Programmers confess unethical, illegal tasks asked of them
uk.businessinsider.com
uk.businessinsider.com
I think it's important that I exercise professional integrity because I personally have the luxury of being able to afford being fired. If I lose my job because I refuse to do something, nothing bad will happen to me:
- I am a citizen in my country of residence (can't lose green card / etc.)
- I have a deep financial safety net
- I live in an area with high demand for my skills (if I spent more than a month looking for a job I would be shocked).
Not everyone is in this position. I respect that, so I'd like to use my privilege to make it more of a professional norm.
I think not shipping shit extends to everything from the obviously immoral to code that will hurt the customer (or their customers) because it is insecure or unmaintainable.
The same ACM that calls verbatim plagiarism "sloppy scholarship" [2]?
The same ACM that doesn't seem to have an official position on excessive state surveillance [3]?
I am no longer a member.
[1] https://raphaelwimmer.wordpress.com/2011/09/07/sheridan-secu...
[2] https://raphaelwimmer.wordpress.com/2016/12/20/acm-ethics-pl...
[3] http://www.acm.org/public-policy/public-policy-statements (in contrast, the German Chapter of the ACM / Gesellschaft for Informatik has condemned excessive surveillance multiple times in the past)
AFAICT no link given in the comments here so far comes anywhere close to the ACM page in terms of providing broad but concrete advice.
The ACM Code of Ethics is important. It was one of the reasons I joined ACM. However, (IMHO) ACM [1] has not necessarily practiced what it preaches in the past.
Given that much of the discussion in this thread is about unions and professional organizations, I wanted to clarify that ACM might not be the best organization to join if you are concerned about ethics.
[1] I'm talking about its administration and committees, not its members. There are quite a few highly ethical and motivated people in the SIGs.
Real engineers can be sued and loose if they signed off on something
In software? Almost every EULA comes with "We assume no responsbility for anything, anywhere, ever"
The idea of a professional degree has crossed my mind. There's enough of a gap in knowledge and ability required to transition from writing static web content to writing high quality (maintainable, operationally sound, scaleable) enterprise backend code that it starts to look like a paralegal/lawyer, LPN vs. RN, etc. distinction. The difference is that the public has little interest in regulating engineers, but it does have an interest in regulating lawyers and nurses.
I'm personally deeply suspicious of degrees. I'm returning to school to get a professional masters in CSCI, but the program explicitly requires work experience as a pre-requisite for entry (which seems like a no-brainer to me). It also has a high price, which is not something I would foist on the community.
I don't think "programming" should ever be tied to professional institutions as such (much less academic computer science). It has strong roots in free, open-source, decentralized, hacker-minded culture, and I don't think we should ever give that up.
So I guess I'm of two minds about the idea of a professional engineering degree. On the one hand it would help raise expectations about professionalism and accountability in software, which seem pitifully low right now, and on the other hand, it seems like a path no one in their right mind would want to go down.
We don't even know what computers or software would look like under such a scenario.
No degree, but rather a programmer publicly signs off on his code, and gets both credit and blame for it.
Anyone who wants can register for a programmer ID (in practice a public key). There is no test, just an administration fee.
When you write code you sign off on it, perhaps with some accompanying text describing what parts you worked on.
No more anonymous code shipped by a company entity, instead do it like how movies are done: Every single person gets credit (including QA and administration), every tool used gets credit.
Seems like a great way for company bosses to say "nah, we didn't know about this, the rogue programmer there made the decision".
Unless you have some way to also blame the management responsible for deciding such a design should be implemented.
Their name is on it as well, with text describing what they approved.
Company-wide, there was a rigid system in place that captured electronic signatures as change requests were documented, code was modified, and tests were completed.
Anything that was done flowed through at least those three distinct groups (data team lead, maintenance programmer, & QA). We could easily tell how a study's database had been modified in the past (including who had requested the change, who programmed the change, and who tested the change)...there was always an expectation that every i was dotted, t was crossed (or semicolon was in place) before anyone signed off on their work since it would permanently enter the record and couldn't be erased.
Consider an analogous situation: You made a mistake designing a building. Should you be able to shrug it off as "mistakes happen"?
This has actually happened in the real world with buildings, and when it does if you are responsible and work diligently to correct the problem people are understanding.
Do the same here.
I'm yet to see a building collapse around me in my city - I see software fail all the time though - I think we are better at building tall buildings than we are building software.
Not so for software.
Perhaps if you change that software might change.
The liability sits with your employer.
As a full time employee, the liability falls on my employer.
My ideal would be something like the actuarial exams. You start with exams on math, calculus, linear algebra, DEs, probability theory, numerical analysis, and so forth. Eventually it moves on to more industry specific exams. There are quite a few, different levels to pass.
