Cyber Law and Professional Ethics

Freedom of expression

Freedom of expression is the right of individuals to hold opinions and to seek, receive and share information and ideas through speech, writing, art, media and the internet without interference or fear of punishment. It is recognised in Article 19 of the Universal Declaration of Human Rights, and by the Constitution of Nepal 2015 (Article 17), though subject to reasonable restrictions. It is vital for democracy, public debate, innovation and accountability.

Key issues related to freedom of expression

1. Controls on development and use of the internet / censorship: Governments block sites, filter content or shut down internet access, which restricts access to information.
2. Anonymity: Anonymous speech protects whistleblowers and dissenters but enables abuse, harassment and defamation.
3. Defamation: False statements that harm reputation are not protected. Online defamation spreads fast and is hard to remove.
4. Hate speech and incitement: Speech that attacks groups by race, religion, caste or gender, or incites violence, is limited by law.
5. Obscenity and child protection: Pornography and harmful content, especially affecting minors, is restricted. Filtering software and laws such as COPA attempt control.
6. Fake news and misinformation: Spread on social media, it harms society, and attempts to control it raise concerns about abuse of power.
7. Corporate and platform moderation: Social media companies remove posts and ban users, raising questions about private control of public speech.
8. Privacy and intellectual property conflicts: Free speech must be balanced with others' privacy and copyright.
9. National security and public order: Laws such as Nepal's Electronic Transactions Act punish posts considered harmful, and may be misused against critics and journalists.
10. SLAPP suits and surveillance: Lawsuits and monitoring can create a chilling effect on speech.

The challenge is to protect legitimate expression while preventing harm, through narrow, clear, proportionate laws and independent courts.

Freedom of expression is the right to hold opinions and to seek, receive and share information and ideas through any medium without interference, as protected by Article 19 of the UDHR and the Constitution of Nepal. It is not absolute and may be limited by law to protect others and public order.

Key issues with examples

1. Controls on anonymity: anonymous posting protects whistleblowers and critics but also enables abuse. Example: a requirement to use real names on social media.
2. Defamation and hate speech: speech harming a person's reputation or inciting hatred is restricted. Example: posting false accusations about a person on Facebook.
3. Censorship and filtering: governments or ISPs block websites. Example: blocking political sites or temporarily banning social platforms.
4. Obscenity and child protection: laws restrict pornographic content, which must be balanced with legitimate expression. Example: age-restricted websites.
5. National security and public order: speech that threatens security can be limited. Example: arrests for posts alleged to incite violence.
6. Copyright and intellectual property: sharing protected content without permission conflicts with creators' rights. Example: uploading a full movie to YouTube.
7. Fake news and misinformation: false information can cause harm, but laws against it may be misused. Example: false rumours during elections.
8. Corporate speech control: employers and platforms may remove posts or fire employees. Example: employee dismissed for criticising the company online.
9. Privacy vs expression: publishing personal information may violate privacy. Example: doxxing.
10. Journalist and press freedom: surveillance and pressure on media and bloggers.

A balance is needed between protecting expression and preventing harm.

Corporate Social Responsibility (CSR)

CSR is a business approach in which a company takes responsibility for the effects of its activities on society, the environment and its stakeholders, and contributes voluntarily beyond what the law requires. It covers economic, legal, ethical and philanthropic responsibilities. Typical activities include ethical business practice, fair treatment of employees, environmental protection, community development, charity and education programmes, and responsible products and marketing.

Why organizations should pursue CSR

1. Reputation and brand image: builds public trust and loyalty.
2. Customer attraction and retention: consumers prefer responsible companies.
3. Employee motivation: better recruitment, morale, retention and productivity.
4. Investor confidence: ethical firms are seen as lower risk and more sustainable.
5. Risk reduction and legal compliance: avoids scandals, penalties and boycotts.
6. Cost savings and efficiency: for example through energy saving and waste reduction.
7. Long-term sustainability and competitive advantage.
8. Ethical duty: a company uses society's resources and so should give back to it.
9. Better relations with government, community and other stakeholders.

Cyber law

Cyber law (IT law) is the body of legal rules that governs the use of computers, the internet and digital communication. It deals with cyber crime, electronic transactions and signatures, data protection and privacy, intellectual property in the digital world, and online conduct. Its aim is to give legal recognition to electronic records, to protect users, and to punish misuse of technology.

Different laws relating to cyber law

In Nepal

• Electronic Transactions Act, 2063 (2008): the main law; recognises electronic records and digital signatures, provides for certifying authorities, and defines cyber offences (such as hacking, unauthorised access, computer fraud, publishing illegal material) and penalties.
• Individual Privacy Act, 2075 (2018): protects personal data and privacy.
• Copyright Act, 2059 (2002): protects software and digital works.
• Muluki Criminal Code, 2074 (2017) and related provisions covering offences committed through electronic means.
• Electronic Transactions Regulation and the National Cyber Security Policy.

International examples

• IT Act, 2000 (India), Computer Fraud and Abuse Act (USA), GDPR (European Union) for data protection, the Budapest Convention on Cybercrime, and UNCITRAL Model Law on Electronic Commerce.

Common subject areas are cyber crimes, electronic contracts and signatures, privacy and data protection, intellectual property and domain-name disputes.

Computer incidents are security events that harm the confidentiality, integrity or availability of computer systems or data. They are common today for several reasons.

1. Increasing complexity of systems: Modern IT uses networks, cloud services, mobile devices, IoT and many software layers. More components mean more vulnerabilities and more mistakes in configuration.
2. Higher reliance on commercial software with weak security: Software is often released quickly with bugs. Attackers exploit unpatched flaws, and zero-day vulnerabilities are found faster than vendors can fix them.
3. Expanding and changing use of IT: Bring Your Own Device (BYOD), remote work, social media and cloud storage widen the attack surface, and much of it lies outside the organization's control.
4. Increasing sophistication of attackers: Ready-made exploit kits, ransomware-as-a-service and malware tools let even unskilled attackers launch attacks. Organized crime and state-sponsored groups add funding and skill.
5. Human factors: Users choose weak passwords, click phishing links, and are fooled by social engineering. Insiders may misuse access deliberately or by accident.
6. Easy internet access and anonymity: Attackers can act from anywhere, hide their identity, and face weak law enforcement across borders.
7. Poor security investment and awareness: Many organizations treat security as a cost, delay patches, and lack training and incident plans.
8. Valuable targets: Personal data, banking details and intellectual property can be sold or ransomed, so the profit motive drives attacks.

