None of the traditional software project management materials address
the ethical issues that arise because of the choices made during software
development. Consequently, these materials do not provide any insights
as to how to address these issues. In this paper we identify several
critical ethical issues that arise in most software projects and provide
a proactive way of addressing these issues which is consistent with most
professional software development standards.
Developing software is frequently complicated involving many people from different areas and with different skills, experiences and social attitudes. There are many operational decisions to be taken during this extended activity. There are many different approaches to control the complexity of this activity which can be viewed at two levels. There are those approaches which are concerned with high level decisions and processes such as the Capability Maturity Model and the ISO 9000 series, and there are methods which deal with the details of the day to day activities of the project managers and software development teams. These latter methods include COCOMO, PRINCE and Function Point Analysis.
All of these methods have as a major function the attempt to anticipate
and avoid all possibilities which may negatively impact a software project.
The negative possibilities are those which would delay the delivery of
the software which performs the desired functions in a timely and cost
effective manner. An additional function is to avoid late changes
to the system because the later the change the more expensive it becomes.
However, none of these methods consider the ethical issues that need to
be identified and addressed during the planning stages and re-considered
throughout the development process.
Effective software project management is a vital ingredient in achieving
a successful outcome. The objectives for the project need to be agreed
at the outset. In deciding the objectives their implications need to be
considered, in terms of the actual outputs and the impact these outputs
will have. There is also a need to consider the impact of the development
process itself. The project team should be well briefed on these
issues and have the opportunity to debate them fully to establish its own
conclusions. The team should consider all the implications of the plan,
including ethical ones. It may need to call on additional resources from
inside and outside the organisation. To confine the discussions within
close boundaries (in an attempt to save money and time) is misguided. Broader
issues will inevitably arise during the course of the project. If the team
members are unprepared, they will lack direction and perform poorly. The
sponsor of the project therefore needs the vision and the authority to
ensure that the project team is supported and coached to consider both
technical and ethical issues.
The purpose of this paper is to consider how software project management
might embrace ethical sensitivity, ensure ethical issues are considered
throughout the development process and provide timely feedback of possible
negative and positive social impacts of a piece of software. [Rogerson
and Bynum, 1996] suggest that a comprehensive set of ethical tools and
techniques needs to be identified and developed which will promote responsible
practice in software development. One such item in this set is the Social
Impact Statement which can be effectively used to focus attention on the
ethical issues associated with each stage of the software development process
[Shneiderman, 1990, Huff and Jawer, 1994].
An interesting list of generic questions was devised by John McLeod in [Parker et al, 1990 pp 207-209] to help determine the ethical nature of actions within IT. These are relevant to software project management because they address many of the project management tasks with the exception of full consideration of the supplier-customer relationship. The software project is concerned with the delivery of an output by a supplier (the project team) to a customer under some agreement. It is irrelevant whether this is an in-house arrangement or whether it is between two independent organisations or whether it is a combination of both. According to [Velasquez, 1992], such an agreement is concerned with output quality and moral liability. Velasquez argues that the principles of due care and social cost must take effect in these situations so that suppliers accept their obligations to customers and the wider community to provide goods and services that are adequate and beyond moral reproach.
By combining and building upon the ideas of McLeod and Velasquez a set of ethical principles can be derived as shown in Figure 1 [Rogerson, 1997]. The principle of honour is to ensure that actions are beyond reproach which in turn demands honesty from the professional. The principle of bias focuses on ensuring decisions and actions avoid the possibility of conflicts of interest and eliminate bias in judgements. Professional adequacy is concerned with the ability of individuals to undertake allocated tasks. The principle of due care is linked with the concept of software quality assurance. Fairness focuses on ensuring all affected parties are considered in project deliberations. Following these principles adds a social cost which recognises that it is not possible to abdicate from professional responsibility and accountability. Finally, the principle of effective and efficient action is concerned with completing tasks and realising goals with the least possible expenditure of resources.
Honour Is the action considered beyond reproach?
Honesty
Will the action violate any explicit or implicit agreement
or trust?
Bias
Are there any external considerations that may bias the action
to be taken?
