Engineer (PE) registration (civil engineers have that), it would help. Companies gathering sensitive information could ask for a PE to sign off on the security measures. That would serve them as a defense should somebody sue them for damages after a leak. The same is true for bridge designers. PEs sign off on the designs, after making sure the bolts are strong enough and the pilings are deep enough and all that stuff. This cyber security subject is near to me; my present (small) company finished our PCI (payment card industry) audit yesterday. We've worked hard to avoid the stupid webdev tricks in Troy's article, and even some not-so-stupid vulnerabilities. These stupid tricks erode confidence in all of us. Hold my beer. Watch this!
- greyfox 9y ago
  can you please link to troy's article? i'm interested in reading it.
  - pcl 9y ago
    I expect he's referring to the post from yesterday: https://www.troyhunt.com/reckon-youve-seen-some-stupid-security-things-here-hold-my-beer/ https://www.troyhunt.com/reckon-youve-seen-some-stupid-secur... https://news.ycombinator.com/item?id=14218270 https://news.ycombinator.com/item?id=14218270
- dsacco 9y ago
WrtCdEvrydy 9y ago
The problem is that software engineers have a lot of "power" and not a lot of "management that goes to bat for them". I had this issue at a previous job, someone above me wanted access to some info they didn't need for their job and I ended up sending an email saying "As the Jr Developer, I have the authority to tell you to go through HR and prove your business need for this". The problem is that developers are put under IT and that's not exactly perfect.
jdboyd 9y ago
I don't see how such a system could be implemented in a meaningful way. If any system would have a chance of being supported by the US government, then it probably wouldn't rule out the bad behaviour examples you give. If by some chance it did anyway, it still wouldn't be likely to apply to many parts of the world (or at least would be unenforced). Also, since you mention doctors and lawyers, it is my feeling that many bar associations and state medical boards are more interested in protecting the finances of their senior professionals as well as their own organization than the public that they should be serving. That is not to say that I feel we would be better off without those organizations (certainly not in the short term), but it makes me hesitant to want to see such organizations brought to any more fields.
mercurialshark 9y ago
As an attorney myself, I wonder if you are insinuating that participating in lawful government programs conducted by DoD or the IC, like SIGINT or cyber warfare operations amounts to professional misconduct (edit)? By that logic, providing legal counsel to any number of federal government departments or agencies is a violation of professional conduct. Which, of course, it is not.
- maxerickson 9y ago
  A lawful program can be immoral and participating in it probably is going to inherit that problem. You seem not to admit that possibility in your phrasing.
  - mercurialshark 9y ago
    No. I'm speaking to professional misconduct. Touching on their point, that a professional conduct regulatory body would not preclude participating in the precise activities they reference as unethical.
    - maxerickson 9y ago
      Your edited comment is harder to misread.
fudged71 9y ago
In Canada, software engineers are bound by a code of ethics that are shared by all engineers, and you can't use the label engineer without it.
tempestn 9y ago
All professional engineers (including software engineers) do have such a code of ethics. Which isn't to say they necessarily adhere to it any better or worse than most software developers.

jacques_chester 9y ago

There is such a code, jointly published by the ACM and IEEE CS[0]. It's simple and sound. In many ways anyone of ordinary decency can intuit the principles. It has no teeth and I expect it never will, despite numerous attempts by national bodies to entrench an accounting/legal/medical style of enforceable professional standards. [0] http://www.acm.org/about/se-code http://www.acm.org/about/se-code

