Join us at The Hedge for a conversation
about engineering,
technology, and business. In this episode, Russ White,
Tom Ammon, and Nash King dig into ethics
and IT.
Well, hello, Tom. I'm glad that you're back
as co host. You know, sometimes I have
to fault a secondary co host and, you
know, it's
I'm just a secondary too. I see how
it works. No. No. No. No. No. No.
So and tonight, we have Nash with us,
which you have never been on the hedge
before. Have you ever been on any of
these podcasts, Nash? You sound very professional, by
the way. Thanks. I have literally never done
a podcast before.
Oh my goodness.
Very first pot and your audio sounds awesome
for having never done a podcast before.
Yeah. I was singing at my computer to
make sure it sounded good. Oh,
well
Wow. We could do that. We'll just listen.
No. That's okay.
So tonight or this afternoon or where? I
don't know. I always say tonight because that's
what it is for me right now. But,
we're talking about ethics in IT, and we
have some very problematic.
I said that word again, Nash, and you
know I shouldn't even say that. Anyway,
you know, we always have these issues with
ethics in IT. And for me, it's particular
I mean, I'm doing a a PhD in
philosophy, which some people know and some people
don't. And so this this is in in
my area of study is technology and culture.
And so, you know, it is it is
a very
rough area to get into is to think
about
personally the decisions you make and how they
impact your larger world view and how they
get us. So so if anybody's listening, this
is gonna be a little bit different of
a hedge because we usually talk about less
heavy topics than this.
Tom, Nash, I mean, any thoughts of where
to start thinking about this particular problem or
this particular space?
Well, I think the,
the idea of what personal what personal choices
do you make in your career
as you do the work that we do,
I don't know. I think that's a good
place to start. I think we working in
technology, we enable all sorts of things. We
enable all sorts of different businesses and different,
choices for other people.
So, I think it's a really interesting realm,
ethically speaking. And there's a lot of a
lot of things we can do that, you
know, we could get ourselves into a place
where we didn't wanna be, if we look
back and say what kind of person do
I wanna be and what kind of choices
do I wanna make.
So,
yeah, I think that's I think it's a
pretty interesting discussion. Well, I'll give you an
example of a couple of things I've run
into, and, these are out of books that
I've read, and I'm not gonna go deep
into the names of the authors and stuff.
But,
the idea that technology sometimes makes things possible
and makes other things either difficult or impossible.
And one very specific example is used to
be in The United States all the all
the the cities were built on Rivers and
if you grew up, you knew where all
the rivers were you I mean you that
was part of your life You knew where
all the rivers were you knew where all
the streams were you knew where all the
oceans were and you basically knew where the
prevailing winds were and what the what the
tides look like and everything else because that
was the primary mode of transportation
now with
the construction of the interstate highway system, which
is, of course, a technology. Now, not it's
not Internet technology per se, but just just
talking about technology in general,
all the and and because of the railroad
system that was built,
all the cities started being built inland away
from the rivers. And now there are very
few people in the world who can tell
you where any river is or what the
nearest river to their house is or what
direction it flows at any time of the
year or any of that information.
So
it's made possible to build
towns and cities, big cities where we didn't
have them before,
but yet it's kind of culturally we've lost
something because of that technology in some sense.
So just that concept of the technology is
not technology isn't really neutral like we might
think of it. We immediately wanna say, oh,
it's just neutral. People just use it for
whatever they're going to. That's not really true.
And that that's that's kind of an issue
that you deal with as a network engineer,
in your daily life. Right? I mean, I
don't know. Nash, any thoughts? I mean, you're
you're kind of
I'm just kind of blown away by the
whole river thing. I grew up in a
watershed. I live by a river now.
The idea of not knowing where the rivers
and the creeks and the winds are, that
just
I can't imagine.
Well, but but it's true. Right? I mean
No. It is. It's
people don't know where they are anymore.
Yeah. They don't know where they are, and
we have so much access to each other
as well.
So we start think we start talking about,
like,
changing technology
and just because this might be a little
bit tangent, but just because I've been a
young woman on the Internet.
I just start thinking about the fact that
it's really easy for people to find you
now.
