Home / Resources / ISACA Journal / Issues / 2022 / Volume 6 / An Ethics Based Algorithm for Governing Data Ethics

An Ethics-Based Algorithm for Governing Data Ethics

Author: Wanbil W. Lee, DBA
Date Published: 1 November 2022
Related: Governance Roundup - What Are You Doing About Environmental, Social and Governance Factors in Your Enterprise? | Digital | English

Individuals and organizations increasingly rely on transformational data-automated technologies. Artificial intelligence (AI), machine learning (ML), big data and the Internet of Things (IoT) have reshaped daily life and catalyzed business innovation. The data on which the software or algorithms that drive these technologies rely are crucial, but they can pose challenging issues regarding data quality and security, including authenticity issues; issues due to corruption, compromise and loss from threats, both internal and external; intentional, malicious or accidental threats; data privacy issues; legal issues due to the increasing reliance on automated processes;1 and bias embedded in data and applications.

Bias is an illogical or irrational preference or prejudice held consciously, subconsciously or unintentionally by an individual toward or against other individuals or organizations. Human bias is innate; therefore, data bias is bias embedded in data when collecting, storing and using data in applications and at the discretion of a human, and organizations can be unaware of it.

Although these challenges make it difficult, reaching sound decisions about ethical acceptability and optimal regulatory controls with a holistic view is critical. Data governance (availability, usability, integrity and consistency) is the first step, and an ethics-based algorithm that comprises the ethical matrix algorithm and hexa-dimension metric algorithm can be used to determine a pragmatic and feasible solution.2

The Ethical Matrix Algorithm

The ethical matrix is a two-dimensional mathematical structure (figure 1). The columns correspond to the prima facie ethical principles or values applicable to the interest groups or stakeholders relevant to the issue in question. The rows represent the stakeholders, and the cells specify the main criterion or objective of the stakeholders that would be met if an ethical principle were respected. The number of rows and columns varies depending on the problem. Some cells may be empty if a certain stakeholder has no concern for an issue under consideration with respect to a certain principle.

The matrix can be “an aid to rational thought and democratic deliberation, not a substitute for them.”3 It is a framework for identifying stakeholders and deliberating ethical issues to arrive at defensible decisions. It can also serve as a checklist of concerns organized around established ethical theory, provide a means of provoking structured discussion. Individuals and groups can use this framework to debate the issues identified, holistically and openly, by weighing the concerns (the cells of the matrix) among one another and against the stakeholders relevant to the issue in question (rows) on the basis of the ethical principles identified (columns) (figures 1, 2 and 3, for example). In some cases, certain principles can be assigned a higher value of importance than others, such as maximizing net benefits to the clients (external auditing) and the organization (internal auditing) by means of, for example, disruptive technologies.

The ethical matrix algorithm is based on the ethical matrix,4 a decision-support tool that is:

…designed to help decision-makers (individuals or groups) [reach] sound judgements or decisions about the ethical acceptability and/or optimal regulatory controls for existing or prospective technologies…5

Use of the matrix may yield a range of outcomes including, notably, raised awareness of many ethical issues, whether they are common and explicit or obscure and hidden, such as data and algorithmic bias and discrimination; encouragement of ethical debate and reflection; provision of a common basis for decision-making; and identification and clarification of a basis for agreement and disagreement. Where conflicts among the ethical principles arise (e.g., prolonged working hours vs. time off), the matrix provides users with a view of the relativity among the principles so that a stronger case for one principle may outweigh a weaker case for another, helping prevent arguments that one theory overrides the others.6

The Hexa-Dimension Metric Algorithm

The concept of the hexa-dimension metric, a measure of the quality of a decision based on six principles, sheds light on the phenomenon of the vicious cycle and the classical approach to decision-making. For example, a vicious cycle is the result of ongoing hefty investments in antihacking that have proved mostly futile coupled with continuing demand for data protection to prevent hacking, and culminating in a chronic data protection problem. One of the root causes lies in the classical approach to decision-making, which is prescriptive, rational and normative. Decision makers tend to formulate solutions in technical, financial and legal term while neglecting or being unaware of the ethical, social and perhaps ecological impacts of a problem. The solution is the hexa-dimension metric. For example, the metric can help to determine the ethical worthiness of using an online consultation facility as a means of surveillance to search for and find offenders of drug trafficking on an enterprise’s premises. Further, auditors or leaders (decision makers) may use the results returned by a hexa-dimension metric algorithm to judge the ethical acceptability of the technologies and reach a defensible decision.

