Hacker News Reader

Comment by freedomben | Hacker News Reader

I really hope that Uber's shenanigans get studied in ethics classes in Computer Science and other technology degrees. When I was doing my CS degree, we had a mandatory ethics class (which I hated at the time but in hindsight think is a good thing). Ethical implications were something I hadn't previously thought of much, but in the field I've encountered them many times.

Based on the news that has been coming out from Uber, I think it's time for our industry to re-focus on the ethics of what we do. Being technologically cool, doesn't make something good.

View on HN

I've been designing a CS ethics class for the past few months, mostly as a personal challenge. I proposed it to a few professors in my department yesterday.

The responses I got were mostly variants of "not until they make us," which is exactly the kind of attitude that results in our present state of affairs (thinking of the BMW emissions controversy, Uber, &c). I don't want another major teachable scandal to come out of the tech world, but that may be what it takes.

Sounds like they don't have the authority to do it. Perhaps pitch it to the business school Ethics professor, who perhaps might be willing to sign a letter of support.

Then take that to the authority. I believe it's the dean or provost of the CS department who would have the authority to make changes to the program -- and it is usually on a review cycle (so they might tell you to wait).

I think it's great what you've started, and so if all else fails -- put it on Coursera or open source it.

Thanks for the advice. I was planning to ask for support from the Philosophy department, but getting it from another school that has a practical ethics requirement is also a good idea.

The professors I talked to referred me to the department chair, who I think has final say over new courses here. Either way, open sourcing it would be fantastic (an entire section is devoted to ethical questions in IP/open source development).

It was VOLKSWAGEN --NOT BMW-- that created the emissions scandal by programming their cars to change the engine running parameters when the detected the conditions of the emissions test.

first article found of 641000 http://www.bbc.com/news/business-34324772

BMW is actually doing it right http://www.bmwblog.com/2016/02/16/top-five-current-diesel-bm...

sheesh

(edit: add BMW story link)

That's not true, All car manufacturers were pulling tricks in order to save adBlue.

The BMW story is on a bmw blog...

Here you can see other emissions, in a Guardian article, where it's clearly to be seen that BMW does not comply to the EURO 6 norms.

https://www.theguardian.com/business/2016/apr/21/all-top-sel...

Perhaps the Guardian story is true and everyone is playing around the margins on the European tests, but that's trying to obscure the forest with one tree.

In the actual context of the comment, which is the the USA "emissions controversy" with the massively fraudulent code, it was VOLKSWAGEN that was the main player, BMW was not involved.

(also IMO, Diesels are a pretty bad way to burn fuel in any case; I don't think BMW should pursue it at all, and although I like my petrol-powered model, I wouldn't buy one of their diesels)

Sorry, I misremembered. I tried to correct it above, but it's too late for me to edit.

I don't think it is lack of ethical knowledge that makes people act unethical. It is that being consistently ethical costs and may have bad impact on your career. It is also that company like Uber would punish overly ethical people too much and would pish them out.

Ethical class won't solve that.

Ethical class might help a young developer understand why working at a company like that is a bad idea. Understanding that a company punishing you for being ethical is a big glowing red flag is important.

Ethics being recognized as an important part of the field would also give one leverage to oppose their employeer's unethical demands, and make it more costly for the latter to make such demands in the first place.

Yes, but the problem is that Uber pays well and it has a lot of interesting problems to solve, and as usual in our society, morality becomes the later priority than interesting work/pay

If developers had a professional organization and working for Uber (or some company that does things which are banned by that organization) was a black mark on your resume that would ensure you never get a good job again, then we'd be in business.

That's how it works for doctors and lawyers.

But if there was the potential for future prosecution because of your actions, maybe that would alter the risk/reward profile enough for some people? Especially if you've taken an ethics course, and thus can't really argue plausible deniability.

It's not a problem limited to our society. Ethics, regulations, and consumer pressure can all help to keep corporations in check. The thing to remember is that a corporation can never have a moral compass, so we have to give it to them.

