A Case Study of the British Airways Data Breach: Ethical Analysis

This report provides a comprehensive analysis of the British Airways data breach of 2018, examining the ethical implications of the incident. It begins with an executive summary and introduction, highlighting the growing importance of ethical considerations in the context of Information and Communication Technology (ICT). The report details the case scenario, where the airline suffered a significant data breach affecting hundreds of thousands of customers. It then applies four major ethical theories – social contract theory, utilitarianism, virtue ethics, and deontological ethics – to the incident, assessing how each theory relates to the breach and the actions (or inactions) of British Airways. The report concludes by emphasizing the necessity of robust information system security and the adherence to ethical guidelines to protect business and customer data. The analysis includes a discussion of the pros and cons of the ethical viewpoints and provides a thorough examination of the incident.

Running head: ETHICS AND PROFESSIONAL PRACTICE
ETHICS AND PROFESSIONAL PRACTICE: A Case Study of British Airways Scandal
Name of the Student
Name of the University
Author’s Note

1ETHICS AND PROFESSIONAL PRACTICE
Executive Summary
The purpose of this report is to showcase the ethical theories for the ICT scandals of British
Airways seen in April 2018. The report describes about the importance of ethics in daily
business operation. The report mainly focuses on the incident of British Airways, ethical
theories related to the incident. Lastly, the report concludes that the security of information
system should be undertaken on frequent basis and every organization should follow some
ethical rules and regulations to secure the information of their business.

2ETHICS AND PROFESSIONAL PRACTICE
Table of Contents
Introduction................................................................................................................................3
Case Scenario.............................................................................................................................3
Ethical theories...........................................................................................................................6
Social Contract theory:...........................................................................................................6
Utilitarian Theory...................................................................................................................7
Virtue Ethics...........................................................................................................................8
Deontological Ethics..............................................................................................................9
Conclusion................................................................................................................................10
References................................................................................................................................11

3ETHICS AND PROFESSIONAL PRACTICE
Introduction
In this new era information system, technology and communication system are
constantly developing with new advanced methods. The advances in ICT are beneficial in the
real world yet they are connected with numerous disadvantages. The growth and advances in
technology in relation to the human gets significance to be considered from an ethical end
and also from an affective perspective. Information technology and communication is
constantly extending and evolving which needs an explicit inclusion of communicative
perspective. It is important to consider the ethical issues which are related with the use and
implementation of Information and Communication Technology (ICT). The ethical issues
constitute the conditions for human attitudes and values specifying human actions and
behavior, and implying conditions for usefulness and maintenance of such systems. The
relationship between technology and ethics are established to synthesize the virtue of the
situation. It is important to be morally correct and virtuous while implementing ICT. There
are several reported cases of ethical breaches in relation to ICT in the recent past. The
number of ethical breach scenarios has gradually shown development in recent time. This
report discusses the recent case of British Airways where hundred thousand passengers’
details were stolen. The case is discussed in detail and also the ethical issues related to the
case. There are four major ethical theories- deontology theory, utilitarianism, social contract
and virtue ethics. The case is related to the violation of one of the ethical theories.
Case Scenario
In the 2018, British Airways have faced severe data breach and data theft. The
incident came into light in the later part of the year. British Airways have a scheme of
rewards which the customers who fly extensively with the Airway can avail by purchasing it

4ETHICS AND PROFESSIONAL PRACTICE
through credit or debit card. The reward booking which was done by the passengers or
customers sometime between the month of April and July were found to be at risk. The
British Airways revealed around 185000 passenger’s personal and credential details have
been in stolen from data breach. The airline suffered a massive data loss of around 380,000
customer details being stolen from the system database. In this scenario the cyber-attacks are
believed to have stolen not only the personal details of the passengers or the customers but
also valuable credit or debit card details. Important card details like CVV number (card
verification value), name, card numbers, identities and expiry dates have been stolen. The
airline fears that the residing customer details and credit or debit card details may be at risk.
The company later downgraded the number of victims to 244000 who have been affected by
the cyber-attack. The airline company estimates that there are several other confidential and
sensitive data are at risk and some may be already lost in the attack. The company later
revealed in a statement to the stock market that around another 108000 customer details have
been stolen which does not include the stealing of CVV number, which is the three-digit card
verification value. The CVV acts as an extra layer of protection for online transactions. A lot
of personal information have been compromised and stolen from the company’s database by
the attackers. There have been instances of data manipulation as the attackers silently
snooped into the network channels of the airline company to gather data from it. Customer
personal details, card details and other sensitive data came in the hand of the attackers. The
data breach occurred on the company’s mobile application and website. As the customers
brought those reward points by using their credit cards, the attackers snooped on the
information from the network channel. There is a high chance of security codes being
compromised. The attackers stole billing addresses of more than hundred thousand customers
along with other official details. The attacks have affected to a customer base of 380,000. The
breach was noticed around the between August 21 and September 1, 2018 (Kozlowski, 2018).

