Fluent Essays

Read the case studies (Attached Below) Making Ethical Decisions ETHICS AND THE INFORMATION SECURITY PROFESSION Answer the following Questions: What are the ethical dilemmas and challenges faced by information security professionals? Are professional organizations' ethical codes of conduct beneficial as an information security professional? How does a corporate ethical policy help information security professionals with ethical decision making? Writing Requirements The Essay must be 3 pages long. Double Space Must have an introduction with a clear thesis statement, a body discussing the three main points, an ethics section discussing the documents ethical ramifications, and a conclusion Use at least 2 academic books and 3 scholarly articles from a library database ETHICS AND THE INFORMATION SECURITY PROFESSION  Whether you subscribe to a professional code of conduct[1] or you just claim to be the "good guy" who is protecting the information assets of your organization, your colleagues, your employer, and those whose information you protect expect you to behave ethically. In this context, I use ethics to mean "the rules or standards governing the conduct of the members of a profession."[2] However, elements of its common use as a synonym for morals also apply. Ethical conduct includes both acts of commission and acts of omission. We have obligations to perform certain tasks and obligations not to perform others. Just as a soldier may be held to account for accepting an unlawful order, so may the information security professional be held to account for acceding to management requests if they would violate professional ethics. I have found, however, a wide diversity of opinion among people who assert professional status in our field. The use of "social engineering" as a technique for testing security, for example, is viewed by some as ethical and by others as unethical. Since I have a background in applied psychology where psychological experimentation might have included "tricking" a person, I have strong feelings about the protocols that you should follow. I believe that a full and professional debriefing of any victims of such trickery is needed. Otherwise, the security test may inadvertently harm these people. In most situations I've heard about, no such protocols were in place. I'd view such testing as unethical. I recognize, however, that other competent and well-meaning professionals may hold a contrary opinion. The rules in our profession are evolving with few well-documented cases. Many organizations with which we may associate have codes of conduct. The Information Systems Security Association (ISSA) has a terse one (see http://www.issaintl.org/members.html). The Information Systems Audit and Control Association (ISACA) has a longer one, which also refers to additional ISACA standards (see http://www.isaca.org/cert3.htm). And the Association for Computing Machinery (ACM)[3] has a very detailed code (see http://www.acm.org/constitution/code.html). The International Information Systems Security Certification Consortium, (ISC),[2] also has a code of ethics. It is only slightly longer than the ISSA code. At the time of my writing, the Ethics Committee of (ISC)[2] was revising this code. In the discussion that follows, I will refer to these and other codes of ethics. SOME BEHAVIOR IS CLEARLY UNETHICAL When the issue is selling confidential data to which you have privileged access or mounting a denial of service attack against a previous employer who refused to renew your employment contract, the information security professional has little trouble knowing what is, and what is not, ethical behavior. Shades of gray invade our ethical palette when we must weigh a social good against a personal evil, or when we can only accomplish one of mutually exclusive objectives forcing an ethical dilemma. For example, an employee tells you of an overheard conversation in which "George" boasts of a scheme to defraud his employer. You have the authority to turn on detailed auditing for all of his transactions and the privileged access level necessary for reading his e-mail, should you investigate George to determine the truth of the allegation? Can you ignore the warning? What if George was boasting of a bomb he had built instead of a fraud he was going to commit? What if George had been discussing only a novel he had just read? The Hippocratic Oath taken by medical doctors includes a pledge to do no harm. Perhaps we should begin with this ethical edict. (In fact, the ACM code contains a similar pledge.) Simple as this principle sounds, our actions in complex situations force us to make difficult choices. We are bound to weigh the interests of many parties in our professional activities. For example, how will our action (or inaction) affect our employer, other employees, stockholders, vendors/suppliers, customers, our professional colleagues, and society at large? Whose interests should take precedence when an inevitable conflict occurs? Although many of us have years of risk management experience and may have used risk analysis tools to assist us, our experience with ethical assessments may lie more with our personal character than with any training in ethical analysis. Our codes of conduct tend to speak in absolutes, but we tend to operate more on the basis of situational ethics. In our earlier example with George, does the risk to the many outweigh the rights of the few? Or are personal freedoms an absolute? If you feel that this begins to sound like a political or religious discussion, then