And no one who developed that technology really
thought about how easy it would make it
to do things like stalk people
and harass them.
And and privacy is a big part of
this. Right? Privacy is a big part of
this. And so, like, even just so bringing
this back to the network, like Sorry. No.
It's fine. Say say that you're a network
operator. Right? And you are the IT guy
that or IP IT person. I shouldn't say,
you know, guys. But anyway, the IT person
who is
managing that network, what are you doing to
protect the information of those people?
Like, as a daily decision,
the people who work for the company that
you run ops for, what are you doing
to protect them?
And I don't know. I mean,
I'll bring it current moment for a second.
DNS over HTTPS, I was just talking to
a friend of mine who lives in Thailand,
and the privacy implications of something as simple
as that
And where does that go?
It's very hard that brings up an interesting
point of,
the those who like if you have the
capability to help protect somebody and they are
not as knowledgeable or they're not as empowered
as you are to protect themselves,
is there a moral obligation there for you
to do so?
I I personally believe that, it is the
responsibility of the strong to help protect the
weak just in general. That's that's my personal
feeling about it. And so if you take
it into a technology context and you have
the privacy of all these users, for the
DNS over h t HTTPS,
thing. So, you know,
Chrome is or sorry.
Firefox is gonna be turning that on pretty
soon. And you had a whole crowd of
users at your company that probably don't even
know what that is. So as the IT
person, do you go in and do the
stuff you need to do to override that?
Or do you say, I don't wanna deal
with it. They don't really care anyway. They
probably don't they probably don't care about their
privacy. Doesn't matter. I don't wanna go do
the work to override that. I mean, I
think that's an example of a choice that's
kind of in this realm.
And
may not even be a choice that an
individual
engineer gets to make. Like, if you're using
a,
content filter that's predicated on DNS.
Your management
might say, no, you have to disable that.
We don't care about privacy, because at, to
disable that. We don't care about privacy because
at work, at least, we view the content
filter as being more important.
But so again, it's kind of I guess,
there you run into how much privacy can
you expect to have in the workplace.
And and then even the question of trade
offs. I mean, I always say, if you
haven't found the trade offs, you haven't looked
hard enough. There are people who are arguing
that are making, I think, a a cogent,
coherent, good argument that DNS over HTTPS doesn't
really solve any privacy issues. It actually can
make things worse. What do you do with
that? Right? How do you how do you
educate? How do you adjudicate that? How do
you understand that as a technical person,
as an engineer? How do you deal with
that type of problem? Do you guys spend
your time investigating it? And there's a lot
of there's a lot of avenues that you
can take with that too because you could
say, well, the company decides I don't. I'm
just an individual contributor. It's not my decision.
Oh, yeah. But but if you took that,
I mean but you do have a personal
responsibility to to teach the business and business
leaders about the consequences of their choices. And
if you throw your hands up and say,
well, it's not my decision, so I don't
need to worry about it. And that's,
you know, that's that's going away that's gonna
take you to a certain place,
that you, you know, you may or may
not wanna go.
This might be harsh, but I feel like
if you just automatically throw up your hands
and say, well, the powers that be at
my company will figure it out and their
choice is correct. You're not gonna make it
very far or you're not gonna be very
happy in what you do.
Because if you're not able
to stand up and push back,
then if something really bad happens,
how are you gonna have the experience
of
saying, well, I think that's a bad idea
for this reason and that reason about something
relatively
smaller with regards to say, a user's privacy
or,
protecting company data.
If you don't have the experience of defending
something smaller,
what are you gonna do when it's something
big?
Yeah. I really like that. That's, building your
ethical muscles. I think that's that's a really
good great point. Yeah. Aristotelian
virtue ethic is what that called that is
called from the
philosophy department.
We're gonna get an education here.
I have some exposure to philosophy. I just
got it through talking to people who read
science fiction. So
in fantasy.
So they've all read these books. I haven't.
I've just read, you know, people's own work
that's drawing on it.
Yeah. Yeah. So, you know, thinking about that,
that that also puts from a network administration
perspective, that kind of put security in a
different light, doesn't it? It's not just, you
know, like these DNS over HTTPS issues, things
like that. It's also these issues around, am
I protecting data exfiltration? Am I taking that
my company
has this data on their customers seriously?
