LEGAL AND ETHICAL ISSUES FOR IT PRACTITIONER

Introduction

Ethics refers to principles of human conduct, or morals, and to the systematic study of such
human values, often called moral philosophy, the study of theories of conduct and goodness,
and of the meanings of moral terms.
An act is considered to be 'ethical' if it is in accordance with approved moral behavior or
norms. Ethics implies civic responsibility on the part of citizens and responsibility by society's
institutions, including governments. Ethics is concerned with questions such as when is an
action 'right' or 'wrong' and what standard separates 'good' from 'bad'. We propose to accept one
of the basic tenets of modern moral philosophy that the authority invoked for 'good' conduct is
the rule of reason and that moral behavior results from rational thought that does not harm the
individual and leads ultimately to the greatest good for all individuals in a society. This
definition and assumption equates well with the main issue of another debate driven partially
by ethics, i.e. relating to public domain information, or more specifically public sector
information that may not be in the public domain, as stated in recent UNESCO-backed
guidelines regarding public sector information.
"One of the ultimate goals of any society is the empowerment of all its citizens through access
and use of information and knowledge. Every person and every nation must have equal
opportunity to benefit from cultural diversity and scientific progress as a basic human right in
the current information revolution and the emerging knowledge society"

CODE OF ETHICS

Contents & Guidelines

1. General Moral Imperatives.
2. More Specific IT practitioners Responsibilities.
3. Organizational Leadership Imperatives.
4. Compliance/Implementation with the Code.
3
GENERAL MORAL IMPERATIVES.
An IT Practitioner is expected to…

1. Contribute to society and human well-being.

This principle concerning the quality of life of all people affirms an obligation to protect
fundamental human rights and to respect the diversity of all cultures. An essential aim of IT
practitioners is to minimize negative consequences of computing systems, including threats to
health and safety. When designing or implementing systems, IT practitioners must attempt to
ensure that the products of their efforts will be used in socially responsible ways, will meet
social needs, and will avoid harmful effects to health and welfare.
In addition to a safe social environment, human well-being includes a safe natural
environment. Therefore, IT practitioners who design and develop systems must be alert to, and
make others aware of, any potential damage to the local or global environment.

2. Avoid harm to others.

"Harm" means injury or negative consequences, such as undesirable loss of information, loss
of property, property damage, or unwanted environmental impacts. This principle prohibits use
of computing technology in ways that result in harm to any of the following: users, the general
public, employees, employers. Harmful actions include intentional destruction or modification
of files and programs leading to serious loss of resources or unnecessary expenditure of human
resources such as the time and effort required to purge systems of "computer viruses."
Well-intended actions, including those that accomplish assigned duties, may lead to harm
unexpectedly. In such an event the responsible person or persons are obligated to undo or
mitigate the negative consequences as much as possible. One way to avoid unintentional harm
is to carefully consider potential impacts on all those affected by decisions made during design
and implementation.
To minimize the possibility of indirectly harming others, IT practitioners must minimize
malfunctions by following generally accepted standards for system design and testing.
Furthermore, it is often necessary to assess the social consequences of systems to project the
likelihood of any serious harm to others. If system features are misrepresented to users,
coworkers, or supervisors, the individual IT practitioner is responsible for any resulting injury.
In the work environment the IT practitioner has the additional obligation to report any signs of
system dangers that might result in serious personal or social damage. If one's superiors do not
4
act to curtail or mitigate such dangers, it may be necessary to "blow the whistle" to help correct
the problem or reduce the risk. However, capricious or misguided reporting of violations can,
itself, be harmful. Before reporting violations, all relevant aspects of the incident must be
thoroughly assessed. In particular, the assessment of risk and responsibility must be credible. It
is suggested that advice be sought from other IT practitioners.

