A-Level Computer Science / Unit 7: Responsible and Legal Computing

7.1.1 Ethical Responsibilities in Computing

🔒 Lesson slides are available to signed-in users. Sign in

7.1.1 Ethical Responsibilities in Computing

Computing professionals make decisions that can affect privacy, safety, access to services, money, employment and public trust. Technical skill is therefore not enough on its own. Professionals must also consider whether their decisions are responsible, fair and in the wider public interest.

By the end of this section, you should be able to:

  • Explain why professional ethics is needed in computing.
  • Describe how the BCS and IEEE support ethical professional practice.
  • Explain the value of joining a recognised professional body.
  • Apply professional responsibilities to a computing scenario.
  • Analyse how ethical and unethical actions affect different stakeholders.
  • Justify a professional response using evidence from the situation.

What Is Professional Ethics?

Professional ethics concerns the standards used to guide decisions and behaviour in a profession. In computing, these standards help a person decide what they ought to do when technical, commercial and human interests do not all point in the same direction.

Professional ethics: principles and expected standards of behaviour used to guide responsible decisions within a profession.

Ethical questions often arise because a system affects people who were not involved in building it. A programmer may be asked to hide a weakness, a data analyst may notice an unfair pattern, or a network engineer may discover that confidential information is visible to too many users.

Source of guidance Main question Why it is not enough by itself
Law What is legally required or prohibited? The law may not cover a new technology or every harmful use.
Organisation policy What rules has the employer set? An internal rule may protect the organisation without fully protecting users.
Professional ethics What action is responsible and professionally defensible? Principles still have to be interpreted using judgement.
Common mistake: “It is legal, so it is ethical” is not a reliable conclusion. A legal action may still be dishonest, unfair, unsafe or harmful to public trust.

Professional Bodies and Codes of Conduct

A professional body brings together people working in a particular field. It can publish a code of conduct, provide continuing professional development, offer guidance and encourage members to maintain recognised standards.

Code of conduct: a published set of principles describing the behaviour and standards expected from members of a profession.
Professional body Full name How membership can support ethical practice
BCS British Computer Society Provides professional standards, ethical guidance, recognised development routes and a community from which members can seek informed advice.
IEEE Institute of Electrical and Electronics Engineers Supports global technical communities, publishes professional guidance and helps members keep their knowledge current as technologies and risks change.

Why joining matters

Membership gives a professional more than a badge or job-title advantage. It creates a clear set of expectations, access to training and a route for discussing difficult cases with people outside the immediate project team. It can also strengthen accountability because a member represents both their employer and their profession.

Exam tip: When explaining the importance of a professional body, include a practical effect such as access to a code, current training, expert advice or accountability. Do not stop at “it tells people how to behave”.

Responsibilities of a Computing Professional

Codes published by different organisations do not use identical wording, but they commonly expect professionals to balance several responsibilities. These responsibilities can conflict, so they should be treated as principles for reasoning rather than as an automatic checklist.

Responsibility What it means in practice Example of poor practice
Protect people and the public interest Consider safety, privacy, security, accessibility and wider social effects. Ignoring a fault because only a small group of users is affected.
Work competently Use suitable knowledge, test carefully and ask for specialist help when needed. Accepting a safety-critical task without the required expertise.
Act with integrity Communicate evidence honestly and do not conceal known risks or conflicts. Changing a test report to make a product appear ready.
Respect privacy and confidentiality Limit access to personal or commercially sensitive information. Using client data for an unrelated demonstration without permission.
Serve clients and employers responsibly Support legitimate goals while refusing actions that conflict with professional duties. Following an instruction that exposes users to an avoidable serious risk.
Support colleagues and the profession Treat colleagues fairly, share concerns appropriately and maintain professional standards. Blaming a junior developer for a management decision they could not control.
Maintain professional knowledge Update skills as systems, regulations and threats change. Using an obsolete security method without checking current guidance.

Stakeholders and the Public Interest

A stakeholder is a person or group affected by a decision. Ethical analysis becomes stronger when the professional identifies these groups explicitly instead of discussing “people” in general terms.

Public interest: the wider safety, welfare, rights and trust of people affected by computing, including those who are not the direct client or employer.