What am I doing with that? Mhmm. Are
you ensuring that you only have the minimum
amount of data necessary
to kind of both
a,
not basically have, like, this unexploded bomb of
data sitting there,
and, b, just sort of
generally not be invasive
for one of a better term. And and
then how do you make those arguments? Right?
If you're a network engineer and you see
something going on, you're an engineer of any
kind in your company,
are you prepared to make those kinds of
arguments about maybe we're collecting too much data.
Maybe we're not doing the right thing by
putting this data in that location.
Maybe we're not doing the right thing, you
know, with, our passwords. By the way, I
I personally think changing passwords every six months
or every three months is ludicrous. Mhmm. But,
you know,
who am I? I'm not a security person.
So
I think you're preaching to the
choir. You know, it's
pick a hard password and stick with it.
It's like changing your password every three months
is not really solving a problem that I
can think of. But Problem is the auditors
list.
Yes
Yes, I know I know so that's even
that's even an ethical issue Isn't it like
when do you do what the auditor tells
you to do versus what you know is
right? And how do you make those arguments?
That's that's another entire
Speaking of auditing,
what do you guys think about this? Sometimes
I've I've heard people talk about, especially for
PCI audits, if you don't leave something there
for them to find, if you don't leave
them a couple of little breadcrumbs,
then it's gonna go off the rails. The
audit's gonna go off the rails. So I've
heard some people say you have to leave
some things unattended to. That way the auditor
can find it. That way you can fix
it. That way the whole system can run.
What what do you what do you guys
think about that?
You know, it's funny because I've actually had
builders tell me the same thing when they're
building houses. Yep. That they will intentionally,
like, not tighten a light switch. Because the
inspector comes through and finds it and says,
oh, I found your broken light switch. And
they can mark it on their form and
everybody's happy.
Yeah. I think it's very
it's honestly smart
when you think about how humans work.
You're like, here's an easy thing. Okay. I
found the easy thing. Done. I don't need
to keep going.
But
what's the purpose of the audit?
Are you actually
fulfilling,
whatever need you have there? Or are you
just passing the audit and, like, skipping out
of class? You're putting your answers on your
smartphone. On your smartwatch, which by the way,
they're banning smartwatches in many classrooms now because
people are putting their answers on the smartwatches.
Back in my day, it was graphing calculators.
Yeah. Or itty bitty writing under your under
your under your palm of your hand or
on the wrist or something, you know, they
used to do that too. Yeah. I mean
people have always cheated, I guess. So so
start starting from the very beginning, well, we've
got it. We've cost a wide circuit already
and haven't resolved anything, have we?
You can't resolve anything, though. You can think
about it and you can try to do
better, but there's no final answer on any
of this.
I thought it was 47,
42.
Sorry. 42.
42. That was that's that's what I thought
was 42.
So we can just close the podcast right
there because we found the answer. It's 42.
No.
The little mice will be very happy. That's
very sad. Yes. So, yeah. So, I mean,
starting from technology really isn't neutral.
And thinking that you need to think about
how your company is using technology. Are you
comfortable with that? How are you dealing with
that as a person? And beyond that, How
are you dealing with security? And are you
taking security as just a checklist? Are you
taking security and privacy
as real things? I mean this this impacts
real people
and What are you doing with that? And
I think that's a huge ethical
can of worms that we, as network engineers,
we don't really like to talk about this
stuff. We'd rather talk about how to configure
BGP
or not. It is easy. People don't want
it.
So yeah. I mean, I would just like
to slap a firewall in front of the
whole thing and just call it done. Right?
And that doesn't Have you act have you
actually, like, looked at your firewall config and
made sure that, say, your other clients can't,
like, cross the streams and get into each
other's DMZs?
How well do you know how well it
works? Mhmm. And then knowing how if you
don't know how well it works, you just
know how to configure it. So this goes
back to the whole thing of how skilled
are you as a practitioner?
And is there an ethical
requirement to be better skilled in order to
solve the problems that need to be solved
in a good way, right, in the right
way?
So, yeah, I mean, it's it's,
I think there's a, sort of a crossover
here between, ethics and craftsmanship.