Ethical Analysis

The following case study, which involves taking a Universal Serial Bus (USB) device home from work, can be used to apply the ethical matrix algorithm and hexa-dimension metric algorithm.

Taking something such as a pen home from work is common; typically, it goes unnoticed. However, taking home a USB device is a different story. People who do that, either unconsciously or for a purpose, should realize that they are taking enterprise property off the premises, which can violate enterprise rules and regulations. Removing the USB device from the premises may cause it to be vulnerable to physical damage or result in loss of the device. The USB device may contain proprietary data that may not have been encrypted, which may result in a breach of privacy policy, unpredictable consequences, and potential liability, such as the cost of a lawsuit, bad publicity and diminished trust.

In this example, one day in the early afternoon, Alex took a USB device with him when he left his office in a hurry because he was trying to get to an evening seminar in time and intended to continue working on his assigned project at home after the seminar. Alice happened to notice the act when passing Alex’s office on her way to the staff pantry. This scenario creates complications, dilemmas and concerns, including:

  • Complications:
    • Alex and Alice have been dating for almost two years.
    • Betty, Alex’s supervisor, recommended promoting Alex last week.
    • The USB device contains classified information, forbidden by rules to leave enterprise premises.
    • The USB device is not encrypted.
  • Dilemmas:
    • For Alice, to report the case or not
    • For Alex, to pretend to be ignorant of the rules or confess and defend himself on the grounds that the intent of taking the USB away from the office was to work at home, a contribution to increased productivity
    • For Betty (if Alice reported Alex’s act) to reprimand Alex, dismiss the report, or do something else
  • Concerns:
    • The loyalty that Alex and Alice have for each other and for the enterprise
    • Professionalism, in that both Alex and Alice regard themselves as IT professionals
    • Alex’s pending promotion; a concern shared by Betty, Alex, Alice and the team
    • Upholding enterprise welfare and protecting enterprise property
    • Observing data privacy policies

Applying the Ethical Matrix Algorithm

The ethical matrix algorithm has five basic elements:

  1. I-weight—Importance of the principle to the issue/problem being considered
  2. D-weight—Degree of respect the stakeholders have for a principle
  3. S-stakeholder—Sum of weights of s-th stakeholder = ∑s, s = 1 … number of stakeholders
  4. S-principle—Sum of weights of p-th principle = ∑p, p = 1 … number of principles
  5. Group—Participants (ideally four) applying the matrix to gain an overview of the case and the ethical issues that arise

The algorithm comprises seven steps:

  1. Assemble the group.
  2. Identify and determine stakeholders or interest groups (i.e., individuals or organizations affected by the action).
  3. Deliberate on and determine the principles that the interest groups should follow.
  4. Fill the cells using debate or the Delphi method, a structured technique for reaching a consensus based on the average answers to questions by the participants, to determine the concerns that stakeholders have with respect to the principles.7
  5. Estimate and assign I-weight (i.e., importance of the principle to the issue being considered) and D-weight on a scale of 0-5 (unimportant to very important).
  6. Multiply the I-weight and D-weight, and sum the products for stakeholders and principles.
  7. Interpret the result using the sums, S-stakeholder and S-principle to determine a final decision.
Decision makers tend to formulate solutions in technical, financial and legal term while neglecting or being unaware of the ethical, social and perhaps ecological impacts of a problem.

Applying the steps to the example in this case study:

