Introduction to Cyberlaw: How to Answer the Cybersecurity Ethics Code of Conduct Discussion Questions
A question-by-question guide to the four Introduction to Cyberlaw ethics discussion prompts — what each question is actually testing, how to engage the Flechais & Chalhoub (2023) paper as evidence, how to structure a position on mandatory vs. voluntary codes of conduct, and how to handle the personal ethics vs. organizational ethics tension without writing a generic opinion piece.
You have read Flechais and Chalhoub’s 2023 paper Practical Cybersecurity Ethics: Mapping CyBOK to Ethical Concerns and you are looking at four discussion questions that sit at the intersection of law, professional practice, and personal moral reasoning. These questions are not asking you to summarize the paper — they are asking you to take a defensible position on contested issues and support that position with evidence from the reading and from your own reasoning. That combination is harder to do well than it looks, particularly on Questions 3 and 4, which require genuine self-reflection rather than abstract analysis.
This guide does not write the responses for you. It explains what each question is actually testing, what the paper offers as evidence, which arguments are strongest on each side, and how to structure a response that the marker will recognize as analytically developed rather than surface-level opinion. The four questions build on each other — the position you take on Question 1 has direct implications for Questions 2, 3, and 4, so reading this guide in sequence before writing anything is worthwhile.
What This Guide Covers
Understanding the Assignment’s Structure and Stakes
The four questions are a structured ethics discussion, not a research essay and not a case brief. The key distinction matters for how you write: you are expected to take a clear position on each question and defend it using reasoning and evidence, including evidence from the Flechais & Chalhoub paper. Responses that only describe the problem without committing to a position — or that present every side without concluding anything — score at the lower end regardless of how thorough the description is.
Questions 1 and 2 are policy questions — they ask whether something should be required, and by whom. Questions 3 and 4 are personal ethics questions — they ask what you would do and what you believe. The shift from the first pair to the second pair is intentional: the assignment is testing whether you can move between systemic analysis (policy level) and individual moral reasoning (personal level) and whether your answers at both levels are consistent with each other. An answer to Question 4 that contradicts your answer to Question 3 without acknowledging the tension is a structural weakness.
A discussion question in a cyberlaw or ethics course expects you to engage with the complexity of the issue — acknowledging the strongest argument against your position before explaining why your position is still more defensible. A response that only presents one side without acknowledging the tension reads as incomplete reasoning. A response that presents both sides and then reaches a reasoned conclusion demonstrates the analytical thinking the assignment rewards. The paper itself is structured around tension — the gap between what ethical research recommends and what professional practice currently delivers — and your responses should reflect that same awareness of competing considerations.
How to Use the Flechais & Chalhoub Paper as Evidence
The paper by Flechais and Chalhoub is a qualitative study based on 15 interviews with cybersecurity professionals. It uses the Cyber Security Body of Knowledge (CyBOK) as a framework to map ethical challenges across different areas of cybersecurity practice — from confidentiality dilemmas and data breach disclosure to AI accountability and the limits of existing professional codes of conduct. It concludes that current codes of practice are too broad to help practitioners navigate specific ethical dilemmas, and that more detailed, area-specific ethical guidance is needed.
When you cite this paper in your responses, you are not just dropping a reference — you are using its findings as evidence for your argument. Each of the four discussion questions maps onto something specific in the paper, and identifying that specific finding before you write strengthens your response considerably.
