Free Ethics-In-Technology Practice Test Questions and Answers (2026)

Corporate Social Responsibility (CSR) is a business model by which companies make a concerted effort to operate in ways that enhance society and the environment. This includes ethical responsibilities, which involve going beyond legal requirements to do what is right, just, and fair. Providing parental leave benefits that exceed legal mandates is a direct example of a company fulfilling its ethical and social responsibilities to its employees, a key stakeholder group. This action demonstrates a commitment to employee well-being and work-life balance, which are central tenets of the social dimension of CSR.

A. Ethics code: An ethics code is a formal document outlining principles and guidelines for conduct. The action of providing benefits is an application of such principles, not the code itself.

C. Supply chain sustainability: This concept focuses on the environmental and social impacts of a company's supply chain, from sourcing materials to product delivery, not internal employee benefits.

D. Integrity: While the organization is acting with integrity (adherence to moral principles), CSR is the specific business framework that encompasses such voluntary, socially beneficial actions toward stakeholders.

1. Carroll, A. B. (1991). The pyramid of corporate social responsibility: Toward the moral management of organizational stakeholders. Business Horizons, 34(4), 39-48. In this foundational model, "Ethical Responsibilities" (p. 41) are defined as activities and practices expected by society but not codified into law, which includes providing a higher level of benefits than legally required.

2. MIT Sloan School of Management. (2017). Corporate Social Responsibility (CSR). MIT OpenCourseWare, 15.S21. This courseware defines CSR as actions that appear to further some social good, beyond the interests of the firm and that which is required by law. Providing enhanced employee benefits fits this definition.

3. McWilliams, A., & Siegel, D. (2001). Corporate social responsibility: A theory of the firm perspective. Academy of Management Review, 26(1), 117-127. This article defines CSR as "actions that appear to further some social good, beyond the interests of the firm and that which is required by law" (p. 117), directly aligning with the scenario. https://doi.org/10.5465/amr.2001.4011987

A trade secret is a form of intellectual property that comprises confidential business information giving a company a competitive advantage. The software company's predictive algorithm is a process or formula that is valuable precisely because it is not generally known to competitors. By keeping the refinements and updates unannounced, the company is actively taking steps to maintain the secrecy of this information, which is the essential characteristic of a trade secret. The algorithm's role in making the product a "market leader" confirms its commercial value derived from secrecy.

A. Tradecraft refers to the methods and techniques used in espionage and intelligence operations, not commercial intellectual property protection.

C. Trade dress protects the visual appearance and overall look of a product or its packaging, not its underlying functional technology or algorithms.

D. A trademark protects brand identifiers such as names, logos, or slogans that distinguish one company's goods or services from another's.

1. World Intellectual Property Organization (WIPO). (n.d.). Trade secrets. WIPO. In the section "What is a trade secret?", it is defined as "IP rights on confidential information" that "has commercial value because it is secret" and the holder has taken "reasonable steps to keep it secret." The scenario's algorithm and the company's actions align directly with this definition.

2. Cornell Law School Legal Information Institute (LII). (n.d.). Trade Secret. Wex Legal Dictionary. The LII defines a trade secret under the Uniform Trade Secrets Act as information, including a "formula, pattern, compilation, program, device, method, technique, or process," that derives independent economic value from not being generally known and is the subject of efforts to maintain its secrecy.

3. Pooley, J. (2015). The Uniform Trade Secrets Act. In Intellectual Property and the New Technological Age: 2015. Berkeley Technology Law Journal. Chapter 5, Section A, pp. 215-216. This text clarifies that software algorithms are a classic example of subject matter that can be protected as a trade secret, as opposed to trademarks or trade dress which protect branding and appearance.

The behavior described is best classified as industrial espionage. This term refers to the illegal or unethical theft of trade secrets and proprietary information from a business competitor for commercial purposes. In this scenario, the sibling illicitly copied the source code—a valuable trade secret and form of intellectual property—from a rival company to overcome a technical challenge and gain a competitive advantage. This action directly aligns with the definition of industrial espionage, which focuses on the acquisition of confidential business information through clandestine means.

A. Nepotism: This is the practice of showing favoritism to relatives, especially by giving them jobs. The scenario involves theft, not preferential treatment in employment.

B. Conflict of interest: This describes a situation where an individual's personal interests could compromise their professional duties. While a potential conflict exists for Employee A, the sibling's act of theft is espionage, not a conflict of interest itself.

D. Corruption: This is a broad term for dishonest conduct, often involving bribery or the abuse of an entrusted position for private gain. Industrial espionage is a more specific and accurate classification for stealing a competitor's trade secrets.

1. Nasheri, H. (2005). Economic Espionage and Industrial Spying. Cambridge University Press. In Chapter 1, "The Nature and Scope of Economic Espionage," industrial espionage is defined as "the unlawful or clandestine targeting or acquisition of sensitive financial, trade or economic policy information; proprietary economic information; or technological information" (p. 8). The theft of source code is a direct example of acquiring proprietary technological information.

2. Davis, M. (2021). "Conflict of Interest". In E. N. Zalta (Ed.), The Stanford Encyclopedia of Philosophy (Winter 2021 ed.). Section 1, "The Definition of 'Conflict of Interest'," defines it as "a set of conditions in which professional judgment concerning a primary interest (such as a patient’s welfare or the validity of research) tends to be unduly influenced by a secondary interest (such as financial gain)." This highlights that it is a situation, not the specific act of theft.

3. Bellow, A. (2003). In Praise of Nepotism: A Natural History. Doubleday. Chapter 1, "Defining Nepotism," establishes the term as favoritism granted to relatives in various fields, particularly regarding appointments or employment, which is not the subject of the scenario.

4. Heidenheimer, A. J., & Johnston, M. (Eds.). (2002). Political Corruption: Concepts and Contexts. Transaction Publishers. In the introduction (p. 6), corruption is broadly defined in a public context as behavior that "deviates from the formal duties of a public role because of private-regarding (personal, close family, private clique) pecuniary or status gains." While the concept can be applied to the private sector, it is less precise for this scenario than industrial espionage.

The act described is doxing, which involves researching and publicly broadcasting an individual's private and identifiable information without their consent and with malicious intent. In this scenario, the hacker illegally obtained sensitive, private health records and published them online for revenge. This action is a direct violation of the employee's privacy, intended to cause harm, embarrassment, and public exposure, which are the defining characteristics of a doxing attack.

A. Anonymous expression refers to communicating without revealing one's identity. The core issue here is the malicious publication of private data, not the anonymity of the perpetrator.

C. Hate speech is defined as an attack on a person or group based on protected attributes like race or religion. The scenario describes personal revenge, not a group-based attack.

D. Libel involves publishing a false statement that damages a reputation. The hacker published presumably true health records, making the act a privacy violation, not defamation.

1. Douglas, M. K. (2016). Doxing: A conceptual analysis. Ethics and Information Technology, 18(3), 199–210. In Section 3, "A Conceptual Analysis of Doxing," the author defines doxing as "the practice of retrieving, compiling, and publishing other individuals’ personal identification information online without their consent" (p. 201). https://doi.org/10.1007/s10676-016-9406-0

2. Citron, D. K. (2016). Regulating Doxing. Washington University Law Review, 93(5), 1003-1052. The article distinguishes doxing from defamation by noting that doxing involves the publication of "true, private facts," whereas defamation (libel) involves "false statements of fact" (p. 1010).

3. Cornell Law School Legal Information Institute (LII). (n.d.). Doxing. In Wex Legal Dictionary/Encyclopedia. Retrieved from https://www.law.cornell.edu/wex/doxing. The LII defines doxing as "the act of publicly revealing previously private personal information about an individual or organization, usually via the internet and without the subject's permission."

The specialist's action is considered ethical because it is guided by the principle of beneficence—the duty to act in the patient's best interest and save their life. In this emergency, the immediate and severe harm of the patient's potential death is weighed against the lesser harm of a privacy violation, making the action ethically justifiable. However, the action is illegal (or at least a serious policy violation with legal implications) because the specialist intentionally circumvented established privacy policies, which are often mandated by laws such as the Health Insurance Portability and Accountability Act (HIPAA). This creates a direct conflict between a core ethical duty and a legal obligation.

A. Unethical and legal: This is incorrect. The action is ethically motivated by the desire to save a life, and it is illegal because it violates established privacy rules.

B. Unethical and illegal: This is incorrect because the primary motivation to preserve life is a fundamental ethical imperative in medicine, making the action ethical in its intent.

C. Ethical and legal: This is incorrect. While the action is ethical, the explicit circumvention of privacy policies makes it illegal or, at minimum, a severe violation of legally mandated regulations.

1. Beauchamp, T. L., & Childress, J. F. (2019). Principles of Biomedical Ethics (8th ed.). Oxford University Press. In Chapter 6, "The Principle of Beneficence," the authors detail the obligation of healthcare professionals to act for the benefit of others, which includes protecting and defending the rights of others, preventing harm, and rescuing persons in danger (pp. 202-204). This supports the ethical justification for the specialist's action.

2. U.S. Department of Health & Human Services (HHS). (2008). Disclosures for Emergency Preparedness: A Decision Tool. This official guidance clarifies that while the HIPAA Privacy Rule allows for disclosures in emergencies, it must be done within specific legal parameters. The scenario's use of the term "circumvent" implies the specialist acted outside these established legal provisions, thus rendering the action illegal. The tool is available on the HHS website under HIPAA guidance for professionals.

3. Magnus, D., & Cho, M. K. (Eds.). (2019). Stanford University, Center for Biomedical Ethics, Bioethics and Medical Humanities - Case Studies. While not a single document, the case study methodology used in this program frequently explores conflicts between ethical principles (like beneficence) and legal/institutional rules (like privacy policies), illustrating that actions can be ethically sound but legally problematic. A common theme is that acting in a patient's best interest may sometimes require violating a rule.

A zero-day exploit targets a previously unknown software vulnerability. Because the vulnerability is unknown to the software vendor, no patch exists, and signature-based security tools like antivirus are unaware of the threat. The scenario describes a fully patched and updated computer being compromised without any user error and without detection by antivirus software. This perfectly aligns with the characteristics of a zero-day attack, which bypasses conventional, signature-based, and patch-dependent security measures by exploiting a flaw for which no defense has yet been developed.

A. Blended threat: This describes malware combining multiple attack types (e.g., worm, virus). It does not explain how a fully patched system was initially compromised.

B. Trojan horse: This method requires the user to be deceived into running malicious software disguised as a legitimate program, which the scenario explicitly rules out.

C. Spear phishing: This is a social engineering attack that relies on tricking a specific user into taking an action, which the worker in the scenario did not do.

1. National Institute of Standards and Technology (NIST). (n.d.). Glossary: Zero Day Exploit. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary/term/zerodayexploit.

Reference Point: The NIST glossary defines a zero-day exploit as "An exploit that takes advantage of a zero-day vulnerability," and a zero-day vulnerability as one "for which a patch is not available." This directly supports the conclusion that an attack on a fully patched system points to a zero-day.

2. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004

Reference Point: Section 3, "The cyber security environment," discusses new-generation threats, including zero-day attacks, which are characterized by their ability to bypass traditional security measures because they are unknown to defenders.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology.

Reference Point: Lecture 1: "Threat models," discusses the nature of vulnerabilities and exploits. The lecture materials explain that exploits target vulnerabilities, and a zero-day exploit is one that targets a vulnerability before a patch is released, making it effective against systems that are otherwise considered "up-to-date."

Using a limited and familiar set of zip codes introduces significant sampling bias. This constitutes a small sample size (or more accurately, a non-representative sample), leading to an algorithm that is not generalizable and will perform unfairly or inaccurately when applied to a broader population.

Furthermore, because demographic characteristics like race and socioeconomic status are often correlated with geographic location (zip codes), using this data can lead to proxy discrimination. The algorithm may learn to use the zip code as a stand-in for a protected characteristic, resulting in discriminatory outcomes against individuals from unrepresented or different zip codes.

A. Privacy violation: The data is specified as "publicly available," which makes direct privacy violation a less immediate or primary ethical concern compared to the biases introduced by the flawed data selection method.

B. Predictive coding: This is a technical term for a machine learning process used to classify data. It is a method, not an inherent ethical concern itself. The ethical issue lies in the biased data used for training.

