Professional Ethics, Intellectual Property and Cyber Law

Software now controls aircraft, money, medical devices, elections and the data of whole populations. Those who build it carry responsibility.

This unit gives you the vocabulary of ethics, the main professional codes, the law of intellectual property and privacy, the Nepali cyber-law framework, and real cases where ethical failure had consequences.

5.1 Ethics and professionalism

Ethics is the study of what is right and wrong and how we ought to act. Morals are personal beliefs; law is the set of rules the state enforces; professional ethics are the standards a profession sets for its members.

Something can be legal but unethical (selling users' data in an undisclosed way where no law prohibits it) or illegal but arguably ethical (civil disobedience). A professional must check both.

A profession has specialised knowledge, a code of conduct, public trust and responsibility. Engineers and doctors are licensed; software work in most countries is not, so personal ethics matter even more.

Main ethical theories

Theory	Question it asks	Example
Utilitarianism (consequences)	which action produces the greatest good for the greatest number?	release a security patch quickly because it protects 1 million users, even though a rare bug may affect a few
Deontology (duty, rules)	which action follows the moral rule or duty regardless of outcome?	never lie to a client about a defect, even if the truth loses the sale
Virtue ethics (character)	what would an honest, fair, courageous person do?	admit a mistake in your own code
Rights-based	does the action respect people's rights?	users' right to privacy
Justice / fairness	are benefits and burdens distributed fairly?	a hiring algorithm must not disadvantage a caste, gender or region

5.2 A method for ethical decisions

1. Identify the facts: who, what, when; separate what you know from what you assume.
2. Identify the ethical issue and the stakeholders: users, client, employer, colleagues, the public.
3. List the options, including "do nothing".
4. Test each option: Is it legal? Does it follow the code of ethics? Who is helped and harmed? Would I be comfortable if my family, a journalist or my professor read about it (the newspaper test)? Would it be acceptable if everyone did it (universality test)?
5. Decide and act, document the decision, seek advice (a mentor, the professional body, a lawyer) before drastic steps.
6. Review the result and learn from it.

5.3 Codes of ethics

The ACM Code of Ethics and Professional Conduct (2018) is the most used code for computing. Its general principles:

#	Principle	In practice
1.1	Contribute to society and to human well-being	consider the effect of a system on all people
1.2	Avoid harm	test safety-critical software thoroughly; report risks
1.3	Be honest and trustworthy	do not exaggerate skills; admit errors; no hidden functions
1.4	Be fair and take action not to discriminate	check software for bias; make it accessible
1.5	Respect the work required to produce new ideas, inventions, creative works	credit sources; honour licences
1.6	Respect privacy	collect only necessary data; secure it
1.7	Honour confidentiality	do not disclose client or employer secrets

The code also covers professional responsibilities (high-quality work, keep skills current, give honest peer review, access resources only when authorised) and leadership (clear responsibility, manage so quality of working life improves).

The IEEE and BCS codes, and the ACM/IEEE Software Engineering Code, are similar; in Nepal, the Nepal Engineering Council governs licensed engineering, and the Computer Association of Nepal (CAN) is the main IT body.

Whistle-blowing is reporting wrongdoing inside an organisation to someone who can stop it.

Order of steps: raise it internally (supervisor, then ethics or compliance channel); document facts carefully; only if that fails, and public safety is at stake, go to a regulator or the public.

Check the legal protections first; retaliation is a real risk.

Conflicts of interest arise when personal interests (a relative's company bidding for a contract you evaluate) could bias professional judgement; declare them.

Nepal's Copyright Act, 2059 (2002) protects literary and artistic works, including computer programs, and the Patent, Design and Trademark Act, 2022 covers inventions, designs and marks. Details and durations change, so check the current text.

Software licences

Licence	Rights	Obligations
Proprietary (EULA)	use only	no copying, modifying or resale
MIT / BSD (permissive)	use, change, redistribute, even in closed products	keep the copyright notice
Apache 2.0	like MIT plus a patent grant	notices; state changes
GPL (copyleft)	use, change, redistribute	derivative works must be released under GPL with source
Creative Commons (CC BY, CC BY-SA …)	content, not software	attribution; share-alike if SA

Fair use / fair dealing allows limited use for criticism, review, teaching or research, with attribution. Piracy, using cracked software or copying paid course material, harms creators and exposes you to malware.

