Ethics, Law, Accessibility and Sustainable IT

Introduction

Information technology is not ethically or socially neutral. Every database, application, algorithm, network and digital service embodies decisions about whose interests matter, what information is collected, who can access it, and what risks are acceptable. IT professionals therefore have responsibilities that extend beyond technical performance. They must protect privacy, respect law and intellectual property, reduce harm, design for diverse users, and consider environmental consequences across the technology life cycle.

These responsibilities are strategic. Public trust, regulatory compliance, inclusion, environmental performance and professional reputation can determine whether an IT project succeeds. A technically impressive system may still be unacceptable if it discriminates against users, enables unlawful surveillance, excludes people with disabilities, wastes energy, or exposes confidential information.

This chapter examines ethical and legal reasoning in IT and applies it to privacy, intellectual property, cybercrime, professional conduct, algorithmic fairness, surveillance, accessibility, the digital divide and sustainable computing.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish ethical, legal, professional and social responsibilities in IT.
2. Explain privacy, intellectual-property and cybercrime issues in digital systems.
3. Apply ethical frameworks to competing stakeholder interests.
4. Identify sources of algorithmic bias and evaluate fairness controls.
5. Explain accessibility, inclusive design and the digital divide.
6. Evaluate the environmental impacts of hardware, software and data services.
7. Recommend responsible technology practices for an organization.

1. Ethics, Law and Professional Responsibility

Ethics concerns reasoned judgments about what ought to be done. Law consists of enforceable rules created by legitimate authorities. Professional conduct includes standards established by professional bodies, employers and accepted practice. These domains overlap but are not identical. An action may be legal but ethically questionable; for example, collecting extensive behavioural data under a broadly worded consent notice may comply with a minimum legal requirement while violating reasonable expectations of privacy.

A useful decision process is:

1. Identify the facts. Separate verified information from assumptions.
2. Identify stakeholders. Include direct users, non-users, employees, communities, suppliers and future generations.
3. Identify duties and rights. Consider privacy, safety, autonomy, equality, property and due process.
4. Identify harms and benefits. Consider probability, severity, reversibility and distribution.
5. Examine alternatives. Seek ways to achieve legitimate goals with less intrusion or risk.
6. Decide, document and review. Record reasons, controls and conditions for revisiting the decision.

Several ethical theories support this process. Consequentialism evaluates outcomes and seeks to maximize benefits or minimize harm. Deontological ethics emphasizes duties and principles, such as honesty and respect for consent, even where violating them might produce a convenient outcome. Virtue ethics asks what a trustworthy, fair and responsible professional would do. Justice-based reasoning focuses on the fair distribution of benefits, burdens and opportunities. In practice, responsible IT decisions often combine these approaches.

Professional codes of conduct commonly require competence, honesty, confidentiality, avoidance of conflicts of interest, respect for law, protection of the public and continuing professional development. A developer should not claim that software has been adequately tested when important tests were omitted. A systems analyst should disclose a financial interest in a vendor selection. A security professional should use authorized methods and report vulnerabilities responsibly.

2. Privacy and Data Governance

Privacy is not simply secrecy. It includes control over personal information, freedom from unjustified intrusion, appropriate use of data and the ability to make choices about observation and disclosure. Personal data can identify a person directly, such as a name, or indirectly, such as a device identifier combined with location history. Sensitive data may include health, biometric, financial, identity or political information, depending on applicable law.

Important privacy principles include:

• Purpose limitation: collect data for specified, legitimate purposes.
• Data minimization: collect only what is reasonably necessary.
• Transparency: explain what is collected, why, how long it is retained and with whom it is shared.
• Choice and control: provide meaningful consent, withdrawal and access mechanisms where required.
• Accuracy: allow correction of significant errors.
• Security: protect data against unauthorized access, alteration, loss and disclosure.
• Retention limitation: delete or anonymize data when it is no longer needed.
• Accountability: assign responsibility and keep evidence of compliance.

Privacy protection should be designed into systems rather than added after deployment. Privacy-by-design techniques include pseudonymization, aggregation, access controls, encryption, separation of identifiers from operational records, local processing and privacy-preserving defaults. Encryption protects confidentiality in transit and at rest, but it does not eliminate risks caused by excessive collection, weak authentication or authorized misuse.

A privacy impact assessment can be used before a high-risk project. It should describe the data flow, purpose, affected populations, threats, legal basis, controls, residual risks and consultation process. Data governance also requires ownership: someone must be responsible for data quality, retention, access decisions and incident response.