It is highly rigorous, but one very key feature of all this is that you don't have a specifically proscribed academic path. There isn't a situation like law school, where aspiring professions are essentially forced to spend $120k+ on tuition to join the profession. You can major in math, I think that's most common, and graduate degrees are not unusual either, but you can major in a related field or, as far as I understand, just study math really hard on your own. You are free to decide how to prepare.
Looking at these tests, I can't possibly imagine that anyone who can pass hasn't learned very rigorous coursework.
Something like this could work for programming. We could set up a series of exams, similar to the actuarial math exams, but covering the essential CS work (another bonus: we could do this once, and it would be graded consistency and fairly, rather than being subjected to repeated "interviews" where we are randomly quizzed on data structures every time we apply for a new job). As it moves on, it might get to more industry specific things.
CS would be an advantage, sure, but a math major who has taken some CS and plugs the gaps through self-study would be perfectly free to join the profession. This is essential, in my opinion, it's very important not to allow a cartel like the law schools to take over. That would be extremely harmful.
I'm sure I haven't thought it all through, but this seems to be the most promising approach.
Oh, and lastly, it's not engineering! The licensing bodies for professional engineers are honorable organizations that have no domain over software, no more than they do over actuarial work. Software is its own thing, it isn't engineering.
Exactly. It's the job of senior and experienced developers to set the culture and transfer knowledge. Including: "We don't do that. Here's why."
It all depends on what you can prove - which is the hardest part.
You can imagine how well it went. I got there, and the two heads of the project down there were waiting, and expecting not only to take delivery, but to see it all installed and working. I had to explain that wasn't my task, and they got more and more upset with me. I had to tell them to call my boss to get answers, because I was just a drone. After yelling at my boss, I was instructed to do minimal setup to verify the hardware worked. I did so, but then they insisted that I prove that the tape had the software. When I did, it unfortunately showed the wrong county name, because whoever had made the tape just took another installation tape and put the "wrong" name on it. I had to tap dance a bit there, but I finally got to leave. So, unhappy me (which meant nothing to my boss) and unhappy customers (which I got blamed for).
Another time, they told me to put a label on a blank tape and ship it to a customer, to pretend to meet a delivery milestone. I refused. I think my boss did it himself.
Also... who is a manager, exactly? Is it the guy who does the strangling's boss? His boss? His boss? Where does the buck stop?
https://en.wikipedia.org/wiki/Execution_by_firing_squad#Blan...
The problem with always deferring culpability upwards is that it usually leads to no culpability.
Perhaps. If they did fire you for refusing to follow unethical (or illegal) orders, there might be judicial remedies. As we can see with this article and the HN threads for this story, reporting the problem to the public may open up other options and may deter future unethical behavior
> not pay my mortgage, not feed my kids
That's why unions and other parts of a social safety net are for. Do you want management to continue utilizing this power they have over you? Or are you willing to join with your peers and push back? If enough people across the software industry show their power by joining in a direct action (e.g. a strike) to tell management that unethical orders are not acceptable, future managers will have to reconsider if the gains from an unethical plan outweigh the risk of triggering another strike.
Also, while your mortgage[1] may be a problem, feeding your kids after suddenly losing your job is what government welfare problems are for. Yes, it can be humiliating to use - I know from personal experience - but it should only be a temporary situation until you can find another job.
> End up in a divorce.
Really? For standing up against unethical behavior? Is a few months of penny-pinching sufficient reason for a divorce?
> Ruin my entire life.
The only way your life would be ruined is if you let it be ruined. Yes, losing your job sucks but it could be a lot worse.
By following the unethical orders, you are conditioning management to believe they can get away with more unethical orders in the future. The longer this is allowed to continue, the harder it will be to correct. We already see this effect in how widespread and normalized unethical behavior has become across the industry.
So yes, you might be forced into a bad situation if you fight back against unethical orders. It may require a significant sacrifice. Do you want to pay that cost now, or do you want to wait for the difficulty and cost to go up as management gains even more power?
[1] If you don't have the savings to cover a couple months while you look for another job, then you probably shouldn't have bought that house.
You can get paid and live comfortably till your family is magically at the back of the que because you've been "mis-tagged" in a system.
Like it or not, right now the people awake in any way to the danger are people who write code day in and day out. That means you, who knows how an if statement, or a filter of a join can screw results.
Indeed. What you allege is called cowardice, and it is most definitely not an excuse.
Then again, bullies do not prey on those who stand up to them. Those who attempt to rationalise their pusillanimity attract them like flies though.
Please do yourself and everyone else a favour, stop blaming other people for your own weaknesses, and start to act in a way that can be an example and an inspiration to your kids. If nothing else, you owe it to them.
When you go to work, you don't give up your moral agency.
The shareholders have the most to lose, not the least.
Ontario Teachers' Pension Plan's $100 million stake in your company (for example) is worth a lot more than all of those jobs put together. That's why they have all the power.
