CSC 379: Ethics in Computing  
  Summer II 2006  
  This course is a survey of the ethical issues involved in computing. It discusses the way that computers and software pose new ethical questions or pose new versions of standard moral problems and dilemmas. It stresses case studies that relate to ethical theory.  
  Edward F. Gehringer
Office: 2301 Partners I
(919) 515-2066
Office hours:
MW 2:45-3:45
  Ahmed Bakir
Lecture 15: Whistleblowing

The Challenger disaster. On January 28, 1986, the Space Shuttle Challenger exploded 72 seconds into its flight, killing all 7 crew members. The flight had received unusual publicity due to the presence on board of a teacher, Christa McAuliffe, who had been chosen following a nationwide competition. The explosion was caused by failure of the O-ring seals between segments of the booster rockets. A subsequent investigation revealed that several employees of the manufacturer, Thiokol, had been aware of O-ring deficiencies.

Dissent within Thiokol. The safety of the booster rockets' performance at low temperatures had been questioned by Roger Boisjoly, a seal specialist at Thiokol, and Allan McDonald, the manager of the solid-rocket motor program. Boisjoly had directed a task force for a year to cope with evidence that hot gases were eroding the rubber O rings. On July 31, 1985, he wrote a memorandum saying, "it is my honest and very real fear that if we do not take immediate action to solve the problem," the company could "stand in jeopardy of losing a flight." The worst O-ring erosion had occurred in a flight the year before when the temperature was 53°. Boisjoly thought there was a link between the temperature and erosion. But neither he nor McDonald could measure it. The absence of conclusive evidence undercut their warnings.

By early in the afternoon of January 27, after a launching was scrubbed, McDonald was getting worried about temperatures dropping to 22° overnight. An anonymous senior engineer told reporters that fourteen Thiokol engineers "fought like hell" to get permission for a presentation to NASA. In the evening, mid-level NASA officials and Thiokol engineers reviewed the evidence. All fourteen Thiokol engineers recommended postponing the launch the following morning. NASA officials Larry Mulloy and George Hardy challenged the recommendation. Mulloy, manager of booster programs, questioned the engineers' technical judgment. "My god, Thiokol, when do you want me to launch, next April?" he exclaimed. Hardy said the engineers' recommendation "appalled" him. Thiokol's management reversed the recommendation for postponement.

Immediate aftermath. After the explosion, McDonald went public with his account of the hours that led up to the disaster. He was demoted by management. But public outcry and a Congressional investigation led to a reversal of that decision, and a promotion instead. He emerged as the spokesman for Thiokol and its newly redesigned rocket boosters. He focused his energy on getting the shuttle flying again, not allowing himself to dwell on the past. On the other hand, a few weeks after the explosion, Boisjoly wrote, "I hope and pray that I have not risked my job and family security by being honest in my conviction." He told friends he could never work on the shuttle again because it was all too painful. He wondered out loud if there was anything else he could have done to stop the launch, although the investigation showed his warnings minced no words.

Later repercussions. Partway through his testimony before Congressional committees, Thiokol reassigned Boisjoly. Following intense criticism, he was reinstated, but his responsibilities were altered. NASA's inspector general investigated the situation and concluded that his testimony did not lead to his reassignment. Boisjoly then took a leave of absence. About a year later, he went on long-term disability and his paychecks stopped. Boisjoly sued Thiokol for $1 billion, and sought to recover $2 billion for the taxpayers in another suit.

The $2-billion suit was filed under the False Claims Act, saying that Thiokol falsely certified safety, that they knew that the rockets they supplied to NASA were defective. (The False Claims Act is a Civil-War era law, stemming from President Lincoln's efforts to stop Civil War profiteers.) However, the suits were dismissed in 1988. The judge ruled that decision to launch was not a false claim, but just an engineering judgment with which other engineers disagreed. NASA, the judge concluded, also, knew the facts behind the allegations, and thus could not have been deceived. Boisjoly's personal suit was dismissed because Thiokol's actions were ruled not to have been designed to cause him distress.

Situations calling for whistleblowing. There are many situations that can call for whistleblowing. Take, for example, software piracy. Suppose you find out that others are taking proprietary software off of bulletin boards? Or that a co-worker has inserted a back door or booby-trap in software that your project is writing? For example, (s)he might have put in a booby trap to assure that he'll get paid for the project. The Digital Equipment Corporation once put a booby trap in a beta-test version of a wordprocessor. On April 1 a year later, it was to crash and erase the current file. By then, all users were supposed to have bought the real version.

Is it OK to do that? What problems can it cause? Suppose the ultimate user paid for the program from a retailer, who had sold his own beta-test copy? The programmer who created the booby trap could be held liable. The same is true of a "back door," for example, to evade encryption. What is the right thing to do? Warn of the existence of the trap? Defuse it? If you warn someone, whom should you warn?

About fifteen years ago at NCSU, a student working in a lab was given the job of backing up disks. While doing that, he stumbled on evidence that the professor directing lab was diverting research funds to prop up his business, which was in financial difficulty. He asked someone "about the level of a dean" if he was interested. The dean said he certainly was. The professor was fired, and, fearing retaliation, the student became afraid to take courses from anyone who was associated with the lab.

Suppose your supervisor promises that your team will complete a task by a date that you consider unrealistic. Should you warn customers? Or, sales personnel may promise performance levels for your product that you consider unrealistic. But, isn't advertising hype pretty common? Back in the early 1980s, a computer writer by the name of Ross quit a project to write book about the Coleco Adam. The public-relations department said capacity of a diskette drive was 500K. But that was unformatted; the formatted capacity was only 250K. He thought the public-relations department had deliberately misrepresented it, so he quit.

Where is the line crossed? Is unreasonable optimism unethical? Well, advertising obviously can't go into full detail about a product's capabilities. But the full specs should at least be available to potential clients. Ross suggests quitting your job if your company intentionally misleads customers. Protesting to your boss probably wouldn't do much good; your boss knows about it anyway. Besides, with that kind of ethics, your employer might not be around for long.

Consider the case of Bret McDanel. While working for Tornado Development, Inc., on Web-based e-mail and voicemail systems, he noticed that their software displayed a user's login credentials as part of the URL shown in the address bar of the Web browser. Not only did that mean it could be observed by passersby, but it also meant that the next Website the user visited could capture his or her login credentials in its log of the "referring" URL. Thus, anyone who was authorized to read the second Web site's logs could use that login and password to access the user's account.

McDanel unsuccessfully protested to his boss. Then he took Ross's advice and quit his job. However, he retained an account on Tornado's system and used it to send a single anonymous e-mail message to 5600 of its customers, describing the flaw and directing them to a Web site he had set up to provide more information. Tornado then fixed the problem. However, they also went to federal prosecutors, who charged McDanel with violating the Computer Fraud and Abuse Act--the same act used to prosecute Robert Morris and other virus- and worm-writers. The prosecutors reasoned that McDanel had caused damage to Tornado's computer system by overloading its e-mail server and spamming its users. He was convicted and served 16 months in jail. The case came to the attention of faculty at Stanford University's Center for the Internet and Society. The executive director appealed on McDanel's behalf, and the government asked the appeals court to reverse the decision. In a highly unusual development, the federal prosecutors agreed, and asked the appeals court to set aside the conviction, which it subsequently did.

Risks of whistleblowing. As the McDanel case illustrates, whistleblowing rarely works out well for the whistleblower. Joseph D. Whitson, a supervisory chemist at Brooks Air Force Base in Texas, says he was told to falsify drug tests. Some commanders would call him, he says, and give him names of people they "knew" were doing drugs. He was told to make the tests come up positive. At a 1984 drug trial, he was called to testify. On the day of the trial, just 1 month after he had received a nearly perfect performance rating, he was removed from his office and relegated to a dreary basement lab used for animal radiation testing. By January 1985, his job was abolished. Two years later, he was working as a mid-level government statistician. His wife was working part-time to help pay off his legal expenses.

Remember the Resolution Trust Corporation, from the aftermath of the savings & loan debacle? One of their lawyers, Bruce Pederson, had his computer disks searched, after charging that the RTC was going easy on some S&L executives. He claimed that the cover-up was due to political pressure, perhaps from the (first) Bush administration. His superiors claimed that he was upset about not remaining a manager when the RTC started closing field offices, after successfully liquidating or merging failed thrifts. An e-mail message from his superior, Barbara Shangraw, said, "I have been requested by D. C. to get into Bruce Pederson's WordPerfect. Please copy into a directory for me what Bruce has in his Word Perfect." Pederson said Shangraw then warned him not to use his computer for personal work. She said she had found personal letters to friends, material about a townhouse, and a Freedom of Information Act complaint. Pederson said that Freedom of Information Act material was related to a grievance he had pending against the RTC.

A survey of whistleblowers was taken by Donald R. Soeken, a whistleblower himself. Out of 233 individuals polled, about 40% responded. Their average age was 47. They had been employed at their jobs for an average of 6.5 years before blowing the whistle. Almost all of those in private industry lost their jobs. Fifty-one percent of government employees lost their jobs. Eighty-two percent said they'd been harassed by superiors, and 69% said they were watched closely. Sixty-three percent reported losing some job responsibilities, and 60% said they were fired after launching their complaints. Almost 10% had attempted suicide. Only 20% felt that their actions resulted in positive changes in their workplace. But more than half of them said they would do it again.

Legal protections. Workers in private industry are covered by more than 12 statutes designed to help them expose health and safety violations. The broadest is the Occupational Safety and Health Act, under which 2900 complaints were handled in 1986. Federal employees are covered under Civil Service Reform Act of 1978. Many states have provided direct support to whistleblowers. These states have recognized a "public policy exception" to the traditional doctrine that employers can fire workers without cause. In these states, a worker can't be discharged for engaging in an activity that public policy encourages, or for not engaging in an activity that public policy discourages.

At least 30 states have adopted "whistleblower protection" statutes. About half of these apply both to public and private-sector employers. But, these laws are rarely used. Not very many employees are aware of them. If they do reveal potential abuses, they are unlikely to learn about the laws before the statute of limitations expires--often within the first month after their dismissal or other reprisal.

But there are risks of making whistleblowing easier. A recalcitrant employee could use it to combat effective management practices. Suppose a disgruntled employee files a frivolous claim. A company could incur substantial expense in fighting it, and irreparable injury to its reputation. In the defense industry, some whistleblowers have become instant millionaires from legal actions. Judgments like this threaten the existence of small defense companies.

The ethical dilemma of whistleblowing. Whistleblowing usually poses an ethical dilemma. As professionals, engineers live by codes of ethics that give them a responsibility to protect the safety, health, and welfare of the public. As employees of corporations, they have an obligation to respect the authority of managers who sometimes give insufficient attention to safety matters.

There are at least three different approaches to whistleblowing ethics. The first is that whistleblowers "rat" on their company, and undermine teamwork based on the hierarchy of authority within the corporation. Their views may be correct, but final decisions belong to management, not engineers. Just as there are Biblical passages that tell us to obey the existing civil authorities, this view holds, we should also defer to authority in the workplace.

A second view is that whistleblowing is a tragedy to be avoided. In certain cases, it may be a necessary evil, but it almost always bad news all around. It is proof of organizational trouble. It threatens the careers of managers, disrupts collegiality (because colleagues resent the whistleblower), and damages the informal network of friends at the workplace. If the whistleblower has been a loyal employee for several years, it will be painful, like the disintegration of a marriage. And it brings severe penalties to whistleblowers.

The third view is that whistleblowing is an obligation when serious and considerable harm to public is involved. One must first report the harm and express moral concern to one's immediate superior. Before whistleblowing, one must exhaust other channels within the corporation. It is necessary to have "documented evidence" that would convince a reasonable impartial observer that one's view is correct, and "good reasons to believe that by going public the necessary changes will be brought about."

How to blow the whistle. Before blowing the whistle, here are some tests to apply. The first is the "mom" test: I'm going to be in this industry a long time. But I will be in different roles in different companies. Will this damage my reputation with my boss, colleagues, future customers or employers, etc.? The second is the test of personal responsibility. Engineers have personal obligations to their family, as well as other obligations, that can only be met if they have an income. One's spouse has a right to participate in decision of whether to whistleblow. Engineers also have the right to pursue a career. These responsibilities may make it permissible not to whistleblow even when most of the factors above would seem to mandate it. Utilitarianism says we should weigh these two factors. Will harm avoided be greater than harm incurred?

If you need to blow the whistle, here are some guidelines to follow. Do it anonymously; in those cases where the evidence can stand on its own, this will protect you from reprisal. Do it in a group. Then your charges will have more weight, and probably won't be seen as a personal vendetta. Another principle is to present just the evidence; leave the interpretation of facts to others. Then you probably won't get blamed for blackballing others.

Work through channels, if you can. Go to your immediate supervisor first. Many companies and agencies, for example, NASA, have set up mechanisms to document and prevent dangerous situations. The NASA Safety Reporting System has a written form that any employee can complete and mail to Battelle Institute, an independent contractor to NASA. Battelle processes the form, removes the identity of the informant, and prepares a summary for NASA.

If internal review procedures do not work, external mechanisms must be resorted to. These usually result in great cost to the employee Most employees who "go public" have already gone through internal channels, so it is unlikely that their identity can be kept secret. Going public makes the whistleblower seem insubordinate. Documenting allegations may require the release of internal reports. The dissenter can be charged with theft or violating confidentiality agreements.

Avoiding the need for whistleblowing. As most of us know, it's not a good idea to marry in haste. Take the time, and choose the right person; then you reduce your chances of going through a divorce later on. When taking a job, choose the right organization. If the organization has an "open door" policy, ask if it is ever used. If not, it is probably a channel that no one dare use. Using such a channel will probably be treated as whistleblowing. An organization described as "one happy family" should be examined with special care. Like families, organizations generally have tensions. An organization that recalls only the good times is not one that never has bad times, but one that has no use for bad news. Is better if old battles can be recalled, but happiness inferred from the fact that all are still working together.

Reduce the need that you will have to whistleblow. Develop informal channels to augment formal channels. Get to know someone who has more clout with your manager, but has common interests with you. Form alliances with colleagues and subordinates. Avoid the need to stand alone against a superior. Group concerns are treated more seriously. But, the group should be sensitive to moral concerns that force one to blow the whistle.

Organizations that are most in need of whistleblowing are likely to cause employees to become morally desensitized. So you will probably need to cultivate the moral sensitivity of potential allies. For example, you could bring in articles from the newspaper that raise questions similar to the ones you could face. Discuss them at lunch. Try to get your professional society to host discussions dealing with ethical problems that come up in their work. Learn how to present bad news in a way that is likely to get a favorable response. Present it clearly, with enough technical detail. Develop your communication skills. Many people probably become whistleblowers because they did not pay enough attention to feelings of audience.

Clearly, whistleblowing is a decision not to be taken lightly. Now is the time to prepare ourselves so that we can avoid the need in the future. But if it does become necessary, we need to be aware of the risks, and above all, of our obligations to our families, our professions, and the public.