◇ OpenCyber Academy
Postgraduate · Chapter 4 · English

Chapter 4 — Advanced risk and ethics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Advanced risk and ethics

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Employer and impartiality"]
  N2["4.2 Insider case fairness"]
  N3["4.3 Pressure"]
  N4["4.4 Privacy and proportionality"]
  N5["4.5 Ransomware payment ethics"]
  N6["4.6 Disclosure"]
  N7["4.7 Wellbeing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Employer and impartiality"]
  N2["4.2 Insider case fairness"]
  N3["4.3 Pressure"]
  N4["4.4 Privacy and proportionality"]
  N5["4.5 Ransomware payment ethics"]
  N6["4.6 Disclosure"]
  N7["4.7 Wellbeing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Employer and impartiality]
    |
    v
[4.2 Insider case fairness]
    |
    v
[4.3 Pressure]
    |
    v
[4.4 Privacy and proportionality]
    |
    v
[4.5 Ransomware payment ethics]
    |
    v
[4.6 Disclosure]
    |
    v
[4.7 Wellbeing]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) analyse ethical risks in enterprise investigations; (2) handle conflicts between employer interest and impartiality; (3) manage insider-case fairness; (4) decide on disclosure obligations.

4.1 Employer and impartiality

Marta's unit is paid by Corvane, but its findings may reach courts, regulators or employment tribunals. Impartiality is a professional duty: report what the evidence shows, including what helps the employee. In the phone case this means that the three messages sent during the employee's flight are reported as prominently as the 14 leaking messages. A report that omitted them would serve Corvane's immediate wish for a clear answer but fail at a tribunal. Marta signs off reports on the understanding that her unit's credibility depends on this.

4.2 Insider case fairness

In the phone case, the employee is suspected, not proven. Examiners look for exculpatory evidence too: was the phone shared? Were messages sent while the employee was demonstrably elsewhere? Casey (2011) stresses testing alternative explanations. Aiyana checks the device for signs of shared use, such as other accounts or unlock patterns known to colleagues, and compares message times with travel and access records. The three messages sent during the flight are the result: they do not clear the employee, but they show the simple account of events is not complete.

4.3 Pressure

A senior manager asks Aiyana to "focus on the messages that prove it". Marta intervenes: the examination answers the authorised question fully, and the report includes findings either way. The request is not unusual; managers often expect forensics to confirm a suspicion. Marta answers in writing, restating the authorised question and noting that selective examination would weaken any later case. Aiyana records the request in the case notes, so the pressure and the response are both visible to reviewers. The manager's request does not change the plan or the report's content.

4.4 Privacy and proportionality

Reviewing the employee's personal photos is not needed to answer the leak question. Proportionality limits examination to what is necessary. The phone holds 1,925 photos in the file-system extraction, and none is needed to establish whether customer account numbers were sent outside. Reviewing them would intrude on the employee's private life without serving the authorised question. If a chat message attached a photo of customer data, only that attachment would be examined. The decision not to review the photos is recorded with its reason in the case notes.

4.5 Ransomware payment ethics

Executives ask whether to pay. That decision belongs to leadership, legal counsel and possibly law enforcement; forensic input is factual: whether backups are intact, whether data were exfiltrated, whether decryption tools are publicly known. For CF-21 the forensic facts were concrete: whether backups were intact, whether the 18 GB transfer included customer data and whether a public decryptor existed for this ransomware. Marta's unit presents those facts with confidence levels and leaves the decision to leadership and counsel. Mixing the two roles would make the evidence look like advocacy.

4.6 Disclosure

If examiners find evidence of unrelated serious crime, they stop and seek legal advice on further authority and reporting obligations. In practice the examiner records what was seen, where and when, stops examining that material and informs Marta, who contacts legal counsel. The original authority covers the leak question, not other offences. Continuing without advice could make the new evidence inadmissible and expose Corvane to claims of overreach. Legal counsel then decides whether new authority is needed and whether any report must be made to authorities.

4.7 Wellbeing

Long incident hours degrade judgement; Marta enforces rest rotations. During CF-21 the response ran from 06:10 through the day and into the following week. Examiners work in shifts with handovers recorded in the case log, and no one signs a key conclusion at the end of a long shift without review. Tired examiners misread timestamps, which is exactly the kind of error this case cannot afford. Marta also checks in with examiners after the incident, because the pressure of CF-21 did not end when systems returned.

Independence of review

For the insider case, Marta asks an examiner who was not involved in the ransomware response to review the phone findings, reducing the risk that fatigue or team expectations shape the interpretation.

Worked example

The chat data show 14 leaking messages, but timestamps for three fall during a period when travel records show the employee was on a flight. Aiyana reports this inconsistency prominently, noting the possibility that another person had access to the phone or that the app queued messages for later sending — each needing investigation.

Synthetic case. The data are invented.

Errors and limits

Ethical guidance does not resolve every dilemma; escalate to legal counsel and professional bodies when stakes are high.

Exercises

Synthesis

Enterprise forensics stays impartial, proportionate and factual under employer pressure.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →