Read the opening and closing cases very carefully and answer the case discussion and ethical decision-making questions. Make sure to answer the questions thoughtfully and completely in paragraph format and with proper English (grammar and punctuation matters). Do not write out the questions or put your answers in a bulleted format. A header for the Discussion Question section and one for the Ethical Decision Making section would be appropriate. Thoroughly explain your answers. For example, tell WHY the categories you picked best describe what is going on in the situation, don't just list categories.

Opening Scenario

It was the middle of the night when Osbert Rimorr finished his programming assignment. Osbert was taking a university class that included a unit on how to write worm programs in order to defend against them. Now, he was about to set into motion events that would affect the lives of numerous people all over the planet (including the employees at HAL), even though he was working in a small computer lab at a relatively unknown campus. Osbert's assignment was to create a multivector, self-replicating module that could take a payload module across a network. Although there are legitimate uses for such a moduleto deploy patched versions of programs or perform unscheduled version upgrades for distributed applications, for examplemany IT professionals frown on this type of programming. It is far too easy to lose control, and the consequences could be devastating. Osbert was a conscientious student. He took great care to make sure the test payload was harmless. It was a little bigger than it needed to be, as he wanted to be able to trace it around the test lab easily. Actually, it was a lot bigger than it needed to be. It seems that Osbert really liked the fun parts he had written into his program and couldn't bring himself to streamline the test payload. He had also varied the timing parameters from those specified by his professor, making the program replicate itself much more quickly than the recipe called for. He did not want to wait around the lab all night to see the results of his test run. The small computer lab Osbert was using had quite an impressive network built by his professors specifically for this project. Several racks of server computers were running many virtual systems, representing a large number of computers of almost every possible type. Variations in capabilities were built in to test the virulence of efforts like Osbert's. To keep the project under control, the whole test network was isolated from the campus network. Osbert could reset each virtual system to its initial state with a simple command. A single status display showed all of the virtual systems in the lab, with a small colored dot to represent each system. Osbert noticed that all the dots were a steady green, which meant that each system was in its original, uncorrupted state. As he prepared to click the Start icon on his screen, Osbert carefully checked all the lab network's software settings one last time. Everything seemed to be in order, so he started the test. Almost too fast to see, the individual indicator dots on the master display turned red; each red light meant that a virtual computer had become compromised by Osbert's worm. "Amazing," Osbert said out loud. The display showed him that the entire lab had been compromised in under 600 milliseconds. No one in his class had even approached that level. Being able to get half of the widely varied systems to accept a worm was the best record so far. Getting 100 percent so quickly meant that the results of his effort were quite impressive. Feeling almost euphoric with his efforts, Osbert scooted his chair to the administrator's console and clicked the button to reset all the virtual machines to their initial state. The command had no effect. "No matter," Osbert thought. "I'll come back early tomorrow and restart all the servers." Unfortunately for him, another student had made a slight but unauthorized change to the test network a few hours before Osbert began his test. The student had forgotten to disconnect a network cable that was running from the test network to a wall plate that connected to the general campus network. Osbert did not know it yet, but he had just unleashed his potent new worm on the Internet.

Closing Scenario

Ninety seconds after Osbert started his lab-based exercise, the first attempt was made to compromise a computer on the HAL company network. Just as in the lab, Osbert's worm took over the HAL mail server and quickly infected every system in the company. As the worm copied itself over and over again, the servers at HAL quickly stopped doing their assigned tasks and spent all their resources copying the worm to every computer they could reach.

Discussion Questions

Who is responsible for this catastrophe? Osbert? His professor? The student who changed the network configuration? The university? On what do you base your position? Osbert had read, understood, and signed the white hat agreement his university required. He had followed all of the rules and never had an intent to do harm. Do you think his position in this matter is defensible if he were to face criminal charges? What if he is sued by the many organizations that might have been affected by his worm?

Ethical Decision Making

Was Osbert acting ethically when he wrote his worm program? On what do you base your position? Was Osbert's professor acting ethically by assigning him the worm program? On what do you base your position?