3. Be honest and trustworthy.

Honesty is an essential component of trust. Without trust an organization cannot function
effectively. The honest IT practitioner will not make deliberately false or deceptive claims
about a system or system design, but will instead provide full disclosure of all pertinent system
limitations and problems.
An IT practitioner has a duty to be honest about his or her own qualifications, and about any
circumstances that might lead to conflicts of interest

4. Be fair and take action not to discriminate.

The values of equality, tolerance, respect for others, and the principles of equal justice govern
this imperative. Discrimination on the basis of race, sex, religion, age, disability, national
origin, or other such factors is an explicit violation of IT ethics and will not be tolerated.
Inequities between different groups of people may result from the use or misuse of information
and technology. In a fair society, all individuals would have equal opportunity to participate in,
or benefit from, the use of computer resources regardless of race, sex, religion, age, disability,
national origin or other such similar factors. However, these ideals do not justify unauthorized
use of computer resources nor do they provide an adequate basis for violation of any other
ethical imperatives of this code.

5. Honor property rights including copyrights and patent.

Violation of copyrights, patents, trade secrets and the terms of license agreements is prohibited
by law in most circumstances. Even when software is not so protected, such violations are
contrary to professional behavior. Copies of software should be made only with proper
authorization. Unauthorized duplication of materials must not be condoned.

6. Give proper credit for intellectual property.

5
IT professionals are obligated to protect the integrity of intellectual property. Specifically, one
must not take credit for other's ideas or work, even in cases where the work has not been
explicitly protected by copyright, patent, etc.

7. Respect the privacy of others.

Computing and communication technology enables the collection and exchange of personal
information on a scale unprecedented in the history of civilization. Thus there is increased
potential for violating the privacy of individuals and groups. It is the responsibility of
professionals to maintain the privacy and integrity of data describing individuals. This includes
taking precautions to ensure the accuracy of data, as well as protecting it from unauthorized
access or accidental disclosure to inappropriate individuals.
Furthermore, procedures must be established to allow individuals to review their records and
correct inaccuracies. This imperative implies that only the necessary amount of personal
information be collected in a system, that retention and disposal periods for that information be
clearly defined and enforced, and that personal information gathered for a specific purpose not
be used for other purposes without consent of the individual(s). These principles apply to
electronic communications, including electronic mail, and prohibit procedures that capture or
monitor electronic user data, including messages, without the permission of users or bona fide
authorization related to system operation and maintenance. User data observed during the
normal duties of system operation and maintenance must be treated with strictest
confidentiality, except in cases where it is evidence for the violation of law, organizational
regulations, or this Code. In these cases, the nature or contents of that information must be
disclosed only to proper authorities.

8. Honor confidentiality.
The principle of honesty extends to issues of confidentiality of information whenever one has
made an explicit promise to honor confidentiality or, implicitly, when private information not
directly related to the performance of one's duties becomes available. The ethical concern is to
respect all obligations of confidentiality to employers, clients, and users unless discharged from
such obligations by requirements of the law or other principles of this Code.

6
SPECIFIED PROFESSIONAL RESPONSIBILITIES.

1. Strive to achieve the highest quality, effectiveness and dignity in both process and
products of professional work.
Excellence is perhaps the most important obligation of a profession. An IT practitioner must
strive to achieve quality and to be cognizant of the serious negative consequences that may
result from poor quality in a system.

2. Acquire and maintain professional competence.

Excellence depends on individuals who take responsibility for acquiring and maintaining
professional competence. An IT practitioner must participate in setting standards for
appropriate levels of competence, and strive to achieve those standards. Upgrading technical
knowledge and competence can be achieved in several ways: doing independent study;
attending seminars, conferences, or courses; and being involved in professional organizations.

3. Know and respect existing laws pertaining to professional work.

IT practitioner must obey existing local, state, province, national, and international laws unless
there is a compelling ethical basis not to do so. Policies and procedures of the organizations in
which one participates must also be obeyed. But compliance must be balanced with the
recognition that sometimes existing laws and rules may be immoral or inappropriate and,
therefore, must be challenged. Violation of a law or regulation may be ethical when that law or
rule has inadequate moral basis or when it conflicts with another law judged to be more
important. If one decides to violate a law or rule because it is viewed as unethical, or for any
other reason, one must fully accept responsibility for one's actions and for the consequences.

4. Accept and provide appropriate professional review.

Quality professional work, especially in the computing profession, depends on professional
reviewing and critiquing. Whenever appropriate, individual members should seek and utilize
peer review as well as provide critical review of the work of others.