Privacy laws differ by jurisdiction. Common regulatory themes include lawful processing, transparency, individual rights, breach notification, restrictions on sensitive data and controls on international transfers. Organizations must identify the laws applicable to their location, sector and user population rather than assuming that one global rule applies.

3. Intellectual Property and Digital Rights

Intellectual property (IP) law protects different interests through different mechanisms:

Copyright usually protects the expression of software, not every underlying idea. A license may permit use, modification, redistribution or commercial deployment under specified conditions. Open-source software is not “free of obligations.” For example, licenses may require attribution, preservation of notices, disclosure of source for certain derivative distributions, or compliance with patent terms. Organizations should maintain a software bill of materials, record license obligations and review dependencies for vulnerabilities and incompatible terms.

Plagiarism is the presentation of another person’s work or ideas as one’s own. It applies to code, technical writing, datasets and designs. Academic and professional integrity require accurate attribution. Employees should also avoid copying proprietary code or confidential material from a former employer.

Generative AI introduces additional questions. Users should verify outputs, avoid submitting confidential data to unauthorized services, check licensing and attribution requirements, and ensure that generated content does not reproduce protected or biased material. Human accountability remains essential: an organization cannot transfer responsibility for an unlawful decision to an AI system.

4. Cybercrime, Security and Responsible Conduct

Cybercrime includes unauthorized access, malware distribution, fraud, identity theft, extortion, data theft, service disruption and unlawful interception. The same technical skill can support defensive security or criminal activity; authorization and intent are central distinctions.

Common offences and risks include phishing, credential theft, ransomware, denial-of-service attacks, insider misuse and supply-chain compromise. A professional security assessment must have written scope, authorized systems, testing limits, data-handling rules and reporting procedures. Scanning a public system without permission may still be unlawful or disruptive, even if no damage is intended.

Responsible vulnerability disclosure generally involves validating a finding carefully, minimizing access to personal data, notifying the affected organization through an appropriate channel, allowing reasonable remediation time, and coordinating public disclosure when necessary. Security researchers should not demand payment or threaten publication. Organizations, in turn, should provide a clear reporting channel and avoid retaliating against good-faith researchers.

Security is a socio-technical responsibility. Technical controls such as multifactor authentication, patching, backups, segmentation, logging and least privilege must be supported by training, policy, incident response and leadership. A secure design also considers human factors: confusing warnings, excessive password rules and inaccessible authentication can cause users to bypass controls.

5. Algorithmic Fairness and Accountability

Algorithms influence recruitment, credit, insurance, education, policing, healthcare and content visibility. Their decisions can reproduce historical inequality or create new discrimination, even when sensitive attributes are excluded. Proxy variables such as postcode, language, purchasing behaviour or school history may correlate with protected characteristics.

Bias can enter at several stages:

• Problem definition: the system objective may encode an unjust goal.
• Data collection: some groups may be underrepresented or over-surveilled.
• Labels: historical decisions may reflect prejudice or unequal opportunity.
• Model design: optimization may prioritize accuracy over equal treatment.
• Deployment: users may behave differently from the training population.
• Feedback: automated decisions can reinforce the data used for future decisions.

Fairness is multidimensional. Individual fairness asks whether similar individuals are treated similarly. Group fairness compares outcomes across demographic groups. Measures may include selection rates, error rates and calibration. These measures can conflict, particularly when groups have different base rates. Consequently, fairness cannot be reduced to choosing one metric; it requires a normative decision about which harms matter and why.

A responsible algorithmic impact assessment should document purpose, data provenance, affected groups, performance by subgroup, foreseeable misuse, human oversight, appeal procedures and monitoring after deployment. High-impact decisions should provide understandable reasons and a meaningful opportunity for human review. Explanations should be accurate and useful, not merely technical descriptions that users cannot interpret.

Human oversight is not automatically effective. A reviewer may accept automated recommendations without scrutiny, a problem sometimes called automation bias. Organizations should define when human intervention is mandatory, train reviewers, measure override behaviour and provide resources for independent judgment.

6. Surveillance and Digital Rights

Surveillance may support public safety, fraud prevention, workplace safety or service improvement. It can also chill lawful expression, create power imbalances and normalize intrusive monitoring. Relevant questions include who is observed, what is inferred, whether observation is necessary and proportionate, how long records are retained, and whether affected people can challenge misuse.

Examples include facial recognition, location tracking, workplace monitoring, web analytics, smart-city sensors and school proctoring. A visible camera may be lawful and still create ethical concerns if images are retained indefinitely or shared for unrelated purposes. Biometric surveillance is particularly sensitive because biometric characteristics cannot be replaced easily after compromise.

