COMPUTING ETHICS: THE CASE FOR CODES OF ETHICS AND PRIVACY POLICIES by Laura Pauline Nyanchama Kombo B.Sc., Kenya Methodist University, 2012 THESIS SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF MASTER OF SCIENCE IN COMPUTER SCIENCE UNIVERSITY OF NORTHERN BRITISH COLUMBIA December 2016 Laura Kombo 2016 Abstract Ethics and privacy are integral to life although limited research has been conducted relative to global codes of ethics and privacy policies of corporations. This piqued the interest on this research where the first contribution examines codes of ethics worldwide. It compares codes of different societies to IEEE and proposes changes which address issues of diversity, culture, and sociopolitical differences. Four countries have adopted the IEEE codes of ethics, while 28 countries have some variations. A global code of ethics would be useful in a world without borders. The second contribution introduces new guidelines for Canadian corporations regarding privacy policies. It examines the compatibility and compliance of corporate privacy policies with PIPEDA. An examination of the corporations revealed only 1,017 have public-facing privacy policies on their websites and some do not seem to satisfy all PIPEDA principles. New guidelines will help to ensure a better compliance with PIPEDA by corporations. Keywords — Ethics, Professional Codes, Code of Ethics, Global Code of Ethics, Corporate Privacy Policies, Toronto Stock Exchange (TSX), Data Privacy, Privacy Breach, Information Security, PIPEDA. ii TABLE OF CONTENTS Abstract ii Table of Contents iii List of Tables iv List of Figures v Glossary vi Acknowledgement viii Chapter One Towards a Global Code of Ethics for Electrical Engineers 1 1.1 Introduction 1 1.2 The History of IEEE and The Development of Its Codes of Ethics 3 1.3 Literature Survey 6 1.4 Problem Statement and Research Objective 12 1.5 Research Methodology 13 1.6 Data Analysis 15 1.6.1 Codes of Ethics Not in IEEE 26 1.7 Proposed Global Codes of Ethics for Electrical Engineers 38 Chapter Two Designing Corporate Privacy Policy that Meet PIPEDA and Information Security of Users 40 2.1 Introduction 40 2.2 Literature Survey 46 2.3 Problem Statement and Research Objective 51 2.4 Research Methodology 52 2.4.1 Part 1 52 2.4.2 Part 2 52 2.4.3 Part 3 64 2.4.4 Part 4 67 2.5 Data Analysis 67 2.5.1 Data Analysis for Part 1 67 2.5.2 Data Analysis for Part 2 67 2.5.2.1 Assessment of PIPEDA Principles Relative to Computing Ethics 69 2.5.3 Data Analysis for Part 3 84 2.5.4 Data Analysis for Part 4 95 2.6 Proposed New Guidelines to Corporate Privacy Policies 96 Chapter Three Conclusions 98 References 101 Appendices 109 iii LIST OF TABLES Table 1 Countries with publicly available code of ethics from different continents 5 Table 2 IEEE code of ethics in compliance with international code of ethics 16 Table 3 International code of ethics not present in IEEE code of ethics 27 Table 4 Technology Corporations’ Privacy Policies Compliance to PIPEDA 53 Table 5 Oil and Gas Corporations’ Privacy Policies Compliance to PIPEDA 54 Table 6 Eight samples of privacy policies and their categories 56 Table 7 Assessment Questions on Designing Corporate Privacy Policy That Meet PIPEDA 65 Table 8 Oil and gas Vs Technology Corporations’ privacy policies compliance to PIPEDA 68 Table 9 Corporations’ privacy policies compliance to PIPEDA 78 Table A1 Privacy Policy Compliance of Corporations to PIPEDA 109 iv LIST OF FIGURES Fig 1 IEEE code of ethics articles 14 Fig 2 Proposed global code of ethics for electrical engineers 38 Fig 3 Akita Drilling limited privacy policy sample 57 Fig 4 Aeterna Zentaris privacy policy sample 58 Fig 5 Axia Netmedia Corporation privacy policy sample 58 Fig 6 Ballard power systems Inc privacy policy sample 59 Fig 7 Dragon Wave Inc privacy policy sample 60 Fig 8 Athabasca Oil Corporation privacy policy sample 61 Fig 9 Agnico Eagle Mines limited privacy policy sample 62 Fig 10 Canadian Real Estate Investment Trust privacy policy sample 63 Fig 11 Proposed New Guidelines to Corporate Privacy Policies 96 Fig A1 Information letter / Consent form 124 v GLOSSARY ACM Association for Computing Machinery AIChE American Institute of Chemical Engineers AIEC American Institute of Electrical Engineers ASCE American Society of Civil Engineers ASME American Society of Mechanical Engineers CIO Chief Information Officer CoE Code of Ethics CS Computer Society CSO Chief Security Officer CV Corporate Value FDE Full Disk Encryption IEEE Institute of Electrical and Electronics Engineers IEEE-CS Institute of Electrical and Electronics Engineers – Computer Society IET Institute of Engineering and Technology IHL International Humanitarian Law IRE Institute of Radio Engineers LOAC Law of Armed Conflict MAC Message Authentication Code NSA National Security Agency PIPEDA Personal Information Protection and Electronic Documents Act PWC PricewaterhouseCoopers REB Research and Ethics Board RSA Rivest Shamir Adleman vi TSX Toronto Stock Exchange UAV Unmanned Aerial Vehicles UN United Nations UNBC University of Northern