The Ethics of Software Engineering from the Lens of Library Science

By Vivi Hoang
Dec. 10, 2021

The fields of computer science and library and information science (LIS) have the capacity to learn a great deal from each other. Libraries grapple with budget issues while endeavoring to adequately serve their communities’ intellectual and practical needs. To better fulfill their mission and meet their patrons where they are, libraries have turned to digital products and services produced by software engineering professionals.

However, sometimes the aims of the two professions can conflict. For example, librarianship’s ingrained code of ethics places great import on patrons’ privacy and confidentiality. In this era of Big Data and automated collection of massive amounts of data — much of it made possible by computer science — that often puts libraries at odds with the software they’re using.

From that perspective, this paper seeks to gain a better understanding of the ethics of software engineering by examining snapshots of its current state and ideas for its future. Software engineering has become woven into the everyday interactions of not just library routines but daily life, which means its impact is widespread.

“As a result, the existence and observance of rules of conduct and clear sanctions in the event of non-compliance are imperative,” writes Marcu et al.¹

LIS core values

For context, the core values of the librarianship profession, based on a survey of writings about the topic, have generally been categorized as:

• Intellectual freedom
• Protecting patrons’ privacy and confidentiality
• Intellectual property rights
• Professional neutrality
• Preservation of the cultural record
• Equity of access²

The American Library Association further codifies these principles in its Code of Ethics, which was most recently updated in 2021 to add a commitment to racial and social justice. This adjustment reflects what Wallace C. Koehler Jr., former director of the information studies department of Georgia’s Valdosta State University, described as an inherent quality of ethics, that they are capable of adaptation to the times:

“Ethics necessarily, at least in their applied form, undergo metamorphosis as underlying conditions change. Thus, for example, as technology changes the conditions of practice, these change the ethics that guide the practice.”³

One blended perspective

Kalev Leetaru, Google Developer Expert with a background in both computer science and LIS, writes that a primary difference between the two fields lies in how they both view the role and treatment of data:

The study of computer science examines how data can be collected, mined and manipulated in a way that, in turn, affects users. On the other hand, the study of library and information science underscores the needs of the community and protection of privacy and civil liberties, “blending discussion of public data management with private data minimization.”⁴

He describes how, as a computer science student, his area of study explored what could be done with data while failing to devote similar attention to what should be done with data. It didn’t consider the question if an innovation might not be worth the cost due to societal harm. Students learned to protect data but not necessarily the users from which that data derived.

Leetaru later enrolled in an LIS doctoral program where, from the start, questions of impact, harm and ethics were considered. But that perspective, too, is changing, he noted, as LIS schools align themselves more with computer science.

“Sadly, as Library and Information Science schools pivot into iSchools and hire waves of computer scientists, the scholarly traditions of the community-centric human focus of LIS are giving way to the data-driven technical focus of computer science.”⁵

The dilemma of data collection

That data-driven focus has certainly manifested in institutions of higher education, which have had to collect increasing amounts of student data in response to stricter federal accountability measures requiring proof that students are learning. Often these numbers are tied to state and federal fundings.

These vast caches of student data have proven irresistible to bad actors, leading to the breaches of at least 14 million records accessed in 727 instances between the years 2005 and 2014 at numerous educational institutions and education-related nonprofits.⁶

Academic libraries are having to consider the ethical ramifications. They, too, need to collect user data to justify their budgets.

Beyond the possibility of stolen records, academic librarians find themselves having to protect their patrons’ privacy. For instance, academic libraries rely on a great deal of third-party vendors for their research databases and other online services. These concerns are typically addressed in the licensing terms but it highlights the divergence of interest: It’s in the interest of these vendors to collect as much data as they can “for their own profit and assessment purposes” while it’s the libraries’ duty to manage and minimize patron data collection.⁷

One example of this conflict arose in 2016: Librarians castigated Adobe Digital Editions, which is often used for ebook lending by academic libraries, when it was discovered that the software was covertly and rampantly collecting user data, both from the book download and from users’ computers.

At the same time, libraries have had to accept that the collection of personally identifiable information for assessment purposes is the reality. The American Library Association went so far to update its code of ethics to acknowledge that balancing act between privacy and access in 2006.⁸

Ethics at the university, professional and employer level

Given those circumstances, we shift over to the computer science side of this equation and explore from where software engineers derive their ethics.

At the university level, one survey published this year of 61 European academic institutions of higher education showed 64% of them taught ethics in their program.⁹ (I was unable to find a similar survey of American schools.)

Of course, not all software engineers have computer science degrees. In the popular knowledgebase site StackOverflow’s 2020 annual survey of its users, 62 percent of the 51,000 respondents reported they had a degree in computer science, computer engineering or software engineering.¹⁰

Computer scientist Graham Lee of the University of Oxford categorized ethical considerations in the field into four areas:

• The software engineer’s actions in their field
• The engineer’s actions in the software’s application domain
• Ethical (or unethical) actions that the software allows users to take
• Bias integrated in, or produced by, the system itself when using artificial intelligence and machine learning.

Both the ACM (Association for Computing Machinery) and IEEE (Institute of Electrical and Electronics Engineers) each have their own codes of ethics, which primarily deal with the first bullet point, Lee said. But as membership-based groups that means not all software engineers belong to either organization. ACM reports its membership as nearly 100,000 members in 190+ countries¹¹. IEEE counts 400,000 members in more than 160+ countries.¹²

The next source of ethical rules to consider then are those of employers. Lee reviewed software engineering-specific directives in the codes of conducts for U.S. tech companies (Amazon, Microsoft, Alphabet/Google, Netflix and Apple) and five U.K. universities (Oxford, Cambridge, Warwick, Bristol and Southhampton).