sevensor 9y ago
This was entirely moderate, reasonable, and well thought-out! To be honest, I was expecting vague committe-written platitudes. I was wrong. This is well worth a read.
- jasonkostempski 9y ago
  You'd need some insane malpractice insurance if you agreed to some of the things in there. The first rule alone is way too broad "Accept full responsibility for their own work."
  - sevensor 9y ago
    That's an interesting point. I wasn't reading this as a binding legal framework. That would be a recipe for disaster. This document is full of sound ethical advice. It's not unreasonable to say that you're morally responsible for the code you write. If you work for a bad company that does bad things, I'm going to judge you for that, just as I expect to be judged. And this document sets up a reasonable standard by which we can judge software developers. But legally? That's a whole other can of worms. Giving this document the force of law would just make it easier to shift the blame in a crooked organization onto the people writing its software. At most, I could see affirmation of this document and an oath to abide by it as the basis for membership in a voluntary professional organization.
    - dsacco 9y ago
      Yes, but who is doing the judging, and how? What does taking "moral responsibility" mean? Laws are not perfectly correlated with morality (regardless of your ideology), but they at least provide a methodology of implementation and disciplinary action. If I stand to gain from unethical software, and the worst thing that happens to me is some vague entity with no power holds me in disrepute, why do I care? It's not an effective code at all, it just feels good for its proponents.
      - dvtv75 9y ago
        > Yes, but who is doing the judging, and how? What does taking "moral responsibility" mean? Hasn't this already been solved? Take a leaf out of Engineering or Medical licensing.
- jnordwick 9y ago
  A little broad and opinionated at points I thought. > diminish quality of life, diminish privacy or harm the environment. Could you work at a targeted advertising company or at resource extraction (eg mining)? > Consider issues of physical disabilities, allocation of resources, economic disadvantage and other factors that can diminish access to the benefits of software. Seems like some economic SJW stuff, and would you break your oath if you didn't add blind accessibility to your GUI? > 3.03. Identify, define and address ethical, economic, cultural, legal and environmental issues related to work projects. This seems way outside the scope of a developer, especially if we are speaking of technical and deep fields like health care or finance. The rest isn't too bad. I often fear things are this would just be used to best people over the head that disagree with "best practices" in the industry or work in unfavored industries.
  - majewsky 9y ago
    > Could you work at a targeted advertising company or at resource extraction (eg mining)? You're on the right track. These moral codes are supposed to get people thinking whether their acts are really ethical, or just rationalized as such.
    - jnordwick 9y ago
      I work in high frequency trading - I'm sure many would try to disbar me if we had a bar. Since lawyers deal in argument, I think they are better at knowing where to draw lines like this. Reading HN or worse /. I don't think developers can do this well. I used to poke around legal forums a lot and their discussions were much better and well argued compared to dev forums
  - phahbeya 9y ago
    >> Consider issues of physical disabilities, allocation of resources, economic disadvantage and other factors that can diminish access to the benefits of software. >Seems like some economic SJW stuff, and would you break your oath if you didn't add blind accessibility to your GUI? If you forgot about maybe ensuring blind accessibility, then you goofed. If you were informed of this issue, and refused to seriously consider the matter, then you broke the code of conduct. If you seriously consider the matter, and decide not to implement blind accessibility after estimating the cost/time for doing so, then you are in agreement with the code. >> diminish quality of life, diminish privacy or harm the environment. > Could you work at a targeted advertising company or at resource extraction (eg mining)? Environmental: I would guess the typical example of unethical software engineering is the big VW diesel scandal. As far as I understood, the Bosch engineers who wrote the offending code clearly documented that it is for debug purposes only, and use in production would be unethical and probably illegal. Were these engineers in breach of the code-of-conduct? In my view this depends on whether there is a good debug justification for the code; if not, then they acted unethically by even writing it and should have refused. The code-of-conduct requires them to think about whether such a feature is justified for debug purposes. Did the VW people who put this into production break the code-of-conduct? Absolutely. >> 3.03. Identify, define and address ethical, economic, cultural, legal and environmental issues related to work projects. >This seems way outside the scope of a developer, especially if we are speaking of technical and deep fields like health care or finance. I think that the code-of-conduct just requires that you carefully think about these matters, and accept that your personal ethical responsibility cannot be discharged by "my boss/customer told me to do this".
gtirloni 9y ago
There is a project to update it: https://ethics.acm.org https://ethics.acm.org https://cacm.acm.org/magazines/2017/5/216328-listening-to-professional-voices/fulltext https://cacm.acm.org/magazines/2017/5/216328-listening-to-pr...
meej 9y ago
For those of us who got degrees in college with the word "Engineering" in the name, there's also the Order of the Engineer, which is entirely about professional responsibility and ethics. https://en.wikipedia.org/wiki/Order_of_the_Engineer https://en.wikipedia.org/wiki/Order_of_the_Engineer In Canada it's known as the Ritual of the Calling of an Engineer. https://en.wikipedia.org/wiki/Ritual_of_the_Calling_of_an_Engineer https://en.wikipedia.org/wiki/Ritual_of_the_Calling_of_an_En... This is something of a tangent, but I have started to wonder if the push to teach "everyone" to learn to code has resulted in a growing population of software developers who are not acquainted with professional ethics. Does anyone know, does the typical coding bootcamp or hacker school curriculum cover ethics? IIRC, ethics education is part of the accreditation requirements for both computer science and computer engineering programs.
- HarryHirsch 9y ago
  The Engineers Order was established after a very public bridge failure with loss of life, where engineers signed off plans that should never have been approved. Things got better, in the Western world bridge and building collapses are rare. But software on the other hand - data breaches are a common occurrence, and those who signed off on the weak security are never held accountable.

