/find@mail

Articles, write-ups, and musings concerning the world of cybersecurity and technology.

Making the Hard Call: The PLUS Framework Applied to Two Security Dilemmas

Simulated Case Studies  · 1,633 words · 8 min read · by QiO:~$ ·

Making the Hard Call: The PLUS Framework Applied to Two Security Dilemmas

Disclosure: The two scenarios in this post (the security researcher and the CIO's request at "Acme Inc.") are hypothetical vehicles for the purpose of applying an ethical decision-making framework. They are not real incidents, and the people and company are fictional.

What do you do when the right answer isn't obvious, and the person pressuring you outranks you? A simple four-question filter, tested on two security dilemmas.

Why a Framework?

Ethical decision making is a part of everyday life. In fact, it is nearly impossible for a person to live a single day without having to consider the ethical implications of their actions. Simple decisions, like whether or not to follow through on a promise to a spouse, or meet a commitment to church, involve some level of ethical consideration, even if the answers come without much inner struggle. Likewise, ethical decisions are commonplace in professional life. Unfortunately, in many cases, making decisions in the workplace can cause ethical dilemmas, as the correct course of action is not always apparent...or easy to take. When such decisions arise, it is important to have a framework to understand the implications and make the most ethical decision possible.

As discussed above, ethical decisions in everyday life can certainly present challenges; however, generally speaking, people are free to make those decisions with a level of autonomy. In other words, they are only responsible to their family, themselves, and God for those decisions. This generally leads to little conflict, or at least less confusion, concerning the most ethical course of action. Conversely, decisions made in professional life often involve more stakeholders, thus complicating the decision-making process. Further still, professionals may unfortunately find themselves personally at odds with management or the policies of their employer. In such situations, how can professionals make the best ethical decisions?

The PLUS Model

Ethical decision-making frameworks offer a structured approach to evaluating ethical dilemmas. Professionals who find themselves in difficult situations can use such frameworks to understand, evaluate, and weigh the ethics of their decisions to gain insight and clarity before acting. One popular ethical decision-making model is known as the PLUS model. This model examines four key areas for professionals to examine ethical decisions:

  • Policy: How does the decision or proposed action align with the written and unwritten (corporate culture) policies of the company?
  • Legal: What are the legal implications of the decision or proposed action?
  • Universal: How does the decision or proposed action comport with universal principles such as fairness and honesty?
  • Self: How does the decision or proposed action align with personal values and beliefs?

When approaching a problem, decision, or proposed action, professionals should first clearly define the issue and understand it from all angles, considering the stakeholders and all relevant facts. Then, all alternative actions or approaches should be considered. Each action or approach can then be weighed against the PLUS elements to determine the ethical viability of said approach.

Now with a framework, we can use it to simulate an evaluation of two ethical dilemmas, both hypothetical, but drawn from situations security professionals really face.

Scenario 1: Disclose or Wait?

In our first hypothetical case, an independent security researcher has found a vulnerability allowing remote exploitation in an extremely popular software product that is used by Fortune 500 companies as well as government agencies. A week ago, the researcher contacted the organization's development team about the exploit and urged them to release a patch as soon as possible. The researcher received a cold and angry response after three days from the organization, denying the validity of the exploit and insisting that they do not intend to develop a patch. The security researcher is weighing the idea of publicly disclosing the exploit in order to force the developer to confront the situation. How does the public disclosure of the vulnerability measure up to the PLUS framework?

