Ethics and morality: a business opportunity for the amoral?

It is common for speakers at computer security conferences to tell audiences that 'they should do' this, and 'should do' that. The word 'should' is regularly thrown about as some jumbled-up mixture of efficiency and ethics, without any justification of the imperative. This paper will concentrate on the ethical issues, and so it will quickly dispose of 'efficiency,' leaving detailed argument for another time. Then, taking the devil's advocate position, it will focus on demolishing the certainty behind the ethical obligation, by questioning the role of ethics in society in general, but specifically in computer security. Indeed this paper will claim that an unsuspected morality and ritual lies behind many real-world security choices and much so-called 'objective' academic analysis. Furthermore, it will propose that such moralistic positions are highly problematic, and that all recommendations phrased in terms of virtue rather than pragmatism be treated as highly suspect.