The public interest is relevant to commercial products as well as public-sector systems. For example, a privately developed payment platform can affect customers, small businesses, banks and people whose identities are used fraudulently.

Stakeholder Possible interest Possible harm
Users Reliable, secure and accessible service Loss of privacy, money, access or safety
Client or employer Working product, lawful operation and good reputation Financial loss, complaints or damaged trust
Development team Realistic work, clear responsibility and fair treatment Pressure to hide faults or accept unsafe practice
Wider public Safe services, trustworthy technology and responsible use of resources Systemic risk, exclusion, misinformation or wasted public funds
The profession Confidence that computing specialists act responsibly Loss of trust in professional expertise
Common mistake: Public interest does not mean that the public must always agree. It means that wider effects must be considered and justified, even when different groups have competing interests.

A Structured Ethical Decision Process

A code of conduct does not produce an answer automatically. The following process helps a professional turn broad principles into a reasoned decision.

Step Question to ask Useful evidence
1. Establish the facts What is known, uncertain or being assumed? Logs, test results, specifications, messages and user reports
2. Identify stakeholders Who may benefit, lose, be exposed to risk or be unable to object? User groups, client, colleagues, public and regulators
3. Identify responsibilities Which professional duties are relevant? Safety, competence, integrity, privacy and public interest
4. Compare options What could happen under each possible action? Severity, likelihood, reversibility and who carries the risk
5. Decide and justify Which action is most professionally defensible? A clear link between evidence, stakeholder and principle
6. Record, escalate and review Who should be informed, and should the decision be reviewed later? Written concerns, escalation routes and follow-up checks
Exam tip: A strong scenario answer usually follows this chain: evidence → stakeholder → risk → professional responsibility → justified action.

Interactive Tools for Ethical Reasoning

The three tools below approach the same skill from different angles: examining a decision through several viewpoints, applying professional responsibilities, and estimating the wider public impact.

1. Ethical Viewpoint Lens

Choose a scenario and compare how different forms of reasoning may change the questions a professional asks.

Scenario

Hidden access weakness

An audit finds that staff in one branch can view confidential records belonging to another branch. A manager asks for the finding to be left out of the client report until after a contract renewal.

Rights and fairness lens

Is it fair to keep affected people unaware of a known privacy risk?

This lens asks whether the organisation is respecting the people whose records are exposed and whether commercial advantage is being placed above their ability to protect themselves.

Student task: Write one action the auditor should take and justify it using this lens.

2. Professional Responsibility Lens

Select a project situation, then inspect it through responsibilities such as public interest, competence, product quality and professional judgement.

Choose a scenario

Access flaw omitted from a report

A security auditor is told not to include a serious access-control weakness in a report sent to a client.

Selected lens: Public interest

Who could be harmed if the weakness remains hidden?

People whose data is exposed may be unable to protect themselves because they do not know that the risk exists.

Possible professional response:

Preserve the evidence, explain the severity clearly and use the organisation’s escalation route if the report is altered.

3. Public-Interest Impact Explorer

Choose a scenario and adjust the ratings. The final level is a prompt for discussion rather than a replacement for a written justification.

Scenario

Alert-system fault

A flood-warning dashboard sometimes marks an alert as sent even when a mobile-network failure prevents delivery.

5
1
4
5

Public-interest concern level: Very high

The fault may leave communities without a warning while operators believe the message was delivered. The evidence should be reported and the system should not be relied on until the failure is controlled.

Worked Scenario: A Confidentiality Finding Is Hidden

A developer is helping to review a community clinic’s booking system. The review shows that staff can open appointment notes from clinics where they do not work. The project lead says that fixing the access rules will delay a planned upgrade and asks the developer to describe the issue as “minor” in the report.

Step 1: Establish the facts

The important evidence is not simply that the interface behaves unexpectedly. The developer should record which accounts can access which records, how often the problem occurs and whether sensitive information is exposed.