1. Barocas, S., & Selbst, A. D. (2016). Big Data's Disparate Impact. California Law Review, 104(3), 671-732. In Section II.A, "Proxies," the authors explain how seemingly neutral attributes like zip codes can serve as proxies for protected classes, leading to proxy discrimination (p. 683). https://doi.org/10.15779/Z38BG31

2. Mehrabi, N., Morstatter, F., Saxena, N., Lerman, K., & Galstyan, A. (2021). A Survey on Bias and Fairness in Machine Learning. ACM Computing Surveys, 54(6), Article 115. Section 3.1.1, "Sample/Selection Bias," details how non-representative data samples, such as those from specific geographic locations, cause models to be biased and perform poorly when generalized. https://doi.org/10.1145/3457607

3. Stanford University. (CS 182: Ethics, Public Policy, and Technological Change). Course materials discuss how biased datasets, resulting from unrepresentative sampling, are a primary source of algorithmic unfairness and discriminatory outcomes. The concept of proxy variables like zip codes is a key topic in lectures on algorithmic bias.

The Gramm-Leach-Bliley Act's (GLBA) Financial Privacy Rule directly addresses this scenario. This rule mandates that financial institutions provide customers with a clear and conspicuous privacy notice that explains what nonpublic personal information (NPI) they collect and with whom they share it. Most importantly, this rule gives customers the right to "opt-out," or direct the institution not to share their NPI with certain nonaffiliated third parties. This opt-out provision is the specific process that allows the customer to control the sharing of their mortgage information for marketing purposes as described in the scenario.

B. Pretexting: This provision makes it illegal to obtain customer information from financial institutions under false pretenses; it does not govern legitimate data sharing.

C. Consumer protection: This is a broad legal concept, not a specific rule within GLBA. The Financial Privacy Rule is the specific provision that provides this particular consumer protection.

D. Safeguards: The Safeguards Rule requires institutions to have a security plan to protect customer data from unauthorized access; it does not address the customer's right to control sharing.

---

1. Federal Trade Commission (FTC). How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act. Section: "The privacy notice" and "The right to opt out." The FTC documentation states, "The privacy notice must explain that you may share the information with nonaffiliated third parties... You must give your consumer a reasonable opportunity to opt out before you share their NPI with nonaffiliated third parties." This directly supports the customer's ability to control information sharing.

Source Document: FTC's official compliance guide for the GLBA Privacy Rule.

2. Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801-6809. Subchapter I—Disclosure of Nonpublic Personal Information, § 6802. Obligations with respect to disclosures of personal information. This section of the law codifies the opt-out requirement, stating that a financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless the institution provides the consumer with a notice and the consumer has not elected to opt out of the disclosure.

3. Litan, R. E. (2000). The Gramm-Leach-Bliley Act: A Boost to Financial Services Competition. Brookings Institution Policy Brief #67. Page 3, Paragraph 2. "The act contains several consumer protection provisions. The most significant of these requires all financial institutions to disclose their privacy policies to their customers and, subject to certain exceptions, to give them the opportunity to 'opt out' of having their confidential personal information shared with non-affiliated third parties."

Source Document: Brookings Policy Brief #67.

The bias was introduced because the historical "nationwide information from the last 20 years" represents a skewed sample. This type of data often reflects long-standing societal biases, such as disproportionate rates of arrest, diagnosis, or reporting for drug and alcohol use among minority populations. When the AI system is trained on this data, which is not representative of the true prevalence of the disorder across all demographics, it learns and codifies these existing prejudices. The model then perpetuates this historical bias by creating plans that unfairly disadvantage minorities, mistaking the skewed data for objective reality.

A. Size disparity: While the dataset might have an unequal number of examples for different groups, the fundamental issue is that the sample itself is unrepresentative of reality, not just imbalanced.

C. Proxy data: The problem stems from the entire dataset being a biased reflection of the world, not from the specific use of one variable as a substitute for a protected characteristic.

D. Limited features: The issue is the biased quality and unrepresentative nature of the data used for training, not a lack of sufficient variables or attributes within the dataset.

1. Barocas, S., & Selbst, A. D. (2016). Big Data's Disparate Impact. California Law Review, 104(3), 671-732. In Section II.A, "Skewed Sample" (p. 677), the authors explain that training data is often a "skewed sample of the world" because it reflects existing patterns of inequality and discrimination, which a model will then learn and reproduce.

