This is one of the reasons some industries create professional associations or trade unions. It is hard to argue against pressure from your boss, so when ethics issues start to become common, you need a reasonably reliable way to apply opposing pressure.
A professional association with a code of ethics offers a standard excuse that you swore an oath against e.g. knowingly creating software that is designed to be fraudulent.
Alternatively, a minimal trade union that was chartered to only address ethics problems can create an incentive (under threat of collective action by the union) to not even ask for anything unethical. I know that it's popular to have a low opinion of unions, but it's important to remember that they are just a tool. If all you need is pressure against unethical requests, that should only need a tiny, mostly hands-off union.
> all it takes is the next dev to come along and say yes
Sure, but that's at least it wouldn't be your ethical problem anymore. Even if a more willing replacement is found, that takes at least some time and resources, and it sends a clear message that some behavior isn't appropriate. If you don't send that message, you're just conditioning the responsible people to do more ask for more unethical things it the future.
> I don't want regulation and lobbyists pushing their tech onto me as a solution.
If regulation could work well as a solution to a specific type of problem, it might be a good idea to get there first. Get to the politicians before the lobbyists carrying cash, a clear and brief explanation of the problem, and your proposed regulation.
However, this may not be a useful approach in some situations. I think some sort of collective organization is usually a better approach, but it's worth at least considering the regulatory approach.
I've been thinking about this recently. Less on the trade union (even if that might make more sense, in the vein of actual leverage), and more on the professional association side. I've been long-enamoured with the Canadian Engineering 'Iron Ring' ceremony. I don't know how much actual leverage that bestows, but something similar in such an infrastructural discipline as software development seems appropriate.
I'm currently an undergrad studying software engineering at a Canadian university, and I'm going to go through the whole Iron Ring ceremony when I graduate. The program here does seem to focus more on ethics, albeit in a somewhat generalized 'engineering' be-careful-when-you-build-a-bridge way, but I've still had some good takeaways that apply to building software.
The Iron Ring ceremony was one I didn't realize existed until our graduating class of nuclear engineers were told "Oh, by the way, you're all going." This was in The South in the USA.
I love it. I have yet to take the ring off. It's a great way to initiate conversations about ethics and a great way to tangibly emphasize my personal pursuit in being ethical.
The ceremony is symbolic, the Iron Ring committee has no real power. There are professional engineering associations with actual power, unrelated to the ring, but software engineers are not usually part of them.
I'm a software dev. with a background in a different engineering discipline and there isn't much reason for me to join an engineering professional association in Canada. Unlike, say, civil, where you have to be licensed to perform some of the duties, nothing in a software engineer position actually requires a license.
Just wanted to chime in and say that I am in a position similar to yours, and agree with everything you have said, but would add that I believe the iron ring is a very good 'nudge' towards ethical decision-making.
Canadian engineering unions are basically a mafia. Their sole purpose is basically ensuring that their members pay dividends and preventing them to do any job if they dont.
Wouldn't the union only be composed of the same colleagues who were resigned to 'hushed mutterings in corners' and laughed at the grandparent poster for 'being on some kind of moral high horse'?
A better approach might be to have a consumer advocacy organization/site that allows devs to anonymously leak and publicly shame the bad practices of their employers. Somewhat like the proliferate Business Software Alliance ads that used to say, "If your employer is using pirated software, report them in confidence at ~place. If we catch them, you'll get a reward".
> Wouldn't the union only be composed of the same colleagues who were resigned to 'hushed mutterings in corners' and laughed at the grandparent poster for 'being on some kind of moral high horse'?
The answer is "yes". There is no reason to assume that a union representing employees would be any more motivated by customers' interests than the employers themselves would be. (And there are plenty of actions by real-life unions in other industries suggesting otherwise.)
Many European countries have IT trade unions and you are only legally allowed to have an Engineer title when the university is certified by the Engineering Association, which is also another door to knock to disclose such behaviors.
This is one of the reasons some industries create professional associations or trade unions. It is hard to argue against pressure from your boss, so when ethics issues start to become common, you need a reasonably reliable way to apply opposing pressure.
A professional association with a code of ethics offers a standard excuse that you swore an oath against e.g. knowingly creating software that is designed to be fraudulent.
Alternatively, a minimal trade union that was chartered to only address ethics problems can create an incentive (under threat of collective action by the union) to not even ask for anything unethical. I know that it's popular to have a low opinion of unions, but it's important to remember that they are just a tool. If all you need is pressure against unethical requests, that should only need a tiny, mostly hands-off union.
> all it takes is the next dev to come along and say yes
Sure, but that's at least it wouldn't be your ethical problem anymore. Even if a more willing replacement is found, that takes at least some time and resources, and it sends a clear message that some behavior isn't appropriate. If you don't send that message, you're just conditioning the responsible people to do more ask for more unethical things it the future.
> I don't want regulation and lobbyists pushing their tech onto me as a solution.
If regulation could work well as a solution to a specific type of problem, it might be a good idea to get there first. Get to the politicians before the lobbyists carrying cash, a clear and brief explanation of the problem, and your proposed regulation.
However, this may not be a useful approach in some situations. I think some sort of collective organization is usually a better approach, but it's worth at least considering the regulatory approach.