5ETHICS AND PROFESSIONAL PRACTICE
The airways claimed that the hackers or the cyber attacker started the attack since April that
year. Such sensitive data falling into the wrong hands creates additional threats for the future
as they can be misused or even manipulated to extract further information or plan for other
future attacks.
There has been a massive amount of data loss from the airline’s data system which
resulted in ethical breaches. The airline company was unable to confirm any details of the
source, origin of the attack and the process of the attack. The pattern of the attack could not
be identified and the airline could not provide any conclusive evidence for investigation.
There was no evidence to support the fact that data was removed from the airline company’s
database. The customers who applied for the reward scheme and paid with their credit or
debit asked was asked to verify with their banks to understand any theft or transfer of money
from their account. The airway constantly kept working with the investigation department to
understand the nature of attack and pull out strong evidence to base the case on. British
Airways said it has not yet received any verified reports of fraud in relation to the data
breach. This particular breach marked the system failure and the numerous vulnerabilities
present in the computer system and network system of the airline company. This led to the
cancelation of numerous flights from the airports that year. The company took action by
letting the customers know about the developing situation and the data loss. They prudently
notified the customers to contact their bank to know about their account balance or to
understand any suspicious transaction of cash from their attack. This was taken as
precautionary step to prevent cash loss from the accounts of the customers whose data have
been stolen. The customers who were not contacted by the airlines company were called safe
from the attack. The company could identify any case of fraud and they offered credit rating
monitoring to customers who are concerned about an impact to their credit scores. The attack
questions the security system of the airlines database and the network channel. The websites

6ETHICS AND PROFESSIONAL PRACTICE
and the mobile application of the company had major flaws and vulnerabilities in the system
which, lead to the attack. The system did not have stringent security protocol to prevent the
launch of the attack and phishing out valuable information from the airline’s database. The
failures in the security protocol lead to such an attack and the loss of massive amount of data
from the database. The IT officials also failed to identify the attacks initially or could not
track any suspicious movement inside the network system of the company. An early
identification of the suspicious activity within the system could have stopped the attack
completely or to some extent could have reduced the magnitude of the attack resulting in
fewer amounts of data being stolen. Other customers of the airline have potential risks of
facing thefts or manipulation as their critical information has been stolen which makes them
vulnerable to additional attacks. Time will tell whether more customers are yet to be affected
from this breach or not.
Ethical theories
Social Contract theory:
Social Contract Theory deals with the people existence in the society in the presence
of some social agreement which establishes the moral and the political rules regarding the
behavior. Socrates introduced the social contracts by describing the ideal agreement, then
Stuart Rachels, a philosopher suggested that the morality is the list of rules used to govern the
behavior which people will accept on the condition that the other people will accept it too.
Social contract may be both explicit like laws and implicit like rising one’s hand to deliver
his or her description regarding any topic. People living in some particular country should
maintain and obey all the social contract mentioned in his or her country’s Constitution’s
social contracts. Moreover, social contracts give an important and valuable layout for
harmony in the society. The Social Contract theory analyzes the right to punish someone for a

7ETHICS AND PROFESSIONAL PRACTICE
particular crime and it also justifies the civil disobedience. The mentioned incident caused a
vital effect to the people as it causes in sharing all the details present in the card, like name,
address, card expiry date and so on. The Social contract theory is applicable as it is not
appropriate to steal one’s identity and misuse that information in various ways. The customer
loses their identity and are leading a risk filled life because the hacker can misuse the identity
anywhere and at any time. The victims are immediately asked to block the card to mitigate
the effect of misuse. The attackers of the incident did not obey or follow the social contract
mentioned in his or her Constitution. Thus, the Social Contract theory is highly disbalanced
in this mentioned incident.
Utilitarian Theory
This theory is the normative ethical theory which places the locus of correct and
incorrect actions on the outcomes. It relocates over one’s perspective of interest and consider
interests of others.
Bentham’s principles of Utility:
 It determines the major role of pleasure and pain in the human life.
 it approves or disapproves the action based on the amount of pain or pleasure
brought by the action.
 It equates good by pleasure and bad by pain
 It measures the pain and pleasure based on the quantification.
In measuring the pain and pleasure Bentham innovates the following method
CERTAINITY, NEARNESS, DURATION, INTENSITY, EXTENT, PURITY and
FECUNDITY.