2. Corbett-Davies, S., & Goel, S. (2018). The Measure and Mismeasure of Fairness: A Critical Review of Fair Machine Learning. Proceedings of the 2018 AAAI/ACM Conference on AI, Ethics, and Society. Section 2.1 discusses how sampling bias occurs when the training population is not representative of the target population, leading to biased models. Historical data on policing and justice is a classic example of this phenomenon. DOI: https://doi.org/10.1145/3278721.3278728

3. Mitchell, S., et al. (2021). Algorithmic Fairness: Choices, Assumptions, and Definitions. Annual Review of Statistics and Its Application, 8, 141-163. Section 3, "Sources of Harm," details how historical bias embedded in data is a primary source of algorithmic unfairness, as models trained on such data will replicate past discriminatory patterns. DOI: https://doi.org/10.1146/annurev-statistics-042720-125902

The scenario describes a classic Denial-of-Service (DoS) attack. The objective of a DoS attack is to make a computer or network resource unavailable to its legitimate users by overwhelming it with a flood of traffic or malicious requests. The use of "several computers" indicates a Distributed Denial-of-Service (DDoS) attack, a common and powerful form of DoS. The malicious hacker coordinates these compromised machines (a botnet) to collectively send high volumes of data, exhausting the target's resources (e.g., bandwidth, CPU, memory) and preventing it from serving legitimate requests.

A. Zero-day exploit: This is an attack that leverages a previously unknown vulnerability in software. The scenario describes a traffic flood, not the exploitation of a specific software flaw.

B. Ransomware: This is a type of malicious software that encrypts a victim's data and demands a ransom for its release. The attack described does not involve data encryption.

D. Worm: This is a standalone malware program that replicates itself to spread to other computers. While a worm could be used to create the botnet, the attack itself is DoS.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). Section 2.3.3, "Denial of Service," p. 2-6. The document defines a DoS attack as "an action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU), memory, bandwidth, and disk space."

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 8.2, "Principles of Secure Networking," discusses Denial-of-Service attacks, describing them as attacks that render a network, host, or other piece of infrastructure unusable by legitimate users by flooding the resource with bogus traffic.

3. Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. MIT OpenCourseWare. Chapter 11, "Security and Protection," Section 11.6.2, "Denial of Service," p. 438. This text explains that DoS attacks aim to "prevent legitimate users from getting service" by consuming a critical, non-shareable resource.

Human developers are a primary, though often unintended, source of bias in AI algorithms. Their personal, cognitive, and societal biases can be unintentionally embedded at every stage of the AI development lifecycle. This includes the initial problem formulation, the selection and labeling of training data, the choice of features and algorithms, and the interpretation of results. Because developers' worldviews and assumptions shape the system's design and the data it learns from, their inherent biases become encoded in the AI's logic, leading to skewed or unfair outcomes.

A. Tainted examples: This is a direct cause of bias, but it is often a symptom or result of human bias in the data collection and selection process, rather than the ultimate source.

B. Excessive validation sample sizes: A large validation set is generally beneficial for assessing a model's generalization capabilities and does not inherently introduce bias. Small or unrepresentative samples are the problem.

D. Excessive training sample sizes: A large quantity of training data is typically advantageous. The source of bias is the quality and representativeness of the data, not its sheer volume.

1. Mehrabi, N., Morstatter, F., Saxena, N., Lerman, K., & Galstyan, A. (2021). A Survey on Bias and Fairness in Machine Learning. ACM Computing Surveys, 54(6), 1–35. In Section 2.2, "Human Bias," the authors state, "Bias can arise from a human’s cognitive, personal, and institutional biases... This can influence the data generation process, the algorithm design, and the evaluation process." This identifies the human element as a core source of bias that permeates the entire system. (DOI: https://doi.org/10.1145/3457607)

2. Suresh, H., & Guttag, J. V. (2021). A Framework for Understanding Sources of Harm throughout the Machine Learning Life Cycle. In Equity and Access in Algorithms, Mechanisms, and Optimization (EAAMO '21). This framework details how human choices and biases introduce harm at every stage, including data collection (leading to "tainted examples") and model development. It positions human-driven processes as the origin of these issues. (DOI: https://doi.org/10.1145/3465416.3483305)