Many technology people adopt a see no evil, hear no evil point of view. It's commonly manifested in the pseudo-libertarian philosophy that you hear a lot.

IMO, its one of the reasons this field is such a feast and famine shitshow. Unlike accountants, attorneys, and engineers, we have no professional associations or standards to help protect our professional interests.

Mine focused on Therac-25... not quite the same problem-space.

It's possible Uber's devs were misled about the nature of the software they were writing - for example I read their other secret system, "Greyball", was written under the guise of protecting Uber drivers from being physically assaulted by militant Taxi drivers - a common sight in certain parts of the world - nothing to do with the dual-use of shadow-banning public officials and journalists.

Are you from Berkeley?

Mine also focused on Therac-25, but I'm not from Berkeley. It's likely that it was used throughout several campuses.

Though I feel that's not so much about ethics as it was appropriate safeguards/testing given the problem space.

I think it's a pretty common ethics case study. Therac-25 almost seems like a meme to me these days:

"What are the ethical implications in the field of software engineering?"

"Therac-25."

I don't think we've gotten any better, either. I'm surprised there aren't thousands of Therac-25s killing people every day, actually. I guess the hardware engineers got better at turning off software, because I don't think software engineers got better at software engineering.

> I guess the hardware engineers got better at turning off software, because I don't think software engineers got better at software engineering.

Years ago (like 25 years) I read an author discussing safety critical system. He flat out said, safety must be a primary system level design goal. Attempts to band aid it in will fail. Properly designed systems have safeties, interlocks, and monitoring subsystems to prevent software bugs from propagating to the point where people are harmed. People designing safety critical systems tend to completely distrust software.

Huh, I think I never heard of the Therac-25. We instead talked about flight Lufthansa 2904 [1] (Airbus A320-211 Warsaw accident), also as a case of overconfident engineers (although Wikipedia mostly blames the weather report).

[1] https://en.wikipedia.org/wiki/Lufthansa_Flight_2904

The "ethics" aspect came from the conduct of the engineers behind Therac that did not take the reports of malfunctions seriously, including a fatality - they were too overconfident and arrogant - as a result it took 2 more people to die, and many more seriously injured, before the problem was identified and fixed.

We also covered other ethics-related case-studies that covered project-mismanagement leading to massive cost-overruns, especially of public-service projects - particularly when those overruns are caused by malfeasance instead of incompetence or ever-changing client requirements (e.g. embezzlement, fraudulent conduct, etc). Another one was the ethics of personal data collection.

To loop others in:

Summary: https://en.wikipedia.org/wiki/Therac-25#Problem_description

Full Reading from Berkeley course: https://www-inst.cs.berkeley.edu/~cs61a/reader/Therac-25.pdf

Therac-25 featured on our syllabus here in the north of England.

Its a pretty infamous case.

What's unethical about this? They were doing market research. It's not much different from stalking your competitor on google and going after the users they advertise to.

Intentionally accessing a protected computer system without authorization and obtaining information from it is a federal criminal offense (18 USC 1030 (a)(2)(C)).

The part of CFAA that classified breaking a EULA or Terms of Service as unauthorized access is a horrible law that is frequently abused (most famously Aaron Swartz)

It is rightfully broadly criticized, and that shouldn't change because Uber are the perpetrators here

Just because you like Aaron Swartz doesn't mean that the law was 'abused'. He flagrantly violated MIT's terms of service and knew that he was doing so.

> He flagrantly violated MIT's terms of service and knew that he was doing so.

Yep and that shouldn't be a federal offense with ~20 year jail term with a lifetime criminal record

It's private companies defining federal law and dictating enforcement for their own purposes. You wouldn't let Wal-Mart define what it's own tax laws are, or have McDonalds define what RICO is - having companies define what theft or trespass are is just as absurd.

edit: the list of notable CFAA cases reads like a tragic comedy[0]

There is a case in there where someone was charged for encouraging his union members to email complaints to a company and when it crashed their mail server he was charged under the CFAA.