Anonymous use of the Internet means communicating or browsing without revealing one's real identity, using tools such as VPNs, Tor, anonymous remailers, pseudonyms and proxy servers.

Benefits

• It protects privacy and personal data from tracking, profiling and advertisers.
• Whistleblowers, journalists and human-rights activists can report wrongdoing without fear of retaliation.
• It supports freedom of expression in countries with censorship or political repression.
• Victims of abuse, or people seeking sensitive help (health, counselling), can do so safely.
• It lets people vote, give opinions or take part in discussions without social pressure.

Challenges

• Criminals use anonymity for hacking, fraud, trading illegal goods, child exploitation and terrorism, making them hard to trace.
• It enables cyberbullying, harassment, trolling and hate speech without accountability.
• Defamation and false rumours spread easily, and victims find it hard to take legal action.
• Law enforcement faces difficulty gathering digital evidence and identifying offenders, especially across borders.
• Anonymous posters can leak confidential company data or spread malware and spam.
• Governments struggle to balance national security with citizens' right to privacy.

Intellectual property (IP) refers to creations of the human mind, such as inventions, literary and artistic works, designs, symbols, names and images used in commerce. The owner has legal rights to control their use and gain from them. Main forms are copyright, patents, trademarks and trade secrets.

Protecting IP using copyright

Copyright protects the original expression of an idea fixed in a tangible form, such as books, software, music, films, photographs, drawings and databases. It does not protect the idea itself.

• Automatic protection: Copyright arises when the work is created and fixed. Registration, where available (in Nepal, with the Copyright Registrar), gives stronger proof of ownership.
• Exclusive rights: The owner alone may reproduce, distribute, adapt, publicly perform or display the work, and license or sell these rights.
• Duration: Normally the life of the author plus a fixed term (commonly 50 to 70 years), after which the work enters the public domain.
• Copyright notice: Marking the work with the symbol (c), owner's name and year warns others and removes the defence of innocent infringement.
• Licensing and agreements: Written licences, employment contracts and non-disclosure terms define who may use the work and how.
• Technical measures: Digital rights management, watermarking and encryption prevent copying.
• Enforcement: The owner can sue infringers for damages, injunctions and criminal penalties. International protection comes through the Berne Convention and the TRIPS agreement.
• Limits: Fair use or fair dealing allows limited use for study, criticism, news reporting and research.

Improving software quality

Software quality means the software meets requirements, is reliable, secure, maintainable and satisfies users. Ways to improve it:

1. Clear requirements: Gather, document and review requirements with users, and control changes.
2. Sound development methodology: Use a defined process such as Agile, Scrum, or a capability maturity model (CMMI), with planning, design reviews and iteration.
3. Good design and coding standards: Use modular design, design patterns, naming conventions and code reviews or pair programming.
4. Thorough testing: Perform unit, integration, system and acceptance testing, along with regression, performance and security tests. Automate tests where possible.
5. Static analysis and inspections: Use walkthroughs and tools to find defects early, since early defects cost much less to fix.
6. Version control and configuration management: Track changes and maintain builds with tools such as Git and continuous integration.
7. Quality assurance and metrics: Measure defect density, test coverage and failure rates, and follow standards such as ISO 9001 and ISO/IEC 25010.
8. Skilled and trained team: Provide training and a culture where quality is everyone's responsibility.
9. Feedback and maintenance: Collect user feedback, fix bugs quickly and release patches.

Why software quality is important

• Poor quality can cause financial loss, safety risks and even loss of life (for example in medical, aviation or banking software).
• It reduces maintenance and rework costs.
• It protects against security breaches caused by defects.
• It builds customer satisfaction, reputation and competitive advantage.
• It reduces legal liability for the developer and vendor.

(a) Computer forensics

Computer forensics is the scientific collection, preservation, analysis and presentation of digital evidence from computers, networks and storage devices so that it is admissible in court. It is used in cybercrime, fraud, data theft and policy-violation investigations.

Main steps:

1. Identification and seizure: Locate devices and secure them to avoid tampering.
2. Preservation: Make a bit-by-bit forensic image and use write blockers, keeping the original untouched. Record a chain of custody and hash values (MD5/SHA) for integrity.
3. Analysis: Recover deleted files, examine logs, emails, browser history and metadata.
4. Documentation and reporting: Prepare a clear report and give expert testimony.

Common tools include EnCase, FTK and Autopsy.

(b) Internet censorship

Internet censorship is the control or suppression of what can be accessed, published or viewed on the internet, by governments, institutions or organizations. It is applied through blocking websites by IP address or DNS, URL filtering, keyword filtering, removing content, throttling bandwidth, and shutting down networks. Reasons given include national security, protecting children, blocking pornography or hate speech, and protecting intellectual property. Critics argue it limits freedom of expression and access to information and can be used to silence dissent. It can be avoided using VPNs or proxy servers.

Ethics in the business world

Ethics is the set of principles of right and wrong that guide behaviour. Business ethics means applying these principles to business decisions and conduct, covering honesty, fairness, integrity, respect for stakeholders, transparency and compliance with law. Ethical behaviour builds trust among customers, employees, investors and society, and helps avoid scandals, fines and loss of reputation. Ethics goes beyond law: an act may be legal but still unethical.

