Hi all,

I've got a case study from my IT subject about ethical dillema and would like to get opinions from IT/business proffesionals point of view.
The case is about:

An undergradute student named Alice is doing her university industrial training program in a company named Wee-Kan, which has a policy of not allowing employees to disclose any company confidential information to outsiders.

Wee-Kan is facing financial difficulties. Meanwhile, another company, Global Corp, is interested in acquiring Wee-Kan. The Wee-Kan CEO explained to staff that the merger will help to increase the market share and stabilize company growth. As it's commercial-in-confidence, all personnel working at Wee-Kan are not allowed to disclose any information to outsiders.

As a result of potential change of management, staffs are no longer interested in their work, so Alice's training is badly affected. She's asked by her academic supervisor to write a quarterly report on Wee-Kan's growth and development strategy.

Given the fact that she hasn't received enough on the job training and is not allowed to discuss any confidential information, she decides to prepare a report detailing recent events using company's computer. Unfortunately, her work is scanned and updated in the IT log file by the IT admin. The admin immediately notifies Alice's supervisor, Brooke, of her progress report. Brooke reads the report and comments that she hasn't taken enough responsibility to understand the ethical and legal issues with the organisation current situation.

Brooke doesn't approve of what she has submitted in the report and asks her to remove some of the company data in the report. She is left with no choice but to submit her shortened progress report to her academic supervisor. She doesn't pass as due to the lack of progress in her work.

My questions are:
1. If Alice could have done something before her report is submitted to her academic supervisor, what do you think she should do?
(given the fact that she shouldn't breach the company's policy but at the same time, she certainly doesn't want to fail)

2. Is Brooke's action legal and/or ethical?

3. Is the IT admin's action of exposing someone's work (Alice's report) legal in this case?


cheers,
pw3

Definitely a complicated question...

But not one without a solution. Of course there are a lot of unknowns in this situation, but I still think it could be handled properly as long as communication is maintained...

The first thing I would have done, as soon as I noticed that training was impacted, would have been to inform my academic supervisor. Without breaching confidentiality, I would have told him/her something along these lines:

"The company CEO has provided the company with some information that is very confidential, and which I believe has seriously affected morale and the quality of training I am receiving. Additionally, because this information is covered under a confidentiality clause, it is limiting my ability to provide materials you have requested. What can we do to insure this situation does not negatively affect the perception of my performance?"

If you gave him/her enough time, I do believe most any decent academic advisor or supervisor would understand this kind of restriction, (especially in today's business environment), and would hopefully even applaud you for maintaining confidentialy in a cathc-22 situation (since nothing specific is stated).

These can be very difficult to come to an answer on, much less the right one. But it is nice to know that these issues are being brought up in school, because they do become quite common.

As an IT person, you frequently come across morality issues when it comes to use of personal information, eavesdropping, licensing and legal compliance. FIndging the middle-ground can be a tough thing to accomplish.

What do you do when your boss tells you to install 5 copies of software you only have one license for? Or when you are told to ignore a potential security hole, or worse a legal requirement, because the cost is too much for the potential risk? And oh yeah.... keeping your mouth shut about how much you are told to spy on fellow employees can also grind your morality wheel. Very rarely are any of these answers cut-and-dry.

Hope you found that 'shpiel' useful.

Elohir

teeheehee @ uts itps student :cheesy:

Hi everyone,

What alice should have done is to get a letter from her supervisor or human resource that she had already received adequate training but she is unable to disclose information about it due to company policy.

If she submits that letter to the university, the university would accept it.

It is a legal one as if the company is publically listed what she writes in her paper about mergers and their financial situation maybe considered priveleged information and if the company wants to take it a step further report her for leaking commercial secrets should their shares fall on the release of her report thus making her the scapegoat

It depends as if she was using the computer on the company's premises then they can pretty much do what they like.

If she had logged on to the company's network from say her home computer and the admin staff took the file from her computer then the admin staff would have broken the law and if they want to take action against her the file would be inadmissable(in the U.S) thus she would walk but her reputation would probably be tarnished.

This kind of situations are common. You see like myself i am currently building clones of commercial softwares but the people i work for made me sign a confidentiality agreement not to release the name of the company or the people and organisations i work for.

Hmm maybe i should have been a lawyer

Richard West
*****************************************************