Legal and ethical consequences of ineffective software development practices

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A company's developers leave a database unprotected and customer data leaks. Which is a likely LEGAL consequence?

A The software automatically runs faster

B Penalties or enforcement action for breaching privacy law

2. A developer copies code from a paid library into the company's product without a licence. What is this?

A Copyright infringement

B Input validation

3. After a data breach, customers stop using an app because they no longer trust it. This is an example of:

A Reputational damage

B Regulatory compliance

4. Which statement about ethical harm from weak development security is correct?

A Ethical harm only exists if the organisation is fined

B Customers can be harmed even if no law is broken, for example by identity theft after a leak

5. Which action best helps resolve the consequences of a privacy breach?

A Notify affected customers openly and cooperate with the regulator

B Hide the breach until someone finds out

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Breach of privacy law		AFailing to protect personal information in line with privacy legislation can lead to legal penalties, investigations and orders to fix the practice.
2Reputational damage		BRemoving the licence and ignoring the source is copyright infringement. It is both illegal and unethical. The team should follow the licence terms and acknowledge the source.
3Using third-party code without checking its licence or acknowledging the source can break copyright law and lead to legal action.		CCustomers lose trust in an organisation after a security failure and may stop using its software or services.
4An organisation can resolve consequences by complying with regulators, being open with affected people and improving its practices.		DCompliance, openness and improved practices
5After a data leak caused by insecure code, the company hides it from customers to protect its reputation.		ECopyright infringement
6A team copies open-source code into its product and removes the licence notice, because only legal penalties matter.		FConcealing the problem is unethical and may breach notification laws. It increases loss of trust. The company should be open and notify affected customers.

Definitions

legal and ethical consequences

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF dataLeaked = TRUE THEN _______________() END IF

IF usesCode ___ NOT licensed THEN removeCode() END IF

trust ← trust - 20 IF trust _ 50 THEN reputationDamaged ← TRUE

_____ NOT compliant DO improvePractices() END WHILE

totalCost ← fine _ legalCosts OUTPUT totalCost

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A breach ← TRUE

B IF breach = TRUE THEN

C notifyCustomers()

D deleteBreachLogs()

E END IF

Question 2

A IF copiedCode = TRUE

B checkLicence()

C acknowledgeSource()

D END IF

Question 3

A trust ← 100

B IF dataLeaked = TRUE THEN

C trust ← trust + 40

D END IF

E OUTPUT trust

Question 4

A audit ← runPrivacyAudit()

B IF audit = PASSED THEN

C updatePractices()

D retrainStaff()

E END IF

Question 5

A code ← getAICode()

B licence ← checkLicence(code)

C IF licence = OK THEN

D useCode(licence)

E END IF

Answer Key

Legal and ethical consequences of ineffective software development practices

Section A: Quick Questions

B — Penalties or enforcement action for breaching privacy law

A — Copyright infringement

A — Reputational damage

B — Customers can be harmed even if no law is broken, for example by identity theft after a leak

A — Notify affected customers openly and cooperate with the regulator

Section B: Match the Pairs

Breach of privacy law → Failing to protect personal information in line with privacy legislation can lead to legal penalties, investigations and orders to fix the practice.

Reputational damage → Customers lose trust in an organisation after a security failure and may stop using its software or services.

Using third-party code without checking its licence or acknowledging the source can break copyright law and lead to legal action. → Copyright infringement

An organisation can resolve consequences by complying with regulators, being open with affected people and improving its practices. → Compliance, openness and improved practices

After a data leak caused by insecure code, the company hides it from customers to protect its reputation. → Concealing the problem is unethical and may breach notification laws. It increases loss of trust. The company should be open and notify affected customers.

A team copies open-source code into its product and removes the licence notice, because only legal penalties matter. → Removing the licence and ignoring the source is copyright infringement. It is both illegal and unethical. The team should follow the licence terms and acknowledge the source.

Section C: Definitions

legal and ethical consequences — Penalties, lost customer trust and harm caused by weak security in development, such as privacy breaches or copyright infringement, resolved through compliance, openness and better practices.

Section D: Fill in the Blanks

IF dataLeaked = TRUE THEN
    notifyCustomers()
END IF

IF usesCode AND NOT licensed THEN
    removeCode()
END IF

trust ← trust - 20
IF trust < 50 THEN
    reputationDamaged ← TRUE

WHILE NOT compliant DO
    improvePractices()
END WHILE

totalCost ← fine + legalCosts
OUTPUT totalCost

Section E: Spot the Error

D — Hiding a breach by deleting logs is not openness and can break the law. The organisation should report it to the OAIC with reportToOAIC().

A — The IF statement is missing THEN. It should read IF copiedCode = TRUE THEN, so the licence check and acknowledgement run when code was copied.

C — A data leak causes reputational damage, so customer trust should go down. It should be trust ← trust - 40, not increase.

B — Practices should be improved when the audit fails. Testing for PASSED means the fixes would only run when nothing is wrong. It should be IF audit = FAILED THEN.

D — The code, not the licence result, is what gets used once the licence check is OK. It should be useCode(code) to avoid copyright infringement.