No Sir, it isn't. I was a manager for years, then a contractor, and nowadays run my own show. Never once did I acquiesce to a request that I had the slightest concern about. Not to falsify data, not to take operational shortcuts, not to infringe the privacy of employees (my own or my client's) or third parties.
When such things are brought up, I do three things: 1. Say no. 2. Tell the other party that it is not a good idea: at worst will get them into a lot of trouble, at best they will lose any trust and respect they may have or hope to have one day. 3. Ask them what the real problem is, and try to help them find a real solution. It's surprising how often people go for the worst idea first without even considering other options.
In all fairness, I do come from a regulated profession background (two of them, actually), where if I screw up I respond with my licence, but I also learned the ropes at a company that were very strict with this sort of thing.
Well you can get a code monkey job somewhere else. That is one option.
The code monkeys are the ones who actually have the code to blow up the world and are the last line of defense when it comes to this.
Ethics precisely means you say no to the managerial class because you are a professional
Some years later it emerged that Banker's Trust had been ripping off their corporate clients wholesale. I've often wondered if I unwittingly helped them construct the tools with which to do so.
https://en.wikipedia.org/wiki/Bankers_Trust
My point here is not only that managers often request unethical behavior of their tech staff, but that the tech people often have no way of assessing the probity of what they're being asked to do. At the time I was only about 21 or 22 and all I knew was how to make big spreadsheets that ran really really fast; I had no insight into the integrity or otherwise of the accounting procedure they asked me to automate and I didn't really think about it until I had a functioning prototype a month or two in and realized that my little project was shuffling very large amounts of money around. I had been out of the job for a good while before I learned enough to wonder whether the underlying process was in fact fraudulent.
That sounds like a reward to me. If it weren't for the ethical cost you mention in the rest of your post, I'd take that job in a heartbeat.
If someone wants to pay me for doing nothing, I can find plenty of things that interest me to do on their time.
On the other hand, I guess "doing nothing" doesn't look too great on your resume. And if you don't learn new skills or work with new tech, that would cost you in the long run. But I could at least work on some open source projects or learn a new language or something. That way I could have something to show for my time, and have fun as well.
There's a strong argument that our discipline can profit by their example.
Unfortunately, laws seem awefully traditional and outdated, and at least some of the system has turned into a form of rent seeking. Even as a mechanical engineer, most of my work is not really considered as engineering work to the letter of the law, because the law was written in the 1960s with mostly civil works in mind. I get the feeling it's either going to take a long time or a huge catastrophy for legislators to catch up to licensing for professional software work.
https://en.wikipedia.org/wiki/Regulation_and_licensure_in_en...
There's a role for them, to be sure. But as you say, and as we see from the history of other disciplines, that role is generally after the fact. We can, and I think must, ourselves create professional societies which can develop codes of ethical conduct and put incentives in place to uphold them. To a certain extent, that comes after the fact, too. But we're at the very least rapidly approaching a sufficiency of horrible examples from which to derive salutary lessons. I'd like to see us develop a sense of professional culture, as an industry, which gives us to think long and cautiously in those cases where we might produce yet another.
We do, for our own protection. Doing so strikes the weapon from the hands of our managers - they can't push us into doing unethical work that easily because they know we're bound by law to refuse it. This is a case of Schelling-style strategy, where limiting your choice/freedom actually boosts your bargaining power.
Do we need legislators and regulators to tell us to do
our work with due care for those whose lives we affect
in so doing?
1. Works that potentially affect public security need to be approved by licensed Proffessional Engineers.
2. Therefore, businesses and managers need to be hire Professional Engineers, or be punished by law.
3. Professional Engineers are held to an ethical code of conduct, else they lose their license.I can't even begin to imagine the sheer flamewar load even thinking about a "professional programmer" certification would cause.
I always liked the idea of an apprenticeship - journeyman - master system. It sidesteps the theoretical definition of what is a masters work by simply having existing masters vote to see if you make the cut, or not. Master level work in the field seems like it should be inherently different in the center of the CRUD app universe vs the center of the financial universe vs the center of the aerospace universe, for example.
The obligation of competency is part of the Deontological Code. Or at least, so it is in Quebec. The Engineer (note that Engineer is a legally reserved title in Quebec, rather than "Professional Engineer" in most other places) is obligated to perform mandates only if he is competent do to them. It is his own resposibility to make sure he's competent.
If he is later shown to have performed work for which he was incompetent, he is liable to fines and/or to have his license revoked temporarily or permanently.
The PE licensing system here also requires a certain period (3 years) under which the EIT (or jr engineer in QC) must work under the direct supervision and direction of a licensed PE, before applying to obtain his PE license. This is similar to the apprenticeship system you propose, from what I understand.
It's mostly easy to constrain for civil works, once again. You design a bridge in a given province, you have to be licensed in that province (state, country, what have you).
It's much harder, say, for an automotive engineer, who works in Canada, using designs from German engineers for cars sold in the US and manufactured in Mexico.