SomeStupidPoint 9y ago

Like the Bush lawyers and the torture enabling memos? Or the DoJ lawyers filing uncontested FISA warrants for inappropriate things? I know! You must mean the federal prosecutors who overcharge as a matter of course to have negotiating leverage for plea deals. Or maybe the patent trolls? Upstanding folks those are! Lawyers definitely don't (categorically) do anything besides what their client wants, externalities and ethics be damned.

dmourati 9y ago
My constitutional law professor Ron Rotunda got himself entwined in those torture memos, at least as far as being mentioned in connection with their authoring. What exactly his role is remains unclear but that shook me pretty deeply: https://www.emptywheel.net/2010/03/09/ronald-rotunda-yoo-sent-email-to-someone-else/ https://www.emptywheel.net/2010/03/09/ronald-rotunda-yoo-sen...
gregwtmtno 9y ago
It seems like you disagree with me. Can you please state your argument without the sarcasm?
- SomeStupidPoint 9y ago
  Your proposed solution doesn't address the stated problem in the field you're discussing (law), why would it solve it in a different field (tech/software)? It just so transparently doesn't work in that field it's hard to even take the proposal as in good faith, since it has to ignore newsmaking and routine behavior. Rather, it comes across as a self-righteous comment: we have ethical standards (even if we routinely don't adhere to them and do terrible things as a matter of course) so clearly those engineers would be better if they were more like us! The sarcasm likely wasn't constructive, so I'll apologize for that.
  - gregwtmtno 9y ago
    I'll certainly agree that the rules of professional conduct in the legal profession don't prevent all unethical conduct, but that doesn't mean that they are completely ineffective. Having enforceable rules may improve ethical standards in the field without solving the problem entirely. I'd also like to point out that I did not propose a solution. I think it should be considered, but I'm a long way from supporting the idea fully. There are a lot of negatives that come with license requirements that attorneys have.

fragsworth 9y ago

Agreed, but it also goes even farther than just avoiding doing things that are immoral. We should be breaking laws that prevent us from doing the right thing. Snowden probably broke some laws, but we're all better off for it. Fortunately, most people in tech understand this!

kalmari 9y ago
thats the grey area in a global network. your probably breaking some ones rules. you need a good foundation of what you believe and take resposonsibility and stand up for that.

wolly 9y ago

The problem aren't really rules so much as a lack of substance in the industry. Even in this case where the author takes a stand and says to "just say no" the top right menu says "domains for sale". Even if you don't consider the domain industry itself shitty there's a huge overlap between that industry and things that are ethically questionable online. If one wants to change things, the system has to change first.

