Stages of Ethics
This is a post about ethics. What does ethics have to do with security? Well, if everyone were ethical, there would be no need for security. So I’m going to justify this entry by saying that understanding ethics (or the lack thereof) helps us to understand how to implement security measures.
Over the years, I’ve read various versions of the stages of ethics. They tend to be very similar, but there’s one I like so I’ll present it here.
Four Stages of Ethics
Stage 1, the baby/toddler years: Something is wrong because you’ll get punished. Children learn, "If I hit my sibling I’ll get a time out or I won’t get to play with a particular toy." So they know hitting the sibling is wrong. However, if they don’t get caught, children in this stage don’t feel bad, or have a guilty conscience, or suffer remorse. If there’s no punishment, it’s OK.
Stage 2, early childhood: Something is wrong because a higher authority says so. When the parents declare, "Don’t ride your bike beyond 6th street," the child won’t. Even if no one is looking, even if they know they wouldn’t get caught, children in this stage won’t do something because the parents said so. But they also start thinking in loopholes, "My parents never said I COULDN’T climb onto the roof, so it’s OK."
Stage 3, late childhood, teens: Something is wrong because the group says so. Older kids and teenagers behave the way they see the group behaving. Most teenagers are a bit rebellious, but most of them also follow a dress code at school, so most teenagers follow the dress code (a bit of circular logic, but trust me, it makes sense). Of course, the teenager who hangs out with kids who shoplift will find it easier to accept the group ethic of shoplifting.
Stage 4, adulthood: Something is wrong because it’s wrong. In this stage, people have ethics. They think about what is right and wrong and why. People with ethics do what they feel is right, regardless of punishment (or lack of punishment), regardless of what higher authorities say, regardless of what the people around them say. People who fought against racial segregation in the US (despite the higher authority and the threat of punishment), and people who don’t call in sick when they’re healthy (despite an almost zero chance of being caught) are ethical people.
The problem is that some people never advance beyond one of the three early stages. There are adults, still in stage 1, who will not hesitate to do something illegal/immoral/wrong if it benefits them and they won’t get caught. Most criminals are this way. The offenders who express remorse at sentencing are often remorseful because of the bad things happening to them, not for the harm they did to other people.
Those stuck in stage 2 are more likely to unquestioningly follow the declarations of a church/priest or the boss and politician ("My country, right or wrong", "My religion says birth control is wrong, so I don’t use it"). They are also the people who look for loopholes and look for alternate interpretations of commands that suit their purpose. When the company policy is "No side businesses at work," someone will justify a side business saying, "I only do it during my lunch hour, so technically I’m not at work."
Someone still in stage 3 will steal office supplies or cheat on their taxes or improperly download movies or music or software, saying, "Everyone does it."
If you presented the stages of ethics (in this form or something similar) to most people, I imagine most would agree with the general idea (maybe quibble on the details). I also think that most people would believe they are in stage 4. You can probably think of some people who are clearly stage 1 or 2 people (probably not stage 3 and at least definitely not stage 4), and I’ll bet you they would say they are in stage 4. No one is going to say, "Yeah, I’m someone who will do anything and not feel guilty so long as there is no punishment."
The reason most people would say this is because they do contemplate ethics. That’s one of the ways to recognize stage 4, thinking about ethics. The problem is that most of us to some degree try to figure out how a situation that would benefit us personally could be considered ethical. That is, the train of thought is not "This is beneficial to me, but is it ethical?" Rather, it is, "This would be to my advantage, how can I construe this to be ethical?" Not explicitly, but that is what is happening.
For example, suppose you have two tickets to a show with unassigned seating. Suppose also that the show has in-and-out privileges, just show your ticket on the way out and the way in. You and a friend could use the two tickets to get in, then you could take both tickets, go outside (showing one ticket on the way out), hand the second ticket to a third party and now you and the third party get in. Three people on two tickets. Is this ethical?
"The show is nowhere near a sellout, so we’re not causing overcrowding."
"They make most of their money on concessions, so they want more people to show up, even if they don’t buy tickets."
"We’d never buy three tickets — if we couldn’t do this 3-for-2 trick our third party simply would not join us — so we’re not depriving them of any income, in fact, we might be adding to it because we might buy concessions."
"If we like the show, we’ll buy more tickets in the future, so they might make more money in the long run."
Is this rationalizing? Or is it a valid ethical conclusion? Sometimes rationalizations are valid ("Even though a right turn on red is illegal at this light, I needed to get out of the way of that ambulance.") In the example above, it is entirely possible the people running the show would be glad to have extra people come in, even though they did not pay, for exactly the reasons given (concession sales and possible future ticket sales). However, in my opinion, the above thinking would be true ethics only if the ticket holder contacted the show people and asked if they would be OK with a 3-for-2 trick. If not, then this is an example of "This would be to my advantage, how can I construe this to be ethical?"
More on this topic in upcoming posts.