you grasp the complexity of determining ethical behavior. When we truly wish to act ethically, real-world cases may force difficult choices. When we need to determine if someone has acted ethically, for example, in enforcing a professional code of conduct, we may similarly face difficulties, both in knowing what the ethical action should have been and in knowing whether the professional's actions were unethical or just poor judgment. As information security professionals, we may need to meet a higher standard than other information professionals. Because we have "special knowledge" others will rely on our advice. If our advice proves inaccurate, we must take responsibility for it. Even when our advice is accurate, because we will not always succeed in making our case clear or sufficiently convincing, some people will ignore our advice. Is a "CYA" memo to the file expiation for us when damage results from our being ignored? Should it be a defense in an ethics proceeding? None of the codes of ethics I've read address the resolution process for ethical dilemma. For example, a requirement to protect confidential information (or a national security classified document) may make cooperation with an investigation difficult, if by cooperation we mean the volunteering of such information. Some of the codes require compliance with "professional standards" as yet undocumented for the information security profession. And all of them ask us to make judgments about outcomes when we can only accurately assess our own actions. In this last case, we seem to ask members of our profession to foresee all consequences. I believe the lack of specificity -- in particular, the absence of clearly documented standards of behavior --makes self-regulation problematic. Notwithstanding, I propose a few rules that might spark a debate. 1. I will resign rather than participate in unethical conduct. The practical implications of ethical practice include a willingness to resign rather than participate in unethical conduct. If your management insists on you monitoring the actions of an individual or group, for example, to catch them at "something" so management can fire them, such monitoring may be unethical -- even illegal -- especially if no objective reason to suspect them of wrongdoing exists. Your first obligation would be to advise management of the risk such an action entails. But if management insists, you are forced to choose between ethical conduct (i.e., you refuse to participate) or unethical conduct (i.e., you do as asked). 2. I will report unethical conduct to appropriate authorities. Refusing to participate may be insufficient in meeting your professional obligations. If you have a mechanism for independent reporting of fraud and abuse, you may also have an obligation to report the actions of your management. 3. I will support my colleagues in their ethical conduct. The information security professional may face difficult choices. Unethical behavior should have consequences to the professional, although ethical behavior is no talisman warding off adverse results. Other members of the profession have an obligation, in my view, to support the ethical conduct of their colleagues. Conversely, we should refuse to engage professionally with persons known by us to conduct themselves unethically. 4. I will shun those persons whom I know have conducted themselves unethically. One of the hallmarks of a profession come of age is its ability to police itself. To the extent that the bodies promoting professional certifications in our field take seriously this obligation, our endeavors rise to the stature of a traditional profession. If we do not take seriously our professional ethics, we risk externally imposed regulation or the denigration of our field to that of a technical specialty, an administrative function, or a hired hand. Our professional ethics warrants wider discussion and open debate. Codes of conduct are a good start, but we need a body of professional standards. Perhaps we may also be able to develop "ethics analysis" tools to assist us. Much work in academic circles has already been done. See, for example, the Center for Applied Ethics at http://www.ethics.ubc.ca/resources/computer/index.html. You may also wish to see a wide variety of codes of ethics from many fields (including a "hacker" code of ethics!). If you visit http://www.ethics.ubc.ca/resources/professional/codes.html you, will find more than two dozen. Please let me know your views on codes of conduct and professional ethics. You may send me an e-mail at [email protected] Notes 1. For examples, the Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Protection Professional (CPP), or Certified Fraud Examiner (CFE). · 2. The American Heritage Dictionary of the English Language, New College ed. (Boston: MA, Houghton Mifflin Company.) · 3. ACM has a special interest group for security audit and control (SIGSAC) that participated in creating its code of ethics. ~~~~~~~~ By Ralph Spencer Poore RALPH SPENCER POORE is an Area Practice Leader, Electronic Commerce for Ernst & Young LLP. Copyright of Information Systems Security is the property of Taylor & Francis Ltd and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. References Poore, R. S. (1999). Ethics and the information security profession. Information Systems Security, 8(1), 15. JENNIFER KREIE AND TIMOTHY PAUL CRONAN MAKING ETHICA DECISIONS How companies might influence the choices one makes. T oday's information technology makes vast amounts of data accessi- ble to businesses and their