Does Having an Ethical Code Make Sense for a Cybercriminal Organization?

 

Last week in the United States, a group named DarkSide carried out a cyberattack on one of the nation’s biggest gas pipelines. Cyberattacks are not new and often not even newsworthy. Businesses spend a lot of money to prevent (or worst case, respond to) this business risk.  The attack caused the pipeline to shutdown causing gas shortages and local panic in some of the areas affected.   While the supply line has slowly restarted, there was one part of the story which peaked my interest.

According to news sources, a DarkSide representative said that they didn’t mean (emphasis added) to create problems, but rather to simply make money.  The group claims to have an ethical code, and even a call-in number and help desk for its victims to discuss the ransom.  Whoa! 

Let’s think about this. What are the implications of these statements?  A code of ethics is important because it documents the values the organization.  In this case, is having a code simply an excuse for rationalizing poor values?  Surely, by using the word “poor” I am making a personal value judgment and not everyone will agree.

Let’s tie this a little more closely to the PMI Code of Ethics and Professional Conduct. The four PMI ethical values are honesty, responsibility, respect and fairness.   One of the guiding PMI principles is that ethics is about making the best possible decisions, with the strong assumption that the best outcome is the most ethical one.  Fairness is the value that particularly sticks with me.  Fairness to whom? In project management and overall business, can we always be fair to everyone?  Perhaps that is why ethical decision making can be hard at times.

Let’s return to DarkSide. I’m not saying that there is a one size fits all for ethical codes, nor am I trying to compare the content of the PMI code to DarkSide’s code. Far from it.  I tried finding DarkSide’s code of ethics, and short of signing up for their mailing list (which I didn’t do), I didn’t find the code.  Let’s just say that even if DarkSide followed their code, the impact was on many, many hardworking people who are already struggling due to the COVID pandemic.  Does that make it right?  Maybe they didn’t mean to create problems, but they did.  Should they be held accountable?

I wrote this blog simply to get people to think and talk about ethical behavior.  There are many hard questions here and I leave you with a few to ponder.  Perhaps we can have a discussion on this.  Let me know your thoughts.

1. Does a code of ethics need to reflect societal norms or are societal norms too dependent on the society we are talking about.
2. Is it sufficient for a company to simply have a written code and follow it, or is there more to it?
3. What would you do if your personal values are inconsistent with those in your organization as reflected in the code?

For more information about the PMI Code of Ethics and Professional Conduct,  please see PMI- "The Code"