Plagiarism in code: copying another student's program or taking code from a repository without respecting its licence and crediting it. Use the licence of the code you reuse, cite sources in comments, and write what you submit.

5.5 Privacy, security and responsible data use

Privacy is the right to control information about oneself. Personal data is anything identifying a person (name, citizenship number, phone number, IP address, photo, location, biometric data). Sensitive data (health, religion, finances) deserves extra care.

Principles of responsible data handling (found in the EU GDPR and most laws, including Nepal's Privacy Act): collect only what you need (data minimisation), tell people why (purpose limitation, consent), keep it accurate, keep it only as long as necessary, secure it (encryption, access control), allow people to see and correct their data, and report breaches.

Security is an ethical duty: store passwords as salted hashes, never in plain text; patch known vulnerabilities; do not leave default passwords; apply least privilege.

Ethical hacking is allowed only with written permission and a defined scope; testing a system you do not own is a crime even with good intent.

Surveillance and monitoring. Employers may monitor work accounts with notice; secret monitoring of private messages is unethical and usually illegal.

Facial recognition, location tracking and profiling raise proportionality questions: is the intrusion needed and the least intrusive way?

AI and algorithmic ethics: bias in training data leads to unfair outcomes (for example a loan or hiring model that disfavours some groups); demand transparency, human oversight, testing for bias across groups, and a way to appeal.

Generative AI adds issues of copyright, deepfakes and misinformation: disclose AI use where it matters, verify output, and never use it to deceive or to submit others' work as your own.

Digital divide, accessibility and sustainability: design for slow connections and low-end phones, support Nepali (Unicode) and accessibility needs (screen readers, contrast), and reduce wasteful computing and e-waste.

Nepal Police's Cyber Bureau investigates cybercrime. The government has also issued directives on social media use and registration of platforms; they have changed repeatedly, so check the current notices.

Penalties and section numbers are deliberately not quoted here because amendments change them; read the current Act on lawcommission.gov.np before relying on it.

Common cyber offences: hacking, phishing and online fraud, identity theft, cyber-stalking and harassment, circulation of private images without consent, spreading hate or defamatory material, piracy, ransomware, and spreading malware.

If you are a victim: save screenshots and URLs, do not delete evidence, report to the platform and to the Cyber Bureau, and tell a trusted adult or colleague.

5.7 Case studies

Therac-25 (1985–87). A radiation therapy machine delivered massive overdoses in at least six accidents, with several deaths, because of a software race condition and the removal of hardware safety interlocks.

Lessons safety-critical software needs independent hardware safeguards, rigorous testing and honest incident reporting; the manufacturer's early denial made it worse.

Volkswagen emissions scandal (2015). Software detected laboratory emission tests and reduced emissions only then ("defeat device"). Engineers and managers were prosecuted and the company paid billions in penalties.

Lessons writing code you know deceives regulators breaches honesty and public-good duties; "I was told to" is not a defence.

Boeing 737 MAX (2018–19). The MCAS flight-control software relied on a single sensor; two crashes killed 346 people. Problems included pilots not being told of the system and pressure to ship quickly.

Lessons disclose critical behaviour, design for sensor failure, do not let schedule override safety, and protect engineers who raise concerns.

Equifax data breach (2017). Personal data of about 147 million people leaked after a known vulnerability was not patched.

Lessons patch management is an ethical duty; collecting sensitive data creates a responsibility to protect it.