Actions organizations take to improve business ethics

1. Appoint a corporate ethics officer / board oversight: A senior person (and a board ethics committee) is responsible for ethics programs and ensuring accountability from the top.
2. Establish a corporate code of ethics: A written code states values, expected behaviour and consequences, covering conflict of interest, gifts, confidentiality, discrimination and use of company resources.
3. Conduct social audits: The organization reviews its ethical and social performance regularly and reports results, to correct weaknesses.
4. Require employees to take ethics training: Workshops, case studies and e-learning teach employees to recognise and resolve ethical dilemmas.
5. Include ethical criteria in employee appraisals: Promotion and rewards are linked to ethical conduct as well as results.
6. Create an anonymous whistleblowing / helpline: Employees can report misconduct safely with protection against retaliation.
7. Enforce discipline consistently: Violations are investigated and punished regardless of rank.
8. Set an ethical tone at the top: Leaders model integrity, so that ethics is part of organizational culture.
9. Support ethical suppliers and audits: Vendors are checked for compliance, and decision-making frameworks are given to employees.

Together these actions create an ethical culture, reduce legal risk and improve long-term performance.

CIA security triad

The CIA triad is the core model of information security. It has three goals:

• Confidentiality: Only authorized people can access information. Threats are eavesdropping, data breaches and social engineering.
• Integrity: Information stays accurate, complete and unaltered except by authorized changes. Threats are tampering, malware and unauthorized modification.
• Availability: Systems and data are accessible to authorized users when needed. Threats are DoS/DDoS attacks, hardware failure, ransomware and power loss.

Implementing CIA at organizational level

1. Security policy and risk assessment: Define a security policy, classify data, and perform regular risk assessments and IT security audits.
2. Confidentiality controls:
   • Access control based on least privilege and need-to-know, with role-based access control (RBAC).
   • Strong authentication, such as multifactor authentication.
   • Encryption of data in storage and transit (TLS, VPN, disk encryption).
   • Data classification, NDAs and physical security.
3. Integrity controls:
   • Hashing and digital signatures to detect changes.
   • Change management, version control and audit logs.
   • Input validation, antivirus and patching.
   • Separation of duties.
4. Availability controls:
   • Regular backups and tested disaster recovery and business continuity plans.
   • Redundant servers, RAID, UPS and generators, load balancing.
   • Firewalls, intrusion detection/prevention systems and DDoS protection.
   • Timely patching and monitoring.
5. People and process: Security awareness training, incident response plan, and compliance with standards such as ISO 27001.

The controls are balanced so that increasing one aspect (e.g., confidentiality) does not unduly reduce availability.

Decision-making process

A decision-making process is a structured series of steps to choose the best course of action among alternatives. A commonly used model has these steps:

1. Define the problem / identify the need: Clearly state what must be decided and why.
2. Gather information and set criteria: Collect relevant facts and define the standards (cost, benefit, risk, legality, ethics) for judging options.
3. Identify alternatives: Develop several possible solutions, including doing nothing.
4. Evaluate alternatives: Compare each against the criteria, considering benefits, costs, risks and impact on stakeholders.
5. Choose the best alternative: Select the option that best meets the criteria.
6. Implement the decision: Plan resources, assign responsibility and carry out the choice.
7. Evaluate the results: Monitor outcomes, compare with expectations, and learn or adjust. If the result is unsatisfactory, return to earlier steps.

In ethical decision making, the evaluation step also checks fairness, honesty, legal compliance and effect on all stakeholders.

Organizational response to cyberattacks

Organizations need a planned incident response to limit damage and recover quickly. Main steps:

1. Preparation: Create an incident response plan and team, define roles, keep contact lists, tools, backups and run drills. Train staff.
2. Detection and analysis: Use IDS/IPS, firewalls, SIEM and log monitoring to detect incidents. Confirm whether it is a real incident, determine type, scope and severity.
3. Containment: Isolate affected systems and accounts, block malicious IPs, and disconnect infected machines to stop the spread. Preserve evidence for forensics.
4. Eradication: Remove malware, close the exploited vulnerability, patch systems and reset compromised credentials.
5. Recovery: Restore systems and data from clean backups, test and carefully return to normal operation with monitoring.
6. Notification: Inform management, affected customers, regulators and law enforcement as required by law. Protect reputation through honest, timely communication.
7. Post-incident review: Hold a lessons-learned meeting, document the incident, calculate cost, and improve controls and the plan.

Other responses include ethical considerations such as whether to pay a ransom, and legal action against offenders.

Ethical issues in social networking

Social networking sites such as Facebook, Instagram, TikTok and X connect people but raise several ethical issues:

1. Privacy violations: Platforms collect, share and sell personal data. Users often do not understand privacy settings, and data leaks (such as the Cambridge Analytica case) occur.
2. Cyberbullying and harassment: Abusive messages, threats and shaming can seriously harm victims, especially young people.
3. Fake accounts, impersonation and identity theft: Fake profiles are used for fraud, scams and catfishing.
4. Misinformation and fake news: Rumours and manipulated content spread rapidly, affecting elections and public health.
5. Hate speech and harmful content: Platforms must decide how to moderate such content without violating free speech.
6. Defamation and loss of reputation: Posts can damage persons or organizations.
7. Employer screening and workplace issues: Employers may check candidates' profiles, and employees may be fired for posts, raising fairness questions.
8. Child safety and online predators: Minors can be exposed to grooming and inappropriate content.
9. Addiction and mental health: Design features encourage excessive use, causing stress, anxiety and lost productivity.
10. Intellectual property violations: Users share copyrighted material without permission.
11. Surveillance and tracking: Location and behavioural tracking is used for advertising or monitoring.

Intellectual property issues

• Plagiarism (using others' work without credit).
• Reverse engineering of software.
• Open source code and licensing.
• Competitive intelligence and industrial espionage.
• Trademark infringement and cybersquatting.
• Software and media piracy / copyright infringement.
• Patent infringement and patent trolls.
• Trade secret misuse and breach of non-disclosure agreements by employees.
• Digital rights management and use of copyrighted material online.

Cybersquatting

Cybersquatting is the act of registering, trafficking in or using an internet domain name that is identical or confusingly similar to a well-known trademark, company or personal name, with bad-faith intent to profit. The squatter usually hopes to sell the domain to the rightful owner at a high price, divert customers, or damage the brand. For example, registering a famous company's name as a domain and demanding money to transfer it.