So, I there's a lot of times when
my personal guide is, do I wanna put
my name on that? Do I want someone
to know that that was my work? Sometimes
I use that to motivate myself to finish
something
or or to do a good job or
something. I think there's an intersection between craftsmanship
and ethics because do you want your name
on that decision? Do you want your name
on how that was carried out?
Can be a pretty good marker.
Yeah. Well, that's
by the way, Tom, now you're in platonic
in the platonic world. Yes. And and, you
know, this this all falls back into the
virtue ethic as well. So if if you're
listening to this and you don't know what
pretty fascinating area of study
And it makes a lot of sense. I
mean essentially
all Aristotle is saying is that
you make good moral choices
by reflex
because
you have practiced making good moral choices
in less than important situations.
So, you know, the important decisions are generally
made on a snap. You don't have time
to think about it the way you want
to. There's a lot of conflicting interest
points.
There's a lot of overriding, and, you know,
there'll be times when you really don't wanna
make that decision even though you know it's
the right thing to do. And the way
to make that decision morally is to build
up your moral muscles through the virtue ethic.
And so you practice making good decisions so
that you can make good decisions when you're
under stress. And C. S. Lewis talks about
this as well. There's a couple of passages
in C. S. Lewis for anybody who follows
who is who's who that is,
who talks about this as well.
It's been picked up by some modern
writers
in the virtue ethic realm. There's a couple
of really good books, that are more recent.
They're
kind of philosophical, but, they're actually really good.
And that's actually an idea that you'll see
a lot of,
younger folks in the Internet generation work on.
Just
we've very much have this idea of if
you make a mistake, apologize, and then do
better next time. And what you're doing better
at is, like, say, being respectful of someone's
choices or
keeping in mind your ability to hurt other
people. The more you practice doing that,
the less likely you are
to stomp through something
and just
without even realizing it
hurt people really badly.
I'm trying so hard not to say the
feminism word here, but there we go.
Right. Well, right. And I think that's I
think that now, I'm gonna bring you know,
go back to the technology world and say,
this has a lot to do with agile.
Mhmm. You don't fix blame, you fix problems.
And I don't think we get that a
lot of times. We do a lot more
fixing blame
than we do fixing problems
and I think that's an important point to
make
just in the way we deal with other
people is just
you know, don't don't
Don't beat them up or whatever.
The concept of
failure that is not that, you know, no
blame
no blame follow through or no blame go
back and figure out what happened
is really
a useful thing
in helping people understand,
or how to, you know, working in this
in this realm that we're in now.
Yeah. And I think accepting responsibility
as well. Basically,
you have to know that what you did
caused the harm.
And then what you do from there is
try not to do it again,
and other people
kind of just move on
and give you a chance to not do
it again.
So,
I mean,
to me, this is kind of something I've
been thinking about as I look at, say,
work situations where
maybe you're being asked to support something that
you
disagree with.
Kind of keeping in mind the idea that
maybe you can't at this job, but at
a future one,
you can do better
and be more congruent, I guess, with your
own internal sense of ethics.
I'm a little bit scattered. I'm so sorry.
No. No. It's actually that's fine. No. I
think that's good. Yeah. I think that,
that kinda does bring in another topic though.
Right? Which is
you are doing something. I mean, it's a
struggle
Because you know that no matter what you
build it's being used for things that you
don't agree with. Mhmm. And you have to
internally figure that out
for yourself, what that means,
and how far you're willing to go to
support things you don't agree with, so to
speak,
as a as an engineer.
Sorry. Sorry, Aris. Especially as a network engineer,
if you think about, you know, the people
that build the roads in any country,
that road can be used for all sorts
of things, and it can also be used
for all sorts of really terrible things. Mhmm.
Do you do you say I am I'm
not gonna be a builder of roads because
somebody's going to use it? You know, someone's
gonna use it in a way that I
didn't intend or I didn't agree with. And
I I get what you're saying, Russ, with
the we can't just, you know, assume that
we don't have any responsibility for the tools.
But but there is also another dimension of
this where if you say I'm not gonna
allow my work to be used for anything
other than what I think is the right
thing, then you'll ultimately end up doing nothing
professionally.