A proportionality analysis asks whether the objective is legitimate, whether surveillance is suitable to achieve it, whether a less intrusive alternative exists, and whether the benefits justify the remaining intrusion. Notice, independent oversight, access restrictions, audit logs, retention limits and complaint procedures are important safeguards. Secret or discriminatory surveillance is especially difficult to justify.

7. Accessibility, Inclusion and the Digital Divide

Accessibility means that people with disabilities can perceive, operate, understand and interact with technology. Disabilities may be visual, auditory, physical, speech-related, cognitive or neurological, and may be permanent, temporary or situational. Inclusive design benefits everyone: captions assist people in noisy environments, keyboard access assists users with injuries, and clear language helps users under stress.

Accessible digital services commonly provide:

• text alternatives for meaningful images;
• captions and transcripts for audio and video;
• keyboard operation and visible focus indicators;
• sufficient colour contrast and non-colour cues;
• scalable text and responsive layouts;
• clear headings, labels, instructions and error messages;
• compatibility with assistive technologies;
• predictable navigation and adequate time to complete tasks.

Accessibility should be addressed during requirements, design, development, testing, procurement and maintenance. Automated checkers can identify some issues but cannot reliably judge meaningful alternative text, logical reading order or whether instructions are understandable. Testing with disabled users is therefore essential. Conformance frameworks such as the Web Content Accessibility Guidelines provide useful criteria, while local disability and equality law may impose additional obligations.

Universal design seeks products usable by the widest range of people without special adaptation. Reasonable accommodation modifies a system or process to meet an individual need when universal design is insufficient. Inclusion also requires accessible support, documentation, training and procurement—not merely an accessible interface.

The digital divide is unequal access to devices, connectivity, affordability, skills, language support and trustworthy services. It exists between regions, income groups, urban and rural communities, generations and people with disabilities. A digital-only public service may deepen exclusion if users lack broadband, accessible devices or digital confidence. Responses include affordable connectivity, public access facilities, device lending, digital-literacy programs, multilingual content, offline channels and accessible design.

8. Sustainable and Green IT

Sustainable IT considers environmental, social and economic effects across the life cycle: extraction of materials, manufacturing, transport, deployment, use, maintenance and end-of-life. Environmental impacts include energy consumption, greenhouse-gas emissions, water use, hazardous substances, mining impacts and electronic waste.

Green IT focuses on reducing the impacts of technology itself. Examples include energy-efficient hardware, power management, server consolidation, virtualization, efficient cooling, renewable electricity, durable devices and responsible recycling. Green software seeks to reduce the resources required by applications through efficient algorithms, restrained data transfer, caching, right-sized infrastructure and avoidance of unnecessary computation.

Sustainable IT is broader than operational efficiency. A highly efficient data centre may still create substantial impact if demand grows rapidly or equipment is replaced prematurely. Organizations should consider embodied carbon, repairability, supplier practices, labour conditions and total life-cycle effects. Extending device life, repairing components and purchasing durable equipment can reduce environmental burdens, although security requirements must still be met.

Cloud computing can improve utilization through shared infrastructure, but it does not automatically mean sustainability. Assessment should consider workload location, energy source, utilization, data transfer, redundancy and provider transparency. Unnecessary data retention also has environmental costs because stored data requires equipment and energy.

A practical sustainability program establishes a baseline, sets measurable targets, assigns responsibility, monitors indicators and reports results. Useful indicators include energy consumed per service transaction, equipment lifetime, reuse and recycling rates, data-centre utilization and emissions associated with procurement. Claims should be evidence-based; vague “green” marketing may constitute greenwashing.

9. Integrated Responsible-Technology Framework

Ethical, legal, accessibility and sustainability decisions should be integrated into the technology life cycle rather than handled by separate departments. The following sequence is useful:

Figure: A responsible-technology life cycle with continuous review.

At the beginning, teams define the legitimate purpose and affected stakeholders. During design, they conduct privacy, security, accessibility, equality and environmental assessments. Before release, they test representative use cases, document limitations and obtain appropriate approval. After release, they monitor incidents, subgroup outcomes, accessibility barriers, resource consumption and changing legal requirements.

Governance should be proportionate to risk. A low-risk internal tool may need a lightweight review, whereas a system affecting employment, healthcare, education or liberty requires independent scrutiny, documented impact assessment, stronger security and an appeal mechanism. Responsibility should be assigned through policies, risk registers, audit trails and escalation channels.

Applied Case: Illustrative University Student-Success System

Background

A university proposes an AI-assisted system to identify students who may need academic support. It combines learning-platform activity, attendance, assessment results and demographic information. Advisors will receive a risk indicator and contact selected students.