Professional adequacy
Is the action within the limits of capability?
Due care
Is the action to be exposed to the best possible quality
assurance standards?
Fairness
Are all stakeholder's views considered with regard to
the action?
Consideration of social cost Is the appropriate accountability
and responsibility accepted
with respect to this action?
Effective and efficient action Is the action suitable, given the
objectives set, and is it
to be completed using the least expenditure of resources?
Figure 1 Eight Ethical Principles
These principles can be used to analyse, inform, and colour practice
within computing and software project management in particular. Within
software development there are numerous activities and decisions to be
made and many of these will have an ethical dimension. It is impractical
to consider each minute issue in great detail and still hope to achieve
the overall project goal. By considering which of the principles
apply it is possible to ascertain which activities and decision making
points are the most ethically charged. The focus of attention must be on
these ethical hotspots because they are likely to influence the success
of the particular software project and promote ethical sensitivity in a
broader context. [Rogerson and Bynum, 1995] define these ethical hotspots
as points where activities and decision making are likely to include a
relatively high ethical dimension.
SPM comprises ten steps as shown in Figure 2. The first five steps are concerned with planning and the remaining five deal with implementing the plan and achieving the goal. O'Connell states that most projects succeed or fail because of decisions made during the planning stage thereby justifying the fact that half of the effort expended in the SPM approach is on preparation.
It is this planning element of project management which lays down the foundations on which the project ethos is built. Here the scope of consideration is established, albeit implicitly or explicitly, which in turn locates the horizon beyond which issues and people are deemed not to influence the project or be influenced by it. How the project is conducted will depend heavily upon the perceived goal. The visualisation of this goal takes place in Step 1. It is here that the scope of consideration is established which should lead to effective discussion by all parties (stakeholders) on all issues resulting in the defining of the project goal(s). Often limited time is spent on this crucial first step. This is because the project manager is under pressure to deliver and so the tendency is to reduce the horizon and establish an artificial boundary around the project with only the obvious issues in close proximity to the project being considered. Steps 2 to 5 are concerned with adding detail and refinements thus arriving at a workable and acceptable plan. Steps 6 to 8 are concerned with implementing the plan, monitoring performance and keeping those associated with the project informed of progress. Step 9 defines the control feedback loops which ensure that the plan remains focused, current and realistic. Finally, Step 10 is the delivery of the project output to the customer and an opportunity to reflect upon what has and has not been achieved.
Step Description
1 Visualise what the goal is
2 Make a list of the jobs that need to be done
3 Ensure there is one leader
4 Assign people to jobs
5 Manage expectations, allow a margin of error and have a
fallback position
6 Use an appropriate leadership style
7 Know what is going on
8 Tell people what is going on
9 Repeat Step 1 through 8 until Step 10 can be achieved
10 Realise the project goal
Figure 2 The Ten Steps of Structured Project Management
Step
1 2 3 4 5 6 7 8 9
10
Principle
1. Honour X
X X X X
2. Honesty X
X X X
3. Bias X X X X
X X
4. Adequacy X X
X
5. Due care X X
X X X
6. Fairness X
X X
7. Social cost X
X X X
8. Action X X X
X X X X
6 2 4 5 4 4 1 5 2
4
Figure 3 The dominant ethical principles in the steps of SPM
This analysis suggests that Step 1 which is involved with defining the
project goal, Step 5 which assigns people to tasks, and Step 8 which communicates
project progress to all concerned are the most significant ethical areas.
The first area defines a project that is ethically, as well as, technically
and economically acceptable. The second area concerns the sensitive
alignment of people's skills and aspirations with the project tasks.
The third area concerns progress reporting to stakeholders and provides
ongoing checks and balances throughout the life of the project. The
first ethical hotspots (at this level), Step 1 will now be used to illustrate
the difficulty in achieving ethical sensitivity and showing how this sensitivity
might be achieved in practice.
Negative affects include both overt harm and the denial or reduction of goods. So obviously the development of a medical software package which delivered erroneous dosages of medicine that killed patients would have a negative effect; but we would also include as having a negative effect software which limited people's freedom of expression. Limitations on positive ethical values and rights are negative effects. It can also be argued that the failure to promote positive ethical values is also a negative effect.