5 Give comprehensive and thorough evaluations of computer systems and their impacts,
including analysis of possible risks.
IT practitioners must strive to be perceptive, thorough, and objective when evaluating,
recommending, and presenting system descriptions and alternatives. IT practitioner are in a
7
position of special trust, and therefore have a special responsibility to provide objective,
credible evaluations to employers, clients, users, and the public. When providing evaluations
the practitioner must also identify any relevant conflicts of interest, as stated in imperative 1.3.
As noted in the discussion of principle 1.2 on avoiding harm, any signs of danger from systems
must be reported to those who have opportunity and/or responsibility to resolve them..

6. Honor contract and assigned responsibilities.

Honoring one's commitments is a matter of integrity and honesty. For an IT practitioner this
includes ensuring that system elements perform as intended. Also, when one contracts for work
with another party, one has an obligation to keep that party properly informed about progress
toward completing that work.
Practitioner has a responsibility to request a change in any assignment that he or she feels
cannot be completed as defined. Only after serious consideration and with full disclosure of
risks and concerns to the employer or client, should one accept the assignment. The major
underlying principle here is the obligation to accept personal accountability for professional
work. On some occasions other ethical principles may take greater priority.
A judgment that a specific assignment should not be performed may not be accepted. Having
clearly identified one's concerns and reasons for that judgment, but failing to procure a change
in that assignment, one may yet be obligated, by contract or by law, to proceed as directed. The
IT practitioner's ethical judgment should be the final guide in deciding whether or not to
proceed. Regardless of the decision, one must accept the responsibility for the consequences.
However, performing assignments "against one's own judgment" does not relieve the
professional of responsibility for any negative consequences.

7. Improve public understanding of computing and its consequences.

IT practitioners have a responsibility to share technical knowledge with the public by
encouraging understanding of computing, including the impacts of computer systems and their
limitations. This imperative implies an obligation to counter any false views related to
computing.

8
8. Access computing and communication resources only when authorized to do so.
Theft or destruction of tangible and electronic property is prohibited by imperative "Avoid
harm to others." Trespassing and unauthorized use of a computer or communication system is
addressed by this imperative. Trespassing includes accessing communication networks and
computer systems, or accounts and/or files associated with those systems, without explicit
authorization to do so. Individuals and organizations have the right to restrict access to their
systems so long as they do not violate the discrimination principle. No one should enter or use
another's computer system, software, or data files without permission. One must always have
appropriate approval before using system resources, including communication ports, file space,
other system peripherals, and computer time.

ORGANIZATIONAL LEADERSHIP IMPERATIVES.

This section draws extensively from the draft IFIP Code of Ethics, especially its sections on
organizational ethics and international concerns. The ethical obligations of organizations tend
to be neglected in most codes of professional conduct, perhaps because these codes are written
from the perspective of the individual member. This dilemma is addressed by stating these
imperatives from the perspective of the organizational leader. In this context "leader" is viewed
as any organizational member who has leadership or educational responsibilities. These
imperatives generally may apply to organizations as well as their leaders. In this context
"organizations" are corporations, government agencies, and other "employers," as well as
volunteer professional organizations.

1. Articulate social responsibilities of members of an organizational unit and encourage

full acceptance of those responsibilities.
Because organizations of all kinds have impacts on the public, they must accept responsibilities
to society. Organizational procedures and attitudes oriented toward quality and the welfare of
society will reduce harm to members of the public, thereby serving public interest and fulfilling
social responsibility. Therefore, organizational leaders must encourage full participation in
meeting social responsibilities as well as quality performance.

9
2. Manage personnel and resources to design and build information systems that enhance
the quality of working life.
Organizational leaders are responsible for ensuring that computer systems enhance, not
degrade, the quality of working life. When implementing a computer system, organizations
must consider the personal and professional development, physical safety, and human dignity
of all workers. Appropriate human-computer ergonomic standards should be considered in
system design and in the workplace.

3. Acknowledge and support proper and authorized uses of an organization's computing

and communication resources.
Because computer systems can become tools to harm as well as to benefit an organization, the
leadership has the responsibility to clearly define appropriate and inappropriate uses of
organizational computing resources. While the number and scope of such rules should be
minimal, they should be fully enforced when established.

