1/ This is an excellent tweet.
2/ When you look across the fields of professions (doctors, lawyers, journalists, priests, bridge builders, etc.), you'll find that the official "professional ethics" have little to do with academic ethics (Aristotle, Kant, etc.) and more to do with practical realities.
3/ That "ethics" derives somehow from ancient greek philosophers is fiction. If it were true, then abortion would still be unethical, as in the original Hippocratic Oath.
4/ Take "off the record" conversations in journalism. You'd think that the highest ethical requirement is to defend this secret. The opposite is true, because those wanting to influence the journalist and the record abuse "off the record".
5/ So you simply saying "this is off the record" doesn't make it so. Journalists only have an ethical duty to keep something off-the-record when the agree before hand, and journalists generally should not agree to it.
6/ We likewise have practical experience in our profession (infosec/cybersec). Vendors are now getting flooded with people trying to extort "bug bounties". Because of this experience, we can easily say it's unethical to demand a bug bounty as a condition off reporting a vuln.
7/ One easy measure of ethics is if you'll be embarrassed if it comes to light. That's what appears to be the case in that Facebook story: they knew what they were doing was wrong, and Facebook was embarrassed by the revelation.
8/ Back to our profession: Is it ethical to hack back at the Russians, like the Internet Research Agency, the GRU, or the oligarchs who funded the 2016 election meddling? It's illegal, but is it nonetheless ethical?
9/ This can be answered by when you are caught, do you say "that was me and I'm damn proud of what I did", or do you say "I would never do such a thing".
10/ I admit that specific example has additional difficulties. Personally, I'd want the world to know I was responsible, but yet I would not like to get poisoned by a nerve agent or polonium by a pissed off Russian government.
11/ I'm out in that grey area of what many would consider ethical/unethical mass scanning the Internet. I'm a creep touching your Internet modem several times a month. I resolve this conflict by making what I do very public, it's me, and I'm proud of what I'm doing, not ashamed.
12/ Companies like Uber and Facebook have the legitimate concern that whatever they make public, no matter how virtuous, will be twisted as evil by the press and activists who hate them. That's a good ethical problem to consider.
13/ The answer is obviously that it's still unethical to hide issues of public concern, such as how Facebook scraped your call log. That your enemies will distort it is not reason enough to keep it secret. If Facebook can defend that action, they need to do so in public.
14/ In other words, Facebook scraping your call log isn't ethical because I think it's wrong, it's unethical because they thought it was wrong, and took steps to hide it from their users.