employ- ees. This accessibility provides great benefits but also creates the poten- tial for misuse of information tech- nology. Businesses are concerned about the ethical behavior of their employees and the security of their information systems. Therefore, businesses are interested in whether they can infiuence their employees' decision to act ethically or unethically [1, 9]. One avenue of action for companies is to establish a code of ethics and there is evidence that having such standards does influence employees [7]. Some researchers [4, 8] believe there are certain sit- uations where external infiuences, such as company standards, are more likely to affect employees' behav- ior. This view of ethical decision-making is based on the concept of an individual's perceived importance of an ethicaliyiE) issue [8]. When an ethical issue is per- ceived as very important, we are more likely to rely on our personal values in judging what is ethical or unethical. However, we are more open to external infiuences, such as business or professional codes of ethics or the opinions of peers, if we do not consider the ethical issue very important. The results of a recent study support the idea that businesses can infiuence their employees' behavior particularly in certain situations. When a person feels the ethical issue in a situation is not especially impor- tant, that person is more likely to act based on what company standards say is acceptable or unacceptable behavior. This does not mean employees will ignore company standards when an ethical issue is important to them, but they are more likely to take their cue from the company when they do not feel an impor- tant ethical issue is involved. On the other hand, in a situation where a person feels the ethical issue is very 66 De<:ember2000/Vol.43,No. 12 COHMUNICAT1ONSOFTHEACM important, that person may make a judgment based more on personal values than on business standards. An ethics survey was given to just over 300 stu- dents' at a large university located in the midwest U.S. The survey participants were mostly from MIS classes but a few were in accounting or finance classes. Stu- dents participated voluntarily. Over three-quarters of the participants were juniors or higher—almost one- third were seniors or graduate students. The average number of years of work experience was 2.4 years. Interestingly, 45% of the participants said they had encountered an ethical dilemma at work. The survey contained five scenarios that were adapted from [3]. The scenarios involve the use of Q information technology and each describes an ^ Thf pa nit i pan IS induded 16 frt-shmtn, 55 sopliomores, 140 juniors, 53 seniors, and X 41 graduate students. The total number ot respondents varies tor each scenario because Q, oFsome incomplete responses. employees actions in a particular situation. The sce- narios were chosen to represent possible ethical issues such as privacy, intellectual property, and accessibility. These scenarios have also been used in previous research conducted by the authors.' During the survey the participants first read each scenario and judged whether what the person did was acceptable (ethical) or unacceptable (unethical).' Next, the participants were given a 7-point scale to rate the importance of the ethical issue in the scenario (very important to unimportant) and to rate the ^A ptevious Communicatiom article examined the ditTerences in ethical judgment between men and women [5|. This atEicle deals with a different data set collected with jn extended •iurvey. A stimmary of the ditTetences between men and women for the current and previous study is available on the Web at web, nmsu.edu/-jkreit7. Signifi- cant difterente.f were tound between men anii women tor some, bul not all, tesfHinses in the srudv on which rhij article ii based, -'The terms "acceptable" and "unacceptable" were used interchangeably with "ethical" and "unethical" when the survey was presented to the study parricipanis. COMMUNICATIONS OF THE ACM December 2000/Vol, 43, No, \1 67 probability they would do the same as the person described (extremely probable to extremely improba- ble). The participants were also asked whether an established company policy against such behavior might affect the employee's behavior. Finally, partici- pants were asked to indicate the degree to which var- ious factors' influenced their judgment of the behavior described in each scenario. The following five sections describe each scenario and highlight certain responses to survey: was the behavior acceptable or not; how important was the ethical issue; would survey respondents probably do the same; how probable is it that someone would do the same if company policy prohibited this behavior; and what percentage of respondents said personal val- ues were very influential in their judgment. The table appearing here provides an overview of the survey responses for each scenario. Seven potenciail)' influenrial factors were discii.wed in a previous Commtinic/itions arti- de |5|: personal values, religious belief sysltm, personal environment, social envinin- menc. legal environment, husinty. environ men I, and professional environment. Scenario One: Making Unauthorized Program Modifications The first scenario used in the ethics survey describes a programmer who modifies a bank's accounting system to bide his overdrawn account and avoid an overdraft charge. After making a deposit, the pro- grammer corrects his modification. A large majority (85%) of survey participants said it was unaccept- able for the programmer to