Society and Ethics in IT

Computer software is protected as intellectual property (IP) through several legal and technical means.

1. Copyright: automatically protects the expression of the program (source and object code, documentation, screen displays) from copying, adaptation and distribution without permission. It does not protect the underlying idea or algorithm. In Nepal, the Copyright Act 2059 covers computer programs, and internationally the Berne Convention and TRIPS apply. Protection lasts for the author's life plus a fixed period, commonly 50-70 years.
2. Patent: protects a novel, non-obvious and useful technical invention, such as a software-based process or algorithm with a technical effect, for about 20 years. Rules vary by country, and software "as such" is often excluded.
3. Trade secret: keeps source code, algorithms and designs confidential through non-disclosure agreements, access control and distributing only object code. It lasts as long as the secrecy is kept.
4. Trademark: protects the name, logo and brand of software products.
5. Licensing: end-user licence agreements (EULA), shrink-wrap and click-wrap licences, open-source licences (GPL, MIT) and non-compete clauses fix the permitted use.
6. Technical protection: product keys, activation, dongles, encryption, code obfuscation, watermarking and digital rights management (DRM).
7. Contracts and employment agreements: assign the ownership of work made by employees and contractors.

Protection usually combines several of these, since each covers different aspects.

Computer crime is any illegal act that involves a computer or network as a tool, a target or a place of crime. Examples: hacking into a bank's system to transfer funds, spreading viruses/ransomware, identity theft and phishing, credit-card fraud, software piracy, cyberstalking, denial-of-service attacks and publishing illegal content.

Prevention strategies

1. Legal measures: cyber laws (Nepal's Electronic Transactions Act 2063), strict penalties, international cooperation, and trained police and cyber courts.
2. Technical security:
   • firewalls, antivirus and intrusion detection/prevention systems,
   • encryption of data and communications, digital signatures,
   • strong authentication (passwords, OTP, biometrics, multi-factor),
   • regular patching and backups.
3. Physical security: controlled access to computer rooms, ID cards, CCTV, locks and secured media disposal.
4. Administrative / organisational measures: security policies, access privileges based on roles, separation of duties, audit trails and logging, background checks of staff and incident response plans.
5. Education and awareness: training users about phishing, passwords and safe practices, plus ethics instruction.
6. Risk assessment and auditing: regular security audits and penetration testing to find weaknesses.
7. Detection and investigation: computer forensics and monitoring to catch and prosecute offenders, which also deters crime.

Digital divide is the gap between people, households, regions or countries that have access to modern information and communication technology (computers, Internet, mobile) and the skills to use it, and those that do not.

Example: in Nepal, urban areas such as Kathmandu have fast broadband and many computer users, while remote Himalayan villages may lack electricity and Internet, so students there cannot use online classes. Likewise rich countries have much higher Internet penetration than poor ones.

Factors that cause the digital divide

1. Economic / income: cost of devices, data plans and electricity.
2. Infrastructure and geography: lack of telecom networks, electricity and broadband in rural, mountain areas.
3. Education and skills: low literacy and digital literacy.
4. Language: most content is in English, not local languages.
5. Age: older people adopt technology less.
6. Gender and social factors: unequal access for women, caste or ethnic minorities.
7. Disability: inaccessible design for disabled users.
8. Government policy and regulation: weak ICT policy, high taxes and monopoly pricing.
9. Awareness and culture: lack of perceived usefulness of ICT.

Reducing it needs affordable access, community centres, training, local-language content and policy support.

Pillars of professionalism are the basic principles on which a professional's conduct is built.

1. Competence: having up-to-date knowledge and skills, and keeping learning through training and certification.
2. Integrity and honesty: being truthful, trustworthy and avoiding conflicts of interest.
3. Responsibility and accountability: accepting the results of one's work and its effect on clients and society.
4. Ethical conduct / code of ethics: following professional codes (ACM, IEEE) and acting for the public good.
5. Confidentiality and respect for privacy: protecting client and user information.
6. Commitment to quality: delivering reliable, safe and quality work.
7. Professional behaviour and respect: punctuality, teamwork, courtesy and respect for colleagues, with continued commitment to the profession and professional bodies.