Problem

The system could help identify students before they fail, but it may also disadvantage students with disabilities, students working long hours, students with limited connectivity or groups historically underrepresented in the training data. Extensive monitoring may undermine trust, and the use of demographic data raises privacy concerns.

Analysis

The legitimate purpose is support, not punishment. Data minimization suggests excluding information that is not necessary for providing assistance. The university should assess whether attendance and platform activity are reliable proxies for engagement. It should test error rates and false-positive rates across relevant groups, examine whether the model treats non-traditional study patterns unfairly, and consult students, disability services, advisors and privacy officers.

The university should provide clear notice, restrict access, define retention periods and prohibit use for disciplinary decisions. Students should be able to ask what information was used, correct errors and request human review. Advisors must be trained not to treat the indicator as a diagnosis or final judgment. The system interface and communications must be accessible, and students must have non-digital routes to support.

Approach and Outcome

The university pilots the system with a small volunteer cohort, uses transparent rules alongside any statistical model, and evaluates outcomes rather than assuming that prediction equals benefit. It discovers that low platform activity often reflects poor internet access rather than low motivation. The university therefore offers connectivity support and changes the intervention from a warning to an invitation for assistance. After review, the model is used only as one input to a human support process, with published safeguards and an annual independent audit.

Learning Points

The case demonstrates that responsible technology is not achieved by adding a disclaimer to an automated tool. Purpose, data selection, fairness, privacy, accessibility, human judgment and institutional support must be designed together. Sometimes the most ethical response to a predicted risk is to improve the underlying conditions rather than intensify surveillance.

Challenges and Limitations

Ethical frameworks do not produce automatic answers. Stakeholders may disagree about acceptable risk, and legal standards may be uncertain or inconsistent across countries. Fairness metrics may conflict, privacy can limit data needed for evaluation, and accessibility improvements may require redesign rather than a quick technical fix. Sustainability data may be incomplete, especially for complex supply chains and cloud services.

Organizations also face implementation problems: commercial pressure, fragmented responsibility, limited budgets, vendor opacity and inadequate expertise. Impact assessments can become symbolic if decision-makers have already committed to a project. Independent review, meaningful stakeholder participation and clear authority to delay or stop deployment help prevent this outcome.

Best Practices

• Establish an ethics, privacy, security, accessibility and sustainability review before high-risk projects.
• Document purposes, assumptions, data sources, decisions, limitations and responsible owners.
• Collect the minimum necessary data and set deletion or anonymization rules.
• Use authorized testing, least privilege, strong authentication and tested backups.
• Maintain software and open-source license inventories.
• Test systems with diverse users and measure outcomes by relevant subgroups.
• Provide understandable notice, human review, correction and appeal mechanisms.
• Procure accessible, repairable, durable and energy-efficient equipment.
• Offer offline, low-bandwidth and non-digital alternatives where exclusion is foreseeable.
• Monitor deployed systems and treat incidents and complaints as sources of improvement.
• Train staff in professional conduct and protect people who report concerns in good faith.

Chapter Summary

Responsible IT combines ethical reasoning, legal compliance, professional conduct and social responsibility. Privacy requires purposeful collection, transparency, security, user control and accountability. Intellectual property obligations apply to software, data, documentation and AI-assisted outputs, while cybercrime prevention depends on both technical controls and authorized professional behaviour.

Algorithms can reproduce inequality through data, labels, objectives and deployment practices; fairness therefore requires impact assessment, subgroup testing, explanation and meaningful human review. Surveillance should be necessary, proportionate, transparent and subject to oversight. Accessibility and universal design help ensure that people with disabilities can participate, while digital-inclusion measures address unequal access to devices, connectivity, skills and support.

Sustainable IT considers the entire technology life cycle, including extraction, manufacture, use and disposal. Green computing, efficient software, durable equipment, responsible procurement and evidence-based measurement reduce environmental harm. The central principle is continuous responsibility: define a legitimate purpose, assess impacts, design inclusively, test rigorously, govern transparently and improve after deployment.

Key Terms

Accessibility: The ability of people, including people with disabilities, to use a product or service.

Algorithmic bias: Systematic and unjustified disadvantage produced by data, models or deployment practices.

Copyright: Legal protection for original expressive works, including many software and documentation forms.

Cybercrime: Criminal activity involving computers, networks or digital information.

Data minimization: Limiting collection to information necessary for a legitimate purpose.

Digital divide: Unequal access to digital devices, connectivity, skills and benefits.