And,
you know, I'm not saying you should, you
know, people should say, whatever. I don't have
to have any responsibility here. But I also
think there's the people have to make their
own choices and the way people use their
own agency.
That that's the interplay there is how how
do you how do you let your
your interaction with their agency determine your choices?
Right. And I think there what you run
into
is trying to do the best you can
to understand the unintended consequences
of what it is you're doing.
Just in the back of your mind, realize
that
you
don't know. I mean the way we put
it in just thinking in terms of,
the way we think of it in terms
of technology or at least I think of
it in terms of technology is when I
when I develop any protocol or I work
on something new and that in the protocol
world.
I need to think in terms of
Not what I intend to do with this
technology, but the maximum range of things that
can be done with it
it. Mhmm. Right? Because that's where it's gonna
be used. That's how it's gonna be used.
It's the maximum range of things that you
can do with it. Mhmm.
Now, on the other side,
I can't change the way other people use
it, but I can think about things like
if I'm building roads, what is this gonna
do
to
the way people see their world?
So you're saying you're saying there's virtue in
in simply considering
that this might be used for something that
is that is utterly wrong. You're saying that
there is it is that a redeeming? I
mean, is that is that is it good
enough to to make that consideration?
I don't think it's redeeming.
I think that
there are things that are inside your control
and things that are outside your control. And
by the way, this, I think, goes back
to the heart of the whole ethical issue
as a network engineer.
I can only protect my users' data so
far. I can only protect their privacy so
far. There are things I can do. There
are things I cannot do.
And
knowing my own limits as an engineer is
a major part of it. If you don't
know your own limits, then you're just gonna
stress yourself out trying to
affect things that you just
can't change.
Not the same thing as there not being
things that you can change.
You just have to figure out, like, what
is my locus of control? The way I
think about this is not an ethical concerns,
but in, you know, trying to
develop solutions that meet requirements, as I always
think about a ladder.
People are gonna use ladder for all kinds
of crazy stuff and all kinds of crazy
stuff that they shouldn't use a ladder for.
And when I've when I've tried to design
networks specifically, I think about the ladder. Like,
the people that figured that out, how to
build a ladder, I'm sure that if they
saw what some of us humans use that
for, they would just be, you know, probably
disgusted and annoyed.
But maybe you can you know, there's there's
all sorts of things you could do with
a ladder that you shouldn't be doing with
a ladder. But, you know, it probably if
they were to think about that while they
were building it, then it probably,
had some consequences, some positive consequences for the
people who were using the ladder in the
right way. It probably made things safer for
the people who are using it the right
way.
So I don't know. Maybe that's a Yeah.
Or or you're a ladder maker and you
just slap labels on it until people stop
using it, you know.
Yeah. But the labels usually come from being
sued because someone's tried to
chair labels.
Someone tried to use a chair as a,
jack for their car. So now it has
a warning label saying don't use it as
a jack for their car.
You can't always predict what interesting life choices
people are gonna make.
Correct. You can try, but
people are creative.
Yep. They are. And it is and it
is that's part of the problem. Right?
Is that you don't know where people are
gonna use things.
But on the other hand again, you can
think about those larger culture issues, right?
If I go out and I build a
system that collects
I'll give you an example actually a personal
example
I was once asked by somebody at a
company I worked for to build a
system that would allow him to collect the
names,
the wives' names, and the children's names, and
the dates of birth and everything for everybody
who worked in that organization.
Is it a valid request? Well, the position
this person was in was,
this was in the military.
Mhmm. And so the position this person was
in was
if one of those people got in an
accident or was killed on duty or something,
they had to know this information.
Okay. So it's a valid request,
right? There's a reason they're asking for this.
But on the other hand,
is it really valid? Are there other places
they could get that information?
And is it right to build it like
on a personal computer sitting in some office
someplace?
Oh, yikes. Right? You know, so so you
so you have to think through
the whole situation and think, what could that
be used for? Where would that information leak?
What would happen if that leaked?
How can I do my best to not
have that be a problem?
Right?
Right. What's the potential harm? Because that's a
significant amount of very personal information.
Yes. Oh, yes. Definitely. Definitely.