4. Ensure that users and those who will be affected by a system have their needs clearly
articulated during the assessment and design of requirements; later the system must be
validated to meet requirements.
Current system users, potential users and other persons whose lives may be affected by a
system must have their needs assessed and incorporated in the statement of requirements.
System validation should ensure compliance with those requirements.

5. Articulate and support policies that protect the dignity of users and others affected by
a computing system.
Designing or implementing systems that deliberately or inadvertently demean individuals or
groups is ethically unacceptable. Computer professionals who are in decision making positions
should verify that systems are designed and implemented to protect personal privacy and
enhance personal dignity.

6. Create opportunities for members of the organization to learn the principles and
limitations of computer systems.
This complements the imperative on public understanding. Educational opportunities are
essential to facilitate optimal participation of all organizational members. Opportunities must
be available to all members to help them improve their knowledge and skills in computing,
10
including courses that familiarize them with the consequences and limitations of particular
types of systems. In particular, professionals must be made aware of the dangers of building
systems around oversimplified models, the improbability of anticipating and designing for
every possible operating condition, and other issues related to the complexity of this
profession.

COMPLIANCE WITH THE CODE AND IMPLEMENTATION OF THIS CODE.

Upholding and promoting the principles of this code, the future of the IT practitioner depends
on both technical and ethical excellence. Not only important for professionals to adhere to the
principle expressed in this Code, but each member should encourage and support adherence by
other members
i. All practitioners providing central IT support, are required to read and sign the
Employee Code of Ethics
ii. All supervisors will ensure that they have reviewed the Code of Ethics with their
employees and maintain one signed copy in their personnel files and provide one copy
to employees or practitioners
iii. The Information Technology Employee or practitioner Code of Ethics should then be
reviewed on an annual basis with employees or practitioners.

I T PRACTITIONER CODE OF ETHICS

In order to fulfill its mission of providing technological support to IT professionals, they must
grant privileged access to the equipment to appropriate Information Technology (IT)
employees or practitioners. This access imposes upon the practitioners the responsibility and
obligation to use systems in an ethical, professional, and legal manner that is strictly within her
or his authorized job functions.
IT professional is committed to advancing the ethical and responsible use of all information
technology resources. The goals of the IT Practitioner Code of Ethics are to create a culture
that fosters trust and a commitment to responsibility, excellence, and institutional and personal
integrity, while avoiding conflicts of interest and appearances of impropriety. IT professionals
will not tolerate illegal, dishonest, improper, or irresponsible use of privileged access.
11
1) In exchange for the privileges granted and as a condition of profession, IT practitioner
agree to abide by all professional IT policies with the understanding that professional
administration may change, rescind or add policies with or without prior notice. I also
subscribe to the following statements.

2) I will take reasonable precautions to prevent unauthorized access to passwords,

user identifications, or other information that may be used to access information
systems
.
3) I will limit access to information contained in or obtained from the systems to only
authorized people.

4) I will diligently protect all confidential information from unauthorized disclosure.

5) I will seek guidance from a supervisor or an appropriate administrator whenever I am

unsure of the correct decision regarding appropriate use, confidentiality, or access, and
will do so BEFORE I take any action on the support issue in question.

6) I will not share, record, copy, transmit, delete, or in any way alter information in these
systems except when required to perform my duties.

7) I will abide by all licensing and copyright agreements.

8) I will transfer to another authorized IT employee any support request that might give
me privileged access to my own academic records or to an electronic course in which I
am enrolled, in order to avoid a conflict of interest.

9) I will immediately report any incidents of personal noncompliance or noncompliance

of colleagues with the terms of this agreement to my supervisor or an appropriate
administrator

12
 10) If I am a practitioner, I will observe the practitioner’s policies on conduct and/or
academic honesty.