If you started being held legally liable for the code you write I bet the tune would change really quickly for a lot of people.
Having been in the industry a while I think the worst thing I have been asked to do was participate in a program that installed our software on the user's machine without their consent. The CEO argued they did give their consent, which was technically true... they could uncheck the "Install partner apps" checkbox before clicking next but it wasn't very obvious.
Thing is, that practice is (was? I hope) common everywhere from Yahoo, AOL, etc... so it was one of those "Everyone is doing it" things.
I pushed back pretty hard but ended up losing the battle. In hindsight I wish I had walked. Ethics aside, none of the customers who got our app this way gave us very good reviews and their lifetime value was way less than customers acquired other ways.
Many of us didn't major in engineering, as the article states. There are no ethics classes in Math (what I studied in school).
> In hindsight I wish I had walked.
I have not yet had to make this choice, but I am specifically making sure my financial situation is in order enough that I wouldn't be tempted to go along with something blatantly illegal or unethical. I'm not completely sure if, in the moment, with the ability to pay rent on the line, if I could refuse in a situation like you mentioned. Luckily, I've never been asked to do anything too questionable.
That is a good point. To expand on that, many software developers don't have formal training at all. I didn't mean to imply that my experience is typical or even common. I know CS programs at other schools that do _not_ require ethics or have it as an optional elective so it's certainly not universal even within CS.
It different from country to country, but CS degrees are training you to be a scientist first and for most, even if most of us leave the universities and will never work as a scientist. The ethics courses are designed to teach us not to fudge our research data, how to behave towards our academic colleagues and how to properly give credit to the work of others. And the well meaning professors that teaches these courses have no experience dealing with unethical managers.
In countries where unions are strong and work, I would let them help their members in these cases instead. In Denmark, unethical behaviour observed by a computer scientist working in the private sector is best left in the hands of the engineering union.
I don't buy the O'Hanian view that we should continue innovating, "without their permission." I don't think software necessarily has to come with the risk of killing people in order for it to cause significant harm. We've seen how innocuous software can cause significant harm to civil liberties and put under-represented people at risk. We've seen how software vulnerabilities put the financial industry and peoples' future at risk. At best we inconvenience a user. At worst... well we don't have to imagine that. I think it's enough that we take some responsibility for what we create into our own hands.
We're going to be bad at regulating our industry at first. It may harm startups for a while. However I think it's important for professional software developers to be licensed, projects insured, and liability enforced. How will self-taught developers fit into the system? I don't know... I'm self taught myself. However I am looking towards going back to school and seeing what I need to do to be licensed... there is a government-backed program where I live.
I just hope that when the time comes and I stick to my guns that there will be an organization behind me with the power to litigate for my job. Too many times I've been asked to put my professional opinion aside... as it's just an opinion after all... in the name of business/progress/innovation. I'd rather be beholden to the profession than to my employer (and I think many employers are smart enough to realize the benefits of this arrangement).
If somebody runs Microsoft Windows XP on the main brake control computer on a high speed train, that is irresponsible.
If somebody runs Microsoft Windows XP in a VM to try out Bonzi Buddy one more time, that is hilarious.
If you speak a mean letter on stage as a comedy act, that is hilarious.
If you send a mean letter to a depressed person, that is irresponsible.
If you use computers to retain PII, then it is your managerial responsibility to ensure that the PII is stored responsibly. Just as you have the responsibility not to leave printouts of that PII in public dumpsters, or post them on Bristol Board in the public square.
This is a very personal topic to me, because I am being paid handsomely to write software for the financial industry at the age of 19, because I can create massive wealth for them; and if software were a regulated profession, I may never have become a software developer at all. I may have just offed myself after failing in school.
>...while hundreds of people have been killed from faulty software during air travel. Notably, some of the points mentioned in the talk referenced in the article are already basically "solved issues". There hasn't been a software-attributed catastrophic aircraft failure in quite a while, and the most recent one we know about was the crash of a pre-production Airbus test aircraft. That aircraft's software hadn't yet passed the standard verification procedures and standards.
Every industry has its own priorities and needs, regulating the hard skill will only lower the quality of software developers.
Frankly I think we are well passed the point of no return -- there most definitely is no means to regulate the industry. Hundreds of thousands of businesses across the planet need a steady stream of code pushed out and they all need to keep costs down, there is no legal entity that can reach across the planet to provide necessary legal protection to the ethically inclined.
Repeat: there is no legal entity that can reach across international jurisdictions for this.
At best we can rally around national voluntary accreditation facilities (eg: Canadian Medical Association, American Medical Association) but it would be difficult because the best of us can simply opt out with little to no personal loss.
The world really is held together by duct tape and bailing wire with occasional sections of steel and concrete. I'm sure we are all familiar with this where we try (as hard as we might) to seal the cracks every chance we get.
I think the medical associations have done a bang-up job, and perhaps the software industry could learn a bit from that.
