Ethics, Professionalism & Applied Fixes

Session Timeline

Learning Objectives

• Understand professional responsibilities as software developers
• Learn BCS Code of Conduct principles
• Understand GDPR and data protection requirements
• Apply WCAG accessibility standards
• Implement basic cybersecurity practices
• Identify ethical issues in team projects
• Implement concrete ethical improvements
• Balance business needs with ethical considerations

BCS Code of Conduct

Four Key Principles:

1. Public Interest: Prioritize public good over personal/organizational interests
2. Professional Competence: Only undertake work you're qualified for
3. Duty to Profession: Uphold reputation of IT profession
4. Duty to Employer/Client: Act with integrity and avoid conflicts of interest

BCS Public Interest Obligations

You must:

• Consider impact of your work on society and environment
• Respect privacy and confidentiality
• Consider individuals with disabilities and disadvantaged groups
• Reject bribery or unethical practices
• Report professional misconduct

GDPR: General Data Protection Regulation

Core Principles:

• Lawfulness: Have legal basis for processing data
• Purpose Limitation: Only use data for stated purpose
• Data Minimization: Collect only what you need
• Accuracy: Keep data accurate and up-to-date
• Storage Limitation: Don't keep data longer than necessary
• Security: Protect data from unauthorized access
• Accountability: Demonstrate compliance

User Rights Under GDPR

Users have the right to:

1. Be Informed: Know what data you collect and why (privacy policy)
2. Access: Request copy of their data
3. Rectification: Correct inaccurate data
4. Erasure: "Right to be forgotten" - delete their data
5. Data Portability: Receive data in machine-readable format
6. Object: Opt out of certain data processing

Data Security Basics

Essential Security Practices:

• Password Hashing: NEVER store passwords in plain text
  Use: bcrypt, Argon2, PBKDF2
• HTTPS: Encrypt data in transit (SSL/TLS certificates)
• Input Validation: Prevent SQL injection, XSS attacks
• Authentication: Verify user identity (JWT, sessions)
• Authorization: Control what users can access
• Environment Variables: Never commit secrets to Git

// Password hashing example (bcrypt)
const bcrypt = require('bcrypt');

// Hash password before storing
const hashedPassword = await bcrypt.hash(plainPassword, 10);

// Verify password on login
const isValid = await bcrypt.compare(plainPassword, hashedPassword);

Web Accessibility: WCAG Standards

Four Principles (POUR):

• Perceivable: Users must be able to perceive information
  Example: Alt text for images, captions for videos
• Operable: Users must be able to operate UI
  Example: Keyboard navigation, sufficient time to complete tasks
• Understandable: Information and operation must be clear
  Example: Clear instructions, consistent navigation
• Robust: Content works with assistive technologies
  Example: Semantic HTML, ARIA labels

Implementing Accessibility

Click



Submit


Submit


Submit

Color Contrast & Visual Design

WCAG 2.1 Requirements:

• Level AA: 4.5:1 for normal text, 3:1 for large text
• Level AAA: 7:1 for normal text, 4.5:1 for large text

Tool: Use WebAIM Contrast Checker to test your colors

Ethical Considerations for AI/ML Projects

Key Concerns:

• Fairness: Ensure fair treatment across demographics
  Example: Credit scoring shouldn't discriminate by protected characteristics
• Transparency: Users should understand how decisions are made
  Example: Explain why loan application was rejected
• Privacy: Training data may contain sensitive information
  Example: Anonymize data, don't memorize personal details

Environmental Impact of Software

Considerations:

• Efficient Code: Optimize algorithms to reduce compute time
• Data Storage: Don't hoard unnecessary data
• Image/Video: Compress media files appropriately
• Cloud Providers: Choose providers using renewable energy
• Unnecessary Features: Every feature has environmental cost

Project Ethical Checklist

Ask Your Team:

• ✓ Do we collect only necessary data?
• ✓ Is personal data secured (hashed passwords, encrypted connections)?
• ✓ Can users delete their data?
• ✓ Do we have a privacy policy (even simple one)?
• ✓ Is our UI accessible (alt text, keyboard navigation, contrast)?
• ✓ Do we validate all user inputs (prevent injection attacks)?
• ✓ Are errors handled gracefully (don't leak system info)?
• ✓ If using ML, have we checked for bias in training data?
• ✓ Do we have proper authorization (users can't access others' data)?
• ✓ Are we transparent about how the system works?