modify the bank's accounting system, and the ethical issue was con- sidered very important by almost two-thirds (63%) of the respondents (see the table). In line with the PIE concept that people are more likely to rely on their personal values when judging an important ethical issue, many participants (72%) in this sur- vey said they relied heavily on their personal values in judging the programmer's behavior. Interestingly, 2 3 % said they would do the same as the program- mer in the scenario (a point we return to later). Thirty-seven percent believe the programmer would do the same despite company policy against such behavior. Table 1. Summary of survey responses by scenario. Judgment of this behavior Unacceptable Acceptable Importance of the issue* Very important Not very important Undecided How probable is it that you would do the same?** Probable Improbable Undecided If there were a stated company policy against such behavior. how probable is it someone would still do it? Probable Improbable Undecided Personal values were very infiuer)tial Scenario 1 Programmer modifies a bank's software to avoid a fee. 85% 15% 63% 22% 15% 23% 66% 11% 37% 47% 16% 72% Scenario 2 Employee keeps soft- ware sent in error but does not pay for it. 60% 40% 39% 40% 21% 56% 34% )0% 54% 34% 12% 65% Scenario 3 Programmer uses company equipment for personal use. 22% 78% 16% 66% !8% 74% 15% 11% 16% 77% 7% 52% Scenario 4 Employee uses proprietary software without paying fee. 75% 25% 61% 18% 21% 29% 54% 17% 41% 46% 13% 60% Scenario 5 Employee copies g o v e r n m e n t database w h e n t o l d t o by boss. 73% 27% 74% 13% 13% 28% 61% 11% 25% 62% 13% 64% * Based on a 7-point scale with responses grouped as very important ( I to 3) t o not very important (5 to 7). A rating of 4 was classified as undecided. ** Based on a 7-point scale with responses grouped as probable (1 to 3) co impmbable (5 t o 7). A rating of A was classified as undecided. 6 8 December 2000/Vol. 43, No. 12 COMMUNICATIONS OF THE ACM Scenario Two: Keeping Something Not Paid For The second scenario presented a situation in which a person receives software ordered from a mail-order company but also finds another software package was sent in error. The extra software is not listed on the invoice. The person keeps the program without paying for it. Table 1 shows that a majority of the study respon- dents (60%) said keeping the software was unaccept- able. In contrast to the first scenario, far fewer people (39%) said there was a very important ethical issue involved in this scenario. Many of the respondents (65%) still said personal values were very influential in their judgment (more so than any other factor). A lit- tle over half of the participants (56%) said they would also keep the software without paying for it. One explanation for this comes ftom past surveys when the external factors such as company policy more likely to influence someone's judgment when no important ethical issue is perceived in the situation? The per- centages shown in the table appearing here lend sup- port to this proposition. Although three-quarters of the participants (74%) said they would do as the pro- grammer did, just over three-quarters (77%) said it was unlikely a person would still do so if there were a company policy against personal use of company computer equipment. Scenario Four: Using Programs Without Paying the Required Fee The fourth scenario presents a person who was inad- vertently given access free of charge to a proprietary program. The person decides to use the program without paying the required fee. The table shows that 75% of the patticipants said it was unacceptable People rely heavily on their personal values when deciding what is ethical or unethical behavior. researchers have discussed the scenarios after conduct- ing the survey. Subjects have stated it is acceptable to keep the software because the mail-order company made the error and the customer is justified in taking advantage of the error. Of all five scenarios this one has the largest percentage, 54%, who believe a person would act the same despite what the company says is acceptable. Scenario Three: Using Company Resources For Personal Purposes In the third scenario a programmer uses company computer equipment to write programs for his friends on his own time on weekends. The program- mer does not charge anything for his programs. This scenario is a good contrast with the other scenarios. It is the only scenario for which a majority (78%) said the behavior of the person was acceptable and the importance of the ethical issue was also the lowest, with only 16% of the respondents rating the issue as very important. Also, this scenario has the smallest number of people (52%) who said their personal val- ues were very influential in their decision. Since the ethical issue wasn't very important to many, this scenario provides the opportunity to check for support of the PIE concept described here. Are to use a proprietary program without paying the required fee and 6 1 % said this is a very important issue. Personal values were again most often rated (60%) as being very influential in the participants' decision. Fifty-four percent of the participants said they themselves would not do as the person did in the scenario, but less than half of the people (46%) feel company policy against such behavior would dissuade employees from doing this. Scenario Five: Keeping Something Not Paid For The fmal scenario describes a marketing company employee who performs some data processing on contract for a government