Human developers are a primary, though often unintended, source of bias in AI algorithms. Their personal, cognitive, and societal biases can be unintentionally embedded at every stage of the AI development lifecycle. This includes the initial problem formulation, the selection and labeling of training data, the choice of features and algorithms, and the interpretation of results. Because developers' worldviews and assumptions shape the system's design and the data it learns from, their inherent biases become encoded in the AI's logic, leading to skewed or unfair outcomes.

A. Tainted examples: This is a direct cause of bias, but it is often a symptom or result of human bias in the data collection and selection process, rather than the ultimate source.

B. Excessive validation sample sizes: A large validation set is generally beneficial for assessing a model's generalization capabilities and does not inherently introduce bias. Small or unrepresentative samples are the problem.

D. Excessive training sample sizes: A large quantity of training data is typically advantageous. The source of bias is the quality and representativeness of the data, not its sheer volume.

1. Mehrabi, N., Morstatter, F., Saxena, N., Lerman, K., & Galstyan, A. (2021). A Survey on Bias and Fairness in Machine Learning. ACM Computing Surveys, 54(6), 1–35. In Section 2.2, "Human Bias," the authors state, "Bias can arise from a human’s cognitive, personal, and institutional biases... This can influence the data generation process, the algorithm design, and the evaluation process." This identifies the human element as a core source of bias that permeates the entire system. (DOI: https://doi.org/10.1145/3457607)

2. Suresh, H., & Guttag, J. V. (2021). A Framework for Understanding Sources of Harm throughout the Machine Learning Life Cycle. In Equity and Access in Algorithms, Mechanisms, and Optimization (EAAMO '21). This framework details how human choices and biases introduce harm at every stage, including data collection (leading to "tainted examples") and model development. It positions human-driven processes as the origin of these issues. (DOI: https://doi.org/10.1145/3465416.3483305)

3. Friedman, B., & Nissenbaum, H. (1996). Bias in Computer Systems. ACM Transactions on Information Systems, 14(3), 330–347. This foundational paper identifies three categories of bias, including "preexisting bias," which is rooted in social institutions, practices, and attitudes. Human developers, as members of society, carry and can embed these biases into systems. (DOI: https://doi.org/10.1145/230538.230561)

The core issue described is a discrepancy in data—the price shown on the order form is different from the price in the confirmation email. This inconsistency represents a failure of data integrity. Integrity, a fundamental principle of information security, ensures that data is accurate, consistent, and trustworthy throughout its lifecycle. It guards against unauthorized or improper modification of information. By reporting the different pricing, the customer is directly addressing this lack of data integrity in the e-commerce system's transaction records.

A. Availability: This principle concerns ensuring timely and reliable access to systems and data. The system was available for the customer to place an order, so this is not the issue.

C. Accessibility: This term typically refers to designing systems to be usable by people with disabilities. It is not the security principle being addressed by a data discrepancy.

D. Confidentiality: This principle focuses on preventing the unauthorized disclosure of sensitive information. The customer's pricing data was incorrect, not leaked to an unauthorized party.

1. University Courseware: Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278-1308. In Section I.A.1, "Design Principles," the paper, a foundational text often cited in university security courses (e.g., MIT), implicitly addresses integrity by discussing mechanisms to prevent unauthorized modification of data, which is the root of the inconsistency described. (DOI: https://doi.org/10.1109/PROC.1975.9939)

2. Academic Publication: Pfleeger, C. P., & Pfleeger, S. L. (2003). Security in Computing (3rd ed.). Prentice Hall. In Chapter 1, Section 1.2, "The Meaning of Computer Security," integrity is defined as ensuring data is not modified improperly. The scenario's price change is a form of improper data modification, whether accidental or malicious.

3. Official Vendor/Government Documentation: National Institute of Standards and Technology (NIST). (2021). Special Publication 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. In Appendix F, "Security Control Baselines," the Integrity (SI) control family is dedicated to protecting the integrity of information and systems. The scenario directly relates to control SI-7, "Software, Firmware, and Information Integrity," which aims to detect unauthorized changes to information. (DOI: https://doi.org/10.6028/NIST.SP.800-53r5)

The National Council of Examiners for Engineering and Surveying (NCEES) is the organization responsible for developing, administering, and scoring the examinations used for engineering licensure in the United States. This includes the Principles and Practice of Engineering (PE) exam for Software Engineering. This specific license is critical for professionals who develop software for safety-critical systems, such as health and safety applications, as it demonstrates a required level of competence to protect the public. While individual state boards grant the actual license, they rely on the standardized examinations and criteria established by NCEES.

A. The National Society of Professional Engineers (NSPE) is a professional association that advocates for licensed engineers but does not issue licenses.

B. The Accreditation Board for Engineering and Technology (ABET) accredits university engineering programs; it does not license individual engineers.

C. The American Society for Engineering Education (ASEE) is a professional society focused on advancing education in engineering, not on professional licensure.