It is addressed by the US Anticybersquatting Consumer Protection Act (ACPA) and the ICANN Uniform Domain-Name Dispute-Resolution Policy (UDRP), under which the trademark owner can have the domain transferred or cancelled.

Developing high-quality software

1. Understand requirements properly: Gather and validate requirements with users, and keep them documented and controlled.
2. Use a mature development process: Follow Agile, Scrum or waterfall with defined stages, and improvement models such as CMMI.
3. Apply good design and coding practices: Use modular design, coding standards, reuse of tested components, code reviews and pair programming.
4. Test at every level: Unit, integration, system, acceptance and regression tests, with automation and continuous integration.
5. Perform inspections and static analysis: Walkthroughs and tools find defects early when fixing is cheap.
6. Use configuration management: Version control and change control keep builds consistent.
7. Apply quality assurance and metrics: Track defects, coverage and reliability, and follow standards (ISO 9001, ISO/IEC 25010).
8. Train developers and encourage a quality culture.
9. Maintain and improve after release: Use feedback and patches.

Importance of software quality

• Failures can cause financial loss, injury or death in critical systems.
• Lower maintenance and rework costs.
• Improved security and fewer vulnerabilities.
• Greater customer satisfaction, trust and market reputation.
• Reduced legal liability for defects and contract disputes.

Contingent workers

Contingent workers are temporary workers who are not permanent employees of the organization. They include freelancers, consultants, independent contractors, temporary (agency) staff, part-time and seasonal workers, and those hired for a specific project. They are paid for the work or period and usually receive no employee benefits, and the employment relationship ends when the task or contract ends. In IT, they are often hired through outsourcing, staffing agencies or for programming, testing and support tasks.

Benefits to organizations

1. Lower cost: No salary commitment in slack periods, and no paid leave, insurance, pension, training or other benefits.
2. Flexibility: The workforce can be expanded or reduced quickly as workload changes.
3. Access to specialist skills: Experts can be hired for short periods without long-term commitment.
4. Reduced recruitment and administrative burden: Agencies handle hiring and payroll.
5. Faster project completion by adding extra staff during peak demand.
6. Reduced risk: The organization avoids layoff costs and legal obligations of permanent employment.
7. Focus on core business: Permanent staff concentrate on key activities.

Drawbacks include lower loyalty, risk to confidential information, knowledge loss and legal issues in misclassifying employees.

(a) Acceptable use policy (AUP)

An acceptable use policy is a written document that states what users may and may not do when using an organization's IT resources, such as computers, networks, email and the internet. Users (employees, students) usually must read and sign it before getting access.

It typically covers: permitted use of resources, prohibition of illegal activity, pirated software, pornography, harassment and spam, rules for passwords and confidentiality, personal use limits, monitoring of activity, and penalties for violations such as warnings, access removal or legal action. It protects the organization from legal liability, reduces security risks and sets clear expectations.

(b) Phishing

Phishing is a social engineering attack in which an attacker sends fraudulent emails, text messages (smishing), calls (vishing) or fake websites that appear to come from a trusted source, such as a bank, to trick victims into revealing sensitive information like passwords, card numbers or OTPs, or to install malware.

Types include spear phishing (targeted), whaling (aimed at executives) and clone phishing.

Prevention: check sender and URLs, never click suspicious links or attachments, use multifactor authentication, spam filters, anti-phishing tools and user awareness training. Victims should report incidents and change passwords immediately.

Corporate social responsibility (CSR)

Corporate social responsibility is the concept that a business has obligations beyond profit to society, the environment and its stakeholders (employees, customers, suppliers, community, shareholders). It means managing business operations to have a positive social and environmental impact, for example through ethical labour practices, environmental protection, community development, philanthropy and fair dealing. Good business ethics means conducting operations honestly and fairly and in compliance with law.

Reasons to pursue CSR and good business ethics

1. Gaining the goodwill of the community: Support for schools, health and local development earns community trust and support.
2. Creating an organization that operates consistently: Shared values and clear ethical standards lead employees to behave consistently across the organization.
3. Fostering good business practices: Ethical dealing with suppliers and customers builds long-term, stable relationships and avoids unfair practices.
4. Protecting the organization and its employees from legal action: Compliance with laws, fines and lawsuits, and regulatory penalties, is avoided. Legal systems may also reduce penalties for organizations with effective ethics programs.
5. Avoiding unfavourable publicity: Scandals damage brand and sales, and ethical conduct avoids negative media coverage.
6. Improving the bottom line / financial gain: Customers prefer responsible brands, loyalty and market share increase, and costs fall through efficiency (such as energy saving).
7. Attracting and retaining talent: Employees prefer to work for responsible employers, and morale and productivity rise.
8. Attracting investors: Ethical investment funds and lenders favour socially responsible firms.
9. Environmental sustainability and meeting stakeholder and regulatory expectations.

Therefore CSR and ethics are strategic investments that strengthen reputation, reduce risk and support sustainable success.

CIA security triad

The CIA triad is the foundation of information security.

• Confidentiality: Prevents unauthorized disclosure of information; only authorized persons can read it.
• Integrity: Ensures data is accurate, complete and not changed without authorization.
• Availability: Ensures systems and data are accessible to authorized users when needed.

Implementation at organization level

• Policy and risk management: Security policy, data classification, risk assessments and audits, compliance with standards such as ISO 27001, and an incident response plan.
• Confidentiality: Role-based access control and least privilege, strong authentication with multifactor, encryption of data at rest and in transit, VPN, NDAs, physical security of server rooms.
• Integrity: Hashing, digital signatures, change management, audit logs, version control, separation of duties, input validation, and patching and antivirus.
• Availability: Regular backups, disaster recovery and business continuity plans, redundant hardware, RAID, UPS, load balancing, firewalls and DDoS protection, IDS/IPS and monitoring.
• People: Security awareness training and clear responsibilities.