The regulation I believe is necessary wouldn't require every programmer to be licensed and wouldn't require every commercial project to be insured and signed off by a licensed software engineer. So what would have prevented you from working in your current situation? Nothing.
It's no less personal an issue to me. My first programming job came to me when I was 17. I was paid more than either of my parents ever made to do something I liked doing (something I used to get yelled at for spending so much time doing...). I helped make gambling websites in the 90s before there was any regulation of such activities. I had no code of ethics and I probably helped enable more than a few addicts relieve themselves of their future prospects. Had there been a requirement that at least someone working on the team to be a licensed professional then at least someone had to be conscious of what we were doing.
Personally I don't trust corporate interested to decide what is ethical. As many programmers here have lamented if they didn't do it someone else would and now we're stuck with an industry whose sole purpose it to circumvent privacy protections in order to track behaviour online and sell it to the highest bidder.
Fortunately we do pretty well when writing flight control software. But it's not a good enough system when it comes to web services or trading services. Or a myriad of other things that can cause harm without risking lives.
I don't have the answers for how it should work. And as I said I suspect we'll be bad at it for a number of years. But that shouldn't be an excuse for not trying.
Chad and Brad. Do you think doctors and engineers could have such high standards for themselves if, they didn't restrict access to their profession somehow?
There is no desire to get rid of coding bootcamps on any side—negative costs are externalized to the consumer.
yes, this amounts to more or less, the same thing-at least interpreting in terms of adding constraints.
However, doctors hold together very strongly. This doctor and another doctor we worked with were acknowledged by our neuros as terrible and doing their patients a misservice, but none of our doctors even contemplated reporting them in any way. Long story short, there's 'bad orders' in medicine as well.
It's not a sure way to ensure you never encounter these problems, but it will reduce the likelihood.
Every time I talk to "real" engineers about what goes on in computing, they're completely dumbfounded. Nobody has ultimate responsibility for signing off on a design? Changes get made without any independent analysis, or without any analysis at all beyond "well it seems to work"? When something fails, people routinely shrug their shoulders and move on without performing any post-mortem?
How about addressing the root cause: People are doing unethical thing as part of their job. Either because they either don't understand the issue or due to their financial situation.
Apparently we have all accepted that business people in general are going to be unethical to the point where there is no fighting it or expectation that it's fixable. How about we address the real issue: The unethical business practises of some company and the people who run them.
But no, let us once again leave it to the developers to fix the problems.
In some ways I'd think large business might have an easier time with forcing workers to behave in some way unethically. Losing a single worker for refusing to do something unethical doesn't have as much impact on their business as a whole. I wouldn't go too far with this argument without doing some research, thought. Just a thought experiment.
I'm not denying the experience of your friends. I just am unsure of how far this goes towards advancing an argument that an interestingly large number of "small businesses are run by liars and frauds", which I'm admittedly not sure you're making. Which is why I'm asking :)
Maybe saying that many small business are run "by liars and frauds" is too much; I admit I get emotional over that sometimes. After all, I don't know those managers/bosses well enough to judge the state of their consciousness. But what I observe is that, nevertheless, the workers are often directly asked to do unethical things that go against the interest of customers.
A charitable way of viewing that is that the bosses are forced to cut corners to deal with the pressure[0] or to stay competitive, or that eventually some unethical conduct becomes a standard practice in the industry (I believe that for example washing meat with detergent is such a thing).
As for the impact of losing a single worker - when we're talking about regular people doing regular jobs, losing an employee often doesn't have much of an impact on the company, but it has a lot of impact on the employee itself. For people outside of very specialized fields, finding a new job is a nontrivial task. Finding a new job that pays comparably to the one you just left making a stand is doubly nontrivial. Quadruply, if you live in a smaller town. I know first-hand of a particularly successful online book seller who uses this fact to overwork and underpay his staff while forcing them to lie to customers - he knows that none of his employees can afford losing this job.
I guess what I'm trying to say is that most of the working class is pretty screwed when it comes to disobeying unethical commands - people in IT often forget that our industry is in a (temporary) golden age, and we can afford to make a stand.
--
[0] - I run a non-profit and I know how much pressure can fall on you when things get messy while various deadlines for deals or paperwork approach. I can only imagine a competitive business is even more difficult to manage.
"As for the impact of losing a single worker - when we're talking about regular people doing regular jobs, losing an employee often doesn't have much of an impact on the company, but it has a lot of impact on the employee itself."
Completely agree. I meant from the perspective of the company. For the employee depending on an income is a different matter all together.
Where regulations, or professional society codes or whatever else, could be usefully applied is where software gets loaded onto something important. You can write all the terrible code you like if it doesn't leave your office, but the moment you package it up and send it out to be installed on a thousand new aircraft (or a million internet-enabled toasters), you're at a ripe point for scrutiny. Can you attest who is responsible for what portions of the code? Have experts signed off on reasonable guarantees of security, safety, and correctness? At that stage, having your engineers be recognized members of a professional society that will hold their feet to the fire to stand by their word is useful. Not all code needs to have an engineer's stamp, but it doesn't make it into a specified set of "serious applications" without stamps.