y_hn_blocks2 9y ago
Then we need a code of conduct for tech folk. Don't build the next set of tools to spy on the populace, don't help build vast scale databases on innocent people. Walk away!
glitcher 9y ago
> If one wants to change things, the system has to change first. Isn't that a bit of a chicken and egg problem there? The way I see it, the system won't change if those who want change are waiting for the system to change first.
cosinetau 9y ago
> If one wants to change things, the system has to change first. Ha! Show me your mettle.

jvreagan 9y ago

You forgot the smiley at the end of your last sentence.

castratikron 9y ago

A lot of people think that laws and ethics are interchangeable. If something's illegal, it must be wrong; otherwise, it must be right. Laws don't define ethics. They're only an implementation of justice. It's up to us to decide what's right and what's wrong.

knicholes 9y ago
In my ethics and values class, I was told that law is the lowest form of morality.
- coldtea 9y ago
  The law can also be totally immoral. (E.g. following a bad law like Jim Crow laws used to make profit or to exploit people etc).
- iopq 9y ago
  The law is the implementation, it's not morality at all. Absolutely immoral things can be legal and absolutely moral things can be illegal.
  - jimmyk 9y ago
    What does it mean for something to be "absolutely moral" or "absolutely immoral"? What test can I perform to find out which bucket something falls into?
    - iopq 9y ago
      Sure, if 95% (or any percentage you wish to set) agree on something, then it's probably not a moral gray area. It can't be 100% because you will always find one person to disagree, but it can be close. For example, I would say that crossing the street on a red light when you can see that there are no cars for miles is going to be considered moral by a huge percentage of people. It will also be considered illegal in most places.

logicallee 9y ago

>some kind of rules for professional conduct and an organization to enforce it like the lawyers have. ... how's that working out for you guys? I mean, no offense, but the two professions require roughly the same mental acumen and amount of investment in learning materials (though lawyers go down a more academic path and must pass a bar exam, strictly there is more they "must" master) -- but out of "sleazy lawyer" and "sleazy programmer" which do you hear? Likely because lawyers must represent their clients - some if whom are sleazy. But I wouldn't take the ethical standard set by the legal profession as a paragon for other professions to emulate. Obviously it has severe limits.

jnordwick 9y ago
I wouldn't call those faults. What you call sleazy lawyers the software profession call those cowboy coders working in advertising, finance, or comp sec. They are just those outside the mainstream. The fact that those sleazy lawyers win cases should show they perform a valuable service from the ambulance chasers to the corporate defenders.
titanomachy 9y ago
> same investment in learning materials Don't you need to go to law school to become a lawyer in most places? That's a lot of money. You can learn to be a programmer using a cheap laptop and public library WiFi.
- logicallee 9y ago
  I meant time investment - both need to master an objectively large body of knowledge. (By the way it is also possible to "read the law"[1] though not common.) [1] https://en.m.wikipedia.org/wiki/Reading_law https://en.m.wikipedia.org/wiki/Reading_law
  - dpc59 9y ago
    There are a lot of places where you can't take the bar exam through just reading the law, you need a degree.

jasonkostempski 9y ago

But then what, no one is allowed to own a compiler or interpreter until they get a degree?

gregwtmtno 9y ago
I think that would be one of the major issues. Here's how that situation is handled on the legal side in the US. Anyone is permitted to practice law for themselves, but to practice law on someone's behalf, you need to be admitted to the bar. I'm not endorsing it, but I can imagine a situation where anyone can write code on their own, but to get paid to do it, you need a license (subject to ethics rules). Again, I'm not supporting the idea, but it could work that way.
- cookiecaper 9y ago
  >Here's how that situation is handled on the legal side in the US. Anyone is permitted to practice law for themselves, but to practice law on someone's behalf, you need to be admitted to the bar. Important caveat: companies must be represented by a licensed attorney. A non-attorney startup founder cannot represent his/her own company in court. This is technically legally compliant with "someone else" since the corporation is a distinct legal entity, but it means that if you can't afford a lawyer (and which of us working slobs can these days?) and someone sues your company you are SOL. Courts are seeing a massive rise in pro se litigants over the last 15 years, entirely because legal services are stretching to costs that put them outside the reach of non-millionaires. Law is a great example of the nightmare that software can become if we go overboard on regulation. There was once a time where becoming a self-taught lawyer was not all that different than becoming a self-taught programmer. You could learn just by "reading the law" and shadowing professionals, much like you can learn just by reading (and writing) code today. It was at least partially merit based and some of the best legal minds of the last generation came up this way. Now, you have to sacrifice 6 years of your life and easily half a million dollars to be allowed to even try to sell legal services, and the market is so flooded with low-end graduates who are stuck in this desperate situation that many of them can't even sell their services anyway, due to the extreme competition in the lower rungs (driven by student desperation to find work to pay down that massive debt and the artificially constrained supply by the ABA's excessive licensing requirements).