Types of privacy

1. Physical (bodily) privacy: protection of one's body and personal space from intrusion or searches.
2. Information (data) privacy: control over the collection, use and sharing of personal data such as records and online activity.
3. Communication privacy: protection of mail, calls, emails and messages from interception.
4. Territorial privacy: protection of the home, workplace and other spaces from intrusion.
5. Decisional privacy: freedom to make personal choices without interference.
6. Anonymity and location privacy are also commonly listed.

Value of privacy in the information age

• It protects personal autonomy, dignity and freedom of thought and expression.
• It prevents identity theft, fraud, discrimination and stalking.
• It builds trust in e-commerce and online services.
• Computers, databases, data mining, cookies, CCTV and social media make it easy to collect, link and permanently store personal information, so privacy matters more than ever. It also limits surveillance and misuse of power, and supports democracy.

The Internet has made software protection both easier and more difficult, but overall it is more difficult.

Why more difficult

• Digital copies are perfect, free and instantly distributed worldwide through downloads, torrents and file-sharing sites.
• Piracy sites and cracks (serial key generators) spread quickly and anonymously.
• Jurisdiction problems: infringers sit in other countries with weak law enforcement.
• It is hard to detect and trace copying among billions of users.
• Open-source and online code repositories make copying and reuse easy.

Why easier (some respects)

• Online activation, licence servers, updates and Software-as-a-Service keep the code on the vendor's server.
• Companies can monitor usage, detect piracy and issue takedown notices (DMCA).
• Digital rights management and cloud delivery give better control.

Conclusion: the Internet increases the reach of both legal sale and illegal copying, but the cost and speed of piracy make protection harder, so vendors combine technical, legal and business measures.

Electronic monitoring is the use of computers, software, cameras, email and phone tracking, keystroke logging, GPS and similar tools by an employer to watch employees' work.

Positive effects

• Higher productivity and accountability, since performance is measurable.
• Better security, prevention of theft, data leaks and misuse of company resources.
• Protection against legal liability (harassment, illegal downloads).
• Better quality control and safety.

Negative effects

• Loss of privacy and feeling of constant surveillance.
• Stress, anxiety, low morale and job dissatisfaction.
• Reduced trust, creativity and autonomy.
• Health problems, and unfair evaluation based only on measurable output (e.g. keystrokes).
• Possible discrimination and misuse of personal data.

Monitoring should be justified, transparent (employees informed by policy), proportionate and legal.

Why software safety is difficult

• Software is highly complex, with enormous numbers of states and paths, so it is impossible to test every case exhaustively.
• Requirements are often incomplete, changing or wrongly understood.
• Software does not wear out but has latent design faults that appear in rare conditions.
• Small changes can have large unforeseen effects, and integration with hardware, users and other systems is difficult.
• Human errors in specification, coding and operation, schedule and cost pressure, and reuse of code in unsuitable contexts (as in the Therac-25 and Ariane 5 failures).
• Real-time, concurrency and timing problems are hard to reproduce.

Can it be guaranteed?

No. Absolute safety cannot be guaranteed. Risk can only be reduced to an acceptable level using formal methods, rigorous testing, reviews, hazard analysis, redundancy and fail-safe design, safety standards, and human oversight with backup systems.

Cyberspace is the virtual, non-physical environment created by interconnected computers, networks and the Internet, in which people communicate, share information, do business and interact. It includes websites, email, social media, cloud services and online systems.

Securing cyberspace

1. Laws and policy: cyber laws, national cybersecurity strategy and international cooperation.
2. Technical controls: firewalls, antivirus, intrusion detection, encryption, secure protocols (HTTPS), authentication and regular patching.
3. Access control and identity management: strong passwords, multi-factor authentication and least privilege.
4. Monitoring and incident response: CERTs, logging, backups and recovery plans.
5. Awareness and education: training users on phishing, safe browsing and privacy.
6. Secure software development: security testing and vulnerability management.
7. Protection of critical infrastructure: special safeguards for banking, power and telecom systems.

Need for an investigation report

An investigation report (in computer forensics or incident investigation) is needed to:

• record clearly what happened, how, when and who was involved,
• present findings and evidence in a legally acceptable form for court or disciplinary action,
• support management decisions and corrective actions to prevent recurrence,
• preserve the chain of custody and provide accountability,
• serve as a reference for future investigations.