8ETHICS AND PROFESSIONAL PRACTICE
John Stuart Mill modifies the more hedonistic tendencies of the Bentham’s
philosophy by highlighting that:
 The center of utilitarianism is not the quantity of pleasure but the quality of the
pleasure.
 The qualities cannot be quantified thus, calculus of quality is unreasonable.
 The Utilitarianism promotes to achieve happiness in all possible ways.
Act and rule Utilitarianism
The basic principle of utility is used directly to every alternative act in the chosen
situation. Then the action is chosen as good or bad, those which provides happiness are
considered to be good and those which provide pain are considered to be bad. It is easy to
justify the immoral acts utilizing the AU. This is known as Act Utilitarianism.
The basic principle of utility which is used to determine the validity of the rules of
conduct is known as rule utilitarianism. In this module the right and wrong are decided on the
basis of the validity of the action.
Thus, in the mentioned incident, data breach is such an incident which provide severe
pain and disappointment to the victims as well as to the airport officials. Customers blamed
the airport officials as they face the attack while the online net banking process. The officials
could not recognize that their transaction bridge was breached by the attacker and the attacker
simply collects all the data of the customers and misuse the data.

9ETHICS AND PROFESSIONAL PRACTICE
Virtue Ethics
It is a wide term for the ethical theories which emphasize the action played by the
character and the virtue in the moral philosophy. It is a character-based model of morality
that assumes that we hold the virtue by practice. A person acquires an honorable and moral
character by being brave, honest, generous behavior. Aristotle stated that people will go for
the right choice when he or she will face the ethical challenges. Virtue ethics deals with some
vast questions like “how should we live?”, “what is good life” and “what are the appropriate
social values?”. It is dimensioned in three main structures: Eudaimonism, ethics of care and
agent-based theories. Eudaimonism basically flourishes the virtues in human, where the
virtues are equated with the performing one’s specific function. An agent-based theories
states that the virtues are realized by general sense intuitions. The ethics of care focuses on
justice and autonomy.
Deontological Ethics
It is the normative theory of the ethics which focuses on the actions of some particular
deeds. The deed is stated as good or bad depending on the action. If the action is right and
follow all sets of rules and regulations of the Constitutions then the deed is said to be
appropriate else the deed is considered as inaccurate. It is the ethical layout which depends on
the preregistered list of rules and regulations regarding the proper functioning of some
actions. The deontology is a simple layout that determines that the action is following some
set of rules or regulations while performing some specific task or not. According to this
theory, Work can be considered as virtuous if and only if the action follows the set of rule
and regulations. Deontology does not have to weigh the cost and benefits of the situation.
This makes the procedure and the method simple than others. Despite its strengths,
deontology can generate some results that can be unacceptable by human.

10ETHICS AND PROFESSIONAL PRACTICE
Thus, in the mentioned incident the attacker breached the site which is an illegal
action which again proves that the incident was a sinful incident. The process of stealing
something is itself a sinful act and here the attacker steals the details of the customer of
British Airways. The customer transferred the money for their ticket booking via online to the
British airways. The officials were unknown of the fact that their site was breached or hacked
by some attacker. In that moment whoever transferred the money to the British airways were
unknown of the fact that they are delivering their card details to the attacker, the details
include name, address, card number, bank balance information and so on.
Conclusion
Therefore, from the above report it can be concluded that data breaching is an
important and a critical ethical deed of ICT. The British Airways incident of 21st April to 28th
July is the freshest example and is displayed in this report. The detail of the incident was
described and the ethical theories regarding the incident was also discussed. The ethical
theories prove that the incident was a sinful one as it deals with delivering pain to the people,
the action of the incident itself is a wrong or inappropriate one for the business, the attacker
did not follow the rules of the social contract. Thus, every organization should build an
accurate ethical blocks or structures which will help the organization to stand straight forward
against any ethical issues. The ICT is an important factor in this digital world and also holds
lots of information, so it should be protected from every possible way and should kept
secured such that the information from the systems do not get lost or could not be easily
hacked by the attackers.

11ETHICS AND PROFESSIONAL PRACTICE
References
Kozlowski, A. (2018). The European Union Effective System of Sanctions Against
Cyberattacks. The VISIO JOURNAL, 9.