Implementation at end-user level

• Confidentiality: Use strong, unique passwords and a password manager, enable two-factor authentication, lock the screen, avoid public Wi-Fi without a VPN, do not share credentials, and be careful with phishing emails.
• Integrity: Keep antivirus and operating system updated, install software only from trusted sources, verify downloaded files using checksums, and avoid unsafe attachments.
• Availability: Back up important files regularly (for example 3-2-1 rule), use a UPS, keep devices updated and report problems quickly.
• Follow the organization's acceptable use policy and report incidents.

Strong security needs both organizational controls and responsible user behaviour.

Importance of protecting intellectual property (IP)

• It rewards creators and inventors and encourages innovation and creativity.
• It gives owners exclusive rights, letting them recover investment and earn profit.
• It protects competitive advantage and brand reputation.
• It prevents piracy, counterfeiting and unfair copying, which cause huge revenue loss.
• It increases the value of a business, for instance for licensing or investment, and supports economic growth and trade.
• It builds consumer trust, since genuine products are safe and reliable.

Copyright

Copyright protects original works of authorship fixed in a tangible form: books, software, music, films, art, databases and websites. It protects expression, not ideas, procedures or facts. Protection arises automatically on creation (registration gives extra proof). The owner has exclusive rights to reproduce, distribute, adapt and perform the work. Duration is generally the author's life plus 50 to 70 years. Fair use allows limited use for education, news and research. Infringement gives rise to civil and criminal remedies. Treaties: Berne Convention, WIPO Copyright Treaty.

Patent

A patent is a government-granted exclusive right to an invention (product or process) that is novel, non-obvious (involves an inventive step) and useful (industrially applicable). The inventor must disclose the invention publicly in the application. Protection lasts about 20 years from filing, after which anyone can use it. Others cannot make, use or sell the invention without permission. It must be applied for in each country (or via the Patent Cooperation Treaty). Software patents are controversial; patent trolls and litigation are issues.

Trade secrets

A trade secret is confidential business information that gives a competitive edge, such as formulas (Coca-Cola), customer lists, algorithms, processes or marketing plans. To qualify, it must be secret, have commercial value because of its secrecy, and be subject to reasonable efforts to keep it secret. Protection is through non-disclosure agreements, non-compete clauses, access restrictions, encryption, and employee training. There is no registration and protection lasts as long as secrecy remains. It is lost if it is independently discovered, reverse engineered legally or leaked. Misappropriation can be sued under law.

H-1B visa

The H-1B is a non-immigrant US work visa that allows American employers to temporarily hire foreign workers in specialty occupations requiring at least a bachelor's degree or equivalent, such as IT, engineering, science, medicine and finance. It is granted for an initial 3 years, extendable to a maximum of 6 years. An annual cap (about 85,000, of which 20,000 for US master's degree holders) applies, and applications are selected by lottery. The employer sponsors the worker and must pay the prevailing wage, and the visa is often used by IT outsourcing firms. Holders may later apply for a green card. Controversies include claims that it displaces American workers, and abuse by outsourcing companies.

IT security audit vs risk assessment

Importance of including ethical considerations in organizational decisions

1. Builds trust and reputation: Customers, employees, investors and the public trust organizations that act honestly and fairly, which supports goodwill and brand value.
2. Avoids legal problems: Ethical decisions usually comply with laws and prevent fines, lawsuits and sanctions. Actions that are legal but unethical can still cause damage.
3. Prevents scandals and negative publicity: Unethical decisions (data misuse, pollution, exploitation) can quickly become public through social media and harm the business.
4. Improves employee morale and retention: Staff are more loyal and productive when they work for a fair and principled organization.
5. Protects stakeholders: Ethical decision making considers the effect on all stakeholders such as customers, workers, community and the environment, not only shareholders.
6. Supports long-term success: Short-term gains from unethical shortcuts often lead to long-term loss. Ethical behaviour gives sustainable growth and investor confidence.
7. Reduces risk and promotes consistency: A shared ethical framework guides employees in dilemmas and ensures consistent behaviour.
8. Fulfils social responsibility and enhances relations with regulators and society.

Cyber law provisions in Nepal

Nepal's main cyber law is the Electronic Transactions Act, 2063 (2008) (ETA), along with its rules. Related laws include the Individual Privacy Act 2075 (2018), the Copyright Act 2059, the Banking Offence and Punishment Act, and the Criminal Code 2074. The main provisions are:

1. Legal recognition of electronic records and digital signatures: Electronic documents and digital signatures are valid for legal and contractual purposes. Electronic contracts and government use of electronic records are recognised.
2. Controller of Certifying Authorities (CCA): The Office of the Controller regulates and licenses certifying authorities that issue digital signature certificates.
3. Cyber offences and punishments (ETA, Chapter 9):
   • Unauthorized access, damage or copying of computer data, source code or systems.
   • Publishing illegal material in electronic form that is obscene, or contrary to morality or public decency, or that spreads hate or jealousy among castes or communities.
   • Computer fraud and stealing or damaging data.
   • Providing false information to a certifying authority, or forging digital signatures.
   • Breach of confidentiality. Penalties include fines (up to about Rs 200,000 for some offences) and imprisonment up to several years (generally up to 5 years).
4. Cyber Appellate Tribunal / IT Tribunal: A special tribunal hears cyber cases and appeals.
5. Privacy and data protection: The Individual Privacy Act protects personal data, and the Constitution recognises the right to privacy.
6. Intellectual property: Copyright Act protects software and digital works.
7. Social media regulation: Guidelines and proposed bills address social media use and registration of platforms.

Weaknesses include outdated provisions, limited enforcement capacity and need for modern laws on data protection and cybersecurity.

Intrusion detection system (IDS)

An intrusion detection system is a hardware or software tool that monitors network traffic or host activity for suspicious behaviour, policy violations or attacks, and generates alerts to administrators. Types: network-based (NIDS) and host-based (HIDS). Detection methods: signature-based (matches known attack patterns) and anomaly-based (detects deviation from normal behaviour). An intrusion prevention system (IPS) goes further and blocks the traffic automatically.