[1] Albeit not implausible, either.
I don't think the solution for this is to have an organization that regulates programmers to make sure a programmer will become ethical. No matter how much ethics you teach someone to become ethical, it is in their own volition to act upon a task that is provided.
What will you do it if a programmer suddenly decides to be unethical or agreed upon doing an unethical task related to work? Remove their license to become programmers? Ban them to use the computers? Put them in jail? Shouldn't the management be responsible for their decisions, too? Why are all the blame here being focus on the programmers? Why don't you teach "Ethics" to those who are pushing the programmers to do such a task? Yes, the programmers have the big decision to do it or not. But regulating them isn't the solution that would make their decisions ethical.
What if the younger generation wanted to code? Will you stop them from learning it because they are not allowed to learn it unless they are in school? Or they are not even allowed to ship code because they don't have a license or it is not under the standards made by the organization?
Remember programmers are people. Same with all the human beings in this world who makes moral decisions on their own. Their beliefs, attitude and principles in life are nurtured based on how they were brought up not because they took an ethics class in College.
If a programmer violated a law because of his actions, then treat them as a person who has violated the law.
It's not just about that. If you are not in a first world country, then feeding your family and ensuring you have a roof over your head are more important than breaking your own ethics with developing software.
As someone who lives in a first world country, the UK. I have I found ethics to be a sliding scale.
We live in a world where gaps in the market will always be filled by someone. Frackers, Oil companys, GMO companies, Chemical companies, the list can go on and on. One side will say they are doing a public good. One other side will argue they are harming the planet and it's unethical for them to operate.
The only way to really change things, is make a movement and vote with the collective wallet. The market will dictate what is acceptable and what is not.
Per the article: I think the more programmers will adopt this attitude, companies will simply stop asking and move the project offshore. I know from experience, they have no such qualms.
That's why recognized professionals (ie lawyer/doctors etc) expect to be well-compensated. They are expected to quit, to walk away from unethical situations even where doing so means they loose out on work. This is why many professions do try to limit the number of members as flooding the market, lowering wages, will push some members to do things that damage the profession.
Don't think I have a vendetta here against doctors. My parents are both surgeons, so trust me when I say my general feelings about medical professionals are overwhelmingly positive. Your argument just strikes me as disingenuous.
It wasn't even anything important. It was only "a little unethical" and wouldn't have really affected many people negatively. But the line for me isn't how unethical it is, just that it's unethical at all. I simply don't need that in my life, no matter the price.
I wish more people would draw the line where I do, but I do understand the conflict and why they might choose otherwise.
It's not just that you know enough of your field for your signature to matter. It's that by signing, you are putting your reputation and even your freedom at risk.
As it is right now, if you write code that does something illegal or unethical, the blame WILL go to you. There may or may not be an email record of you being told to do this, but there will be no question of YOUR intent, and you can be sure that your bosses will do whatever it takes to get all the liability put on you, because with source code, there can be no question of intent.
(Well, in older times you could obfuscate intent in the source code, but that option went away with K&R C)
So it might as well be time to standardize the software engineering form of the professional engineer exam and licensing procedure, and start requiring that software PEs review code.
Professions are fields that grant members special abilities and protections beyond lay persons. They are officially trusted by society to do things that normal people are not allowed to do. Doctors cut people open. Engineers put their stamp on bridges carrying people. Lawyers hold client secrets. Nurses handle dangerous drugs. These professions are officially recognized in law. They have societies that too are recognized in law (State Medical/Bars etc). With this then comes the ban on anyone outside the profession performing such tasks.
What would a world look like should "computer programmer" become a recognized profession as the article suggests? Will non-professionals be forbidden from writing code? Will we have state boards deciding how and by whom computer programing may be taught as they do law schools? Would hardware with open firmware be sold only to licensed professionals as we do with medicines? That's an absurd world.
Programming isn't a profession because it simply could not exist as a profession. Professional associations and ethical standards certainly have a place in educating, but they should not be given the power to actually regulate behavior.
I would prefer some kind of universal professional ethics and responsibilities that wouldn't be related to your specific profession. Heck, being ethical applies to mathematicians, economists, journalists, musicians, programmers, engineers, and so on.
Just joking. I mean, the questions are doable, they just aren't very meaningful.
That still leaves chemical engineers and material engineers, and that is partly because Civ-E is older, and the need for licensing in Civ-E was established first, by the Quebec bridge disaster.
But ultimately the whole thing is an exercise in social engineering, to make you care about your honor as much as about money (the money for being a PE is not that big a bonus), and making you look at Civ-E for a day in this fashion, well, it works.
