1. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-1 BUSINESS DRIVEN TECHNOLOGY Business Plug-In B2 Ethics

2. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-2 LEARNING OUTCOMES 1.Summarize the guidelines for creating an information privacy policy. 2.Identify the differences between an ethical computer use policy and an acceptable computer use policy 3.Describe the relationship between an e-mail privacy policy and an Internet use policy

3. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-3 LEARNING OUTCOMES 4.Explain the effects of spam on an organization. 5.Summarize the different monitoring technologies and explain the importance of an employee monitoring policy

4. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-4 INTRODUCTION Ethics – the principles and standards that guide our behavior toward other people Important ethical concepts stemming from IT: – Intellectual property – Copyright – Fair use doctrine – Pirated software – Counterfeit software

5. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-5 INTRODUCTION ePolicies address information privacy and confidentiality issues – ePolicies – policies and procedures that address the ethical use of computers and Internet usage – Privacy – the right to be left alone when you want to be, to have control over your own personal possessions, and not to be observed without your consent – Confidentiality – the assurance that messages and data are available only to those who are authorized to view them

6. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-6 Ethics Individuals form the only ethical component of an IT systems

7. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-7 Ethics Acting ethically and legally are not always the same

8. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-8 INFORMATION HAS NO ETHICS Information has no ethics Information does not care how it is used Information will not stop itself from sending spam, viruses, or highly-sensitive information Information cannot delete or preserve itself

9. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-9 Developing Information Management Policies Organizations strive to build a corporate culture based on ethical principles that employees can understand and implement ePolicies typically include: – Ethical computer use policy – Information privacy policy – Acceptable use policy – E-mail privacy policy – Internet use policy – Anti-spam policy

10. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-10 ETHICAL COMPUTER USE POLICY Ethical computer use policy – contains general principles to guide computer user behavior The ethical computer user policy ensures all users are informed of the rules and, by agreeing to use the system on that basis, consent to abide by the rules

11. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-11 ETHICAL COMPUTER USE POLICY Six principles for ethical information management

12. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-12 INFORMATION PRIVACY POLICY The unethical use of information typically occurs “unintentionally” when it is used for new purposes – For example, social security numbers started as a way to identify government retirement benefits and are now used as a sort of universal personal ID Information privacy policy - contains general principles regarding information privacy

13. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-13 INFORMATION PRIVACY POLICY Information privacy policy guidelines: 1.Adoption and implementation of a privacy policy 2.Notice and disclosure 3.Choice and consent 4.Information security 5.Information quality and access

14. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-14 ACCEPTABLE USE POLICY Acceptable use policy (AUP) – a policy that a user must agree to follow in order to be provided access to a network or to the Internet An AUP usually contains a nonrepudiation clause – Nonrepudiation – a contractual stipulation to ensure that e-business participants do not deny (repudiate) their online actions

15. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-15 ACCEPTABLE USE POLICY

16. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-16 E-MAIL PRIVACY POLICY Organizations can mitigate the risks of e-mail and instant messaging communication tools by implementing and adhering to an e-mail privacy policy E-mail privacy policy – details the extent to which e-mail message may be read by others

17. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-17 E-MAIL PRIVACY POLICY

18. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-18 INTERNET USE POLICY Internet use policy – contains general principles to guide the proper use of the Internet

19. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-19 ANTI-SPAM POLICY Spam – unsolicited e-mail Spam accounts for 40% to 60% of most organizations’ e-mail and cost U.S. businesses over $10 billion in 2003 Anti-spam policy – simply states that e-mail users will not send unsolicited e-mails (or spam)

20. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-20 Ethics in the Workplace Workplace monitoring is a concern for many employees Organizations can be held financially responsible for their employees’ actions The dilemma surrounding employee monitoring in the workplace is that an organization is placing itself at risk if it fails to monitor its employees, however, some people feel that monitoring employees is unethical

21. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-21 MONITORING TECHNOLOGIES Monitoring – tracking people’s activities by such measures as number of keystrokes, error rate, and number of transactions processed

22. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-22 EMPLOYEE MONITORING POLICIES Employee monitoring policies – explicitly state how, when, and where the company monitors its employees

23. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-23 Closing Case One Sarbanes-Oxley The Sarbanes-Oxley Act (SOX) of 2002 is legislation enacted in response to the high-profile Enron and WorldCom financial scandals to protect shareholders and the general public from accounting errors and fraudulent practices by organizations Sarbanes-Oxley is where information technology, finance, and ethics meet

24. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-24 Closing Case One Questions 1.Define the relationship between ethics and the Sarbanes-Oxley Act 2.Discuss why records management is an area of concern for the entire organization 3.What are two policies an organization can implement to achieve Sarbanes-Oxley compliance? 4.Identify the biggest roadblock for organizations that are attempting to achieve Sarbanes-Oxley compliance

25. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-25 Closing Case Two Spying on Employees Many organizations have taken the Big Brother approach to Web monitoring and track Internet usage and read employees’ e-mail to help prevent lost productivity Current research indicates that the effects of such employee monitoring are even worse than the lost productivity from employee Web surfing

26. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-26 Closing Case Two Questions 1.Explain the ethical issues involved in employee monitoring 2.Summarize the adverse effect employee monitoring can have on employees. Summarize the potential issues an organization can face if it does not monitor its employees. If you were the CEO of an organization, would you choose to monitor your employees? Why or why not?

27. McGraw-Hill/Irwin © 2006 The McGraw-Hill Companies, Inc. All rights reserved. 2-27 Closing Case Two Questions 3.Identify the relationship between information privacy and e-mail monitoring 4.Summarize the different monitoring technologies and rank them in order of least invasive to most invasive for employees