Stages of the e-discovery process

E-discovery is the process of identifying, collecting and producing electronically stored information (ESI) as evidence in legal cases. Stages (based on the EDRM model):

1. Information management / identification: Determine where relevant ESI is located (emails, files, databases, devices) and who the key people (custodians) are.
2. Preservation (legal hold): Prevent deletion or alteration of the data by issuing hold notices.
3. Collection: Gather the data in a forensically sound way, maintaining chain of custody.
4. Processing: Convert, de-duplicate and filter data to a manageable form.
5. Review: Lawyers examine documents for relevance, privilege and confidentiality.
6. Analysis: Study content, patterns and timelines to understand the facts.
7. Production: Deliver the relevant data to the opposing party in the agreed format.
8. Presentation: Present the evidence in depositions, hearings or trial.

Internet censorship

Internet censorship is the control or suppression of what can be accessed, published or viewed on the internet. It is carried out by governments, and sometimes by institutions, schools, employers or internet service providers, usually to block content considered harmful, illegal, immoral or politically sensitive, such as pornography, hate speech, terrorism, piracy, gambling or political dissent.

How it works

1. IP address blocking: The ISP refuses connections to the IP address of a banned server.
2. DNS tampering / blocking: DNS servers give false or no results for a banned domain name.
3. URL and keyword filtering: Proxies or firewalls inspect requests and block pages containing certain URLs or words.
4. Deep packet inspection: Traffic content is analysed and blocked or throttled by type or protocol.
5. Content removal: Authorities order websites or platforms to delete posts or accounts.
6. Throttling and shutdowns: Bandwidth is reduced or the whole internet or specific services (such as social media) are disconnected, as during protests.
7. Self-censorship and legal pressure: Fear of punishment or surveillance causes people to limit what they say.

Users sometimes bypass censorship using VPNs, Tor or proxy servers. Supporters cite security and protecting children; critics argue it violates freedom of expression and access to information.

Cybersquatting

Cybersquatting is registering, buying or using an internet domain name that is identical or confusingly similar to someone else's trademark, brand or personal name, in bad faith, hoping to profit by selling it to the rightful owner at a high price, diverting traffic or damaging the brand.

Types of cybersquatting

1. Typosquatting: Registering misspelled versions of popular names (for example, gooogle.com) to catch users who mistype.
2. Identity theft / name jacking: Registering the name of a celebrity or person to sell or misuse it.
3. Brand/trademark squatting: Registering a company's trademark as a domain before the company does, then demanding payment.
4. Name changing / domain hijacking: Taking over an existing domain by deceiving the registrar or by letting registration lapse and taking it over (drop catching).
5. Reverse cybersquatting (reverse domain name hijacking): A trademark holder falsely claims rights to take a legitimate domain.
6. Combo-squatting: Adding words to a brand, such as "brand-login.com", to mislead users, often for phishing.

How to tackle cybersquatting

• Register trademarks and relevant domain names (including common misspellings and different extensions) early.
• Monitor new domain registrations and use watch services.
• Send a cease-and-desist letter to the squatter.
• File a complaint under the ICANN Uniform Domain-Name Dispute-Resolution Policy (UDRP) with WIPO, which can order transfer or cancellation of the domain.
• Sue under national law such as the US Anticybersquatting Consumer Protection Act (ACPA) for damages.
• Negotiate and buy the domain if cheaper than litigation.
• Use domain privacy and auto-renewal to protect own domains.

Whistleblowing

Whistleblowing is the act of an employee or insider reporting illegal, unethical or unsafe activities within an organization, such as fraud, corruption, safety violations, data misuse or cover-ups, to management, regulators, the media or the public. Internal whistleblowing is reported inside the organization, while external whistleblowing goes outside. Whistleblowers often face retaliation, so laws such as the Sarbanes-Oxley Act and the Whistleblower Protection Act protect them. Organizations encourage it through anonymous hotlines and non-retaliation policies.

Why green computing is a key issue for multinational companies

Green computing is the environmentally responsible design, manufacture, use and disposal of computers and IT resources to reduce energy use and electronic waste.

1. Large energy consumption: Data centres, servers and cooling use huge amounts of electricity, which creates high costs and carbon emissions. Reducing consumption lowers expenses.
2. Climate change and carbon footprint: Multinationals face pressure from governments, investors and the public to cut emissions and meet net-zero goals.
3. E-waste: Short device lifecycles produce toxic waste (lead, mercury). Companies must recycle responsibly under laws such as the EU WEEE directive.
4. Regulation and compliance: Environmental laws and standards (Energy Star, RoHS, ISO 14001) apply across many countries.
5. Corporate image and CSR: Sustainable practices strengthen brand reputation and attract customers and talent.
6. Cost saving and efficiency: Virtualization, cloud, energy-efficient hardware and power management reduce operating costs.
7. Supply chain responsibility: Large firms are held accountable for the environmental impact of suppliers.

Corporate Social Responsibility (CSR) is a company's commitment to operate ethically and to contribute to the economic, social and environmental well-being of employees, communities and society, beyond simply making profit.

Why it is crucial to promote CSR and ethical business practices

• Trust and reputation: customers, employees and the public trust honest businesses.
• Avoiding scandals and legal trouble: ethical conduct reduces fraud, corruption, lawsuits and fines.
• Sustainable society: businesses depend on healthy communities and a healthy environment.
• Fair treatment of stakeholders: protects employees, consumers, suppliers and shareholders.
• Long-term survival: unethical short-term gains usually harm the firm later.
• Meeting expectations: laws, regulators and investors increasingly require responsible behaviour.

How CSR benefits a business organization

1. Better brand image and customer loyalty.
2. Higher employee morale, retention and recruitment of talented staff.
3. Cost savings through energy efficiency, less waste and lower risk.
4. Easier access to investors and capital, since responsible firms are seen as lower risk.
5. Competitive advantage and differentiation in the market.
6. Stronger community and government relations, easing licences and operations.
7. Risk management: early attention to social and environmental issues avoids crises.
8. Innovation: pursuing sustainable products and processes opens new markets.