| Discussion Question | Most Relevant Section in the Paper | Key Finding to Draw On |
|---|---|---|
| Q1 — Should organizations be required to create a Code of Conduct? | Section 2.4 (Professional Codes of Practice) and Section 5.4 (Implications for Professional Practice) | Existing codes from the ACM, ISSA, and UK Cyber Security Council are too broad and do not address the specific ethical dilemmas professionals face in particular areas of practice. Participants in the study encountered real dilemmas that current codes did not help resolve. |
| Q2 — Should a Code of Conduct be legislated or voluntary? | Section 5.4 and the comparison to medical ethics | The authors draw an analogy with medical ethics regulation — noting that in medicine, violation of ethical codes can lead to disciplinary proceedings and loss of license. They suggest this model deserves consideration for cybersecurity, while also acknowledging the complexity of legislating ethics in a rapidly evolving technical field. |
| Q3 — Should you report a non-illegal violation? | Section 4.1.1 (Maintaining Confidentiality), Section 4.2.1 (Ethical Hacking), and Section 5.1 (Ethics of Cybersecurity Decision-Making) | Participants described genuine dilemmas about when to break confidentiality — including a security engineer who framed the threshold as harm to human life. The paper notes that decision-making in cybersecurity is always subjective, objective, and affective simultaneously. |
| Q4 — Should organizational ethics override your personal ethics? | Section 4.1.2 (Business vs. Security Conflicts), Section 4.4.2 (Vulnerability Patching Priorities), and Section 5.2 (Decisions in Cybersecurity Professions) | Participants described conflicts between company interests and customer/public interests — including companies that prioritized reputation management over breach disclosure. The paper notes the potential for personal conflicts of interest when organizational decisions produce negative personal outcomes but benefit others, or vice versa. |
The paper describes what cybersecurity professionals experience and what the authors recommend — but it does not answer Questions 3 and 4, which ask what you believe and would do. Your task is to use the paper as evidence that supports your own position, not to report what the paper concludes. A response that only summarizes the paper’s findings without developing your own argument fails the assignment’s requirement for personal analysis and reflection, particularly on the ethics questions.
Question 1: Should Organizations Be Required to Create a Code of Conduct for Cybersecurity Personnel?
This question asks whether the requirement should exist — not whether organizations would do it well, or whether you trust them to do it. The distinction matters: you could believe organizations would implement poor codes of conduct and still argue that the requirement itself is necessary and worthwhile. Your response needs to decide first whether you are arguing for or against mandatory codes, then support that position with reasoning.
What the Question Is Really Testing
The question is testing your understanding of the gap between professional ethics in theory and in practice — which is exactly what Flechais and Chalhoub identify as the central problem their paper addresses. A strong response recognizes that the question has real stakes: cybersecurity personnel have access to sensitive data, can monitor individuals, can limit system access during incidents, and can choose whether to disclose vulnerabilities or breaches. The ethical implications of those powers are significant, and the question of whether organizations should be formally required to establish conduct standards for them is a live regulatory debate.
Building the Pro-Requirement Argument
The case for requiring organizations to create a Code of Conduct rests on three pillars: the scale of potential harm from unethical cybersecurity practice, the demonstrated inadequacy of existing voluntary codes, and the precedent from analogous professional fields.
Arguments Supporting Mandatory Codes of Conduct
- Power asymmetry: Cybersecurity teams have access to privileged information and the ability to take actions that affect large numbers of people — employees, customers, third parties. Flechais and Chalhoub open their paper by noting that this power should come with clear ethical oversight, but in practice it does not.
- Evidence of real harm without guidance: The paper’s interview findings document specific cases where professionals faced ethical dilemmas and had no clear guidance — from the confidentiality-versus-harm disclosure dilemma (P07) to the business-interest-versus-breach-disclosure conflict (P01). These are not hypothetical problems; they are experienced by working professionals.
- Inadequacy of industry-wide codes: The ACM Code of Ethics and ISSA Code of Ethics are both acknowledged in the paper as “very broad” and insufficient for navigating the specific ethical dilemmas that arise in particular areas of cybersecurity. An organization-level code can be tailored to the specific risks and responsibilities of that organization’s cybersecurity team in a way that a generalist professional code cannot.
- Size is not a meaningful distinction: Small organizations often have less cybersecurity oversight infrastructure than large ones, which arguably increases the risk of unethical practices going unnoticed. Requiring small organizations to create a code of conduct — even a minimal one — creates accountability where there currently may be none.