Documents included in the report

1. Title/cover page and executive summary.
2. Case details: purpose, scope, authorisation and investigators.
3. Chain-of-custody forms and evidence lists.
4. Description of the incident and background.
5. Tools and methods used, with the steps of evidence acquisition and analysis.
6. Findings, logs, screenshots, recovered files and timelines.
7. Analysis, conclusions and opinions.
8. Recommendations.
9. Appendices: witness statements, interview notes, photographs, hash values and glossary.

(a) Physical access control

Physical access control restricts who can enter buildings, server rooms and use equipment, to protect hardware, data and people. Measures include locks and keys, ID cards and smart cards, PINs and keypads, biometric readers (fingerprint, iris, face), security guards, receptionists and visitor logs, turnstiles and mantraps, CCTV surveillance, alarms, and fences or secured zones. Access is granted on the principle of least privilege and every entry is logged.

(b) Computer forensics investigation

Computer forensics is the scientific collection, preservation, analysis and presentation of digital evidence from computers and networks so that it is admissible in court.

Steps: identification of the incident and sources of evidence; preservation by isolating the system and creating a bit-by-bit image, with hash values (MD5/SHA) to prove integrity; analysis of files, deleted data, logs, emails and registry (tools such as EnCase, FTK, Autopsy); documentation with the chain of custody; and presentation in a report and as expert testimony. Original evidence must never be altered.

Penal code

A penal code (criminal code) is a statutory collection of laws that defines crimes and prescribes their punishments (fine, imprisonment, etc.) and the rules of criminal procedure. In Nepal it is the Muluki Criminal Code, 2074.

Differences between morality and law

Digital divide

The digital divide is the gap between those who have access to ICT (computers, Internet, mobile) and the skills to use it, and those who do not, whether between countries, regions, urban and rural people, rich and poor, men and women, or young and old.

Why it matters in the social context of computing

• Education: students without Internet or devices miss online learning, as seen during COVID-19 lockdowns.
• Economy and jobs: lack of ICT skills limits employment, e-commerce and banking.
• Health and public services: e-government, telemedicine and information are not reachable.
• Democracy and participation: unequal access to news and a voice online.
• Inequality: it widens the existing social and economic gaps, and creates information-rich and information-poor groups.

Obstacles to overcome

1. High cost of devices, Internet and electricity.
2. Lack of infrastructure in remote and mountain areas.
3. Low literacy and digital skills.
4. Language barriers and lack of local content.
5. Gender, social and cultural barriers.
6. Poor accessibility for disabled people.
7. Weak policy, regulation and investment, and lack of awareness.

Remedies: affordable broadband and community information centres, subsidies and tax relief, digital literacy training, local-language content, rural electrification and inclusive public-private programmes.

Improving software quality

1. Gather clear, complete requirements and involve users.
2. Use a structured development process (SDLC, agile, CMMI) with good project management.
3. Apply sound design, coding standards, modular and reusable design.
4. Perform code reviews, inspections and walkthroughs.
5. Test thoroughly at unit, integration, system and acceptance levels, with automation and regression testing.
6. Use formal methods for critical parts, and static analysis tools.
7. Use version control, configuration management and continuous integration.
8. Employ trained, motivated developers and ethical professional practice.
9. Collect metrics, perform quality assurance (QA), and maintain feedback and defect tracking.
10. Provide good documentation and maintenance.

Causes of software failures

• Incomplete, ambiguous or changing requirements.
• Poor design and complexity.
• Programming mistakes (bugs) and inadequate testing.
• Unrealistic schedules, budgets and poor project management.
• Weak communication between team members and users.
• Misuse by users, human error and lack of training.
• Hardware or environment problems, integration errors and security attacks.
• Reuse of software in unsuitable contexts (Ariane 5), and lack of maintenance.

Virtualization and virtual reality (VR): consequences

Virtualization creates simulated versions of resources or worlds, and VR immerses a user in a computer-generated environment.

Benefits: safer training (pilot, surgeon), education, remote work, entertainment, cost saving and access to places otherwise out of reach.

Consequences and ethical implications:

• Blurring of real and virtual: escapism, addiction, loss of social contact and confusion about reality.
• Behavioural effects: violent or harmful virtual acts may desensitise users or change attitudes. There are questions of moral responsibility for virtual actions.
• Privacy: VR collects biometric and behavioural data.
• Identity and deception: fake identities, avatars and deepfakes.
• Inequality: unequal access, and health issues such as motion sickness and eye strain.
• Property and crime: theft of virtual property, harassment in virtual worlds.