Therefore, we extend the traditional software project stakeholder list
from customers and corporations or shareholders to include all those who
will be affected by the software and by its production. This includes:
users of the software, families of the users, social institutions which
may be radically altered by the introduction of the software, the natural
environment, social communities, software professionals, employees of the
development organisation and the development organisation itself.
Given such a range of stakeholders, how is one ever to identify the relevant
and significant stakeholders?
In determining the rights and obligations of the developers of a software
product , one can use one of the professional codes of ethics. A
code such as the Software Engineering Code of Ethics [Gotterbarn et al,
1997] defines the rights of the developer and others related to the software
process and the final software product. The imperatives of the ACM
Code of Ethics (Appendix A) can be used to guide the stakeholder search.
The process of identifying stakeholders also identifies their rights and
the developers’ obligations to them.
Appropriate people from the whole range of stakeholder groups should be consulted. Participation by owners and employees is obvious but it may be desirable for other groups to take part in particular situations. For example, if a manufacturing company wishes to improve links with suppliers and customers then it would make sense to involve representatives from both groups. Similarly, if an organisation wished to form a strategic alliance with a competitor in an attempt to increase market share through synergy then participation by that competitor would be essential. Finally, the drive for efficiency gains through applying IT by a large local employer could mean a reduction in the work-force or employing a different work-force group. In such circumstances the involvement of unions and relevant community groups is probably desirable.
The widespread use of, and dependence upon software within organisations
and society affects the lives of most individuals. The project management
process must consider, from the start, the views and concerns of all affected
parties and do so using the principles of due care, fairness and social
cost. Concerns over, for example, deskilling of jobs, redundancy, the break-up
of social groupings can be then aired at the earliest opportunity. Fears
can be allayed and project goals adjusted if necessary.
There are two types of SoDIS. The first is a Generic SoDIS which has as its primary function the identification of stakeholders and related ethical issues. In the light of the identified issues a preliminary project management plan is developed. A second more detailed SoDIS is then employed. This is the Specific SoDIS. There will be a number of Specific SoDIS within a particular methodology. Each SoDIS is tied to a particular development methodology and to each step in that methodology. Even though each Specific SoDIS is tied to a development methodology, they all include the means of revisiting and re-evaluating ethical issues in the light of the unfolding development process. This organic nature of the SoDIS is very different for the environmental impact statement model.
Any SoDIS requires a set of instructions which include information about
what data to gather, how to gather it, and how to document the entire process.
The set of instructions should also include information about monitoring
the SoDIS development process for accuracy, completeness, objectivity,
and enforcement of the results. This paper will not deal with the monitoring
and the enforcement issues. These fall within the communications
and reporting ethical hotspot mentioned previously and indeed must wait
until the SoDIS process becomes a part of typical development methodologies.
A SoDIS should have a standardised physical structure which will help its
users to organise the issues and the information.
Figure 4 The IEEE model for a software project management plan
All software project management plans will include similar elements to those included in this model. This plan starts with a project overview which generally states the functions desired, called the requirements, for the software by the customer and constraints on the development process such as time, budget, and resources. These are stated from the customer's point of view. The preliminary material in a plan also includes a list of those things which will be delivered to the customer at the end of the project. This constitutes the developer's contract with the customer. What we propose with a SoDIS is to broaden the developer's contract to include a commitment to develop a product which is ethically sensitive. The Generic SoDIS would be part of the deliverables section of the software project management plan.
Section 1.3 of the IEEE model recognises that software development is a very organic process and that all eventualities can not be fully anticipated at the beginning of the project so it is necessary for the plan to be flexible. The way in which a plan may change and what is needed to approve such changes are included in section 1.3 The ethical impact of a software product will change as the product changes, so a Generic SoDIS must also include a section describing its change mechanism. Several large companies now employ ethics officers. If the software development company has an ethics officer, then s/he should be involved in the change process.