Building the Counter-Argument and How to Respond to It
The strongest counter-argument is that a required code of conduct risks becoming a compliance exercise — organizations create the document to satisfy the requirement without embedding it in actual practice. This is a genuine concern and deserves acknowledgment. However, the response to it is not to abandon the requirement but to argue that the requirement must specify how the code is implemented and evaluated, not just that it exists. A code of conduct that includes specific guidance for the types of ethical dilemmas that arise in that organization’s practice — rather than generic principles — is both more useful and harder to implement as pure formality.
Weak Response Structure
“Organizations should have a code of conduct because cybersecurity is important and ethics matter. Small organizations might find it difficult but they should try.”
Strong Response Structure
Acknowledge the specific problem (existing codes are too broad to address practice-level dilemmas), state a clear position (yes, organizations should be required), support it with evidence from the paper’s findings (interview data showing dilemmas that current codes did not resolve), address the strongest objection (compliance theater), and explain why the requirement should still be made despite that risk.
Question 2: Should a Code of Conduct Be Legislated and/or Mandated by Government, or Remain Voluntary?
Question 2 follows directly from Question 1. If you argued in Q1 that organizations should be required to create a code of conduct, Q2 asks who does the requiring — government mandate or professional/market pressure? If you argued in Q1 that it should remain optional, Q2 essentially asks you to explain the mechanism for voluntary adoption. Be aware that your answer to Q2 must be logically consistent with your answer to Q1.
The Legislative Mandate Position
The argument for government legislation draws on the medical ethics analogy that Flechais and Chalhoub explicitly raise in Section 5.4. The General Medical Council in the UK (and analogous bodies in other jurisdictions) can revoke a practitioner’s license for violations of the code — a mechanism that gives the code genuine teeth. The authors suggest considering whether cybersecurity ethics codes could carry similar consequences. Supporting this position means engaging with what that regulatory framework would actually look like, including who enforces it, what counts as a violation, and how enforcement interacts with the technical complexity of cybersecurity practice.
Arguments for Legislative Mandate
Government mandate creates uniform baseline standards across all organizations — preventing the race-to-the-bottom dynamic where organizations that invest in ethics are at a competitive disadvantage against those that do not.
- Creates enforcement mechanism with real consequences — not just reputational
- Precedent exists in adjacent fields: GDPR mandates data protection practices; HIPAA mandates healthcare data security; FISMA mandates federal agency information security programs
- Professional licensing in medicine shows that regulatory ethics frameworks can coexist with a technically complex profession
- Organizations demonstrated they will not self-regulate adequately — the paper notes companies that delayed breach disclosure to manage reputational damage rather than addressing the underlying security failure
Arguments for Voluntary Adoption
Legislation risks creating inflexible requirements in a field that evolves faster than the legislative process can keep pace with — specifically relevant given the paper’s findings on AI in cybersecurity.
- Cybersecurity practices and threats evolve rapidly; legislated codes can become outdated and counterproductive
- Compliance-oriented cultures can produce “checkbox ethics” — organizations meet the legal standard without developing genuine ethical judgment
- Professional bodies like the ACM, UK Cyber Security Council, and FIRST already produce codes; the problem is adoption and detail, not legal status
- Industry-led codes can be updated faster and with more practitioner input than legislation
The Middle Ground and How to Handle It
A defensible middle position is a tiered or hybrid framework: certain baseline requirements legislated (analogous to data protection law) while detailed practice-level guidance is developed and updated by professional bodies. This mirrors how GDPR works — it mandates principles and minimum standards while leaving implementation detail to organizations and industry guidance. If you take this position, be specific about what the legislation mandates and what stays in professional codes — a response that just says “a combination of both” without specifying the division is not a position, it is avoidance.
[Legislated baseline] Require all organizations employing cybersecurity personnel to maintain and publish a Code of Conduct that covers at minimum: data breach disclosure timelines, handling of discovered illegal activity, third-party contractor standards, and AI system accountability. Violation consequences tied to existing data protection enforcement mechanisms.
[Professional code] Area-specific ethical guidance (penetration testing, incident response, infrastructure security, etc.) developed and updated by professional bodies — CyBOK provides the framework for this breakdown. Organizations required to adopt the relevant professional guidelines for their operational context or justify deviation from them.
