Ethics and Professional Practice of Cathay Pacific Airways Data Breach

This essay examines the 2018 Cathay Pacific data breach, where personal information of over 9.4 million passengers was compromised. It explores the main issues, including the delayed disclosure and the breach of customer data, and applies ethical frameworks like consequence-based, duty-based, contract-based, and character-based theories to analyze the situation. The essay delves into the facts of the breach, the affected parties, and the ethical implications, suggesting potential solutions such as improved data security policies, accessibility management, and regular data backups. It concludes by emphasizing the importance of strengthening IT infrastructure and adopting robust security measures to prevent future breaches. The essay highlights the pros and cons of the situation and proposes the best option for Cathay Pacific, which involves policy changes to ensure high security standards.

0ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
Ethics and Professional Practice of Cathay Pacific Airways
Name of the Student
Name of the University
Author’s note

1ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
Table of Contents
1. Introduction to the Scenario.........................................................................................................2
2. Main Issues of the chosen Scenario.............................................................................................2
3. Doing Ethics Technique..............................................................................................................3
3.1 What is going on?..................................................................................................................3
3.2 What are the facts or information?........................................................................................3
3.3 What are the main issues?......................................................................................................4
3.4 Who are affected?..................................................................................................................4
3.5 Ethical Issues and Implications.............................................................................................4
3.5.1 Consequence based theory..............................................................................................4
3.5.2 Duty based theory...........................................................................................................5
3.5.3 Contract based Theory....................................................................................................5
3.5.4 Character based theory...................................................................................................6
3.6 What can be done?.................................................................................................................6
3.7 What are the options?............................................................................................................6
3.8 What is the best option and why?..........................................................................................7
4. Pros and cons of the issue............................................................................................................8
5. Conclusion...................................................................................................................................8
References........................................................................................................................................9

2ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
1. Introduction to the Scenario
According to details derived from news, it has been discussed that Cathay Pacific has
detected a massive data breach and exposing of personal information of more than 9.4 million
passengers. The Hong Kong based airline carrier had also faced a massive form of criticism
based on their seven month of delay in publishing the news based on their revelation of breach
within their data (Cathay Pacific flags data breach affecting 9.4 million passengers, 2019). The
data breach that had been reported by the airline carrier had been made due to unauthorized
access within their data network. Many kind of suspicious activity were also detected within the
security network, which had occurred in March.
In the report based on the breach of data, Cathay Pacific had confirmed that the data of
more than 9.4 million passengers within their unit and Hong Kong Airlines Limited were also
accessed without any form of authorisation (Hunter & Lambert, 2016). In the published report by
the airline carrier, Cathay had also confirmed that 245,000 Hong Kong based identity card
numbers, 860,000 passport numbers, 430 expired credit card numbers and the Card Verification
Value (CVV) were also been released in the breach. Although the company had apologised over
the event, but such kind of events would lead to leak of information for the clients and which
might cause tremendous issues for the company.
2. Main Issues of the chosen Scenario
The news revealing the incident of the data breach had come many weeks after the
British Airway had revealed about the fact that many credit card details of passengers were
stolen over a period of two weeks. In several statements that were exposed by the company, it
was also revealed that the names of passengers, birth dates, nationalities, physical and email

3ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
addresses, passport numbers, historical travel information and identity card numbers were also
been revealed.
The main issues that had raised from the scenario is that there was a detection of
suspicious activity within their network (David-Cooper, 2015). Personal data of several
customers were breached. The main issues that had risen from the issue is that hundreds of data
from customers would be revealed. The customers had also revealed that their valuable were
being breached, thus demanding a solution to their problems raised from security issues.
3. Doing Ethics Technique
3.1 What is going on?
New updates on the news about the data breach based on Cathay Pacific had also
revealed the fact that the personal data of more than 9.4 million passengers were breached. The
breach into the personal data had sustained for a time period of more than three months. The
Hong Kong lawmakers in their written statement had also claimed the fact that victims of the
cybercrime were at intense tensed situations (Sharkey, 2016). However, with the effect of the
data breach, there were no such regulations that had emerged from the concerns based on the
specific data, which were compromised.
3.2 What are the facts or information?
The facts or information that are in relation to the data breach are discussed as follows:
1. In March, 2018, the airline carrier had detected their first breach within the data in
their network. They had also taken immediate action based on the understanding of the incident
(Sjöblom, 2016). The company had also sought the help of the leading global cyber security firm
in order to gain many more details about the authority responsible for the incident.

4ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
2. During the period of May-August, Cathay Pacific had also attempted to ascertain the
extent to which the data of passengers had been stolen or accessed. They were also trying to
ascertain whether the compromised data could be further reconstructed outside of the IT systems
(McAllister, 2015). During this phase, the company officials had also tried to derive a single,
meaningful and accurate notification in relation to every affected passenger. They had decide to
handle these rather than providing a non-specific or overly board notice.
3.3 What are the main issues?
The main issues that were faced by Cathay Pacific is that the leaked data of passengers
had risen the concerns of the passengers. They were demanding justice in terms of protecting
their data from the next steps of the breach. These customers were reported to demand an answer
from Cathay to compensate the affected customers (Riedy & Hanus, 2016). They had also
demanded an answer from the lawmakers about incurring a fine from the new European Union
privacy rules.
3.4 Who are affected?
Cathay Pacific had confirmed the information about the data breach during the
performing of investigation of their internal data. The Hong Kong based flight carrier had
reported that the incident of data breach had led to an exposure of more than 9.4 million
passengers (Broderick et al., 2017). However, they could not provide a specific information in
relation to the fact up to which extent the data had been compromised. However, during the
investigation over the data breach, it was confirmed that the safety of flight systems were not
affected during the data breach

5ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
3.5 Ethical Issues and Implications
3.5.1 Consequence based theory
Based on the consideration of the consequence based theory, the incident for the Cathay
Pacific could be focused based on the results and consequences. The sole purpose of morality is
determined to be utility or usefulness. The moral form of correct action could be defined as the
one, which would be able to produce the most form of good to the affected people and would
also cause least form of suffering for the common people.
3.5.2 Duty based theory
The duty based theory can also be defined as the deontology theory. This kind of theory
states that people would be morally obliged to act as per accordance within a certain set of
guidelines, rules or principles. This theory further states that every individual has their individual
responsibilities and duties to fulfil their individual duties in order to achieve social good towards
the society (Ashenmacher, 2016). In the case of the data breach incident, it can be further
confirmed that the internal team at Cathay Pacific would have a responsibility to investigate
regarding the incident of the data breach and thus also suggest the best possible measures that
would be leading to protect the internal systems.
3.5.3 Contract based Theory
The social contract theory also suggests that people would live together in accordance
within the society based on a certain level of agreement. This would further be able to establish a
certain connection between the political and moral rules based on behaviour (Fox, 2014). There
are many people who would believe in the fact that is people would live together according to
the norms of social contract, then they would be guided in a moral form based on their own
choices.

6ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
In the case of the data breach incident, it could be discussed that if the internal data
security team had been guided under the moral principles, then they might be able to secure their
systems in the future and thus ensure that the data of the passengers would remain highly
secured.
3.5.4 Character based theory
Character based ethics theory can also be termed as virtue ethics. It can be defined as
normative ethics theory based on putting emphasis over the virtue for each person based on their
character and mind (Vasiliadou, 2016). The use of virtue theory defines the virtue for each
person involved within a certain incident based on the depth of the situation.
With the help of such kind of ethics, that could be applied to real life contexts, it could be
discussed that the researchers and analysts would be put to work within the real-life scenario of
the data breach incident (Cavoukian et al., 2015). These researchers would have to build their
own virtue in order to determine the incident of the breach and thus suggest some possible
measures that would help the company in solving the problems in relation to the data breach.
3.6 What can be done?
In accordance to the discussed scenario, it can be discussed that Cathay Pacific should
take care of their Information Systems and thus should also redefine their IT standards based on
security and the underlying encryption standards. A strong form of building of It infrastructure
by investing into the IT structures should be done (Austin, 2018). The company should also hire
a new security staff who would be responsible for designing the new standards based on security.
The information that had majorly been accessed are in relation to the credentials of the customers
that had been extracted by the company in order to perform analysis over them.

7ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
3.7 What are the options?
Based on the incident of the data breach, it can be discussed that Cathay Pacific should be
responsible for taking various kind of measures in relation to securing their data that is derived
from their customers. Some of the best possible options that could be taken by Cathay Pacific
are:
1. Accessibility management – Cathay Pacific should be able to decide in the best
options about choosing the proper candidate who would be given the responsibility the internal
data of the company. They should primarily determine which employees would have to access to
the type of data.
2. Development of data security plan or policy – Another strategy that could be
developed based on the security of the data is based on designing of a data security policy. Such
kind of plan that would be put in place would lead to protection of data security breaches
(Ebrahimi & Walsh, 2018). This kind of policy would also lead to changes within the
amendments and bringing in innovation within the policies of the company.
3. Regular backup of sensitive data – The backup of sensitive data in relation to the
company should be performed on a regular basis. Loss of data is always considered as a serious
issue and thus Cathay Pacific should opt to a cloud based solution for backing yup their internal
data.
3.8 What is the best option and why?
The best option that could be selected from the range of options is that the company
should focus on bringing in changes of their policies. From the consideration of the data breach
incident, it has been confirmed that the incident had majorly affected to the low amount of

8ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
quality of standards in relation to security (Camilleri, 2014). A proper form of data security plan
that might be put in proper order would guide the employees within the company to act
accordingly to such kind of plans. They would thus be able to ensure the protection of systems
with the help of encryption standards. The different forms of encryption and other security
techniques would help Cathay Pacific to ensure a high standard
4. Pros and cons of the issue
Based on the discussions over the Cathay Pacific data breach issues, it pros that can be
discussed from the scenario is that the internal security team were able to understand about the
lacks in their data systems.
The cons from the issue is that the leaked data of the customers could be further used for
gaining access to their bank accounts (MorEY & KrajEcKi, 2016). The hackers could thus
extract the money from their accounts. Another con from the issue is that it might lead to a bad
reputation for the company, which might lead to a bad impact for them in the global market.
5. Conclusion
Based on the discussed scenario of the data breach, it could be concluded that the incident
of data breach should be taken under deep consideration. The security officials should respond to
the incident by implementing various kind of technical measures within the systems. Backup to
cloud based systems could also be taken as a serious concern as this would help the company in
securing the data of their client. Hence, the securing of end systems should be highly taken into
consideration in order to protect the data of customers. This would also be helpful in protecting
the reputation of the company and ensure a successful position in the international market.

9ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
References
Ashenmacher, G. (2016). Indignity: redefining the harm caused by data breaches. Wake Forest
L. Rev., 51, 1.
Austin, G. (2018). Corporate Cybersecurity. In Cybersecurity in China (pp. 65-79). Springer,
Cham.
Broderick, R., Emmel, L., Gierczak, K., & González, R. O. (2017). Safety and profits in the
airline industry. International Journal of Arts & Sciences, 10(2), 327-338.
Camilleri, S. (2014). The Current State of Cyber Security Readiness in the Aviation Industry.
Cathay Pacific flags data breach affecting 9.4 million passengers. (2019). Retrieved from
https://in.reuters.com/article/cathay-pacific-cyber/cathay-pacific-flags-data-breach-affecting-9-4-
million-passengers-idINKCN1MY2B8
Cavoukian, A., Chibba, M., Williamson, G., & Ferguson, A. (2015). The importance of ABAC:
attribute-based access control to big data: privacy and context. Privacy and Big Data Institute,
Ryerson University, Toronto, Canada.
David-Cooper, R. (2015). Implementing safety management systems (SMS) in Canada: is flight
safety on a collision course with the forced disclosure of SMS data. Issues Aviation L. &
Pol'y, 15, 77.
Ebrahimi, A., & Walsh, L. (2018). Improving Management Education Outcomes: Why
Managers Need to Understand Information Technology in Today's World. Ubiquitous Learning:
An International Journal, 11(1).

10ETHICS AND PROFESSIONAL PRACTICE OF CATHAY PACIFIC AIRWAYS
Fox, S. (2014). Safety and Security: The influence of 9/11 to the EU framework for air carriers
and aircraft operators. Research in transportation economics, 45, 24-33.
Hunter, J. A., & Lambert, J. R. (2016). Do we feel safer today? The impact of smiling customer
service on airline safety perception post 9–11. Journal of transportation security, 9(1-2), 35-56.
McAllister, M. C. (2015). Maximizing Safety under NextGen: Apportionment of Duty, the
FTCA, and Policy in Aviation. Colo. Tech. LJ, 13, 129.
MorEY, T., & KrajEcKi, K. (2016). Personalisation, data and trust: The role of brand in a data-
driven, personalised, experience economy. Journal of Brand Strategy, 5(2), 178-185.
Riedy, M. K., & Hanus, B. (2016). Yes, Your Personal Data Is at Risk: Get over It. SMU Sci. &
Tech. L. Rev., 19, 3.
Sharkey, C. M. (2016). Can Data Breach Claims Survive the Economic Loss Rule. DePaul L.
Rev., 66, 339.
Sjöblom, O. (2016). Data Mining in Promoting Flight Safety.
Vasiliadou, A. (2016). Leisure Travel and Legal Issues in Aviation. In Aviation and Tourism (pp.
89-102). Routledge.