3. Friedman, B., & Nissenbaum, H. (1996). Bias in Computer Systems. ACM Transactions on Information Systems, 14(3), 330–347. This foundational paper identifies three categories of bias, including "preexisting bias," which is rooted in social institutions, practices, and attitudes. Human developers, as members of society, carry and can embed these biases into systems. (DOI: https://doi.org/10.1145/230538.230561)

The core issue described is a discrepancy in data—the price shown on the order form is different from the price in the confirmation email. This inconsistency represents a failure of data integrity. Integrity, a fundamental principle of information security, ensures that data is accurate, consistent, and trustworthy throughout its lifecycle. It guards against unauthorized or improper modification of information. By reporting the different pricing, the customer is directly addressing this lack of data integrity in the e-commerce system's transaction records.

A. Availability: This principle concerns ensuring timely and reliable access to systems and data. The system was available for the customer to place an order, so this is not the issue.

C. Accessibility: This term typically refers to designing systems to be usable by people with disabilities. It is not the security principle being addressed by a data discrepancy.

D. Confidentiality: This principle focuses on preventing the unauthorized disclosure of sensitive information. The customer's pricing data was incorrect, not leaked to an unauthorized party.

1. University Courseware: Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278-1308. In Section I.A.1, "Design Principles," the paper, a foundational text often cited in university security courses (e.g., MIT), implicitly addresses integrity by discussing mechanisms to prevent unauthorized modification of data, which is the root of the inconsistency described. (DOI: https://doi.org/10.1109/PROC.1975.9939)

2. Academic Publication: Pfleeger, C. P., & Pfleeger, S. L. (2003). Security in Computing (3rd ed.). Prentice Hall. In Chapter 1, Section 1.2, "The Meaning of Computer Security," integrity is defined as ensuring data is not modified improperly. The scenario's price change is a form of improper data modification, whether accidental or malicious.

3. Official Vendor/Government Documentation: National Institute of Standards and Technology (NIST). (2021). Special Publication 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. In Appendix F, "Security Control Baselines," the Integrity (SI) control family is dedicated to protecting the integrity of information and systems. The scenario directly relates to control SI-7, "Software, Firmware, and Information Integrity," which aims to detect unauthorized changes to information. (DOI: https://doi.org/10.6028/NIST.SP.800-53r5)

The National Council of Examiners for Engineering and Surveying (NCEES) is the organization responsible for developing, administering, and scoring the examinations used for engineering licensure in the United States. This includes the Principles and Practice of Engineering (PE) exam for Software Engineering. This specific license is critical for professionals who develop software for safety-critical systems, such as health and safety applications, as it demonstrates a required level of competence to protect the public. While individual state boards grant the actual license, they rely on the standardized examinations and criteria established by NCEES.

A. The National Society of Professional Engineers (NSPE) is a professional association that advocates for licensed engineers but does not issue licenses.

B. The Accreditation Board for Engineering and Technology (ABET) accredits university engineering programs; it does not license individual engineers.

C. The American Society for Engineering Education (ASEE) is a professional society focused on advancing education in engineering, not on professional licensure.

1. National Council of Examiners for Engineering and Surveying (NCEES). (2019). PE Software Engineering Exam Specifications. NCEES. p. 1. Retrieved from the NCEES website. The document outlines the exam content, with Section IV, "Software Safety," explicitly covering topics like safety-critical systems and hazard analysis, which are central to health and safety software.

2. National Society of Professional Engineers (NSPE). "About NSPE." NSPE. Retrieved from the NSPE website. The organization's mission statement clarifies its role as a professional society for the "licensed Professional Engineer," distinguishing it from the licensing bodies themselves.

3. ABET. "About ABET." ABET, Inc. Retrieved from the ABET website. The site states, "We are a nonprofit, non-governmental organization that accredits college and university programs in the disciplines of applied and natural science, computing, engineering and engineering technology." This confirms its role is in academic accreditation, not individual professional licensing.