agency. The data concerns infotmation about children and theit patents. The employee is told by his boss to make a copy of the data for the company's tise. The contract with the government agency does not explicitly prohibit this, so the employee makes a copy of the data. In the current survey 73% said copying the data li k iiitL-icstLiig to noif ihat the siifijcas in the ^mdy on whiih this article i.i based judgfd itiis lith.iviot as acceptable by a mucb l.irger percentage than did the subjects in tbt 1991) survey. Sixiy percent of the students In tbe previou.s year said tbis was unatceptabic. One pos.sibie explanation is that recent news coverage of ways in which information tccbnology can tbrtaten personal privacy has heightened awareness and awareness and raised concern. COMMUNICATIONS OF THE ACM December 2000/Vol. 43. No. \1 6 9 Reliance on personal values in many situations does not rule out that an established code of ethics could affect what employees decide to do. was unacceptable.^ Seventy-four percent said the eth- ical issue was very important—the largest majority of all the scenarios regarding the perceived importance of an ethical issue. Personal values were rated as a strong influence (64%), more so than other influ- ences. Twenty-eight percent said they would do the same as the employee in the scenario. Sixty-two per- cent said it was unlikely the employee would copy the data if there were a company policy against it, which may he contrary to the PIE concept. Discussion This study offers support for the proposition that external factors, such as a company code of ethics, can he an influence when people do nor think an important ethical issue is involved. The responses to Scenario Three are of particular interest here because few felt an important ethical issue was involved. Most participants in the current survey said it was okay for a programmer to use company computer equipment for personal tise. They also said they would likely do the same. However, over three-quar- ters thought company policy against personal use of computer equipment would dissuade employees from doing as the programmer had done. The personal use of company equipment may be an important issue for businesses even though most employees don't see it as an important ethical issue. It is important for businesses to loiow that the responses in this survey, as well as information from past research, indicate people are receptive to what the company tells them to do in this situation. Further, in discussions with participants of previous surveys, the subjects have often said companies should make it clear to employees if they do not want employees to make personal use of company equipment even on personal time. Conversely, if companies are aware of the ethical issues important to the employee companies may want to use additional means to encourage compli- ance with company policy. For example, the company could notify employees that monitoring and detective See web.nmsu.edu/-jkieie/ for responses and significance levels summarized by gender. measures are tised by the company and there are con- sequences for certain unacceptable behavior. The authors' past research indicates that knowledge of spe- cific negative consequences for certain behavior may act as a deterrent and some past study participants have said the likelihood of getting caught would be a factor in how they act. What people say they probably wouldn't do. Managers that are concerned about their employees acting ethically might take some comfort from what the majority of participants said they would not do themselves. A majority said they would not make unauthorized changes to a program for personal ben- efit (Scenario 1), would not take advantage of access inadvertently given (Scenario 4), and would not copy data that might itwade others' privacy (Scenario 5).'' It is also interesting to note that in all three instances there is a statistically significant difference between women and men. Consistent with previous research [5], a significantly larger number of women than men said they would not do what the employees did in these scenarios. What people say they probably would do. There were two scenarios where the majority of respondents said they would do the same as the employee in the scenario. As noted earlier, 74% of the subjects said they would do the same as the programmer in Sce- nario Three—unless the company had a policy against using company equipment. For Scenario Two a small majority (56%) said they would keep sofiware without paying for it. Well under half (39%) of the respondents felt the ethical issue in this scenario was very important but, unlike Scenario Three, over half of the people (54%) thought an employee would do the same even if com- pany policy prohibited such behavior. One possible explanation for this is that people see this as a situa- tion outside the realm of company policy. The mail order company made an error and it has no impact on the employee's company. Another interesting point can be made about what some people said they would do. Scenarios One and Two, for instance, indicate some people will do what they say is unethical. In other words, some subjects 70 December 2000/Vol. 4J. No. 12 COMMUNICATIONS OF THE ACM said what the person in a scenario did was unaccept- able but they themselves would do the same. For Sce- nario One only 15% of the respondents said is was okay for the programmer to modify the accounting program but 23% said they would do the same. This certainly prompts the question of why people would