1. National Council of Examiners for Engineering and Surveying (NCEES). (2019). PE Software Engineering Exam Specifications. NCEES. p. 1. Retrieved from the NCEES website. The document outlines the exam content, with Section IV, "Software Safety," explicitly covering topics like safety-critical systems and hazard analysis, which are central to health and safety software.

2. National Society of Professional Engineers (NSPE). "About NSPE." NSPE. Retrieved from the NSPE website. The organization's mission statement clarifies its role as a professional society for the "licensed Professional Engineer," distinguishing it from the licensing bodies themselves.

3. ABET. "About ABET." ABET, Inc. Retrieved from the ABET website. The site states, "We are a nonprofit, non-governmental organization that accredits college and university programs in the disciplines of applied and natural science, computing, engineering and engineering technology." This confirms its role is in academic accreditation, not individual professional licensing.

4. Van de Poel, I., & Royakkers, L. (2011). Ethics, Technology, and Engineering: An Introduction. Wiley-Blackwell. In Chapter 9, "The Social Responsibility of Engineers," the text discusses the structure of the engineering profession, noting that organizations like NCEES administer the exams required for licensure by state boards, while societies like NSPE focus on professional advocacy and ethics codes.

The consultant is a white hat hacker, also known as an ethical hacker. This classification applies to security professionals who are explicitly authorized by an organization to use hacking techniques to test and identify vulnerabilities in their systems. The consultant was hired for this purpose, and their actions, such as using SQL injection in a controlled test, were performed with permission to improve the organization's cyberdefenses. The intent is constructive and defensive, which is the defining characteristic of a white hat hacker.

A. Cybercriminal: A cybercriminal engages in illegal activities for financial gain. The consultant's actions were legal, authorized, and contractual, not criminal.

C. Cyberterrorist: A cyberterrorist is motivated by political or ideological goals to cause widespread disruption or fear. The consultant's motive is professional security assessment.

D. Black hat hacker: A black hat hacker accesses systems without authorization and with malicious intent (e.g., theft, data destruction). The consultant had explicit permission.

---

1. Palmer, C. C. (2001). Ethical Hacking. IBM Systems Journal, 40(3), 769–780.

Reference: Page 770, Paragraph 2. The paper defines ethical hackers as individuals hired by companies to perform penetration tests. It states, "A company can hire an ethical hacker to perform a penetration test on its network... The ethical hacker is given a contract that specifies what he or she is to do." This directly aligns with the scenario.

DOI: https://doi.org/10.1147/sj.403.0769

2. Engebretson, P. (2013). The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy (2nd ed.). Syngress.

Reference: Chapter 1, "What Is Penetration Testing and Ethical Hacking?", Section "White, Black, and Gray," p. 5. The text explicitly defines a white-hat hacker as someone who "has the express consent of the system owner" to identify vulnerabilities, which perfectly describes the consultant in the question.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology.

Reference: Lecture 1: Introduction, Section "Who are the adversaries?". The lecture notes differentiate between adversaries, including "White hats / ethical hackers" who are "security professionals, find flaws for good." This contrasts with "Black hats / crackers" who "break into systems, steal data, hold for ransom." The consultant's role is clearly that of a white hat.

The Digital Millennium Copyright Act (DMCA) of 1998, specifically Title II, the Online Copyright Infringement Liability Limitation Act (OCILLA), created a "safe harbor" for online service providers, including ISPs. This provision protects them from direct liability for copyright infringement committed by their users. To qualify for this protection, providers must meet certain requirements, such as not having actual knowledge of the infringing activity and expeditiously removing or disabling access to infringing material upon receiving a valid notification (a "takedown notice") from a copyright holder. This framework balances the rights of copyright holders with the practical realities of operating an internet service.

B. The Copyright Term Extension Act, also known as the Sonny Bono Act, extended the duration of copyright protection; it does not address ISP liability.

C. The Digital Performance Right in Sound Recordings Act established royalties for the digital transmission of sound recordings, not general ISP safe harbors for user infringement.

D. The Leahy-Smith America Invents Act was a major reform of U.S. patent law, shifting to a "first-inventor-to-file" system, and is unrelated to copyright liability.

1. U.S. Copyright Office. (1998, December). The Digital Millennium Copyright Act of 1998: U.S. Copyright Office Summary. Section-by-Section Summary, Title II: Online Copyright Infringement Liability Limitation, pp. 5-9. This document explicitly states that Title II "creates a new section 512 of the Copyright Act to provide limitations on liability for copyright infringement by online service providers."

2. MIT Libraries. (n.d.). The Digital Millennium Copyright Act (DMCA). MIT Libraries Scholarly Publishing. In the section "Safe Harbor," it is explained that the DMCA "protects online service providers (OSPs) from being held liable for the copyright infringement of their users, as long as the OSP meets certain requirements."

3. Samuelson, P. (1999). Intellectual Property and the Digital Economy: Why the Anti-Circumvention Regulations Need to Be Revised. Berkeley Technology Law Journal, 14(1), 519-566. On page 523, the article discusses the DMCA's OCILLA provisions (Title II) as a key component that "provides safe harbors from copyright liability for online service providers for infringing acts of their users." https://doi.org/10.15779/Z383X83J5M