I think that Software Engineers should be held to the same standards as other kinds of engineers (and yes, I am aware I am implying Software Engineers are Engineers). The industry just hasn't caught up yet.
The other major blocker is that the Professional Engineer licensure process requires "four years of progressive engineering experience under a PE" (see https://www.nspe.org/resources/licensure/what-pe). There being few, if any, software PEs, there is something of a chicken-and-egg problem.
Agreed, this is a big issue.
Also, it requires that the school have a specific accreditation that is unusual for Computer Science. My school has it but it didn't have it until 3 years after I graduated because it was so new. Although I had to take all the same courses as the eventually accredited version. (my year was the first year to do so but it takes a few years to get the accreditation)
So I'm not sure if I'm even eligible to take it because of that.
Not just accreditation (many schools have that), it needs a specific type that is for engineering.
Either way, as someone pointed out. It is a process. It won't happen overnight.
Based on that page I linked, the SW Engineering PE has the lowest passing rate and an average passing rate of repeat test takers of any of the exams. I presume because most schools and careers do not prepare people properly for this exam.
No.
> Will we have state boards deciding how and by whom computer programing may be taught as they do law schools?
No.
> Would hardware with open firmware be sold only to licensed professionals as we do with medicines?
No.
> That's an absurd world.
Yes, because you've tried to make it sound absurd. The reality is that in medicine, engineering, and law, restrictions are based on knowledge, skill, and ability, which is reasonable and would also be reasonable to apply to software.
I can buy some medicine at the store, like Advil. I need a prescription for others, like Oxycontin. And some medicines can only be administered by professionals, like chemotherapy.
Likewise, anyone can teach in medical school or law school. They just need to demonstrate that they are qualified to do so. And there is plenty of medical training that does not have to meet that standard, like CPR, basic first aid, even EMT.
How would similar approaches for software be absurd? Some software is more critical than others, just like some engineering, medicine, and law is more critical than others.
Here's an example of something that is actually absurd: the physical systems of a car are engineered by professional engineers, to comply with known safety standards and regulations. Meanwhile the code controlling those physical systems can be written by someone with no training, and is held to no standards whatsoever.
Software controlling robots cut people one, beams of ionizing radiation guided by software burn tumors inside them.
> Engineers put their stamp on bridges carrying people.
Finite element analysis software tell engineers the stresses on bridges carrying people.
> Lawyers hold client secrets.
Cryptographic protocols protect everyone's secrets.
> Nurses handle dangerous drugs.
Hospital administration software tell nurses what drugs to deliver at what dosages.
In each of these fields, as practiced today, professional and ethical conduct on the part of software engineers is a necessary precondition for the successful outcomes downstream.
But in none of those fields do the engineers building the tools have any real knowledge of the ethical obligations, nor are they held responsible should their innovations be misused. Their services are not relied upon directly by the patients/clients but by other professionals. The Doctor is responsible to the patient because he is the one telling the patient to trust the robot. The engineer is only responsible to the Doctor as the Doctor is the one buying the product.
A coder's ethical duties end once his invention is fit for purpose. He does not control how his invention is used. A coder cannot know how his work will be used by others, nor is he expected to supervise how his innovations are used once sold. Many innovations will eventually be released into public domain (copyright). A doctor or lawyer's professional obligations do not end, continuing even after death. Doctors/lawyers/teachers/carpenters also retain absolute control over how their services are used and can withdraw at any time. They are not creating products for sale.
(A doc can invent and sell a product, as a lawyer can write a book, but such products are something different than providing professional services to a client.)
Now, if the engineer were the product owner, then of course, he is responsible.
I think this author doesn't fully understand how software is developed and doesn't understand or differentiate between the roles of product managers/product owners and software engineers.
There are, of course, systems that can be used in both good and evil ways. But when your boss says 'just write code that detects when the car is being tested, and when it's being driven normally', you know it's sketchy, and you should refuse.
I know this is easy to say and hard to do. But it's still something we should talk about, and that programmers should think about, before we get asked to do something, not after.
Software engineering is not not not a profession. It is a form of literacy. People write down lies and untruths and abominations, using the great gift of literacy.
And society assumes that as everyone else it literate those who write down lies do not automatically have an advantage
We do, but creating a software literacy profession is not the right solution
Edit: let me adjust this. Professionalism is meant to be about minimum standards of performance expected from any member of the profession (it is a way of saying we the profession ensure you get at least the baseline service no matter who you hire)
The ethics of professionalism are usually well enforced in areas of individual criminal mesbehaviour (i.e. Accountants who dip into their clients accounts get barred)
However the issues discussed here are more areas of regulation than criminality. Yes making software that drives a tesla into a truck is bad, but that was not an actual requirement - it was a failure in the whole industry to decide what is the right thing to do. Different regulators in different industries and countries will let different standards (i.e. With LIdar / without) - and unethical companies can play arbitrage.
