ETHICAL DILEMMAS IN CYBERSECURITY

Transcription

1 SESSION ID: LAB4-T09 ETHICAL DILEMMAS IN CYBERSECURITY Sean Brooks Research Fellow UC Berkeley Center for Long-Term Jeff Klaben CISO SRI International Irina Raicu Director, Internet Ethics Program Markkula Center for Applied Ethics, Santa Clara

2 Ethical Dilemmas in Cybersecurity Note: Views are our own! 2

3 MCAE: A Framework for Ethical Decision-Making Recognize an ethical issue: Could this decision (or product) be damaging to someone or some group? Is the issue about more than what is legal or most efficient? Get the facts: identify the stakeholders; consult those who would be impacted Evaluate your proposed action through 5 ethical lenses: utilitarianism, rights, fairness/justice, common good, virtue Make a decision and test it Act and reflect on the outcome (and then improve on it) 3

4 MCAE: A Framework for Ethical Decision-Making In app form, too! 4

5 MCAE: A Framework for Ethical Decision-Making It s about thinking through a decision showing your moral math -- Prof. Patrick Lin 5

6 MCAE: A Framework for Ethical Decision-Making THE UTILITARIAN PERSPECTIVE Does this action produce the most good and do the least harm for all who are affected? What good and what harm will or may result? How will I measure a good outcome? While the potential harm from this action may affect only a few people, is the harm so great that it would outweigh the good this action might bring to many others? 6

7 MCAE: A Framework for Ethical Decision-Making THE RIGHTS PERSPECTIVE Does my action best respect the rights of all who have a stake? Does this action respect the dignity of others? If I take this action, am I treating others simply as a means to an end? Does the action hurt or help others in securing a minimum level of well-being? 7

8 MCAE: A Framework for Ethical Decision-Making THE FAIRNESS / JUSTICE PERSPECTIVE Does this action treat people equally or proportionally? Does it give each person affected his or her due? Might I have some prejudice or interest that might make me favor one person over another? Am I treating each individual the same way, or is there a valid reason to treat someone differently? 8

9 MCAE: A Framework for Ethical Decision-Making THE COMMON GOOD PERSPECTIVE Does this action best serve the community as a whole, not just some members? Will this option be to everyone's advantage? Does this action contribute to the conditions of social life that give everyone an opportunity to thrive? How will my action affect the resources everyone must share, such as the environment? 9

10 MCAE: A Framework for Ethical Decision-Making THE VIRTUE PERSPECTIVE Does this option lead me to act as the sort of person I want to be? What character traits would I be exhibiting if I chose this action? Honesty or deceit? Compassion or selfishness? Prudence or irresponsibility? What habits of character would I be developing if I took this action? What would a person I respect say about this choice? 10

11 Ethical Dilemmas in Cybersecurity CONCLUSION: No silver bullet. No perfection. However Asking questions + Evaluating potential decisions through ethical lenses + Showing your moral math = Likely to lead to more thoughtful development of more ethical cybersecurity products and practices 11

12 APPLYING THE FRAMEWORK TO ETHICAL CHALLENGES IN CYBERSECURITY Sean Brooks

13 Dual-Use Technology Image courtesy of Citizen Lab: BLUE COAT DUAL USE DEVICES MAKE THEIR WAY TO US-EMBARGO COUNTRIES A company s technology is capable of infringing the rights of individuals what is the company s responsibility for monitoring the resale of their devices?

14 Real Names Policies REAL-NAME POLICIES ACCUSED OF DISCRIMINATION, INVASION OF PRIVACY How does an organization balance the priorities of their business with the needs of minorities of users who may be disproportionally affected by new policies or practices? 14

15 AutoSploit AUTOMATIC EXPLOIT TOOL BLENDS SHODAN WITH METASPLOIT Does the ease at which such a tool enables exploits jeopardize its value to the research community? 15

16 Eternal Blue WAS MAINTAINING THE ETERNALBLUE VULNERABILITY IN THE PUBLIC INTEREST? 16

17 Some Ethical Dilemmas in Cybersecurity Cybersecurity incident response: How much time and energy should be spent investigating a breach? What is an appropriate level of incident detail to share with customers and other stakeholders? How thick is the line between satisfying organizational obligations and finding the complete "truth" behind an incident? The role of the CISO: What kinds of personal risk should a Chief Information Security Officer or manager-level security officer accept on behalf of an organization? It is not uncommon for CISOs to be fired or forced out when a cybersecurity breach occurs; should organizations offer CISOs employment agreements that include provisions for relief from personal legal liability or other protections? How should organizational deficiencies (underinvestment, bad practices, etc.) factor in this analysis? Research: How should researchers balance the use of potentially aggressive penetration testing techniques against the legal rights of the owners of systems they are researching? Does that balance change in cases where those system owners are not implementing reasonably strong security methods? Automated security tools: Is it ethical to release tools that can automate attacks on a broad array of systems into the wild? 17

18 Additional Ethical Dilemmas in Cybersecurity Vulnerability disclosure: When and how should researchers inform the public about vulnerabilities in widely-used products? What steps should be taken before any such notification? Encryption: What should companies do in response to legal law enforcement requests for encrypted data? Should known vulnerabilities in systems be used to comply with requests that would otherwise be impossible? Should law enforcement agencies use such vulnerabilities themselves if they suspect a formal legal request will not bear fruit? Sale restrictions: What (if any) is the responsibility of cybersecurity professionals to try to prevent the sale of products they have developed to autocratic governments that would use them to harm their citizens? 18

19 Apply Slide Review the Ethical Decision-Making Framework Download MCAE s ethical decision-making app Use the framework when you encounter ethical dilemmas Discuss your analysis and decision with fellow cybersecurity professionals and with trusted people outside the field Follow the Internet Ethics program on 19

20 THANK YOU FOR YOUR INPUT, AND LET'S KEEP THIS CONVERSATION GOING! Irina 20