Legal & Ethical IT: Laws, Privacy, Cybercrime & Professional Conduct

TAKEAWAYS:

• Legal frameworks like Nepal’s Electronic Transaction Act 2008 and Cyber Security Act 2018 define rights/obligations for digital transactions, data storage, and cybercrime penalties.
• Ethical principles (autonomy, beneficence, justice) guide decisions in AI, data mining, and digital inclusion—e.g., WhatsApp’s end-to-end encryption vs. government surveillance trade-offs.
• Copyright and IP protect digital works (software, music, code) under Nepal’s Copyright Act 2058—plagiarism in code (e.g., copying Daraz’s checkout script) is illegal.
• Cybercrime threats (phishing, ransomware, identity theft) exploit weak passwords or unpatched systems; Ncell’s 2022 SIM-swap attacks cost users NRs 50M+.
• Professional ethics require IT workers to report conflicts (e.g., NEPSE’s insider trading) and uphold confidentiality (e.g., eSewa’s tax data leaks).
• Global vs. local laws clash in cases like Google’s data centers in Nepal (GDPR vs. Privacy Act 2075) or Pathao’s driver surveillance policies.

1. Legal Aspects of IT: Laws and Regulations

IT operates under three tiers of law:

1. Constitutional laws (e.g., Nepal’s Fundamental Rights protecting free speech vs. hate speech online).
2. Statutory laws (enacted by Parliament):
   • Electronic Transaction Act 2008: Legalizes digital signatures (e.g., eSewa’s OTP authentication).
   • Cyber Security Act 2018: Mandates data localization (e.g., banks storing customer data on Nepal servers).
   • Copyright Act 2058: Protects software, music, and code (e.g., Daraz’s app UI copyright).
3. Case laws: Judicial rulings (e.g., Nepal Telecom vs. Ncell on net neutrality).

Key Legal Concepts

flowchart TD
    A["Cyber Security Act 2018"] --> B["Data Localization"]
    A --> C["Digital Forensics"]
    A --> D["Penalties: NRs 1M–10M or 3–7 years jail"]
    B --> E["Example: Banks must store data in Nepal"]
    C --> F["Example: Ncell investigates SIM-swap fraud"]

2. Ethical Issues in IT

Ethics in IT balances rights vs. responsibilities. Key dilemmas:

• Privacy vs. Security: WhatsApp’s end-to-end encryption protects users but hinders law enforcement (e.g., investigating child abuse).
• AI Bias: YouTube’s recommendation algorithm may favor Nepali news channels over global content, reinforcing echo chambers.
• Digital Divide: Pathao’s app requires smartphones; rural users in Kavrepalanchok lack access.

Ethical Theories Applied to IT

pie
    title AI Loan Approval Bias in Nepalese Banks
    "Approved (Male)" : 78%
    "Approved (Female)" : 52%
    "Approved (Dalit)" : 45%
    "Approved (Non-Dalit)" : 68%

3. Copyright and Intellectual Property (IP) in IT

Copyright protects:

• Software (e.g., Microsoft Windows, Daraz’s app).
• Music (e.g., Nepali songs on YouTube).
• Code (e.g., open-source libraries like Python’s requests).

How to Protect Your Work:

1. Register with Nepal’s Department of Intellectual Property.
2. Use licenses:
   • GPL: Open-source (e.g., Linux).
   • MIT License: Permissive (e.g., React.js).
3. Avoid plagiarism: Copying code from Stack Overflow without attribution is illegal.

Worked Example: Plagiarism in Code

# Original code (Student A)
def calculate_tax(income):
    if income <= 500000:
        return 0
    else:
        return (income - 500000) * 0.1

# Plagiarized code (Student B)
def calculate_tax(income):
    if income < 500000:
        return 0
    else:
        return (income - 500000) * 0.1  # Identical logic, no citation

Outcome: Student B fails for violating Copyright Act 2058 (Section 42).

[GPL logo] | General Public License (copyleft)
[MIT logo] | Permissive license (minimal restrictions)
[Apache 2.0 logo] | Open-source with patent protection

4. Cybercrime and Security Laws

Common Cybercrimes in Nepal:

1. Phishing: Fake eSewa emails asking for passwords.
2. Ransomware: Ncell users locked out of accounts until they pay.
3. Identity Theft: Stealing NID cards to open bank accounts.
4. Cyber Defamation: Posting false news on Facebook (e.g., accusing a politician of corruption).