British Columbia UNHRC United Nations Humanitarian Rights Council vii ACKNOWLEDGEMENT I would like to acknowledge the guidance, love and support of my parents, my boyfriend, my family and friends during my studies. The advice and guidance of my supervisors, Dr. Saif alZahir and Dr. Todd Whitcombe and, my committee members Dr. Chris Opio and Dr. Iliya Bluskov, the support and advice of my fellow graduate students and the financial support from the University of Northern British Columbia. Finally, I would like to acknowledge the human subjects interviewed, for their willingness to be part of the research. viii 1.0 CHAPTER ONE TOWARDS A GLOBAL CODE OF ETHICS FOR ELECTRICAL ENGINEERS 1.1 Introduction Ethics are moral rules, principles, or broad guidelines developed for a specific group of people to assist in their day to day interaction with each other [1]. Ethics is also considered a branch of moral philosophy concerning and specializing in the impact of human relationships [2]. Codes of ethics are rules adopted by professional societies to guide professionals in their practice and to assist professionals in upholding the highest levels of ethical conduct [1]. A code of ethics provides a backdrop against which professionals are able to maintain high standards of practice and integrity pertaining to their professional duties. These duties might include protecting the public’s interest, demonstrating professional competence, preserving confidentiality, addressing conflicts of interest and assisting professional members in engaging in social activities [1]. Codes of ethics are developed to guide the behavior of members in their respective societies and/or professional associations. They are rules for how to behave and provide a framework for decision making that a professional can call upon when making judgement calls [5]. Engineering and computer science societies around the world recognize the importance of having a code of ethics. This is supported by the presence of codes of ethics which are publicly available for many electrical engineering and computer science societies. In some cases, codes of ethics are not publicly available and may be private, only available to the internal employees and/or members. The growth and changes in modern technology have been accompanied by changes in the way people engage at all levels: social, gender, cultural, political, religious and racial 1 norms. What has been considered ethical by different cultures has always been influenced by the development of technology. In the past decades, the increasing rate of development and changes in technology has been accelerated by the changes in cultural and social beliefs of different people and cultures. The growth and changes in modern technology has forced people into different perspectives and to confront entirely new and different channels of judgement on what they consider ethical or unethical. Platforms for ethical judgements still keep on changing with time and what was considered unethical decades ago may now be considered ethical due to industrialization and technological growth. Different communities and/or societies all over the world have different perspectives on what they consider ethical or unethical based on factors as culture, nationalism and/or race. This has made ethics and what is considered ethical a dynamic process albeit one which changes fairly slowly. Engineering is an all encompassing term for many disciplines and each country handles their engineers in their own way. As such, within the sub-disciplines of electrical engineering and computer science, there are many different societies worldwide and each has a different code of ethics due to sociopolitical, historical, and/or cultural reasons. Engineering societies all have different teachings on how to apply right and wrong in the decision making processes with the help of their societal code of ethics. Currently, at an international level, it would appear the professional societies from around the world have not attempted to unify their codes of ethics to a single global code of ethics for electrical engineers and computer scientists. Different societies in different countries generally hold their own societal codes of ethics with higher regards than the codes of ethics of Institute of Electrical and Electronics Engineering (IEEE), despite having chapters of IEEE within their countries. If the various societies adhere to come to a single 2 global code of ethics then such global code of ethics could identify the professionals’ commitments to public safety, health, and welfare among other clauses. 1.2 The history of IEEE and the development of its code of ethics The Institute of Electrical and Electronics Engineers (IEEE) is an international technical institution for electrical engineers and computer scientists. The IEEE is an overarching organization which includes other technical societies such as the Institute of Electrical and Electronics Engineers Computer Society (IEEE-CS) and the Association for Computing Machinery (ACM) among many others.