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#N...

The sentencing is up to the judge, not the law. Swartz was never sentenced to anything. You are getting the 20 year figure from media outlets that added up the maximum possible sentences for everything he was charged with, which bears no relation to how sentencing actually works.

Also, it obviously has to be a federal offense, since wires cross state lines.

> The sentencing is up to the judge

With 97% of federal cases ending in plea agreements sentencing is overwealmingly in the hands of prosecutors.

In the Swartz case she wanted him to plead guilty to every single charge and serve up to 6 years. Hence the suicide.

As leverage in negotiations they told him at trial he was facing up to 35.

>serve up to 6 years.

It was 6 months, not 6 years. http://archive.boston.com/metrodesk/2013/01/14/mit-hacking-c...

>As leverage in negotiations they told him at trial he was facing up to 35.

Again, this is a nonsense figure. Can you give an example of someone who has been sentenced to 35 years in jail for similar crimes?

The whole point is that they don't sentence people to 35 years - they use that as a threat to leverage them into pleading guilty. Hence the dictatorship-level 99%+ conviction rates.

Same thing happen to Aaron, they hung a 7 year sentence around his neck if he didn't please guilty to all charges and accept the deal they offered him.

Even the innocent would please guilty in those circumstances, it's the only rational thing to do.

>they don't sentence people to 35 years - they use that as a threat to leverage them into pleading guilty.

But you contradict this in your own post. They threatened him with a 7 year jail term, not a 35 year jail term.

The plight of the innocent in the US system is very real, but irrelevant to the case of AS, as he was very clearly and unambiguously guilty.

There is no contradiction. Let me break it down again.

The original DOJ press release[0] when Schwartz was charged:

> If convicted on these charges, SWARTZ faces up to 35 years in prison

That maximum sentence is not uncommon in CFAA cases as most charges carry 10 or 5 years and layering charges together is very common (ex Mathew Keys faced 25 years on 3 charges for sharing a password)

Facing 35 years Swartz enters plea talks and is offered 6 months recommended, up to 6 years but guilty to all charges

The prosecutors tell him if he doesnt take that deal and goes to trial then they'll be seeking a 7 year minimum 35 year max

A lot has been written about the problems with not just federal sentencing and plea agreements (internationally it is a unique system) but also specific problems with CFAA and sentencing guidelines:

https://www.eff.org/deeplinks/2013/03/41-months-weev-underst...

[0] https://web-beta.archive.org/web/20110724043722/https://www....

Again, 35 years is simply the figure derived by adding up all of the maximum sentences. Swartz had good legal advice. He knew he wasn't going to be sentenced to 35 years in jail.

The problems with plea agreements relate largely to innocent people being pressured into taking them because a trial is too risky. Swartz had clearly violated the law, so he would have had nothing to gain from going to trial in any jurisdiction.

See e.g. here for further analysis:

http://volokh.com/2013/01/16/the-criminal-charges-against-aa...

>... realistically, Swartz was facing anything from probation to a few years in jail if he went to trial — depending largely on how you value the loss he caused — and either a 4 months in jail or 0-6 months in jail if he pled guilty.

How does that justify having a ridiculous 35 year sentence hanging over somebody for a terms of use violation? That is murder levels of sentencing

The case was far from clear cut, weev had his case overturned and the Lori Drew case was overturned specifically because the judge said terms of use violations don't apply under CFAA

I read Orin Kerr a lot, abd agree with almost all of what he says in the series he wrote on the Swartz case - I only didn't buy his justification that overprosecution is ok because all the other prosecutors also do it

Swartz's main concern was a lifetime criminal record and not being able to work, and second pleading guilty to charges that he (and many others) don't agree he was guilty to

I def agree with Kerr that the unauthorized access statutes need to be reformed tho, that would have the Swartz case irrelevant and placed it back where it belonged - in a civil court

>How does that justify having a ridiculous 35 year sentence hanging over somebody for a terms of use violation?

