(30 points) Equifax Case Study

Answer the following questions about Case Study 2 of the Vallor Cybersecurity Ethics reading posted on Canvas. The PDF can also be found online here.

Each question is graded on quality of argument, and all aspects of the question should be addressed for full credit.

1. (10 points) [2.1] Of the ten types of ethical challenges for cybersecurity practitioners that were listed in Part 2, which of those types does the Equifax case study potentially involve? Identify all that apply and explain your answer.
   

2. (10 points) [2.2] What significant ethical harms are involved in the Equifax case, both in the short-term, and in the long-term? Who are the different stakeholders who may be harmed and how?
   

3. (10 points) [2.5] In what ways could an organizational culture of thinking about the ethics of cybersecurity, as it pertains to the challenges you identified in part 2.1, potentially have (1) prevented the Equifax breach, and (2) reduced its harmful impact?

   Refer to the challenge questions that Vallor raises in Part 2 of the reading.
   

(30 points) Offensive Security Case Study

Answer the following questions about Case Study 5 of the Vallor Cybersecurity Ethics reading posted on Canvas.

Each question is graded on quality of argument, and all aspects of the question should be addressed for full credit.

1. (5 points) [5.5] Identify the 5 most significant ethical issues/questions raised by Anthony and Sarah’s cybersecurity practice.

   Cite the reading and justify your choices.
   

2. (6 points) [5.6] Of the first set of 12 ethical best practices in cybersecurity listed in Section 5 of the reading, which ones do Anthony and Sarah seem not reliably practice? Explain your answer.
   

3. (6 points) [5.7 (Derived)] How might Anthony and Sarah’s conduct be judged according to each of the three ethical theories described in Part 4 of the reading: Utilitarian, Deontological, and Virtue Ethics? Briefly explain your answers for each. Explanations can draw on external sources, but should be grounded in the reading.
   

4. (4 points) [5.8 (Derived)] How should the conduct of Anthony and Sarah’s employer be evaluated here? Was it ethical, and if not, what ethical standards/duties/best practices were violated by the employer?
   

5. (9 points) [5.9 (Derived)]

   1. What might be the fallout if Anthony and Sarah’s methods cause harm to the property, data, or other significant interests of innocent parties, and this becomes public knowledge?
   2. How are the impacted stakeholders: the company’s employees, investors, members of the public, the tech media, and the cysec community of professionals— likely to react?
   3. Will they accept Anthony and Sarah’s claims of justification? Why or Why not?

   
   

(40 points) E2E, Apple, and the UK

In early 2025, the UK Government issued a so-called Investigatory Powers Act 2016 (IPA) “technical capability notice” (TCN) to Apple. The notice demanded that Apple build a “backdoor” into users’ cloud data — meaning that, under the order, UK security agencies would get broad access to files stored with Apple’s cloud service globally.

The demanded access would have undermined the security of the company’s high-security offering, Advanced Data Protection (ADP), which provides end-to-end encryption such that only the user can decrypt their iCloud data. Under ADP, not even Apple can view the data.

Apple refused to comply with the notice and withdrew ADP from the UK; as of February 21, 2025, new UK users can no longer enable ADP.

After pulling ADP, Apple filed a legal challenge at the Investigatory Powers Tribunal (IPT), arguing that the UK government’s demand violated privacy and encryption norms. The hearing was scheduled in closed court, though media and civil-society organizations have pushed for public transparency, arguing it’s a case of broad public interest.

On August 18, Tulsi Gabbard posted that the UK would be dropping their TCN.

1. Read the following series of short articles to familiarize yourself with the details of the controversy.

   • Brodkin, Jon. “UK demands Apple break encryption to allow gov’t spying worldwide, reports say”. Ars Technica. 2025-02-07. Online.

   • Belanger, Ashley. “Apple pulls end-to-end encryption in UK, spurning backdoors for gov’t spying”. Ars Technica. 2025-02-21. Online.

   • Brodkin, Jon. “Apple refuses to break encryption, seeks reversal of UK demand for backdoor”. Ars Technica. 2025-02-21. Online.

   • Kleinman, Zoe. “UK backs down in Apple privacy row, US says”. BBC. 2025-08-19. Online.

   • Fraser, Graham. “Court documents shed new light on UK-Apple row over user data”. BBC. 2025-08-29. Online.

   
   

2. (10 points) Identify the stakeholders involved in the case, both those directly involved, and those who would be affected indirectly. Explain what is at stake for each individual or group identified.
   

3. (10 points) Identify the technologies relevant to this story and why they are the subject of contention between Apple and the UK. What is the relationship between the technology(-ies) and each party?
   

4. (10 points) Make an argument for both Apple and the UK government, defending their ethical position based on the interests they are trying to protect, and the harms they are trying to prevent.

   Refer to Part 1 of the Vallor reading to formulate your argument.
   

5. (10 points) What are the ethical values in tension in this case?

   Pick the side that you think has a stronger argument by identifying which interests and/or harms outweigh the other in this particular instance and justify your decision with scenarios or concrete examples.