This structure addresses the “rapidly evolving field” objection (professional codes stay current) while maintaining enforceable baseline standards (legislation). It is also directly supported by the paper’s recommendation that CyBOK be used to frame area-specific ethical guidance (Section 5.4).
Question 3: If You See a Violation in Your Workplace, Should You Report It Even If It Is Not Illegal?
This is the most personally demanding question in the set. The assignment instructions explicitly tell you to “think for a few minutes about your own moral code” before answering — which signals that the grader is looking for genuine self-reflection, not a theoretical argument about whistleblowing in the abstract. At the same time, your personal moral reasoning should be supported by evidence and logic, not just assertion. The goal is to show that you have thought seriously about what you would actually do and why, while engaging with the complexity the paper reveals.
Why This Question Is Harder Than It Looks
Most students read this question and immediately answer “yes, of course you should report it.” That answer is not wrong, but it is incomplete — because the paper documents exactly how complicated this decision is in practice. The security engineer (P07) who encountered potential illegal activity during a repair job framed a clear threshold: data about tax avoidance is “none of my business”; a threat to human life creates an obligation to report. But non-illegal violations are in between those poles — and the paper’s broader findings show that most ethical dilemmas in cybersecurity exist precisely in that grey zone.
Define What “Violation” Means in Your Answer
A non-illegal violation of a code of conduct could range from a minor procedural shortcut (a security engineer skipping documentation) to a decision that is legal but causes real harm (not disclosing a data breach that has already been patched, as described by Privacy Engineer P15 in Section 4.4.3). Your answer should acknowledge this range — the threshold for reporting a serious but non-illegal violation (one that harms users or undermines public trust) may be different from reporting a minor internal compliance shortfall.
Consider the Audience and Mechanism for Reporting
Reporting to whom? A supervisor, an internal ethics function, a professional body, or external regulators? The paper notes that existing professional codes do not provide detailed guidance on reporting mechanisms. Your answer should be specific: under what conditions would you report internally first, and at what point would you escalate beyond the organization? This specificity distinguishes a thoughtful response from a platitude.
Acknowledge the Personal Cost
The paper documents a key observation in Section 5.2: “One dimension that was not identified explicitly by our participants is the inherent potential for them to be placed in a personal conflict of interest when making such decisions.” Reporting a violation that is not illegal carries professional risk — particularly if it involves a senior colleague or a decision taken by management. Your answer to Q3 should acknowledge that cost and explain why you believe it is outweighed, or under what circumstances it might not be.
Connect to a Principle, Not Just a Feeling
The principlist framework in the paper (beneficence, non-maleficence, autonomy, justice, explicability) provides a vocabulary for grounding your moral position. If you would report because you believe users deserve to know something, that maps to autonomy and explicability. If you would report because continuing the violation causes harm, that maps to non-maleficence. Using this vocabulary connects your personal position to the ethical framework in the reading — which is exactly what the assignment asks you to do.
What a Strong Q3 Response Contains
Components of a Developed Q3 Response
A clear position (yes or no, or conditional on specific factors — but not indefinitely hedged). A definition of what kind of violation you are reasoning about. An acknowledgment of the professional risk of reporting. An explanation of which ethical principle grounds your decision — drawn from the principlist framework in the paper. A reference to at least one specific finding from the paper that illustrates the real-world complexity of this decision. A brief consideration of what changes your answer — the factors that would raise or lower your threshold for reporting.
Question 4: Should an Organization’s Ethical Standards Override Your Own?
This question is the most philosophically contested of the four. It sits at the intersection of professional obligation, employment contract, personal conscience, and the limits of institutional authority. The question is also deliberately personal — it asks what you believe, not what the law requires or what a code of conduct says. Your answer should be grounded in your own moral reasoning, supported by the paper’s findings as evidence.
Understanding What the Question Is Actually Asking
The question is not asking whether organizations have authority over their employees in professional matters — they clearly do. It is asking whether that authority should extend to ethical standards — and specifically, whether a conflict between organizational ethics and your personal ethics should be resolved in the organization’s favor. This is a harder question than it appears, because it assumes a scenario where a conflict exists. If your personal ethics and your organization’s ethical standards are well-aligned, no tension arises. The question becomes meaningful only when they are not.