5.8 Eight responsibilities of an IT professional

1. Honesty and integrity. A professional tells the truth about what a system can do and about its defects. Hiding a bug, as in the double-charge example, harms customers and ends careers. Honest reports build long-term trust with clients.
2. Competence and continuous learning. Accept only work you are able to do, and keep skills up to date. Technology changes fast, so reading, courses and practice are a duty. Poor work in banking or health software can hurt many people.
3. Respect for privacy and confidentiality. Data of customers, such as phone numbers, citizenship numbers and bank details, must be used only for the stated purpose. Collect the minimum, store it safely and do not share it. A leak from one ConnectIPS-type service could affect thousands.
4. Respect for intellectual property. Use only licensed software, follow open-source licence terms and credit the authors of code and content. Do not use cracked software or copy a friend's project. This protects creators and keeps your own work credible.
5. Security and safety of users. Design with passwords hashed, input checked and updates applied. A professional thinks of how the system can be attacked or misused, and fixes weaknesses before release. Safety-critical software, such as hospital systems, needs extra care.
6. Obeying the law. Know the basics of the Electronic Transactions Act, the Copyright Act and the Privacy rules relevant to your work, and never help in hacking, fraud or harassment online. Ignorance of the law is not a defence. If a request seems illegal, refuse and seek advice.
7. Fairness and respect for people. Treat colleagues, users and clients without discrimination by gender, caste, religion, language or ability. Make software that is accessible, for example with Nepali-language support and readable text. Fairness widens the number of people who can benefit.
8. Accountability and whistle-blowing. Accept responsibility for your decisions and mistakes, and report serious wrongdoing through proper channels when the public may be harmed. Keep records of your decisions. Courage to speak up is part of professional ethics.

(a) An identity card: three fields can identify a person

(b) Share of people unique on ward + birth year + gender

Formula and fact sheet

• Theories: utilitarian (outcomes), deontological (duty), virtue (character), rights, justice.
• Decision steps: facts → issue/stakeholders → options → tests (legal, code, harm, newspaper, universality) → decide and document → review.
• ACM 1.1 to 1.7: well-being, avoid harm, honesty, fairness, respect IP, respect privacy, confidentiality.
• IP: copyright (expression), patent (invention), trademark (brand), trade secret (confidential).
• MIT/BSD permissive; GPL copyleft.
• Data minimisation, purpose limitation, consent, security, access, breach reporting.
• Nepal: ETA 2063, Copyright Act 2059, Privacy Act 2075, Muluki Criminal Code 2074.

Chapter summary

• Ethics asks what we ought to do; law sets the minimum, and professionals are expected to exceed it.
• A structured method and a code such as ACM's turn vague unease into a defensible decision.
• Copyright, patents, trademarks, trade secrets and licences define what you may do with others' work; plagiarism and piracy violate them.
• Responsible practice means protecting privacy, securing data, testing for bias and speaking up about danger.
• Real failures (Therac-25, VW, 737 MAX, Equifax) show what happens when these duties are ignored.

Practice

1. Differentiate ethics, morals and law with an example where a legal action is unethical.
2. Explain utilitarianism and deontology with one software example each.
3. State and explain any five principles of the ACM Code of Ethics.
4. Your employer asks you to copy a colleague's licensed library into your product without paying. Apply the decision method.
5. Differentiate copyright, patent, trademark and trade secret.
6. Differentiate MIT and GPL licences. Which would you pick for a library that you want companies to adopt freely?
7. List six principles of responsible personal data handling.
8. Why is storing passwords in plain text unethical? What should be done?
9. List four laws relevant to cyber activity in Nepal and one offence each addresses.
10. Analyse the Boeing 737 MAX case under ACM principles 1.2 and 1.3.
11. A model that screens CVs rejects most women applicants because past hiring favoured men. What went wrong and how can it be fixed?
12. A friend asks you to test a website's security without telling the owner. What do you do?

Answers and worked solutions

1. Ethics is the systematic study of right and wrong; morals are personal values; law is state-enforced rules. Example: legally selling users' contact lists when the privacy policy is silent can be unethical.

2. Utilitarianism: choose the option with the best overall outcome, such as shipping a patch that protects most users. Deontology: follow the duty regardless of outcome, such as always disclosing a known defect to the client.

3. Any five of 1.1 to 1.7 as in the table, with a line of practice each.

4. Facts: using licensed code without payment infringes copyright. Stakeholders: the library author, employer, customers. Options: refuse, ask for a licence, replace with an open-source alternative, write your own. The newspaper test fails for copying. Decision: propose buying a licence or using an open-source library, and document your objection.

5. Copyright: expression, automatic; patent: invention, granted; trademark: brand identity; trade secret: confidential information.

6. MIT permits any use with notice kept; GPL requires derived works to be released with source under GPL. For free adoption by companies choose MIT (or Apache 2.0).

7. Minimisation, purpose limitation, consent, accuracy, limited retention, security, access/correction, breach reporting.

8. If the database leaks, every account is exposed and users who reuse passwords are harmed. Store salted hashes (bcrypt, Argon2), enforce strong passwords and offer two-factor authentication.