As an employee, I understand that if I violate this agreement, I may be subject to disciplinary

action up to and including dismissal from the profession. Additional legal action may be taken
if federal or state laws are violated.
I have read and agree to abide by this practitioner Information Technology Employee Code of
Ethics.
Employee’s signature: ______________________________ Date: ____/____/____
I have reviewed the Information Technology Employee Code of Ethics with this employee and
provided a copy of this signed document to the employee.
Supervisor’s signature: ______________________________ Date: ____/____/____

BRITISH CODE OF PRACTICE

The British Computer Society sets the professional standards of competence, conduct and
ethical practice for computing in the United Kingdom. The Society was incorporated by Royal
Charter in July 1984, with the following:
i. The Code of Practice is directed to all members of The British Computer Society.
ii. It consist of essential series of statements which prescribe the minimum standards of
practice, to be observed by all members.
iii. The Code is also concerned with professional responsibility. Responsibilities to clients,
to users, to the State and society at large.
iv. Those members who are employees also have responsibilities to their employers'
customers and, often, to a Trade Union.
v. In the event of apparent clash in responsibilities, obligations or prescribed practice, the
Society's Secretary-General should be consulted at the earliest opportunity.
vi. The Code is to be viewed as a whole: individual parts are not intended to be used in
isolation to justify errors or omissions or commission.
vii. The Code is intended to be observed in the spirit and not merely the word.
viii. The BCS membership covers all occupations relevant to the use of computers (as
computer practitioner, professionals etc)

13
NIGERIA CODE OF PRACTICE

On the same code of practice on legal and ethical issues for IT practitioner, Nigeria is not left
out. The body and the authoritative organization for IT Practitioner is the computer
professional council of Nigeria (CPCN), established and operating under the Act NO.49 of
1993 constitution of the federal republic of Nigeria, gazetted august 9th of the same year.

Functions and Duties of the Council

The computer professional council of Nigeria (CPCN) is “a corporate body with perpetual
succession and common seal”, a legal entity charge with the control and the supervision of the
computer IT Practitioner in the country. In regard thereof, its duties include:

(1) Set and improving IT standards

To determine what standards of knowledge and skills are to be obtained by persons seeking to
become member of the computing profession and improve those standard from time to time as
circumstances may permit.

(2) Publication of registered members

To secure in accordance with the provision of the Act, the establishment and maintenance of a
registered and those seeking to be register under the Act as computer practitioner and
professionals, and the publication from time to time of the list of these persons.

(3) Other functions bestowed upon the council by the Act are as follow
To perform any other functions as bestowed on it (council) by the provision of the Act.
Consequent upon the foregoing, the council has responsibilities for the following, among
others;
i. Organization of IT practice in the country
ii. Control of computing in the country
iii. Screening individual seeking to be registered as computer IT Practitioner and
Professional in Nigeria
iv. Screening corporate bodies seeking to be registered to engage in the sale or use of
computing facilities and/or the provision of professional services in computing in the
country.
14
 v. Ensuring high computing professional ethics and professionalism-standards.
vi. Local and international contacts (with relevant associations and bodies)
vii. Reduced charges for some specific professional services and facilities.
viii. Determining academic standards in computer science, computer engineering,
information science, etc.
ix. Accreditation of institution, courses and programs and the evaluation of certificate in
computing.
x. Conducting professional examinations in computing by liaising with
associations/bodies external to the council.
xi. Publicizing the activities of the council.
(xii) Publication of the register of computer professional and other computing professional
works-journals, books, magazines, newsletters.

REGISTRATION
The Act 49 of 1993 referred to above makes it mandatory for all persons and organizations
seeking to engaged in the sale and/or use of computing facilities, and/or provision of
professional services in computing in the country to be registered by the council and licensed
to carry out such activities.
It is definitely illegal to engaged in computing professional practice without satisfying the
above condition-registration and possession of a current valid license.
If application is successful, an applicant is requested to pay a once-for-all registration fee and
the license fee for the current year, to have the applicant’s name inserted in the register and for
the applicant to commence professional activities, respectfully.

BENEFITS.
Persons and corporate bodies that are registered and hold current valid licenses, apart from
being eligible to carry out their business, stand to enjoy benefits including but not limited to:
i. Raised professional standing / status (from recognition as a registered computing
practitioner ).
ii. Protection from the public (from exploitation, harassment, etc, in the course of
performing bonafide, legitimate professional activities).
iii. Right to use the council’s Insignia (e.g. individualized seal, crest/plaque, ties, clips etc.)
15
 iv. Meet and network new professional friends at our regular network meetings.
v. Corporate business network and harnessing of business opportunities.
vi. On-line business/professional discussions and exchange of ideas.
vii. Non-stop training and development.
viii. Access to and attendance at regular professional programs (conferences, seminars,
symposia, workshop, continuing of professional education, training, etc.)
ix. Entrepreneur development and workshops for startups.
x. Enjoy reciprocal registration with foreign computer professional bodies.
xi. Awards and recognitions.