  1. There is a group of four parties who are carrying out the analysis of ethical issues.
  2. The group identifies four stakeholders.
  3. The group concludes that the stakeholders respect three principles:
    • Deontology—The idea that the actions of the stakeholders, their employer, their families, their colleagues and society at large are right or wrong based on a series of rules8
    • Utilitarianism—The idea that happiness should be the guiding principle for stakeholders on what actions to take9
    • Consequentialism—The idea that stakeholders should understand the consequences when determining their actions10
  4. The group determines the ethical values relevant to the identified stakeholders’ concerns. Alex is a conscientious and diligent worker sensitive to productivity and data protection, but conscious of self-interest (i.e., his promotion). Alice is torn between Alex, the enterprise and the data privacy policy. She is also loyal and worried about Alex’s promotion. Betty is concerned about duty and obligation to the enterprise, the welfare of her subordinates and worries about data leakage. The team’s concern stems from the impact of Alex’s fate on team morale and promotion opportunities, and their awareness of data protection (figure 1).
  5. The group concludes that all three principles are of equal importance to Alex, thus, I-weight = 5. The group estimates that Alex respects all three principles very highly and assigns 5 to Alex’s D-weight. For the other stakeholders, the group assigns various weights reflecting the degrees of importance with respect to the different principles (figure 2).
  6. Multiply the weights (I-weight and D-weight) for cells and sum the products (figure 3).
  7. To conclude, the S-stakeholder and S-principle suggest to the decision makers that Alex is diligent and a conscientious and dutiful worker; he is concerned about optimizing his time to serve the enterprise and meet deadlines. What appears to worry Alice most is her boyfriend’s fate; and Betty, who has the authority to decide to ignore, mitigate or pursue Alex’s action, may feel a little intimidated when comparing her ethical score to that of Alex. The team adopts the attitude that they are not directly involved. That is, everyone worries about the consequence of Alex taking home the USB device for fear of a suppressive management regime should Alex be dismissed or mistreated in some undesirable way, for example. The moral is that the enterprise should consider promoting its code of conduct or creating a code if none exists.

At this point, the matrix enables the group to identify the stakeholders, establish and select the principles that the stakeholders value, and document the ethical impact on the individual stakeholder with respect to the principles. After having filled in the cells, the users can weigh the relative importance of the issues identified, according to the potential ethical impact on their interest. Through group discussion and debate, users can express their opinions with the aim of reaching agreement about how the options under consideration, if implemented, would affect the different interest groups with respect to their well-being, autonomy and entitlement to justice, and finally reach consensus.

Applying the Hexa-Dimension Metric Algorithm

The hexa-dimension metric measures six principles:

  1. Financial viability
  2. Technical effectiveness
  3. Legal validity
  4. Ethical acceptability
  5. Social desirability
  6. Ecological sustainability

The coefficient of success (β) is an indicator or of the degree of success that a desirable outcome, action, policy or solution can achieve. The ωβ equation computes the β-value and figure 4 provides a reference scale.

The ωβ Equation: β = {∑ [(Ri/Rs) + ɛ] + [Si x Ss]}/ 2λ, i = 1, … , λ

The various factors are defined as:

  • R-weight = the rank or importance (of the attribute or principle [well-being, etc.] with respect to the case under study), 1, …, 5 (least to most important) (Ri, i = 1, …, λ), and Rs (Standard R-weight, in ideal state, all attributes are of equal rank or importance ∀i) = 5
  • S-weight = the level (%) of satisfaction (of the stakeholders’ expectation the action meets) (100%, …, 0%) (Si, i = 1, …, λ), and Ss (standard S-weight, in ideal state, ∀i Si = 100%) =1
  • λ = 1, …, 6, depending on the number of attributes (principles/measures) pertinent to the issues under consideration. For example, λ = 6 if all six principles/measures are applicable
  • i ranges from 1 to λ
  • ɛ is a normalization constant (normally zero)

The Standard Coefficient of Success (βs) is the coefficient of a desirable solution derived under ideal conditions—that is, the principles are of equal importance—and serves as a reference standard. It is derived, with λ = 6, Rs = 5, Ss = 1, and ∀i Ri = 5 and Si = 100% or 1, and ɛ = 0, as follows:

  • βs = {∑ [(Ri/Rs) + ɛ] + [Si x Ss]}/2 λ = {∑ [(5/5) + 0] + [1 x 1]}/12 = 1

The algorithm comprises these five steps:

  1. Assemble the group (i.e., the parties participating in determination of the measure of the quality of the decision or action).
  2. Determine the λ-value, λ = 1, …, 6, depending on the number of attributes (principles/measures) (assuming successful fulfillment of all management requirements).
  3. Assign the R-weight (1, …, 5 [least to most important], Ri, i = 1, …, λ; ∀i Rs = 5), and estimate the S-weight (100%, …, 0%, Si, i = 1, …, λ; ∀i Ss = 1).
  4. Compute βp and βa using the ωβ equation: β = {∑ [(Ri/Rs) + ɛ] + [Si x Ss]}/ 2λ, i = 1, …, λ; ɛ is a normalization constant (normally zero).
  5. Draw a conclusion.