9. ETA 2063: hacking or computer fraud; Copyright Act 2059: software piracy; Privacy Act 2075: misuse of personal data; Muluki Criminal Code 2074: defamation or fraud online.

10. 1.2 (avoid harm): the design depended on a single sensor and failure modes were not safe. 1.3 (honesty): pilots and regulators were not given full information. Engineers should have raised and documented concerns and managers should not have put schedule above safety.

11. The training data encoded historical bias, so the model learned it. Fix: audit outcomes by group, remove proxies, rebalance or reweight data, test fairness metrics, add human review, and allow appeals.

12. Decline unless the owner gives written permission and a scope. Unauthorised testing is a crime and breaches ethical-hacking norms. Offer to help set up a legal test, for example on a lab you control or through a bug-bounty programme.

Model answers: medium (5 marks) and long (10 marks) questions

Q (5 marks). Compare the MIT licence and the GNU GPL. Which would you choose for (a) a library you want everyone to use freely and (b) a program whose improvements you want kept open?

A software licence is the permission the copyright owner gives to others to use, copy, change and share the software. Open-source licences fall into two groups: permissive (few conditions) and copyleft (conditions that keep derived work open).

Point	MIT (permissive)	GPL (copyleft)
Use and modify	allowed	allowed
Redistribute	allowed	allowed
Use inside closed, paid products	allowed	not allowed: derivative works must also be GPL
Obligation	keep the copyright and licence notice	release source of derivatives under the GPL
Effect	maximum adoption	keeps improvements open to all
Examples	many JavaScript libraries	the Linux kernel

Choice. (a) For a library that everyone, including companies, should be free to use, the MIT licence is best because it does not restrict commercial use.

(b) For a program whose improvements should stay open, the GPL is best, because anyone who distributes a modified version must share its source.

Conclusion the choice depends on whether the owner values wide adoption or guaranteed openness. Whatever the licence, the user must read it, keep the notices and give credit.

Q (10 marks). Define professional ethics. Explain the steps of an ethical decision, illustrate with the example of hiding a software defect, and discuss intellectual property and cyber law as part of the professional's duty in Nepal.

Introduction. Ethics is the study of what is right and wrong; professional ethics are the standards of conduct that a profession expects of its members: honesty, competence, confidentiality, fairness and responsibility to the public.

Law sets the minimum, while ethics asks what we should do beyond it. Codes of ethics (such as the ACM and IEEE codes) guide computing professionals.

Ethical decision method (Figure 5.1). (1) Identify the facts. (2) Identify the issue and the stakeholders. (3) List the options, including doing nothing.

(4) Test each option: is it legal, is it consistent with the code of ethics, who is helped or harmed, and does it pass the newspaper test? (5) Decide, act, document and seek advice. (6) Review the result.

Example. The day before launch you find that the payment module charges customers twice about once in 200 transactions, and your manager says "Launch anyway, do not tell the client".

The stakeholders are customers (money lost), the client (reputation, liability), the employer and you. The options are: obey silently, launch with a clear warning and a quick fix, or delay the launch.

Silent launch is harmful and fails the newspaper test; the ethical choice is to inform the client, fix or delay, and record the decision, escalating if necessary.

Intellectual property (Figure 5.2). Copyright protects expression (code, text, images) automatically; a patent protects a new useful invention; a trademark protects brand names and logos; a trade secret protects confidential know-how.

Nepal's Copyright Act, 2059 (2002) covers computer programs, and the Patent, Design and Trademark Act, 2022 covers inventions, designs and marks. Licences such as MIT, Apache, GPL and Creative Commons tell others what they may do.

Piracy and code plagiarism are unethical and illegal.

Cyber law in Nepal. The Electronic Transactions Act, 2063 (2008) gives legal recognition to electronic records and digital signatures and defines computer-related offences such as unauthorised access, damage to computer systems and publishing unlawful material.

Specific penalties and sections change, so check the current text. Professionals must also protect personal data and follow the privacy rules that apply.

Conclusion. Professionals should not stop at "is it legal?": they should ask whether a decision is honest, fair and safe for everyone affected.

A clear method, respect for intellectual property and knowledge of cyber law help students make such decisions with confidence.