PROCEDURE FOR REGISTRATION

i. Applicant obtains registration application form.

ii. The duly completed application form (together with ALL relevant supporting
documents) is submitted to the secretariat.
iii. On receipt of the application form in the previous step, the secretariat will dispatch
an acknowledgment letter to the applicant.
iv. Appropriate processing of the form then commences.
v. Applicant is thereafter informed of the outcome of the application.
Every registered computer professional and corporate body is required thereafter to pay,
annually, a license fee (to renew the practitioner’s license) for computing professional
practice, by such professional or body for that year.

1. Personal Requirements

i. Keep yourself, and subordinates informed of such new technologies, practices, legal
requirements and standards as are relevant to his duties.
ii. Ensure subordinates are trained in order to be effective in their duties and to qualify
for increased responsibilities.
iii. Accept only such work as he believes, he is competent to perform and not hesitate to
obtain additional expertise from appropriately qualified individuals where advisable.

16
 iv. Actively seek opportunities for increasing efficiency and effectiveness to the benefit of
the user and of the ultimate recipient.

2. Organization and Management Requirements

i. Plan, establish and review objectives, tasks and organizational structures for himself
and subordinates, to help meet overall objectives.
ii. Ensure that any specific tasks are assigned to be identified individuals according to
their known ability and competence.
iii. Establish and maintain channels of communication from and to seniors, equals and
subordinates.
iv. Be accountable for the quality, timeliness and use of resources in the work for which
he is responsible.

3. Contracting

i. Seek expert advice in the preparation of any formal contract.

ii. Ensure that all requirements and the precise responsibility of all parties adequately
covered in any contract or tendering procedures.

4. Privacy, security and integrity

i. Ascertain and evaluate all potential risks in a particular project with regard to the cost,
effectiveness and practability of proposed levels of security.
ii. Recommend appropriate levels of security, commensurate with the anticipated risks,
and appropriate to the needs of the client.
iii. Apply, monitor and report upon the effectiveness of the agreed levels of security.
iv. Ensure that all staff are trained to take effective action to protect life, data and
equipment (in that order) in the event of disaster.
v. Take all reasonable measures to protect confidential information from inadvertent or
deliberate improper access or use.
vi. Ensure that competent people are assigned to be responsible for the accuracy and
integrity of the data in the data file and each part of an organization’s database.

17
CONCLUSION
These General Moral Imperatives, Legal and Ethical Issues for IT Practitioners are summarized
with these Ten Commandments.

The Commandments are:

1. Thou shalt not use a computer to harm other people.

2. Thou shalt not interfere with other people's computer work.

3. Thou shalt not snoop around in other people's files.

4. Thou shalt not use a computer to steal.

5. Thou shalt not use a computer to bear false witness.

6. Thou shalt not use or copy software for which you have not paid.

7. Thou shalt not use other people's computer resources without authorization.

8. Thou shalt not appropriate other people's intellectual output.

9. Thou shalt sell while fault computer components.

10. Thou shalt not commit interment fraud (YAHOOZEE) .

18
REFFERENCES

1) COMPUTER PROFESSIONERS (REGISTRATION COUNCIL OF NIGERIA)

www.cprcn.org (1993)

2) ADELMA, C (2000). THE CERTIFI CATION SYSTEM IN INFORMATION

TECHNOLOGY.
(PARALLEL POSTSECONDARY UNIVERSE)

3) SHELLY, CASHMAN, VERMAAT DISCOVERING COMPUTERS 2000

4) ALL EN, T AND M, MORTON INFORMATION TECHNOLOGY

(OXFORD UNIVERSITY PRESS)

5) AMA (AUSTRALIAN INSTITUTE OF MEDICAL SCIENTIST) 2008.

http://domino.ama.com.au/DIRO103/MediaREL.nsf/Media.AHWeb (28/09/2008)

6) BADWIN, P.(2006) HIGHER EDUCATION QUANTITY AND DIVERSITY

IN THE 21ST CENTURY (CAMBERRA, AGPS.)

19
20