And
this is why, you know, when I look
at technology and culture, I worry a lot
about we're just doing things and we're not
really thinking through.
What does that mean? Like, what's what's the
ultimate end here? Where are we going with
this?
And so,
obviously, I'm not a Luddite because I work
in technology. But at the same time,
I do worry about it.
I mean,
I saw a joke recently about,
tech enthusiasts versus people who work in tech.
The tech enthusiast has a smart everything in
their house.
The person who works in tech has, like,
a toaster with a hammer next to it
as a just a warning in case the
toaster gets any ideas.
And it was like, okay. Ouch. You don't
need to personally attack me on the Internet,
but alright. Fine.
But but it's true.
It is. It is. Most of people I
know who work in social media don't have
that many social media accounts. It's really funny.
It's they just don't.
Yeah. I recently started using Twitter,
and it's very strange
talking to people and having it be even
remotely tied to my real life identity.
Just because
I come from a background where you don't
social media.
Because you look at it and it's like
and they're getting this info and this info,
and who knows where it's being stored and
who has access to it.
And it it's even I mean,
really, once you see how the sausage is
made, you don't want none of that sausage.
Yeah. I learned that one when I was
eight and watched a Julia Child cooking show.
Yeah. You know?
Wow. Okay.
I think I'm
I don't think I want that sausage.
Yeah. So it's so it's I mean, it's
a thing. Right? It's it's a thing, but
yet,
you know, you work in this area, and
you and you gotta think about it. So
I think it comes down to this. Be
aware.
Like, what are the ultimate what what what
can you get to? What's going on here?
And what can you do? What are your
limits on trying to do
the best that you can to limit any
ethical damage that might happen because of your
actions?
And can you argue against your company or
whoever it is doing unethical things?
And can you help people who are trying
to use this technology help them to use
it more ethically? I think those are big
issues.
And I think you have to be kind
with yourself
because
you may not be able to have the
impact that you want to have.
And you can't if you destroy yourself because
you're not able to
prevent something
that you think is, you know, putting people
at risk of harm or privacy invasion or
whatever,
if you destroy yourself because you failed,
then you won't be there in the future
to try again.
Yeah. I think that's really important. I think
that's a really important point, and it's very
good point.
So
go ahead. Part of that. Sorry. Just one
more thing. I that just made me think
of was,
a a big part of, I think, being
successful in making ethical considerations is,
putting responsibility where it really goes. Mhmm. Right?
If it if it really is your responsibility
to do this, then you should do it,
and you should not shirk it, and you
should make this decision and not pander it,
but not push it off onto somebody else.
But if it's somebody else's decision,
and you have a part in it, but
it's their decision, it's not it's also just
equally as wrong for you to turn take
that burden on yourself
when you're not responsible for it. I think
it just you just have to do what's
in your sphere of influence to do. Right.
I think it's really good. I think you
also have to think about the,
you're usually not actually alone.
We have this tendency, I think, as a
culture in The US at least, to think
that it all has to be, like, one
brave individual
making the change and making the choice. But
at least where I work, it's never just
me. There are always other people that I
can
enlist
when I need support convincing management to make
what I think is a better choice. Thanks
Nash for coming on terrific. Thank you. Terrific,
show. Now I assume since you're not on
social media, nobody can get in touch with
you any place. You just hide in a
corner.
I'm dealing with it. Okay? I'm trying. So
what's your Twitter handle so everybody can follow
you?
Oh god. Alright. Fine. I'll give you it.
Nice.
Okay.
I'll probably have to type this for you.
It's at gamma
capricornai.
Okay. If you send it to me, I'll
get it put on the show notes. Yeah.
No one can actually spell it from hearing
it said.
And, Tom, where can people get in touch
with you?
I'm on LinkedIn. I'm also on Twitter at
Tom Ammon. And, now I'm thinking of a
Twitter handle that's like a random string of,
numbers and
It's not actually random.
Nash is short for Nashira,
which is the name of the star gamma
cap gamma Capricorni.
Oh, okay. Cool. Just teasing.
All right. And I'm Russ White. You can
always find me at rule11. Tech and we
hope you join us the next time on
another great episode of The Head.
Thank you for joining us. You can find
the hedge at rule11.tech.