Ethical aspects of

Business GN 10
Case on Cyber Attacks
Submitted by
Rajesh Polampalli (1401108)
Vikas Chandra (1401109)
Vimal S(1401110)
Vipul Gupta (1401111

The Case
Cyber Attacks: Disclose or Not Disclose?
Cyber attacks on American companies have become frequent, but
not all companies respond to security breaches the same way.
Companies such as Facebook, Twitter and Apple, have voluntarily
gone public with their security troubles. Alternatively, a number of
companies have continued to deny cyber attacks, despite reports
stating otherwise; including, Exxon Mobil, Coca-Cola, Baker Hughes,
and others. The U.S. government has encouraged transparency on
cyber attacks as part of a wider effort to protect American intellectual
property. Advocates of disclosing breaches claim it will set a
precedent for other companies to get more active in fighting cyber
attacks. The majority of company lawyers advise not to disclose,
pointing to potential shareholder lawsuits, embarrassment and fear of
inciting future attacks. Health and insurance companies must
disclose breaches of patient information, and publicly traded
companies must when an incident affects earnings.

Utilitarianism
To analyze an issue using the utilitarian approach, we first identify the
various courses of action available to us. Second, we ask who will be
affected by each action and what benefits or harms will be derived from
each. And third, we choose the action that will produce the greatest
benefits and the least harm. The ethical action is the one that provides the
greatest good for the greatest number.
Step 1:

Who will be harmed: Share

holders, Future of company
Benefits: Transparency,
Proper and lawful action
against the criminal

NON-Disclose

DISCLOSE

Following the same approach, we have two course of actions, viz. disclose
the attacks to public and do not disclose.
Step 2:
Who will be harmed: account
holders of companies like
Facebook, Gmail, Twitter
Benefits: Future of company
remain intact, Maintain
confidence level

Decision:
Step 3:
1. Disclose where public information is involved. Like Social
Networking Sites, Insurance Companies, Interpol, Banks, Mails
etc
2. Dont Disclose for companies which does not involve public

Rights Theory

The second important approach to ethics focused on the

individual's

right to choose for herself or himself.

We cant compare different sectors, so we classified on
Sole proprietor,
ownership
basis
Public traded
Sole proprietor,
Partnerships But
Companies

Partnerships

Public is
shareholder of
company, thus
have full right to
know about the
company which
they have
invested or going
to invest
Ex: Ford, FB,
Google

In this case the

owner/ owners of
the firm is having
all the rights to
hold their private
information
Public Dont have
any right to
interfere in their
internal aspects.

Disclose

Not-Disclose

With Public
information
Even if it is sole
proprietorship, it
involves crucial
public
information
So the public
should know
about the
breaches.
Ex: Companies
like flipkart, we
Disclose
chat

Justice Approach

Equals should be treated equally and un-equals unequally

How fair is an action? Does it treat everyone in the same way, or
does it show favoritism and discrimination?
Favoritism gives benefits to some people without a justifiable
reason
Discrimination imposes burdens on people who are no different
from those on whom burdens are not imposed
Both favoritism and discrimination are unjust and wrong.
The information shared among all the stakeholder should be
same irrespective of his position or equity
In this case , some people in higher positions only know about
this breach. But everyone should know about that
Final Decision: Disclose

Conclusion

All the theories of ethics suggests common conclusion of

disclosing the cyber breach in public, if it is related with public
information.
So the companies like Facebook, Google, Flip kart, banks should
disclose any cyber attack
For other companies, the results of different approaches
contradicts.
Our group is proposing, not disclosing of information is good for
other companies which dont have public information, as we are
focusing on the long run of the company.