It's arithmetic. The maximum sentences are what they are, and their sum is what it is. Justification doesn't come into it. But a 35 year sentence was never "hanging over him". He had good legal advice. He knew that he would not go to jail for 35 years.

>The case was far from clear cut,

He physically broke into one of their network closets while attempting to disguise his identity. If that doesn't count as unauthorized access, nothing does.

>Swartz's main concern was a lifetime criminal record and not being able to work

Which, as Kerr points out, makes it absolutely baffling that he did this in the first place. It's often glossed over, but it really was an enormously stupid thing to do. It's sad that he got himself into so much trouble by doing it, but I can't see how anyone else is to blame for that. Especially when he'd already had fair warning after the PACER incident.

You should definitely read this: http://bit.ly/2pgTpDg

I have read it, but it opens with the "35 years in jail" canard and is full of nonsense. Example:

>MIT is aware of the controls they could put in place to prevent what they consider abuse, such as downloading too many PDFs from one website or utilizing too much bandwidth, but they choose not to.

MIT did impose controls on the network to prevent Aaron from downloading PDFs, and he kept deliberately circumventing them (e.g. by spoofing his MAC address). So the idea that MIT was totally cool with what he was doing is obviously false, and AS knew that at the time.

They didn't access any Lyft systems. They ran Lyft software on their own devices and collected and analyzed the data Lyft provides. One can argue that they broke EULA, but it's not necessarily unethical, and I'm ready to bet the majority of this site users broke at least one software EULA in their lifetime.

Sure, the fake accounts just violated the ToS. But they then used an enumeration attack to find existing accounts and retrieve information not intended to be available to them. That it's not technologically sophisticated doesn't mean it's not a criminal offense.

If someone doesn't lock their front door and you enter their building, you're still trespassing. Especially if it's your competitor's front door and you're repeatedly entering the building to scout the place out for financial gain.

I don't use any service without having a basic understanding oh how secure and private their systems are - the CFAA makes that all illegal

"You wouldn't open an unlocked door" is the "you wouldn't download a car" of infosec. The later redefined theft as not requiring anybody to be deprived of a good while the former has the same flaw, you arent deprived of any good, you aren't harmed, you haven't been coerced or forced - i.e. It meets none of the common law definitions of trespass[0]

[0] but it does explain why ddos attacks, spam and stealing user data are trespass because they do meet those definitions

FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through.

There's a difference between "opening an unlocked door" and opening it, walking through it, making notes of everything behind it and repeating this room for all the other unlocked doors and then doing that pretty much continuously for days, weeks, months or however long Uber did it.

> FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through.

I would totally open an unmarked unlocked door in a public space that has locked doors clearly marked "restricted access", especially if the layout of the place I'm visiting suggests that there would be something interesting there.

That's pretty much what it boils down to, no? Just because you didn't document an endpoint doesn't necessarily mean it's restricted access. In fact, if the end point is accessible, and you have other sections of your service that require authentication, then it's very much the exception that proves the rule — the fact that you specifically forbid access to some routes reasonably means that, in general, I'm allowed access to unauthenticated endpoints.

My point was that walking through an unlocked door is a terrible analogy for accessing a resource URI that isn't directly linked from a page

Enumeration attacks are clearly covered by CFAA based on current law. See weev for example.

Assuming they did like you said the main point is

> collected and analyzed the data Lyft provides

they did it without permission

http://blog.erratasec.com/2012/11/you-are-committing-crime-r...

Not saying I agree with parent or not, but he asked what was unethical, not about the legality. I do not base my ethics on the law.

A protected computer system.

The Information article suggests that driver IDs were available in the clear to anyone who'd bother looking at API payloads.

Let's explore this from the information security perspective, since that is my thing. If I had performed this research against Lyft and knew about these "information disclosure" issues I would have felt they were significant enough for disclosure to see them remediated.

Why? Sweeping privacy concerns. In a world where most people have an Uber or a Lyft app installed security issues like this become spy machines. So it isn't just drivers that lose their privacy, in the long run it touches on everyone's privacy, because location data is notoriously hard to anonymize and machine learning is only getting better. So there is the first ethical argument against this behavior that pops to mind.