joncalhoun 9y ago

Any suggestions as to how those rules for professional conduct would be enforced? A lawyer can be disbarred, and this is easy to enforce because they can't go into a courtroom and defend or prosecute afterwards. Developers have no equivalent. There is no way to dictate who can and can't work as a developer. Perhaps you could create some sort of agency that every developer needs to be a part of to work, but I don't ever see developers all agreeing to give an organization that much power.

brilliantcode 9y ago

The laws, ethics, morality were all constructed by people who disregarded them and was able to build massive fortunes and influence before they invented the gun with force. Except we don't have kings anymore but hundreds of thousands f corporations writing the rules to benefit their shareholders who collectively act as the brain.

BjoernKW 9y ago

You're right in that you shouldn't use your skills for unethical activity. However, since you mentioned you're an attorney I'm wondering if an official professional code of conduct does really help with that. There are plenty of lawyers engaging in unethical behaviour and the Bar often doesn't bar them from doing so. Case in point: The way Aaron Schwartz was treated. The prosecution seriously overstepped the boundaries of what can be considered ethical behaviour. Even worse, they did it for shady political reasons and personal career considerations.

aaron-lebo 9y ago
It clearly doesn't help. Who are the most successful lawyers? Politicians. Try and think of an unethical one...too many to chose from. Hell, if religious laws don't prevent people from doing horrible things and then justifying it (and they don't), why would a code of conduct help anything? If the heart of a profession is greed (and tech is or is getting there), then your code of conduct means nothing. You just gotta justify your actions, and tech companies already do that. "We're changing the world for the better! (But don't mind us if we track, spy, manipulate, and price-gouge you along the way)." Is that unfair? It feels unfair, but the actions of too many tech companies are deplorable and yet we've got tens of thousands of people working for them. Where do you draw the line? When do you become complicit (someone abuses data because you've built systems which allows and encourages it)? It's really an argument of social norms, and how do you change those, especially (if like law was at one point), you are the industry to get into to make money? If that is the main reason lots of people get involved (from management on down), how do you build and maintain norms that say that quality and concern for the user comes before all else?
- CJKinni 9y ago
  "Who are the most successful lawyers? Politicians" The most public ones, sure. But not necessarily the most successful.
- will_brown 9y ago
  You think the most successful lawyers are politicians? It's usually the other way around the most successful politicians are lawyers. Obama, Clinton(s), Ghandi, Lincoln...none of whom were "successful" lawyers, but they all did just fine in politics. As to your point about laws/code not preventing horrible things...they often times do. But no one is claiming laws always eradicate behavior (they can and have) that's why we put people on notice and create penalties because we know people violate the laws/rules anyway. Say Bill Clinton lying under oath, he was caught and the only one who disciplined home was the Bar of his home state: totally disbarred him. In other cases, the law itself might be immoral -take the British colonial law against Indian's making salt, and Ghandi violating it and being arrested, even after, as a politician he was able to change the law and the norms.

tomjen3 9y ago

I would consider it immoral to be a member of such an organization.

maxxxxx 9y ago

Sorry, I have trouble seeing lawyers as example for professional conduct. In my view it's often lawyers that push the limits of ethical behavior to the absolute limits.