Step 2: Identify stakeholders and responsibilities

Stakeholder Possible effect Relevant responsibility
Patients Private information may be viewed without a work-related reason. Privacy, confidentiality and public interest
Clinic staff They may accidentally access information they should not see. Clear system design and professional competence
Clinic management A delayed upgrade is inconvenient, but hiding the problem increases later risk. Honest advice to the client
Developer and project team Their report and reputation may be damaged if the finding is misrepresented. Integrity, accountability and duty to the profession

Step 3: Compare possible actions

Action Likely consequence Ethical judgement
Accept the wording “minor” without challenge The client may make a decision without understanding the real risk. Weak: it conflicts with honesty and confidentiality duties.
Describe the evidence accurately and propose a temporary access restriction The risk is visible and an interim control can reduce exposure while a full fix is developed. Strong: it balances accuracy, practicality and user protection.
Post the finding publicly immediately This may warn people, but it could also expose details that make misuse easier. Usually premature unless internal and formal routes have failed and serious harm is imminent.
Model conclusion: The developer should document the access evidence accurately, explain the privacy risk to the project lead and recommend an immediate restriction while the full fix is prepared. If the report is deliberately changed, the concern should be escalated through an authorised route because concealing the weakness conflicts with integrity and the public interest.

Impact of Ethical and Unethical Action

The syllabus expects more than identifying whether an action is ethical. You should be able to explain its consequences for a particular situation.

Area Possible impact of ethical action Possible impact of unethical action
Users Risks are reduced and users receive clearer information. Users may suffer privacy loss, unsafe outcomes or unfair treatment.
Organisation Better decisions, stronger trust and fewer hidden liabilities. Complaints, financial loss, legal action or reputational damage.
Professional Evidence of integrity, competence and accountable judgement. Disciplinary action, loss of trust or damage to career prospects.
Colleagues A culture in which concerns can be raised and corrected early. Pressure to repeat poor practice or accept blame for concealed decisions.
Wider public More dependable systems and greater confidence in computing. Reduced trust, wider harm and reluctance to use beneficial technology.
Important: Acting ethically does not guarantee that a manager will agree or that the problem will be solved immediately. The professional should still use evidence, follow appropriate procedures and make a defensible judgement.

Common Mistakes and Misconceptions

  • Defining ethics only as “knowing right from wrong” without linking it to professional behaviour.
  • Listing BCS and IEEE without explaining why membership or guidance is useful.
  • Assuming that an employer’s instruction automatically overrides responsibility to users or the public.
  • Giving a judgement without identifying evidence, stakeholders or consequences.
  • Writing “report it” without stating what should be reported, to whom and why.
  • Assuming that public interest applies only to government systems.
  • Treating a code of conduct as a fixed algorithm that removes the need for judgement.

Practice

Knowledge and understanding

  1. Explain what professional ethics means in computing.
  2. State the full names of BCS and IEEE.
  3. Explain two ways that joining a professional body can support ethical practice.
  4. Explain why a code of conduct does not remove the need for professional judgement.

Application

  1. A developer is asked to use real customer records in a sales demonstration because creating realistic test data would take longer. Explain two ethical concerns.
  2. A company knows that its delivery-tracking app continues recording drivers’ locations after their shifts. Suggest and justify one professional response.
  3. An engineer is asked to approve encryption software that they have not tested and do not fully understand. Explain which professional responsibility is most directly involved and why.

Extended reasoning

  1. A local authority uses a digital form that cannot be completed with a screen reader. Analyse the effects on at least three stakeholders and recommend an ethical response.
  2. A project manager wants to delay informing customers about a serious account-access problem until after a new product launch. Evaluate the decision from the perspectives of the client, users, the development team and the wider public.
Answer planner: Start with the exact decision. Name an affected stakeholder, explain a realistic consequence, connect it to a professional responsibility and finish with a justified action.

Review

Question A strong answer should include
Why is professional ethics needed? Computing decisions affect people, and law or employer policy may not resolve every conflict.
Why join a professional body? Ethical guidance, current professional learning, expert support and accountability.
What do BCS and IEEE contribute? Recognised professional communities, codes or guidance and support for maintaining standards.
What is public interest? Consideration of wider safety, rights, welfare and trust beyond the immediate employer or client.
How should a scenario be analysed? Facts, stakeholders, risks, responsibilities, options, justified action and appropriate escalation.
How should impact be explained? A specific consequence for a named stakeholder rather than a vague claim that something is “bad”.
Final exam tip: Ethical answers gain precision when every judgement is attached to a concrete consequence. Replace “this is wrong” with “this exposes patients’ confidential data, so it conflicts with privacy and public-interest responsibilities”.