Among the U.S. tech companies’ codes of conduct, they agreed on four points:

• Avoiding conflicts of interest
• Reporting ethical misconduct
• Following a set of rules to report misconduct
• Not punishing those who report misconduct

What was conspicuously absent, Lee noted, was any substantial mention of the societal impact of the software these companies.

“The conclusion we draw from this observation is that the codes of conduct for these large corporations do not demonstrate their executives’ commitment to using the special computing knowledge of their professional employees for the public good. The codes of ethics demonstrate that the employees have been told not to violate relevant corporate law and Securities and Exchange Commission rules.”¹³

The universities’ code of ethics all required that researchers “be aware of the codes of ethics relevant to their domain, and those of professional societies in those domains” and generally stipulated honesty, accuracy and transparency. None, however, explicitly outlined ethical expectations in the context of research software.

Lee concluded that his research, while admittedly limited in sample size, raised the question of an “ethics gap” in software engineering. He urged further study on whether current best practices in the field raised ethical issues and whether (or what) adjustments could close the gap.¹⁴

Proposed solutions

Pedagogical frameworks at the university level

One curriculum framework for teaching ethics and social impact to computer science students from 1997 divided the subject into five areas:

• Responsibility of the Computer Professional: The history of computer science and an overview of ethics, including professional codes of conduct.
• Basic Elements of Ethical Analysis: How to think critically about ethics and incorporate it in decision-making.
• Basic Skills of Ethical Analysis: Determining the stakeholders and ethical issues in concrete situations, applying ethics to the situation and considering alternative paths of action.
• Basic Elements of Social Analysis: Taking the social context, power relations and values of software engineering into consideration.
• Basic Skills of Social Analysis: Analyzing the social context of the application domain, including the system’s assumptions and values, and being able to evaluate the implementation.

“If only one strategy is possible, the integration of social and ethical issues into existing courses is the preferable option because it helps the student to understand the connection that exists between technical, ethical and social problems,” writes the researchers.¹⁵

Faculty at Uppsala University in Sweden released a paper last year discussing how at some point, even though there were no complaints from students, the school realized it wasn’t adequately serving the needs of their engineering and computer science students with their existing ethics course.

“[P]erhaps the best way to put it in hindsight, is that we taught courses about engineering ethics, rather than courses for engineering ethics.”¹⁶

They revamped their curriculum, focusing on awareness, responsibility, critical thinking and action.

The awareness portion covers the ethics of dealing with the product but also with people, as well as addresses private life, since modern-day practices have blurred the lines between work and home. In this area, awareness, the authors point out how students often assume if they’re working in what could be considered a “good” tech field, such as sustainability, there will not be ethical issues with the product. No matter the area of specialization, there’s no guarantee, but at the very least, students will still need to think about their relationships with others.

While the curriculum does address engineering disasters, the authors note those disasters can seem so far removed, so there’s also an emphasis on ethical issues that arise in the day-to-day work. The course seeks to provide both positive and negative examples so students see a spectrum of experiences based on engineers’ choices.

The responsibility portion encourages students to consider the conditions for taking action — “Is this an issue that I should do something about?” — rather than focusing on accountability or liability. This is followed by a discussion on common reasons for avoiding responsibility, such as the different kinds of rationalization (such as denial of harm, blaming the victim, etc.).

“We implicitly try to avoid the all too easy ‘collective responsibility’ view, and point out that by assessing professional, as well as personal, responsibilities at every critical decision point, we can understand the nuances of a situation in much greater detail, and thereby move towards judgement.”¹⁷

The critical thinking phase deals in analyzing options and making the right choice. Students get two scenarios to apply what they’ve learned: Designing an algorithm for self-driving cars to handle accidents and choosing how to store used nuclear fuel.

Finally, when covering the action phase, students, choose how to proceed but also get a roadmap on long-term ethical conduct.

Ethics-aware software engineering

Two researchers from Utrecht University in The Netherlands observed in 2018 that consumers are increasingly concerned about the ethical cost of products — such as fair labor, working conditions, sustainability and health impact — and that these same questions should be applied to software.

These factors include a number that coincide with the LIS values discussed earlier:

• Working conditions of those making the software.
• If the product fostered unhealth behaviors such as digital addition.
• User privacy.
• Diversity.
• Fairness.

The researchers proposed “ethics-aware software engineering,” a framework applied to everyone involved in the creation of software — generally termed “software professionals” and including customers, developers and organizations — that integrates ethical discussions through each phase of the software process.

The process, which the researchers admit is a work in progress, starts with ethics requirements, in which the different stakeholders articulate their ethical values for the software and the development process. These values are translated to specifications such as, for example, “the system shall be gender-neutral.” This leads to the ethical specifications being implemented, verified and validated.¹⁸

“Our goal is to foster the community to fill the existing gaps: current codes of conducts lack of breadth and depth, there are no languages for stakeholders to express their ethical standpoints, and software organizations do not reveal details on ethical issues. As a result, it is practically impossible for a human to check her/his ethical alignment with a given software product or its producing organization. Notably, we do not try to promote one or another ethical concern; our main aim is to support transparency.”¹⁹

Conclusion

In closing, the ethics and expectations of both computer science and library and information science continue to evolve, at times colliding and possibly, with time, converging. Researchers point to the need to better harness the capabilities of software engineering so as not to cause harm to their users or to society. Instilling these values is a task that has the potential to be addressed from various sources in the industry, including educational institutions, professional groups and employers.