Cybercrime is any criminal activity that uses a computer, network or digital device either as a tool or as a target, for example hacking, online fraud or distributing illegal content.

Types of cybercrime and countermeasures

General countermeasures: cyber laws such as the Electronic Transactions Act, security policy, encryption, regular audits, backup, and cooperation with law enforcement.

Ethics vs Morals

Importance of fostering good business ethics

• Builds trust and reputation with customers, partners and investors.
• Reduces legal risk, fraud and fines.
• Raises employee morale, loyalty and productivity.
• Improves decision making by giving clear standards.
• Attracts investment and talented staff.
• Supports long-term profitability and sustainability.

Cyberstalking is the repeated use of the Internet, email, social media or other electronic means to harass, threaten, monitor or intimidate a person. It includes sending threatening messages, spreading rumours, tracking location, hacking accounts, posting private data or impersonating the victim. It can cause fear, emotional distress and sometimes physical danger, and is punishable under cyber and criminal law.

Responding to a cyber attack

1. Detect and identify: confirm the incident and find which systems and data are affected.
2. Contain: isolate infected systems, disconnect from the network, disable compromised accounts.
3. Preserve evidence: keep logs, screenshots and disk images, with chain of custody.
4. Eradicate: remove malware, close the vulnerability, patch systems and change passwords.
5. Recover: restore systems and data from clean backups and monitor for repeat attacks.
6. Report and notify: inform management, affected users and the police or cyber bureau, and regulators as required.
7. Review lessons: analyse the cause, update security policy, and train staff.

This follows an incident response plan prepared in advance.

Digital signature

A digital signature is an electronic code created using public-key cryptography to prove the identity of the sender and the integrity of a message or document. The sender computes a hash of the message and encrypts it with their private key; the receiver decrypts it with the sender's public key and compares it with a freshly computed hash. It provides authentication, integrity and non-repudiation, and is legally recognised under the Electronic Transactions Act, 2063.

Importance of professional ethics in IT

• IT professionals handle sensitive data, so ethics protect privacy and confidentiality.
• It ensures honesty, competence and responsibility toward clients and users.
• It prevents misuse such as hacking, piracy and fraud.
• Systems affect safety (banking, health), so errors and negligence can cause great harm.
• It builds public trust in the profession and the organization.
• It guides decisions where the law is unclear and reduces legal liability.

Ethical considerations in a decision-making system

1. Fairness and non-discrimination: decisions must not be biased by gender, race, caste, religion or other attributes; data and algorithms should be checked for bias.
2. Transparency and explainability: people should understand how and why a decision was made.
3. Accountability and responsibility: a person or organization must be answerable for outcomes, not "the system did it".
4. Privacy and data protection: personal data must be collected with consent, used for a stated purpose and kept secure.
5. Accuracy and reliability: the data and models must be correct and tested, with errors correctable.
6. Human oversight: critical decisions should allow human review and appeal.
7. Beneficence and non-harm: the system should benefit stakeholders and avoid harm to individuals or society.
8. Legal compliance and consent: follow applicable laws and respect human rights and autonomy.
9. Stakeholder interests: consider all those affected, not only the organization.

Material on the Internet is generally judged obscene using tests such as the US Miller test. The key issues are:

1. Community standards: whether an average person applying the contemporary standards of the community would find that the work, taken as a whole, appeals to prurient (lustful) interest. Online, it is difficult to say which community's standards apply, since content is accessible globally.
2. Patently offensive depiction: whether it describes sexual conduct in a clearly offensive way as defined by law.
3. Lack of value: whether the work, taken as a whole, lacks serious literary, artistic, political or scientific value.
4. Jurisdiction: differing laws between countries and states about what is obscene and where the crime occurs.
5. Protection of children: child pornography is illegal everywhere, and material harmful to minors needs age verification and filtering.
6. Intent and context: educational, medical or artistic purpose versus commercial exploitation.
7. Freedom of expression: the need to balance restrictions with the right to speech.
8. Technical issues: enforcing laws on anonymous users, hosting providers and ISPs, and filtering software that may block legitimate content.

Intellectual property (IP) refers to creations of the mind, such as inventions, literary and artistic works, designs, symbols, names and images, for which the creator gets legal rights to control use and benefit from them. Main forms are patents, copyrights, trademarks, trade secrets and industrial designs.

Plagiarism is using another person's words, ideas, data or work and presenting them as one's own without giving proper credit. It is academically and professionally unethical and may violate copyright.

Types of plagiarism

• Direct (complete) plagiarism: copying a work word for word without acknowledgement.
• Self-plagiarism: reusing one's own earlier work without disclosure.
• Mosaic (patchwork) plagiarism: mixing phrases and ideas from several sources without citing them.
• Paraphrasing plagiarism: rewording someone's ideas without citation.
• Accidental plagiarism: careless or unintentional failure to cite or quote properly.
• Source-based / citation plagiarism: wrong or fabricated citations or misrepresenting sources.
• Collaborative / ghostwriting: submitting work written by another person.

It can be avoided by citing sources, quoting properly and using plagiarism-detection tools.

(a) Reverse Engineering

Reverse engineering is the process of analysing a finished product, software or system to understand its design, structure and functioning, usually without access to the original design documents. In software, it means studying the compiled code (using disassemblers and decompilers) to recover the source or algorithms.

• Uses: interoperability, security analysis and malware analysis, finding vulnerabilities, recovering lost documentation, and learning.
• Legal and ethical issues: may violate copyright, licence terms (EULA) and trade secrets if used to copy or crack software; it is often allowed for interoperability and security research under limited conditions.

(b) CMMI Model

Capability Maturity Model Integration (CMMI) is a process improvement framework (from SEI) that helps organizations improve the quality of their software development processes. It defines five maturity levels:

1. Initial: processes are unpredictable and ad hoc.
2. Managed: projects are planned and tracked.
3. Defined: standard, documented processes across the organization.
4. Quantitatively managed: processes are measured and controlled using statistics.
5. Optimizing: continuous process improvement.