Ethics of AI

Key issues:

1. Bias and fairness: biased data lead to discriminatory decisions.
2. Transparency and explainability: understanding why AI decides.
3. Accountability and responsibility: who is liable for harm.
4. Privacy and surveillance: large-scale data use.
5. Safety and security: reliable, robust systems and misuse prevention.
6. Job displacement: automation of work.
7. Human autonomy and control: human oversight, especially in weapons and healthcare.
8. Misinformation and deepfakes, and the social good and sustainability.

Principles: beneficence, non-maleficence, justice, autonomy and explicability, with regulation and ethical guidelines.

Ethical problems in computing

• Privacy violation by data collection, surveillance and data breaches.
• Intellectual property: software piracy, plagiarism and copyright infringement.
• Computer crime: hacking, viruses, fraud and identity theft.
• Software reliability and safety: harm caused by defective software.
• Digital divide and unequal access.
• Cyberbullying, offensive content and misinformation.
• Employee monitoring, and job loss through automation.
• Bias in algorithms and AI, and misuse of social media and loss of anonymity.

Moral codes vs moral standards

Codes of ethics

A code of ethics is a written set of principles and rules that guides the professional conduct of members of an organisation or profession, stating their duties to the public, clients, employers and colleagues. Examples are the ACM Code of Ethics and Professional Conduct and the IEEE Code of Ethics. Typical contents: contribute to society and human well-being, avoid harm, be honest, respect privacy and confidentiality, respect intellectual property, give professional care and maintain competence, and obey the law.

Purposes: set standards, guide decisions, protect the public, build trust and give a basis for disciplinary action.

Significance of ethics in decision making

• It helps choose between right and wrong when the law is silent or unclear.
• It ensures decisions consider all stakeholders and their consequences, not only profit.
• It builds trust, reputation and credibility.
• It reduces legal risks and conflict, and promotes responsibility and accountability.
• It helps to resolve dilemmas by principles such as honesty, fairness and respect for rights.

Privacy is the right of individuals to control their personal life and information, and to be free from unwanted intrusion.

Types of privacy

1. Physical (bodily) privacy: protection of one's person from searches or intrusion.
2. Information (data) privacy: control over how personal data are collected, stored and used.
3. Communication privacy: confidentiality of mail, calls and emails.
4. Territorial privacy: protection of home and workplace from intrusion.
5. Decisional privacy: freedom to make personal decisions.

Values of privacy

• It protects individual dignity, autonomy and freedom.
• It prevents misuse of information, identity theft, fraud and discrimination.
• It builds trust in society and e-commerce.
• It allows freedom of thought, expression and association, and creates space for personal development.
• It limits power of governments and organisations, and so supports democracy.

Intellectual property (IP) refers to creations of the mind (inventions, literary and artistic works, designs, symbols, names and software) for which the creator has legal rights of ownership and control over use.

Methods of protecting ownership rights

1. Copyright: protects original literary, artistic, musical and software works from unauthorised copying, for the author's life plus a set period.
2. Patent: gives the inventor an exclusive right for about 20 years over a new, useful, non-obvious invention.
3. Trademark: protects names, logos and symbols that identify goods and services.
4. Trade secret: protects confidential business information by secrecy and non-disclosure agreements.
5. Industrial design and geographical indication registration.
6. Licensing and contracts: licence agreements, EULA and employment agreements.
7. Technical measures: encryption, passwords, digital watermarking and digital rights management (DRM).

Cyberbullying is the use of digital technology (social media, messaging apps, email, gaming platforms, mobile phones) to repeatedly harass, threaten, humiliate or target a person. It is intentional, often anonymous, can reach a large audience quickly and leaves a lasting digital trail.

Types of cyberbullying

• Harassment: repeated offensive, insulting or threatening messages sent to the victim.
• Flaming: heated, abusive online arguments using vulgar or angry language.
• Denigration (dissing): spreading false rumours or gossip to damage someone's reputation.
• Impersonation (masquerading): pretending to be the victim or creating fake profiles to post harmful content in their name.
• Outing and trickery: sharing private secrets or embarrassing information, or tricking someone into revealing it and then publishing it.
• Exclusion: deliberately leaving a person out of online groups or chats.
• Cyberstalking: persistent monitoring and following online, causing fear for personal safety.
• Doxing and image-based abuse: publishing personal details or private photos without consent.