Penalties Under Cyber Security Act 2018:

Real-World Trace: Ncell SIM-Swap Attack (2022)

1. Attack: Hackers used social engineering to transfer victims’ Ncell numbers to new SIMs.
2. Impact: 5,000 users lost NRs 50M+ in unauthorized transactions.
3. Legal Action: Ncell fined NRs 5M under Cyber Security Act 2018.

[Subject: "Your eSewa Account is Locked"]
[Sender: "support@esewa.com.np" (fake)]
[Body: "Click here to verify"]
[Link: "esewa.com.np/login-fake.com"]
[Footer: "© 2023 eSewa"]

5. Professional Ethics for IT Practitioners

IT professionals must follow codes of ethics (e.g., IEEE’s Software Engineering Code of Ethics). Key principles:

• Confidentiality: Never disclose client data (e.g., eSewa’s tax records).
• Integrity: Report conflicts of interest (e.g., NEPSE insider trading).
• Competence: Stay updated on laws (e.g., GDPR for global projects).
• Accountability: Take responsibility for mistakes (e.g., a bug in Daraz’s payment system).

Case Study: eSewa Data Leak (2021)

• Issue: Hackers leaked 1M user records (names, PAN numbers).
• Ethical Violation: eSewa’s IT team failed to encrypt data (violating Privacy Act 2075).
• Outcome: CEO resigned; NRs 10M fine imposed.

flowchart TD
    A["You find a bug in Daraz’s\npayment system that steals\nuser credit card data."]
    A --> B["Report to Daraz’s CTO?"]
    B --> C["Yes: Fix the bug\n(Accountability)"]
    B --> D["No: Keep quiet\n(Risk of exposure)"]
    C --> E["Daraz rewards you\nwith a bonus"]
    D --> F["Bug exploited;\nusers lose NRs 20M"]

6. Global vs. Local IT Laws: Challenges

Nepal’s IT laws often conflict with global standards:

Worked Example: WhatsApp in Nepal

• Local Law: Telecom Act 2004 bans VoIP (WhatsApp calls).
• Global Law: WhatsApp complies with GDPR for EU users.
• Ethical Dilemma: Should Nepal allow VoIP for rural connectivity?

In the Real World

1. eSewa’s Digital Signature

   • Idea: Electronic Transaction Act 2008 legalizes digital signatures for payments.
   • How it works: Users verify transactions via OTP (a digital signature under law).
   • Impact: Enabled NRs 500B+ in digital transactions (2023).

2. Ncell’s SIM-Swap Fraud

   • Idea: Cyber Security Act 2018 penalizes identity theft.
   • How it happened: Hackers used fake NID copies to swap SIMs.
   • Lesson: Two-factor authentication (OTP + biometrics) reduces fraud.

3. YouTube’s Algorithm in Nepal

   • Idea: Copyright Act 2058 protects content, but AI bias favors certain creators.
   • Example: Nepali music channels get fewer ads than global ones due to lower watch time.
   • Ethical Issue: Reinforces digital divide between urban/rural content creators.

Exam Tip

1. Memorize Key Acts:

   • Electronic Transaction Act 2008: Digital signatures.
   • Cyber Security Act 2018: Data localization, penalties.
   • Copyright Act 2058: Software/music protection.

2. Case Study Patterns:

   • Question: "How would you handle a data breach at eSewa?"
   • Answer:
     1. Report to Cyber Bureau Nepal (Act 2018, Section 12).
     2. Notify affected users (Privacy Act 2075).
     3. Encrypt future data (IEEE ethical principle).

3. Compare Global vs. Local Laws:

   • Example: "How does Nepal’s net neutrality law differ from the EU’s?"
   • Answer: Use a table (as above) and cite Telecom Act 2004 vs. GDPR.

4. Ethical Dilemma Questions:

   • Format: "You discover a bug in Daraz’s system that steals data. What do you do?"
   • Structure:
     • Option 1: Report internally (accountability).
     • Option 2: Go public (whistleblowing).
     • Law: Cyber Security Act 2018 (Section 9 on reporting).
     • Ethics: Utilitarianism (protect users) vs. loyalty (to employer).

5. Visuals in Exams:

   • Flowcharts: Draw Cyber Security Act 2018 penalties.
   • Tables: Compare GPL vs. MIT License.
   • Diagrams: Label a phishing email (as above).

Pro Tip: Relate every answer to Nepal. Examiners reward local examples (e.g., "How would Ncell comply with data localization?").