Part B: Implementing Ethical Improvements

Today's Goal:

• Fix at least 2-3 ethical issues from your audit
• Focus on high-priority items (security, privacy, accessibility)
• Document what you changed and why
• Test improvements work correctly

Implementation: Secure Password Hashing

// BAD: Plain text password ❌
const user = {
  email: 'Tom@example.com',
  password: 'password123'  // NEVER DO THIS!
};

// GOOD: Hashed with bcrypt ✓
const bcrypt = require('bcrypt');

async function createUser(email, password) {
  const hashedPassword = await bcrypt.hash(password, 10);
  const user = {
    email,
    password: hashedPassword  // Stored as hash
  };
  return db.insert('users', user);
}

async function verifyPassword(plainPassword, hashedPassword) {
  return await bcrypt.compare(plainPassword, hashedPassword);
}

Implementation: SQL Injection Prevention

// BAD: SQL Injection vulnerable ❌
app.get('/user', (req, res) => {
  const userId = req.query.id;
  const query = `SELECT * FROM users WHERE id = ${userId}`;
  // Attacker could send: id=1 OR 1=1 (returns all users!)
  db.query(query, (err, result) => res.json(result));
});

// GOOD: Parameterized query ✓
app.get('/user', (req, res) => {
  const userId = req.query.id;
  const query = 'SELECT * FROM users WHERE id = $1';
  db.query(query, [userId], (err, result) => {
    if (err) return res.status(500).json({ error: 'Server error' });
    res.json(result);
  });
});

Implementation: User Data Deletion

// Backend: Delete user endpoint
app.delete('/api/user/:id', authenticateUser, async (req, res) => {
  const userId = req.params.id;
  
  // Verify user can only delete their own account
  if (req.user.id !== userId) {
    return res.status(403).json({ error: 'Unauthorized' });
  }
  
  try {
    // Delete user and all associated data
    await db.query('DELETE FROM orders WHERE user_id = $1', [userId]);
    await db.query('DELETE FROM user_data WHERE user_id = $1', [userId]);
    await db.query('DELETE FROM users WHERE id = $1', [userId]);
    
    res.json({ message: 'Account deleted successfully' });
  } catch (err) {
    res.status(500).json({ error: 'Deletion failed' });
  }
});

Implementation: Accessibility Fixes

Submit






  Submit


Email Address:

We'll never share your email

Implementation: Authorization Checks

// BAD: No authorization check ❌
app.get('/api/order/:orderId', async (req, res) => {
  const order = await db.query(
    'SELECT * FROM orders WHERE id = $1', 
    [req.params.orderId]
  );
  res.json(order);  // Any user can view any order!
});

// GOOD: Verify ownership ✓
app.get('/api/order/:orderId', authenticateUser, async (req, res) => {
  const order = await db.query(
    'SELECT * FROM orders WHERE id = $1 AND user_id = $2',
    [req.params.orderId, req.user.id]
  );
  
  if (!order) {
    return res.status(404).json({ error: 'Order not found' });
  }
  
  res.json(order);
});

Implementation: Environment Variables

// BAD: Hardcoded secrets ❌
const db = new Database({
  host: 'localhost',
  password: 'mySecretPassword123'  // Committed to Git!
});

const apiKey = 'sk_live_abc123xyz';  // Exposed in code!

// GOOD: Environment variables ✓
// .env file (NOT committed to Git)
DB_HOST=localhost
DB_PASSWORD=mySecretPassword123
API_KEY=sk_live_abc123xyz

// .gitignore (ensure .env is ignored)
.env
.env.local

// Application code
require('dotenv').config();

const db = new Database({
  host: process.env.DB_HOST,
  password: process.env.DB_PASSWORD
});

const apiKey = process.env.API_KEY;

Creating a Simple Privacy Policy

Tip: Create docs/privacy-policy.md and link from your app footer

Testing Your Ethical Improvements

Verification Checklist:

• Security:
  • Try SQL injection attacks (in safe test environment)
  • Verify passwords are hashed in database
  • Test authorization (can User A access User B's data?)
• Accessibility:
  • Navigate site using only keyboard (Tab, Enter)
  • Use screen reader (NVDA, VoiceOver)
  • Check color contrast with WebAIM tool
• GDPR:
  • Create account, delete it, verify data removed from DB
  • Check privacy policy is accessible

Before Next Lecture

1. Complete Ethical Fixes:
   • Finish any incomplete improvements
   • Create pull requests for review
   • Merge approved changes
2. Documentation:
   • Create/update privacy policy if handling user data
   • Document security measures in README
3. Submit to Moodle:
   • Ethical audit document (docs/ethical-audit.md)
   • Summary of fixes implemented
   • Screenshots showing improvements
4. Continue Sprint 2:
   • Resume work on Sprint 2 stories
   • Prepare for integrations work next week