Effects include anxiety, depression, poor academic performance and, in severe cases, self-harm. Prevention includes awareness, privacy settings, blocking and reporting, keeping evidence, and legal action under Nepal's Electronic Transactions Act, 2063.

Etiquette is the set of accepted rules of polite and respectful behaviour in social or professional settings (for example, netiquette online: no flaming, respecting others' time and privacy). Manners are the habitual ways of behaving towards others, such as courtesy, punctuality, politeness and respect. Etiquette is the code; manners are its practice.

Professionalism means conducting oneself with competence, integrity and responsibility in a profession. It includes:

• Technical competence and continuous learning.
• Honesty, reliability and meeting deadlines.
• Respect for colleagues, clients and confidentiality.
• Proper communication and appropriate dress and conduct.
• Accountability for one's work and avoiding conflicts of interest.

Ethical responsibilities of IT professionals (as in the ACM/IEEE codes):

• Act in the public interest and avoid harm to users and society.
• Protect privacy and confidentiality of data.
• Be honest about capabilities and report risks and defects truthfully.
• Respect intellectual property and licences; do not plagiarise or pirate software.
• Deliver quality, secure and tested products.
• Obey the law and report unethical or illegal conduct (whistle-blowing where needed).
• Treat all people fairly, without discrimination.

Protecting computer software

Software is intellectual property and can be protected by:

• Copyright: automatically protects the source and object code as an original work (in Nepal, under the Copyright Act, 2059); it gives the owner the exclusive right to copy, distribute and modify.
• Patents: protect novel technical inventions or processes embodied in software, where the law allows.
• Trade secrets: keeping source code and algorithms confidential through non-disclosure agreements.
• Trademarks: protect the product name and logo.
• Licensing: end-user licence agreements (EULA), proprietary or open-source licences stating permitted use.
• Technical measures: product keys and activation, dongles, encryption, code obfuscation, digital rights management (DRM) and watermarking.
• Legal action: against piracy, reverse engineering and unauthorised copying.

Transnational issues

• Software crosses borders instantly, but laws, copyright terms and enforcement differ between countries.
• Piracy and cybercrime are hard to prosecute because of jurisdiction questions: which country's law applies and where to sue.
• Extradition and cooperation between countries are limited.
• International agreements such as the Berne Convention, TRIPS (WTO) and WIPO treaties try to harmonise protection.
• Other issues include differing privacy and data-protection rules (such as GDPR), export controls on encryption, and cross-border data flow.

Digital evidence is any data stored or transmitted in digital form that can be used in court (files, logs, emails, images, memory contents, network traffic).

Preservation

1. Identify and secure the scene: isolate the device, prevent further use or remote wiping (for example, disconnect from the network).
2. Document: photograph the setup, record device details, time and persons involved.
3. Collect volatile data first: RAM, running processes and network connections, before powering off.
4. Create a forensic image: use a write blocker and make a bit-by-bit copy of the storage; work only on the copy, never on the original.
5. Verify integrity: compute hash values (MD5/SHA-256) of the original and the copy; matching hashes prove nothing changed.
6. Maintain chain of custody: a written record of who handled the evidence, when and why, with secure storage.

Analysis

• Examine the image with forensic tools (such as Autopsy, FTK, EnCase).
• Recover deleted files and file-system artefacts; search keywords; examine file metadata, timestamps, registry, browser history, logs and emails.
• Build a timeline of events and correlate it with other evidence.
• Check for encrypted, hidden or steganographic data.
• Record all findings and prepare a clear, reproducible report that can stand in court.

The process must follow legal procedure and preserve the integrity and admissibility of evidence.

Ethics vs privacy

Ethical basis for privacy protection

• Respect for human dignity and personal autonomy: people should decide about their own information.
• Fairness and trust: misuse of data harms people and erodes trust.
• Harm avoidance: leaks can cause discrimination, fraud and embarrassment.
• Principles such as informed consent, purpose limitation and data minimisation.

Legal basis for privacy protection

• Constitution of Nepal (2072), Article 28, guarantees the right to privacy of person, property, residence, documents, data, correspondence and character.
• Individual Privacy Act, 2075 (2018), and the Electronic Transactions Act, 2063, penalise unauthorised access and disclosure.
• International instruments: Universal Declaration of Human Rights (Art. 12) and ICCPR (Art. 17), and laws such as GDPR elsewhere.