4. Van de Poel, I., & Royakkers, L. (2011). Ethics, Technology, and Engineering: An Introduction. Wiley-Blackwell. In Chapter 9, "The Social Responsibility of Engineers," the text discusses the structure of the engineering profession, noting that organizations like NCEES administer the exams required for licensure by state boards, while societies like NSPE focus on professional advocacy and ethics codes.

The consultant is a white hat hacker, also known as an ethical hacker. This classification applies to security professionals who are explicitly authorized by an organization to use hacking techniques to test and identify vulnerabilities in their systems. The consultant was hired for this purpose, and their actions, such as using SQL injection in a controlled test, were performed with permission to improve the organization's cyberdefenses. The intent is constructive and defensive, which is the defining characteristic of a white hat hacker.

A. Cybercriminal: A cybercriminal engages in illegal activities for financial gain. The consultant's actions were legal, authorized, and contractual, not criminal.

C. Cyberterrorist: A cyberterrorist is motivated by political or ideological goals to cause widespread disruption or fear. The consultant's motive is professional security assessment.

D. Black hat hacker: A black hat hacker accesses systems without authorization and with malicious intent (e.g., theft, data destruction). The consultant had explicit permission.

---

1. Palmer, C. C. (2001). Ethical Hacking. IBM Systems Journal, 40(3), 769–780.

Reference: Page 770, Paragraph 2. The paper defines ethical hackers as individuals hired by companies to perform penetration tests. It states, "A company can hire an ethical hacker to perform a penetration test on its network... The ethical hacker is given a contract that specifies what he or she is to do." This directly aligns with the scenario.

DOI: https://doi.org/10.1147/sj.403.0769

2. Engebretson, P. (2013). The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy (2nd ed.). Syngress.

Reference: Chapter 1, "What Is Penetration Testing and Ethical Hacking?", Section "White, Black, and Gray," p. 5. The text explicitly defines a white-hat hacker as someone who "has the express consent of the system owner" to identify vulnerabilities, which perfectly describes the consultant in the question.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology.

Reference: Lecture 1: Introduction, Section "Who are the adversaries?". The lecture notes differentiate between adversaries, including "White hats / ethical hackers" who are "security professionals, find flaws for good." This contrasts with "Black hats / crackers" who "break into systems, steal data, hold for ransom." The consultant's role is clearly that of a white hat.

The Digital Millennium Copyright Act (DMCA) of 1998, specifically Title II, the Online Copyright Infringement Liability Limitation Act (OCILLA), created a "safe harbor" for online service providers, including ISPs. This provision protects them from direct liability for copyright infringement committed by their users. To qualify for this protection, providers must meet certain requirements, such as not having actual knowledge of the infringing activity and expeditiously removing or disabling access to infringing material upon receiving a valid notification (a "takedown notice") from a copyright holder. This framework balances the rights of copyright holders with the practical realities of operating an internet service.

B. The Copyright Term Extension Act, also known as the Sonny Bono Act, extended the duration of copyright protection; it does not address ISP liability.

C. The Digital Performance Right in Sound Recordings Act established royalties for the digital transmission of sound recordings, not general ISP safe harbors for user infringement.

D. The Leahy-Smith America Invents Act was a major reform of U.S. patent law, shifting to a "first-inventor-to-file" system, and is unrelated to copyright liability.

1. U.S. Copyright Office. (1998, December). The Digital Millennium Copyright Act of 1998: U.S. Copyright Office Summary. Section-by-Section Summary, Title II: Online Copyright Infringement Liability Limitation, pp. 5-9. This document explicitly states that Title II "creates a new section 512 of the Copyright Act to provide limitations on liability for copyright infringement by online service providers."

2. MIT Libraries. (n.d.). The Digital Millennium Copyright Act (DMCA). MIT Libraries Scholarly Publishing. In the section "Safe Harbor," it is explained that the DMCA "protects online service providers (OSPs) from being held liable for the copyright infringement of their users, as long as the OSP meets certain requirements."

3. Samuelson, P. (1999). Intellectual Property and the Digital Economy: Why the Anti-Circumvention Regulations Need to Be Revised. Berkeley Technology Law Journal, 14(1), 519-566. On page 523, the article discusses the DMCA's OCILLA provisions (Title II) as a key component that "provides safe harbors from copyright liability for online service providers for infringing acts of their users." https://doi.org/10.15779/Z383X83J5M