Applying the five steps includes:

  1. Have a group of four parties to carry out the analysis.
  2. The group concludes that for the problem, Alex’s action has no bearing on climate change and has no financial implications. Hence, the analysis excludes the ecology measures, and λ = 3 (figure 5).
  3. The group applies step 3 (i.e., assigns the R-weights and S-weights to each of the six attributes of the metric) (figure 6). Since Alex’s action does not involve finance and environment considerations, they are not applicable.
  4. Given λ = 3, ɛ = 0, Is = 5, Ss = 1, β = {∑ [(Ri/Rs) + ɛ] + [Si x Ss]}/ 2x3, i = 1, …, 3,
    • βp = {[5/5+0]+[1x1]+[5/5+0]+[0.8x1]+[5/5+0]+[0.6x1]}/6 = {1 + 1 + 1 + 0.8+ 1 + 0.6}/6 = 0.90
    • βa = {[5/5+0]+[0.8x1]+[5/5+0]+[1x1]+[5/5+0]+[0.8x1]}/6 = {1 + 0.8+ 1 + 1 + 1 + 0.8}/6 = 0.93
  5. Finally, the β values of Alex’s action planned and beta values of Alex’s action are almost identical (0.90 vs. 0.93), which is very close to the desirable solution. That is, Alex has done the right thing.

Conclusion

Human bias is innate; therefore, data created and used by humans are biased. However, the software or algorithms that drive the technologies individuals and organizations depend on in their daily activities require accurate, consistent and reliable data, devoid of bias. What is at issue is not data bias per se, but the issues that the biased data induce. These issues transcend financial, technical and legal considerations and are inclusive of hitherto neglected social, ethical and environmental concerns.

Data quality is a crucial issue to data protection, and data bias is a hidden nuance to protecting that quality—data governance is needed. Governing data ethics is a precondition, and the ethics-based algorithm is one such solution.

Governing data ethics is a precondition, and the ethics- based algorithm is one such solution.

The ethical analysis of the example case study of taking a USB device home from work highlights the efficacy of the ethics-based algorithm to provide a holistic, pragmatic and feasible view, with quantitative and qualitative indications of the decision, action or policy thus reached.

The solution is especially valuable for auditors who deal with financial data and data governance as a matter of policy and for compliance with accounting principles and institutional regulations on data accuracy, consistency and reliability. It is imperative for auditors to be aware of hidden issues such as data bias and algorithmic bias and discrimination.

Endnotes

1 Centre for Financial Regulation and Economic Development (CFRED), Third Machine Lawyering Conference: Legal Innovation in Digital Society (Online), Chinese University of Hong Kong, February 2022, https://www.law.cuhk.edu.hk/app/events/the-3rd-machine-lawyering-conference-legal-innovation-in-the-digital-society-online/
2 Lee, W. W.; “Hexa-Dimension Metric, Ethical Matrix, Cybersecurity,” Encyclopedia of Information Science and Technology, 5th Edition, IGI Global, USA, 2017
3 Mepham, B.; M. Kaiser; E. Thorstensen; S. Tomkins; K. Millar; Ethical Matrix Manual, LEI, The Hague, January 2006, https://www.researchgate.net/publication/254833030_Ethical_Matrix_Manual
4 Op cit Lee
5 Food Ethics Council, https://www.foodethicscouncil.org/resource/ethical-matrix/
6 Op cit Lee
7 Twin, A.; “Delphi Method Definition,” Investopedia, 27 May 2022, https://www.investopedia.com/terms/d/delphi-method.asp
8 Stanford Encyclopedia of Philosophy, “Deontological Ethics,” 30 October 2020, https://plato.stanford.edu/entries/ethics-deontological/
9 Stanford Encyclopedia of Philosophy, “The History of Utilitarianism,” 22 September 2014, https://plato.stanford.edu/entries/utilitarianism-history/
10 Stanford Encyclopedia of Philosophy, “Consequentialism,” 3 June 2019, https://plato.stanford.edu/entries/consequentialism/

WANBIL W. LEE | DBA

Is a cyberethics evangelist and has five decades of experience in computing. He is president and founder of the Computer Ethics Society and is principal of Wanbil & Associates. Also, he is a university professor teaching information security and cyberethics to under- and post-graduate students. He researches, consults, and publishes in these areas, and has written more than 100 journal articles and conference papers.