Higher maturity leads to better quality, predictable cost and schedule, and is often a requirement for outsourcing contracts.

(c) Contingent Workers

Contingent workers are temporary, non-permanent workers such as freelancers, consultants, contract and part-time workers hired for a limited period or project instead of regular employees.

• Advantages: flexibility, lower long-term cost, specialised skills, quick scaling.
• Issues: weaker loyalty, lack of benefits and job security, risk to confidentiality and intellectual property, and legal/ethical questions about fair treatment.

Whistle-blower

A whistle-blower is an employee, former employee or insider who reports illegal, unethical or unsafe activity in an organization (such as fraud, corruption, safety violations or data misuse) to management, a regulator, the media or the public. Whistle-blowers act in the public interest and should be protected against retaliation by law and by company policy, with confidential reporting channels and anonymity where possible.

Implementing CIA (Confidentiality, Integrity, Availability)

• Confidentiality: only authorized people can read the data.
• Integrity: data is accurate and cannot be changed without authorization.
• Availability: systems and data are accessible when needed.

1. Network level

• Confidentiality: firewalls, VPNs, IPsec/TLS encryption of traffic, network segmentation (VLANs), secure Wi-Fi (WPA2/WPA3).
• Integrity: intrusion detection/prevention systems, hashing and message authentication codes, secure routing and DNS, digital signatures.
• Availability: redundant links and devices, load balancing, DDoS protection, UPS, failover and regular monitoring.

2. Application level

• Confidentiality: authentication (passwords, multi-factor), role-based access control, encryption of stored data and sessions, secure session management.
• Integrity: input validation, protection against SQL injection and cross-site scripting, secure coding, code signing, audit logging, database constraints and transactions.
• Availability: load balancing, clustering, database replication, regular patching, backups and disaster recovery, rate limiting.

3. End-user level

• Confidentiality: strong unique passwords, MFA, screen locks, awareness of phishing and social engineering, encrypted devices, clean-desk policy.
• Integrity: antivirus and updates, not installing unauthorized software, verifying downloads and signatures, careful handling of files.
• Availability: regular backups of personal data, reporting incidents quickly, using approved devices, and training on acceptable-use policies.

Together these layered (defence-in-depth) controls, supported by security policies and audits, protect the information assets of the organization.

Current issues in the protection of intellectual property (IP)

Intellectual property (copyrights, patents, trademarks, trade secrets) is protected by law, but digital technology creates many problems:

1. Software and digital piracy: Illegal copying and distribution of software, music, films and e-books costs creators large revenue. Peer-to-peer sharing and torrents make enforcement difficult.
2. Copyright infringement online: Content copied or reposted on websites and social media without permission; determining fair use is hard.
3. Plagiarism: Copying text, images or code, made easier by copy-paste and by AI tools.
4. Software patents: Patent protection for algorithms and software is controversial; "patent trolls" buy patents only to sue others, and overly broad patents hinder innovation.
5. Open source and licensing conflicts: Misuse or violation of licences (e.g. GPL), and unclear compatibility between licences.
6. Reverse engineering and cracking: Used for legitimate interoperability but also to bypass protection and copy products.
7. Trademark and domain-name disputes: Cybersquatting, typosquatting and look-alike domains that exploit a brand name.
8. Trade secret theft: Employees moving to competitors, insider leaks and industrial espionage through hacking.
9. Digital rights management (DRM) and fair use: DRM protects owners but can restrict legitimate uses such as copying for backup or education.
10. Generative AI: Models trained on copyrighted works without permission, and questions over who owns AI-generated output.
11. Cross-border enforcement: Laws differ among countries, and enforcement against infringers abroad is slow and costly; weak enforcement in developing countries, including Nepal.
12. Balancing access and ownership: Strong IP protection may restrict access to knowledge and medicines, so a balance with public interest is needed.

Responses: international treaties (WIPO, TRIPS, Berne Convention), updated national laws, licensing and DRM technology, watermarking, takedown notices, and public awareness.

Cyber defamation

Defamation is making a false statement of fact about a person or organization to a third party that damages their reputation. When it is done through the Internet (social media posts, emails, blogs, comments, videos, fake profiles), it is cyber defamation. It is called libel when written or recorded, and slander when spoken. Because online content spreads rapidly, remains permanent and reaches a wide audience, the harm is often greater.

Elements: a false statement, published to others, identifying the victim, causing harm to reputation. Truth, fair comment and consent are defences. Example: posting a false allegation that a teacher took bribes. In Nepal such acts can be punished under the Electronic Transactions Act and the Criminal Code.

Issues: anonymity of offenders, identifying and tracing them, jurisdiction across borders, platform liability, and balance with freedom of expression.

Current social networking ethical issues

1. Privacy violations: Collecting, selling or leaking users' personal data (as in data-misuse scandals); sharing photos or details without consent.
2. Cyberbullying and harassment: Abuse, trolling, threats and cyberstalking, with serious mental-health effects, especially on young people.
3. Fake news and misinformation: Rapid spread of rumours and manipulated content that influence elections and public health.
4. Fake profiles and identity theft: Impersonation, catfishing, scams and phishing.
5. Hate speech and extremism: Content inciting violence or hatred toward groups.
6. Inappropriate content and child safety: Exposure of minors to adult content and online predators.
7. Employer screening and workplace issues: Employers monitoring staff and applicants' profiles; staff dismissed for posts that harm the company.
8. Addiction and time wastage: Excessive use affecting productivity, study and wellbeing.
9. Intellectual property violations: Sharing copyrighted material without permission.
10. Content moderation versus free speech: Platforms' power to remove or promote content, algorithmic bias and lack of transparency.
11. Deepfakes and AI-generated content: Realistic fake images and videos that damage reputations.

Remedies: strong privacy settings, clear community guidelines, reporting tools, digital literacy, responsible posting, and effective cyber laws.