What a Strong Q4 Response Contains
The clearest structure for Q4 is: state your position; acknowledge the strongest argument for the opposite position; explain the conditions under which organizational standards should and should not override personal ones; ground your reasoning in at least one principle from the ethical framework; and cite a specific finding from the paper that illustrates the tension you are analyzing.
[Position statement] No — an organization’s ethical standards should not automatically override personal ethical standards, particularly when the organizational standard would require action that causes harm to users, customers, or the public.
[Conditionality] Where organizational standards raise the bar — requiring greater transparency or more rigorous security practice than my defaults — I should be held to that standard. Where organizational standards lower the bar — normalizing the suppression of breach disclosures or tolerating third-party malpractice — I retain a personal obligation to refuse or escalate.
[Evidence from paper] Flechais and Chalhoub document exactly this dynamic: participant P01 described companies that had a “plan to deal with reputational damage” from data breaches without “actually addressing the issue.” The organizational ethical standard in that context normalized harm to customers in exchange for commercial continuity. That is not a standard I should accept as overriding my own.
This structure takes a clear position, distinguishes between organizational standards that raise and lower the ethical bar, grounds the position in a specific paper finding, and connects to the non-maleficence principle from the framework. It is not a simple yes/no answer, but it is a committed position with reasoning — which is what the question requires.
How the Four Questions Connect — and Why That Matters
These four questions are not independent. They form a logical sequence from the systemic to the personal, and your answers should be internally consistent. Here is the logical thread that connects them: if you argue in Q1 that organizations should be required to have a Code of Conduct, and in Q2 that this should be legislated, then your answer to Q3 (reporting a violation) is supported by a formal mechanism — you are reporting within a system that exists precisely for this purpose. Your answer to Q4 (personal ethics vs. organizational ethics) should then acknowledge that a well-constructed organizational code of conduct would itself be grounded in ethical principles that could align with — or elevate — your personal standards, and that the scenario in Q4 where tension exists is partly the result of the failure identified in Q1 and Q2.
The converse is also true: if you argued in Q1 that codes should remain voluntary and in Q2 that government legislation is inappropriate, then your Q3 and Q4 answers are operating in a context with fewer formal protections for the person who wants to report a violation or decline an unethical instruction. Your reasoning across all four questions should account for the implications of your earlier positions.
Q1 → Q3 Connection
If you argued for mandatory codes in Q1, then in Q3 you have a formal mechanism to report violations against — which strengthens the case for reporting. If you argued against mandatory codes, explain what mechanism you would report to.
Q2 → Q4 Connection
If you argued for legislative mandate in Q2, then in Q4 the organization’s ethical standards are partly externally defined — which shifts the “override” question from pure internal authority to a legally framed obligation with external accountability.
Q3 → Q4 Connection
Your Q3 answer (would you report a non-illegal violation?) directly implies something about Q4 (would you let the organization’s standard override yours?). Reporting a violation suggests you prioritize your own ethical judgment over organizational silence. These two positions should be consistent.
Where Most Responses Lose Marks
Summarizing the Paper Instead of Using It
Writing two paragraphs about what Flechais and Chalhoub found before addressing the question. The paper is background — your response is the foreground. Lead with your position, then use the paper as evidence. A response that mostly summarizes the paper and then states a brief opinion at the end has its structure backwards.
Instead
State your position in the first or second sentence. Then bring in the paper: “This position is supported by Flechais and Chalhoub’s finding that [specific finding] — which demonstrates that [connection to your argument].” The paper is evidence for your position, not an introduction to it.
Both-Sides Responses Without a Conclusion
“On one hand, organizations should have codes of conduct. On the other hand, it can be difficult to implement. Both approaches have merit.” This structure presents the issue without taking a position — which is what the question asks you to do. A discussion question in this format requires a conclusion.