Arguing that a spec for a online game fails to meet regulations might work, but individually saying younundersrand the regulations better than the various hierarchies above you is unlikely to work.
So I have lost my trainnof thought but
- TPP is actually supposed to be where regulatory arbitrage is defeated. We need something like it back
- All professions face ethical issues at all levels (I would argue that most issues in software (privacy, self driving cars, armoured robots) are issues we as societies have not decided upon yet so individuals are just applying their own judgement (this is the don't work for a tobacco company question)
- and other professions stuff this up as well - banking did it spectacularly so.
So, yes we should raise the minimum standards but questions of ethics are something for the profession as a whole to decide, (I will not code a self driving car that does not have LIdar out to 100 yards behind, and my professional body will support me, is an ethical stance yes, but really it's a post hoc regulation)
I've had my own.. disagreements with the people here running the place. One of those very disagreements was what I thought was active targeting was in fact me triggering a spam filter or something.
The underlying problem is HN should be more transparent in how people get on "shit lists"- hellbanning, no submit, and other statuses.
I tended to like the Kur5hin style model, where every mod is linked to the user, and everyone can see it. Albeit, K5 is dead...
I am against shipping broken software. If you bought a car that is malfunctioning and you are expected to take it to the mechanic to get it working, would that not be unethical?
"But what developers really need is an organization that governs and regulates their profession like other industries have"
What this inevitably turns into is a collection of content-free truisms (eg "programmers shouldn't write programs that break the law") combined with credentialism ("we won't let you join the Society of Programmers without a degree in computer science, and it's 'unethical' to hire a non-SOP programmer to work on your project") and politically motivated de-credentialing ("we have determined your work on the Trump advertising program targeting white voters was implicitly racist; you're disbarred").
If you think the last part is silly, here's an article citing architects claiming it would be "unethical" to work on the border wall.
http://www.businessinsider.com/trump-wall-impossible-build-a...
That reminds me of the American Psychological Association's (APA) position on torture:
"Any direct or indirect participation in any act of torture or other forms of cruel, inhuman, or degrading treatment or punishment by psychologists is strictly prohibited. There are no exceptions."[1]
This might seem unfortunate to some, or may smell to them of unwarranted political meddling. But I for one am glad these professions are taking these strong and clear ethical stances, and doing so on what I consider to be the "right" side (ie. anti-torture and anti-xenophobia).
I'm also not sure how one could separate ethics from politics. Some people even believe that every action is political.
Why are people like you so desperate to hand someone else the whip hand? Do you actually think Your Kind Of Guy is going to be in power in perpetuity? Does it actually seem to you like these guys are reasoning from some set of elucidated & unchanging moral principles?
Ironically the nightmarish story of how ineffective the APA's "ethics code" was should permanently disabuse you of the notion that they're useful for anything other than economic protectionism and occasionally crushing the outgroup du jour.
I guess that's more on what's now called data science though, rather than programming.
Here are the things I've been asked to do and refused, so they just went to someone else to get it done.
- Disable the back button coming from a Google search (Don't want them going to a competitor's site).
- Change the default selection for being included in spam list from no to yes.
- Export email lists ignoring the "include me in spam lists" selection.
- If someone has purchased before, save their credit card information, and if they add something to their cart ever again, charge them immediately, and them make refunds difficult.
- Make the RMA / refund page throw an error the first time, to try and discourage returns. It'd work the 2nd time.
- Add a "pay with cash discount" wish is really a credit card surcharge because the request to pay in cash is never approved.
- Doctor the math for discounts so unless a customer double-checks they won't notice the ~25 cent discrepancy.
- Take donations for a cause with fine print (literally, like 3pt type) that says only a small percentage gets donated.
- Intentional violation of credit card rules, such as storing the customer's credit card without their knowledge, sending credit cards numbers through email unencrypted, refusing to honor recurring payment cancellations, and so on.
- Ship by a slower shipping method than what the customer is charged for.
This list could go on for literally hundreds of entries. The point is that, yes, as the programmer, we are the last line of defense. The stories here with people working in the health care industry just break my heart - so much more at stake then people's money.
One piece of advice I can offer. When you refuse, and they go hire someone somewhere else to do the dirty work, you can always report them anonymously afterward. The satisfaction of seeing them having their credit card processing or merchant account yanked can give you some solace.
But in the end, I don't know if it's a winnable war. I want to say this very carefully, because I in no way wish to disparage programmers from other countries, but what I've seen, over and over, is that if I won't do it, there is always someone in another country, for cheap, who will. I'm sure they've got two kids too, and they need the money. There will always be someone ready to do the wrong thing, for whatever reason.
If facebook really did cause T. to get elected, fb programmers may be responsible for orders of magnitude more suffering and/or death than the above.
What I am saying, is that software with political implications, can have far greater effects than software which directly controls physical objects. Not sure how this is illogical, but open to hearing views.
It would be nice if downvoters explained their view, in addition to downvoting.