do something they consider wrong but no clear answer is apparent. When the researchers have dis- cussed this scenario with students, some justifications for the programmer's actions were: "It should be a perk of the job to not have to pay overdraft: charges," and "Its not hurting anyone." Some students also indicated they would do the same as the programmer if they thought they would not get caught. Perhaps any one these arguments is sufficient for some people to decide they would modify the program. In any case, the responses in this survey concur with some findings that people will sometimes do what they say is wrong. For Scenario Two a fairly large number of people, 40%, said keeping the software was okay, but an even larger number, 56%, said they would do the same. Students in the past have argued that since the mail- order company made the error it is okay for the employee to keep the software. The employee didnt steal the software and he or she is not obligated to cor- rect the company's error. A company code of ethics. The results for Scenario Three indicate rhere are situations where companies can influence their employees' behavior. The impact of a company's written standards or code of ethical behavior is, of course, contingent on the company having such a code and on the employees knowing the code exists. However, some research indicates that companies may have a written code of ethics more for reasons of legal protection and public relations than internal use [7]. Employees may not be aware a com- pany code exists. In discussions of the survey's scenar- ios students clearly indicated they believe companies should have specific guidelines for employees to explain what is unacceptable behavior. If a company wants to educate its employees about its code of ethics it could provide ethics training using ethical scenarios tailored to its business environment. Having employees evaluate and discuss ethical scenar- ios would help employees undersrand rhe complexity of certain ethical dilemmas and help employees learn company guidelines for ethical behavior. Managers, like many educators, could use scenarios and discus- sions to help people develop a better understanding of ethical issues, what possible actions there are to take, and the consequences of certain actions [2]. One study reported that workers felt studying ethics affected their views [7]. There is also empirical evi- dence [6] that some students' moral reasoning bcne- fitted from peer-led discussion of ethical scenarios. Ethics training can also make employees aware of penalties for unethical behavior. Conclusion The results of this survey indicate people rely heav- ily on their personal values when deciding what is ethical or unethical behavior. However, when the ethical issue in a given situation is not considered of great importance, people are more likely to consider what company standards say to do or to not do. Reliance on personal values in many situations does not rule out, however, that an established code of ethics could affect what employees decide to do. Businesses can encourage ethical decision-making by having a written code of ethics and providing ethics training, such as discussion of ethical scenarios, to help employees understand what is expected. In addition, businesses should consider providing practi- cal support to employees for handling ethical issues. For instance, a support mechanism for a code of ethics should include procedures for an employee to follow who wants to talk to someone about an ethical issue or to report unethical behavior. B REFERENCES 1. Behar, R. Who's reading your e-mail? fortwnf (Feb. 3, 1997), 57-70. 2. Cougar, J.D, Preparing IS studencs to deal wiiK ethical issues. MIS Quarterly 13, 2 (1989), 211-216. i. Dejoie, R., Fowler, G. and Paradice, D.B. Ethical Issues in Information Systems. Boyd and Fraser Publishing Company, Bosron, MA, 1991. 4. Jones, T.M. Echical decision making by individuals in organizations: An issue-contingent model. Academy of Management Review 16, 1 (1991), 366-395. 5. Kreie, J. and Cronan, T.P. Judging what is echical or unethical: There arc differences between men and women. Commun. ACM 41, 9 (Sept. 1998). 6. Nelson, D.R. and Obremsld, T.E. Protnoting moral growth through intra-group participation. Journal of Business Ethics 9, (1990), 731-739. 7. Pierce, M.A. and Henr)', J.W. Computer ethics: The role of personal, informal, and formal codes. Journal of Business Ethics 15. (1996), 423^37. 8. Robin, D.P., Reidenbach, R.E. and Forresr, P.J, The perceived impor- tance of an echical issue as an influence on the ethical decision-making ok ad minagas. Journal of Business Research 35, (1996), 17-28. 9. Sala, R. What would you do? Computerworld (Mir. 16, 1996). J E N N I F E R K R E I E ([email protected]) is an assistant professor of Business Computer Systems at New Mexico State University. T I M O T H Y P A U L C R O N A N ([email protected],edu) is A professor of Computer Information Systems and Quantitative Analysis at the University of Arkansas in Fayetteville. Permission to make diffital or hard copies of all or part of this work for personal or class- toom use is granted without fee providetl that copies ate nni made or distributed for profit or commercial advanrige and that copies beat this ntrtice and the full citation on the first page. To copy otherwise, to tepublish, to post on server; ot to tedistribute lo lists, tequites prior specific permission and/or a fee. © 2()(H) ACM 0002-0782/00/1200 $5,00 COMMUNICATIONS OF THE ACH December 2000/Vol. 43. No. 12 71