Instead
Acknowledge the strongest counter-argument and then explain why it does not change your position (or under what specific conditions it might). “Although mandatory codes risk becoming compliance exercises, this does not eliminate the requirement — it changes what the requirement should specify about implementation and monitoring.”
Treating Q3 and Q4 as Abstract Policy Questions
Answering Q3 with “employees should report violations because transparency is important” and Q4 with “organizational ethics frameworks serve a useful function in aligning individual behavior” — without any personal voice. The assignment explicitly asks what you believe and would do. Responses that stay entirely in the third person avoid the assignment’s actual requirement.
Instead
Use first person for Q3 and Q4. “I would report the violation if…” or “My position is that organizational standards should not override my own when…” Write as someone reasoning through a real decision, not describing a policy. The grader is looking for evidence that you have thought about your own moral code, not that you can describe ethics in the abstract.
Ignoring the Distinction Between Small and Large Organizations in Q1
“Large organizations should definitely have a code of conduct. Small organizations might find it too difficult.” The question asks about both — and dismissing small organizations with a vague acknowledgment of difficulty misses the analytical opportunity. The risks in small organizations may be different but not necessarily lower — in some ways they are higher, because there is less formal oversight infrastructure.
Instead
Engage with the small/large distinction directly. What would a proportionate Code of Conduct requirement look like for a small organization with two cybersecurity staff? The paper’s finding that existing codes are too broad actually suggests that the problem is not size but specificity — a small organization with a narrow scope of cybersecurity activity might need a shorter but more precisely targeted code than a large enterprise, not a lighter one.
Conflating “Illegal” with “Unethical” in Q3 and Q4
Responding to Q3 as if the question were about illegal behavior — “of course you should report illegal activity” — without engaging with what it means for something to be unethical but not illegal. The paper is full of examples in that grey zone: suppressing a breach disclosure that is not technically required, using AI surveillance that is legal but violates reasonable privacy expectations, prioritizing company interests over customer interests in ways that are legal but not transparent.
Instead
Engage explicitly with the legal/ethical gap. “The fact that an action is not illegal does not settle the ethical question — particularly in cybersecurity, where the law consistently lags behind both technology and practice.” Cite the paper’s finding on breach disclosure decisions (Section 4.4.3) as an example where legal compliance and ethical transparency were in tension.
Q4 Responses That Default to “It Depends” Without Specifying What It Depends On
“Whether organizational ethics should override personal ethics depends on the situation.” Every answer in ethics depends on the situation — the question is which aspects of the situation determine the answer. A response that ends at “it depends” has not done the analytical work.
Instead
Specify the conditions: “Organizational standards should override my defaults when they require greater accountability, transparency, or harm prevention than I would impose on myself. They should not override my standards when they require me to suppress information that users need to make informed decisions about their own security — which maps to the autonomy and explicability principles in the Formosa et al. framework cited in the paper.”
Frequently Asked Questions
Putting It Together: What a Complete Set of Responses Looks Like
The strongest submissions treat these four questions as a unified analytical exercise rather than four separate tasks. Your Q1 argument about why codes of conduct should exist sets the context for Q2’s argument about how they should be enforced. Your Q2 position on enforcement shapes what mechanisms are available to you in Q3’s reporting scenario. And your Q3 answer about personal judgment in a specific situation connects directly to Q4’s broader question about where the limits of organizational authority over personal ethics lie.
When all four responses are written with that logical thread in mind — and when the paper’s specific findings are used as concrete evidence rather than general background — the responses read as a coherent analytical position rather than four separate opinion statements. That coherence is what separates a strong submission from a competent one: not more facts, but tighter reasoning across the questions with a consistent underlying framework.
For direct support with this assignment — whether you need help developing a defensible position, integrating the paper’s evidence effectively, or reviewing a draft for analytical consistency and citation accuracy — our law and cybersecurity writing team works specifically with ethics discussion assignments, critical analysis responses, and position-based coursework at the undergraduate and graduate level.
Continue with: critical analysis paper writing · philosophy assignment help · opinion essay writing · computer science assignment help · professional coursework writers.