ASinclair 9y ago

Like the ACM/IEEE Software Engineering Code of Ethics and Professional Practice [1]? The tricky part is enforcement because Professional Licensure in Software Engineering is relatively new and I suspect won't become widespread. We had to study this code in my Computer Science program's ethics course. [1] http://www.acm.org/about/se-code http://www.acm.org/about/se-code

sametmax 9y ago

Exactly. Plenty people complains about the state of our privacy right now. But when Google offered a job interview to me, I refused and my entourage though it was a bad move. Well, you live in the word you create.

djsumdog 9y ago

In my 20 years of IT, I've worked for a health insurance company (during the height of the 2008 debates), a defense contractor (I only made software licensing servers for them, but we still got e-mails about what bills we should support), multiple telecom companies, two governments, a news agency, a debt collection firm, a shoe shop, a University, etc. I don't think I've ever been asked to do anything illegal (to my knowledge) but I've seen tons of things that have been very unethical. No matter what field you are in, if you open your eyes, you'll see what your company does to stay on top, how their lawyers will stretch things and often settle out of court, and how your industry will lobby for laws that do not protect consumers. I've only written about health care because I think that was the most blatant and currently affects the most people: http://fightthefuture.org/article/returning-to-america-and-the-unaffordable-care-act/ http://fightthefuture.org/article/returning-to-america-and-t... You should always leave if you're asked to do something illegal (and luckily that's never happened to me), but even if your company isn't an Uber or Wal-Mart, they're probably still doing something questionable, even if it's just to compete with the bigger players. It is a reality we have to deal with. I'll say my favourite position was probably the University. I enjoyed working for a place that, although paid a lot less, was less about a product and more about supporting the staff, faculty and students. Don't get me wrong, I still saw a lot of problems and money wasted on stupid stuff, but overall it was a good, non-morally objectionable work environment.

epalmer 9y ago
I work at university now and agree. I worked as an IT person and a compliance person at a bak as well. Was never asked to do anything illegal or unethical. I have known people that do bookkeeping who see transactions that give them pause. Family trips written off as business trips and things like that.

closeparen 9y ago

> enables mass government surveillance, dark patterns, big data aggregation, and cyber warfare. It's far from obvious that these things are unethical or immoral. Sure, that's the consensus among a vocal segment of the readership of HN, but I imagine that the security services have no problem finding people who think surveillance and cyber warfare are necessary and patriotic duties, or that adtech companies can find people who think targeted advertising is a glorious expression of efficient free market entrepreneurship. You will find plenty of lawyers working for the Justice and Defense departments, and also defending tech companies against privacy-related lawsuits.

tptacek 9y ago

We are nowhere close to understanding our field well enough to define it as carefully as that. There have been lawyers since the Roman Empire. We've had software development for a few decades. Check back in 50 years or so.

naasking 9y ago
> We are nowhere close to understanding our field well enough to define it as carefully as that. There have been lawyers since the Roman Empire. We've had software development for a few decades. That's an important point, but even so, not knowing a lot doesn't mean we know nothing. We certainly know that using source control is important, we know some languages, some APIs and some practice are inherently unsafe, and projects using those should implement stringent security audits in particularly vulnerable deployments. They largely don't, and it's hard to argue that this isn't unethical.
- tptacek 9y ago
  I guess I sort of agree with this, but you just "knew" virtually every mainstream OS, database, and web server into "unethically unsafe", and if you believe that: are you going to stop using them right now? Keeping up with the competition isn't a license to surrender your ethics. I'm just saying it's complicated, and part of that is because we don't really have a good grip on the problem.
  - naasking 9y ago
    It's unethical if there are any safer, viable alternatives. In systems programming, there is little reason not to use Ada for instance (hopefully Rust soon). Finally, classifying the creation of something as unethical doesn't necessarily entail its use is unethical. An unethically developed cure for cancer would certainly be widely prescribed and used, despite the long history of medical ethics.

batmansmk 9y ago

Engineer is a title in France, you sign an oath. In my eng. school, not following this oath later in your career condemn you to prison, lost of title and interdiction of practicing the job ever again. Does work pretty well.