  • Policy: The researcher is independent, and his policy is to ensure critical vulnerabilities are addressed as soon as possible. Since the company is non-responsive, a public disclosure would almost certainly force action.
  • Legal: The researcher doesn't believe he violated any law or digital copyright, nor accessed any protected systems during discovery, and is therefore within his rights to disclose the vulnerability legally. The EFF's vulnerability reporting FAQ supports the core of this: publication of truthful information is protected by the First Amendment. But it also warns that researchers have received legal threats from vendors, and advises talking to a lawyer early if there's any chance an NDA or a DRM system is involved.
  • Universal: The researcher believes he should contact the organization again, giving them a hard deadline for a security patch before the vulnerability is publicly released. This matches how the industry tends to handle it. Google's Project Zero, for example, uses a 90-day disclosure deadline, and the EFF likewise suggests waiting "a reasonable and fair amount of time" for a patch.
  • Self: The researcher believes that the public is at great risk of data theft and exposure, and every day's delay is another day that threat actors are victimizing people by exploiting the vulnerability. He feels a tremendous weight of responsibility each passing day. Public exposure, forcing a fix, would align with his personal value as it benefits the public and protects them from harm. He views the safety of public and consumer data as more important than an enterprise's reputation.

Verdict: After evaluating the decision, the researcher chose to reach out to the organization once more, and give them a deadline to act in good faith to remediate the vulnerability before public disclosure.

Scenario 2: The CIO's Request

In our second hypothetical scenario, Acme Inc. has had the production of all of its internal emails and records compelled by subpoena in a financial fraud case. During this time, the CIO has met privately with a security engineer and asked that he secretly delete hundreds of emails sent by the company CEO to his mistress. The CIO claims these emails aren't relevant to the fraud investigation and would only serve to embarrass the CEO publicly when the affair is exposed. The CIO has put much pressure on the security engineer by making veiled threats of termination for non-compliance while also implying that loyalty would be rewarded. The security engineer is evaluating the option of secretly deleting the emails using the PLUS framework:

  • Policy: Most of the emails in question are still required to be stored per company policy. The engineer decides that deleting those emails would violate written policy.
  • Legal: The subpoena from the court specifically stated "ALL" emails within a date range are to be turned over. Deleting any emails within this date range would very likely constitute destruction of evidence, which is a crime. In a federal matter, for example, 18 U.S.C. § 1519 makes it a crime to knowingly destroy or conceal records with the intent to impede an investigation, punishable by up to 20 years in prison.
  • Universal: The engineer considers that it is undesirable to unnecessarily expose his boss's affair, and it is probably unfair in some ways if the emails bear no relevance to the fraud case. However, he also realizes that it is a judge and jury who decide legal relevance in a just society. He feels the universally moral choice is to comply with court orders and let the legal process play out.
  • Self: The engineer feels that the right thing to do is to comply with a court order. He would be embarrassed and ashamed for his family and community to know he tried to hide things from the court.

Verdict: After evaluating the decision, the engineer decides that deleting the emails is not the ethical choice. He retains a lawyer to protect himself from retribution.

Where Frameworks Run Out

From these examples, it becomes clear that the evaluation of decisions, from an ethical standpoint, can be done with a structured approach. However, it must be said that the framework only provides guided filters through which each question can be evaluated. The interpretation of said evaluation is up to each individual at the end of the day. For example, a professional may evaluate a decision that goes against company policy, yet is aligned with universal and personal values, as the correct action. Conversely, an individual may consider taking an action that goes against universal and personal values, yet is legal and aligned with company policy. In both cases, another individual may evaluate each of them the opposite way. No framework is intended to replace thoughtful and prayerful analysis of one's actions. Ultimately, whether using a framework for analysis or not, professionals should weigh the consequences of their actions accordingly and make the most ethical decision possible.

The Takeaway

Look at how the two scenarios actually resolved. The engineer's case was easy to read: all four filters pointed the same way, which is why the verdict came quickly. The researcher's case is the more interesting one. Self said "disclose now," while Universal said "give them a deadline." The framework didn't hand him an answer; it showed him where his own impulse and the profession's norms disagreed, and he chose the path that satisfied both. That's what a framework is for. When all four filters line up, you were probably going to make the right call anyway. When they conflict, that's where the thinking happens.

Sources

Read next

Insider Espionage and Encryption: A Simulated Case Study of ABC Corp