It's completely different, so far different as to be antonyms, opposites, completely diametrically opposed ends, because you just described a passive, orthogonal, ethical activity while Uber actively fooled with Lyft's systems to get the intel they wanted (emphasis mine):

> Hell originated after Uber created fake rider accounts on Lyft and used software to trick Lyft’s system into thinking those riders were in certain locations. This allowed Uber to see the eight closest available Lyft drivers to each fake rider.

You literally just typed the equivalent of "what's wrong with using an ad unit to deliver a zero day exploit? It's not much different from advertising."

It's not an exploit. There was no privilege escalation, denial of service, theft of private data, or anything like that. You can take the technology involved and replace it with a human process: multiple people around the city open the app and report back to the HQ the locations they see. Now, would you say this process is illegal?

Simplifying it even more: If you had people on the street, looking for cars with a Lyft sticker and reporting back every one you see - would you say that is illegal?

> Simplifying it even more: If you had people on the street, looking for cars with a Lyft sticker and reporting back every one you see - would you say that is illegal?

Yes, because trying to "hack" the legal system by finding things that you can argue are "technically legal" is not something that impresses me.

I get that beating someone up and throwing a paying customer off a plane, or using a firehose on civil rights marchers, is "legal" if some judge can be persuaded ($$$) to agree, but I'm not going to play that game: I don't want to live someplace where we do what is legal and don't do what is illegal; I want my neighbors to know right from wrong.

A Reasonable Person would think that Uber was doing this to wrong Lyft and indeed it turns out, was doing this to wrong Lyft.

Don't get me wrong. I think they're total assholes and shouldn't be doing this even if it is legal. But at the same time I'm interested in what would happen in case of an actual lawsuit. These don't care what impresses us :-(

Also, discussing what changes on Lyft's side would make it definitely illegal is interesting if you ever have some personal data in your own service.

The thing is, it would likely be a civil tort case, not necessarily a criminal case. An action can be legal from a criminal statute point of view, and yet still open the company up to a lawsuit in civil court where the other party can try to prove they were harmed.

Not sure about this in the US, but I'm pretty sure that in the UK, gathering a database of intelligence on competitors' staff earnings would be a violation of the Data Protection Act.

It would be interesting if this came to a trial. DPA protects only information that identifies people. If Uber collected information on cars instead which is anonymous and then correlated it with data it already has access to, so it only deanonymises its drivers, that's... I don't know.

IANAL, but I read the DPA a few times and I think it's an edge case. If someone has better idea, I'd love to hear it.

The Data Prrotection Act specifically covers this:

"* “personal data” means data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller"

Sorry, but they already thought of that one.

I believe it would need to be personally identifiable data. The fact that Uber can personally identify someone with location is unique to them and falls into this gray area.

I have decided that location data is PII. It is notoriously hard to anonymize. I have conducted some experiments with customers and even with a a relatively few samples it was possibl to merge address databases and "anonymous" location with ease. Right now there is a data classification fiction in most corporations that location days is not PII because it lets them do all sorts of analytics. I predict this fiction is going to get so excited organization in trouble and not just an Uber being so blatant about it.

All of which /u/stass would have know had there been an ethics class for them to take. ;)

There isn't the one and only standard for ethics. Perhaps a class would teach a certain version of ethics, but not a universally applicable one. As a somewhat relevant example, a lot of ethical norms in USSR (prosecution of successful individuals, outlawing free speech, destroying dissent, banning "unethical" literature and works of art) would be considered completely unethical in the Western society and vise versa, although the admiration of former became fashionable in tech circles lately.

Creating fake accounts is pretty common for spiders... standard search engine tactics.

Since we all learned so much from Enron and ethical problems like that never cropped up again, stands to reason Uber's going to be the last of its kind.

Sorry I can't tell whether this is sarcastic.

Reply on news.ycombinator.com