The change process requires the same care as was taken in the original
development of the SoDIS. If the impact on particular stakeholders changes
in a negative way then the ethical obligations to those stakeholders, as
stated in the original SoDIS, must be re-evaluated. If necessary
new action plans need to be developed to meet the new obligations and these
plans need to be integrated into the software development process.
This method focuses on the individual requirements but it can be used at this stage to give a composite picture of the ethical impact of the entire project from the point of view of these two stakeholders.
Like the project as a whole, each WBS task can have a significant ethical impact which may not have been anticipated by the generic SoDIS. The particular way in which the WBS is designed may endanger the software user or have significant social consequences. The specific SoDIS is used to address this problem. It is included as an integral part of a WBS task document as shown in Appendix C. A standard WBS task document only addresses technical issues relating to software and hardware, but the modified WBS task document, which includes a specific SoDIS, addresses the potential ethical issues generated by that WBS task and the ways to address or avoid those potential issues. A WBS task document also specifies the criteria the WBS task must satisfy to be considered complete. The SoDIS version of a WBS task document also includes a discussion of the ethical criteria which have to be satisfied by this task. The techniques used in the development of the generic SoDIS are used in the development of the specific SoDIS.
Once the SoDIS WBS task documents are completed their implementation
must be monitored. This monitoring process is another ethical hotspot
which will be discussed later in this series of papers.
1.1 Contribute to society and human well being.
1.2 Avoid harm to others.
1.3 Be honest and trustworthy.
1.4 Be fair and take action not to discriminate.
1.5 Honour property rights including copyrights and patents.
1.6 Give proper credit for intellectual property.
1.7 Respect the privacy of others.
1.8 Honour confidentiality.
2.1 Strive to achieve the highest quality, effectiveness and dignity
in both the
process and products of professional work.
2.2 Acquire and maintain professional competence.
2.3 Know and respect existing laws pertaining to professional
work.
2.4 Accept and provide appropriate professional review.
2.5 Give comprehensive and thorough evaluations of computer systems
and their
impacts, including analysis of possible risks.
2.6 Honour contracts, agreements, and assigned responsibilities.
2.7 Improve public understanding of computing and its consequences
2.8 Access computing and communication resources only when authorised
to do so.
3.1 Articulate social responsibilities of members of an organisational
unit and
encourage full acceptance of those responsibilities.
3.2 Manage personnel and resources to design and build information
systems
that enhance the quality of working life.
3.3 Acknowledge and support proper and authorised uses of an organisation’s
computing and communication resources.
3.4 Ensure that users and those who will be affected by a system have
their
needs clearly articulated during the assessment and design of
requirements;
later the system must be validated to meet requirements.
3.5 Articulate and support policies that protect the dignity of users
and others
affected by a computing system.
3.6 Create opportunities for members of the organisation to learn the
principles
and limitations of computer systems
.
1. Software Requirements:
Could be included by reference to other project documents.
The requirements should be numbered for easy reference in the
SoDIS development process.
2. Change Process
Frequency of Review
Review Team Members
Approval process
Who is on the review team
How open it to public stakeholders
3. Primary Stakeholder analysis
Obligations list
Right violated _____ by _____ causes
_____ obligation to _____
Requirements with a high level of ethical concern
Requirements review in the light of this analysis
Review of analysis process in the light of professional code of conduct.
4. Extended Stakeholder analysis
Identify potential stakeholders
5. Prioritised obligations list divided into actions which are morally
wrong,
permissible, and required
Typical Work Breakdown Structure task document with SoDIS modification
Name Name and numeric identifier of the task
Description Technical function of the task
Dependencies What technical and SoDIS tasks must be complete before this task can be started
Project Members People who will work on this
Duration Estimated time to complete this task
Resources Technical and other resources needed to complete this task
Product Product description
Completion criteria What are the technical and ethical marks of task completion
Acceptance criteria Who has the authority to certify that this WBS task is complete in terms of its technical and social requirements
Risks Potential risks to timely successful WBS task completion
Risk Resolution Plan to address these risks should they arise
Specific SoDIS Risks Stakeholder analysis and risk identification
SoDIS Risk Resolution