OliverJones 9y ago

I'm married to an attorney. I like to think she's generally honest. She has put together some form contracts for software businesses I've been in, and they have the nice attribute that everybody says "this is a fair deal" and signs them. I can say that the legal code of ethics has some bright lines in it. If a client gives you funds to hold for some reason, and you put them into your own account, and you get caught doing that, you get disbarred : you lose the right to call yourself a lawyer and/or appear in court for your clients. If you give another lawyer money to induce him to tell his client to sue your client so you both get fees, you get hauled up before the bar overseers on charges. If you talk about your clients' business without their permission, you get hauled up on charges. To say "lawyers are unethical" is to fall prey to the availability heuristic. We all know about scumbag pols who happen to be lawyers. I think gregwtmnto has a point. If we software people had something like Professional Engineer (PE) registration (civil engineers have that), it would help. Companies gathering sensitive information could ask for a PE to sign off on the security measures. That would serve them as a defense should somebody sue them for damages after a leak. The same is true for bridge designers. PEs sign off on the designs, after making sure the bolts are strong enough and the pilings are deep enough and all that stuff. This cyber security subject is near to me; my present (small) company finished our PCI (payment card industry) audit yesterday. We've worked hard to avoid the stupid webdev tricks in Troy's article, and even some not-so-stupid vulnerabilities. These stupid tricks erode confidence in all of us. Hold my beer. Watch this!

greyfox 9y ago
can you please link to troy's article? i'm interested in reading it.
- pcl 9y ago
  I expect he's referring to the post from yesterday: https://www.troyhunt.com/reckon-youve-seen-some-stupid-security-things-here-hold-my-beer/ https://www.troyhunt.com/reckon-youve-seen-some-stupid-secur... https://news.ycombinator.com/item?id=14218270 https://news.ycombinator.com/item?id=14218270
dsacco 9y ago

WrtCdEvrydy 9y ago

The problem is that software engineers have a lot of "power" and not a lot of "management that goes to bat for them". I had this issue at a previous job, someone above me wanted access to some info they didn't need for their job and I ended up sending an email saying "As the Jr Developer, I have the authority to tell you to go through HR and prove your business need for this". The problem is that developers are put under IT and that's not exactly perfect.

jdboyd 9y ago

I don't see how such a system could be implemented in a meaningful way. If any system would have a chance of being supported by the US government, then it probably wouldn't rule out the bad behaviour examples you give. If by some chance it did anyway, it still wouldn't be likely to apply to many parts of the world (or at least would be unenforced). Also, since you mention doctors and lawyers, it is my feeling that many bar associations and state medical boards are more interested in protecting the finances of their senior professionals as well as their own organization than the public that they should be serving. That is not to say that I feel we would be better off without those organizations (certainly not in the short term), but it makes me hesitant to want to see such organizations brought to any more fields.

mercurialshark 9y ago

As an attorney myself, I wonder if you are insinuating that participating in lawful government programs conducted by DoD or the IC, like SIGINT or cyber warfare operations amounts to professional misconduct (edit)? By that logic, providing legal counsel to any number of federal government departments or agencies is a violation of professional conduct. Which, of course, it is not.

maxerickson 9y ago
A lawful program can be immoral and participating in it probably is going to inherit that problem. You seem not to admit that possibility in your phrasing.
- mercurialshark 9y ago
  No. I'm speaking to professional misconduct. Touching on their point, that a professional conduct regulatory body would not preclude participating in the precise activities they reference as unethical.
  - maxerickson 9y ago
    Your edited comment is harder to misread.

fudged71 9y ago

In Canada, software engineers are bound by a code of ethics that are shared by all engineers, and you can't use the label engineer without it.

tempestn 9y ago

All professional engineers (including software engineers) do have such a code of ethics. Which isn't to say they necessarily adhere to it any better or worse than most software developers.