Digital surveillance: Systematic observation or inference about people through digital technologies.

Green IT: Practices that reduce the environmental impact of technology.

Intellectual property: Legal interests in creations, inventions, brands and confidential information.

Least privilege: Giving an account only the access required for its authorized task.

Open-source license: Terms governing use, modification and distribution of openly available software.

Personal data: Information relating to an identified or identifiable person.

Privacy by design: Building privacy protections into systems from the beginning.

Proportionality: The principle that an intervention should not impose more intrusion or burden than justified by its objective.

Reasonable accommodation: A modification that enables an individual to participate when standard design is insufficient.

Sustainability: Meeting present needs while limiting environmental and social harm over time.

Universal design: Designing products and services for broad usability without special adaptation.

Vulnerability disclosure: Reporting a security weakness to enable responsible remediation.

Review Questions

Short Answer Questions

1. How do ethical obligations differ from legal obligations in IT?
2. Explain the principle of data minimization and give one example.
3. Identify three ways algorithmic bias can enter an IT system.
4. What is the difference between accessibility and the digital divide?
5. Why must sustainable IT consider the hardware life cycle?

Long Answer Questions

1. Explain how privacy-by-design principles can be applied to a mobile health application.
2. Discuss the responsibilities of an IT professional conducting an authorized security assessment.
3. Compare consequentialist, duty-based and justice-based approaches to a controversial surveillance system.
4. Explain why fairness metrics may conflict and describe safeguards for a high-impact algorithm.
5. Evaluate how an organization can integrate accessibility and sustainability into procurement.

Analytical / Application Questions

1. A retailer wants to collect precise customer locations indefinitely to personalize promotions. Analyze the privacy, legal, ethical and security issues, and recommend a proportionate alternative.
2. A recruitment algorithm selects fewer candidates from one demographic group, although its overall accuracy is high. Design an investigation and propose possible corrective actions.
3. A government plans a digital-only benefits service. Assess the accessibility and digital-divide risks and develop an inclusive implementation plan.

Multiple Choice Questions with Answers

Question 1

Which principle requires an organization to collect only data reasonably necessary for a stated purpose?

A. Data minimization

B. Open licensing

C. Universal design

D. Least privilege

Correct Answer: A. Data minimization

Question 2

Which statement best describes a professional security assessment?

A. It may scan any public system without permission.

B. It must operate within written authorization and agreed scope.

C. It requires publishing all discovered data immediately.

D. It is acceptable to demand payment before reporting a flaw.

Correct Answer: B. It must operate within written authorization and agreed scope.

Question 3

What is a common source of algorithmic bias?

A. Using version control

B. Underrepresentation of groups in training data

C. Encrypting stored data

D. Providing an appeal process

Correct Answer: B. Underrepresentation of groups in training data

Question 4

Which practice most directly supports web accessibility?

A. Using colour alone to communicate errors

B. Removing keyboard navigation

C. Providing text alternatives for meaningful images

D. Requiring users to disable assistive technology

Correct Answer: C. Providing text alternatives for meaningful images

Question 5

Why is cloud computing not automatically sustainable?

A. Cloud services cannot use renewable electricity.

B. Shared infrastructure always increases hardware waste.

C. Environmental impact depends on utilization, energy source and other life-cycle factors.

D. Cloud services do not require data centres.

Correct Answer: C. Environmental impact depends on utilization, energy source and other life-cycle factors.

Question 6

Which protection generally applies to original software expression and documentation?

A. Copyright

B. Trademark

C. Trade secret only

D. Patent in every case

Correct Answer: A. Copyright

Question 7

A proportionality analysis of surveillance primarily asks whether the measure is:

A. The most expensive available option

B. Necessary and no more intrusive than justified

C. Completely invisible to affected people

D. Based only on automated decisions

Correct Answer: B. Necessary and no more intrusive than justified

Question 8

Which control gives an account only the access required for its authorized task?

A. Data aggregation

B. Least privilege

C. Universal design

D. Purpose expansion

Correct Answer: B. Least privilege

Question 9

What is a key reason for human review of high-impact automated decisions?

A. To guarantee that the algorithm is always correct

B. To provide correction, context and a meaningful appeal opportunity

C. To eliminate the need for testing

D. To permit decisions without explanations

Correct Answer: B. To provide correction, context and a meaningful appeal opportunity

Question 10

Which action best reduces the environmental impact of end-user devices?

A. Replacing all devices annually

B. Extending device life through repair and responsible maintenance

C. Increasing screen brightness permanently

D. Storing obsolete devices indefinitely

Correct Answer: B. Extending device life through repair and responsible maintenance