Revision Library

revisionlibrary.co.uk

A-Level · Computer Science

A1.5 Legal, Moral, Cultural and Ethical Issues

OCR H446 · Calculators not allowed · about 130 minutes

Total Marks

Name: _______________________________ Date: ____ / ____ / ______

Answer ALL questions. Show all your working.

Callum Ferguson is a Year 13 student at Millbrook Academy. He watches his computing teacher type in a password and memorises it.

(a)State the name of the Act of Parliament that makes it a criminal offence to access computer material without authorisation in the UK, and give the year it was passed.(2)

(b)Callum uses the password, out of curiosity, to look at his own predicted exam grades before they are officially released. He changes nothing. Identify which offence under the Act applies to this action and justify your answer.(2)

(c)Callum then uses the same password to change one of his predicted grades from a D to an A* in the school system before it is released. Identify which (more serious) offence under the Act now applies and state the maximum prison sentence on indictment.(2)

(Total for Question 1 is 6 marks)

Redwood Sports Academy uses a cloud-based system to store data about student athletes, including their medical conditions and performance statistics.

(a)State the UK Act that governs how the academy must handle this personal data, and name the framework it incorporates into UK law.(2)

(b)The academy keeps full medical records for athletes who left five years ago, 'in case they are useful in future'. Identify which data protection principle this breaches and explain why.(3)

(c)The academy shares an athlete's mental health data with a sponsor, without asking the athlete, to help the sponsor decide whether to fund them. Explain why this is a particularly serious breach of data protection law.(3)

(Total for Question 2 is 8 marks)

Nadia Hussain runs a small games studio. She has written a new game engine and is deciding how to license it.

(a)Explain the difference between open source and proprietary software licensing.(3)

(b)Nadia releases her engine under a Creative Commons Attribution-NonCommercial (CC BY-NC) licence. State what each of the two conditions means for someone who wants to use the engine.(2)

(c)A rival developer, Owen Blackwood, copies Nadia's proprietary source code without permission and sells a near-identical game. State the Act that has been broken, identify the right that has been infringed, and state one civil remedy available to Nadia.(3)

(Total for Question 3 is 8 marks)

Elmswood Borough Council receives a request from a local journalist, Grace Ellison, asking how much the council spent on new laptops last year.

(a)State which Act gives Grace Ellison the right to make this request, and identify the type of organisation this Act applies to.(2)

(b)Explain two reasons why the council might legally withhold or redact some of the information Grace has requested.(3)

(c)Discuss one benefit and one drawback of the Freedom of Information Act for public sector organisations such as Elmswood Borough Council.(3)

(Total for Question 4 is 8 marks)

Kingsmere Logistics installs software on all staff computers that records keystrokes, takes screenshots every ten minutes, and logs websites visited, including for delivery-planning staff such as Daniel Achebe.

(a)State the name of the Act that regulates surveillance and interception of communications in the UK, and identify two conditions that must be met for workplace monitoring like this to be lawful.(3)

(b)Identify one moral argument in favour of Kingsmere Logistics monitoring staff in this way, and one moral argument against it.(3)

(c)State two further safeguards Kingsmere Logistics should put in place to make its monitoring policy more ethical and lawful, explaining why each would help.(4)

(Total for Question 5 is 10 marks)

A data centre in Sheffield runs 2000 servers. Each server draws 300 watts of power continuously (24 hours a day).

(a)Calculate the energy used by one server in one day, giving your answer in kWh.(2)

(b)Calculate the total energy used by all 2000 servers in the data centre in one day, giving your answer in kWh.(2)

(c)Discuss the environmental impact of large data centres such as this one, and evaluate one way this impact could be reduced.(5)

(Total for Question 6 is 9 marks)

TalentSprint is a recruitment company that uses a machine learning system to rank job applicants' CVs automatically. The system was trained on ten years of the company's past hiring data. A data analyst, Ben Okafor, notices the system consistently ranks applicants from certain universities and postcodes lower, regardless of their qualifications.

(a)Explain how algorithmic bias of this kind can occur in a machine learning system trained on historical data.(3)

(b)Identify and explain one piece of UK legislation, other than data protection law, that might be relevant if TalentSprint's system is found to discriminate against applicants based on characteristics correlated with race or social background.(3)

(c)Discuss the ethical responsibilities of TalentSprint and of individual computer professionals such as Ben Okafor in developing and using AI systems for recruitment. Evaluate whether it is enough to rely on individual professionals to identify and fix such issues, or whether wider regulation is needed.(6)

(Total for Question 7 is 12 marks)

BrightPath Learning, a UK education technology company, wants to sell its revision app in Japan, Saudi Arabia and Germany.

(a)Identify three cultural or legal factors, other than translating the text, that BrightPath Learning must consider when adapting (localising) its app for these markets.(3)

(b)Discuss the cultural and ethical challenges of creating 'one size fits all' educational software for a global market, evaluating whether full localisation is always achievable or desirable.(4)

(Total for Question 8 is 7 marks)

Leah Kowalski is a software engineer producing control software for railway level crossings. During testing, she finds a rare timing bug that could, in one specific circumstance, leave a barrier open for an extra two seconds after a train is detected. Her manager tells her to ignore it because the release deadline is in three days and fixing it would cause a delay.

(a)State the name of the UK professional body for IT that publishes a code of conduct for computing professionals, and identify one principle from a typical professional code of conduct relevant to this scenario.(2)

(b)Explain why Leah has an individual moral responsibility to act on this bug, even though her manager has told her to release the software as planned.(3)

(c)Discuss the options available to Leah and evaluate which course of action best balances her professional, ethical and legal responsibilities.(5)

(Total for Question 9 is 10 marks)

Oakfield University uses an automated plagiarism-detection system that compares every piece of submitted coursework against a global database of previous student work, journal articles and websites, producing a percentage 'similarity score'. A first-year student, Sophie Chen, is placed under investigation after her essay returns a 42% similarity score.

(a)Explain one benefit and one drawback of using automated plagiarism-detection software, from an ethical and cultural perspective, referring to fairness for students.(3)

(b)Evaluate whether it is ethical for a university to rely primarily on a percentage similarity score, without human review, to decide whether a student has committed academic misconduct.(4)

(Total for Question 10 is 7 marks)

AutoDrive Motors is trialling a self-driving car on UK roads. In an emergency where a collision is unavoidable, the car's control software must choose between braking hard (risking injury to the passenger) or swerving (risking injury to a pedestrian, Omar Farouk, who has stepped into the road).

(a)Identify who might bear legal and moral responsibility if the car's decision leads to injury, and explain why assigning responsibility is harder than with a human driver.(3)

(b)Evaluate the ethical challenges of programming a self-driving car to make decisions in unavoidable-collision scenarios, and discuss whether it is possible to create rules that are morally acceptable to everyone.(7)

(Total for Question 11 is 10 marks)

A cyber-security researcher, Ryan McAllister, discovers a vulnerability in the software used by a UK hospital trust's patient record system. Without permission, he accesses a live test copy of the system to confirm the vulnerability is real, then emails the hospital IT department describing the flaw. Two months later, having received no response, he publishes full technical details of the vulnerability, including working exploit code, on his personal blog. A criminal group then uses this exploit to access and copy 50,000 patients' medical records, which are later found for sale on the dark web.

(a)For each of the following actions, identify whether Ryan McAllister could be prosecuted under the Computer Misuse Act 1990, and if so, under which section: (i) accessing the test copy of the system without permission; (ii) publishing the exploit code online.(4)

(b)Identify which piece of legislation is relevant to the hospital trust's own responsibilities after 50,000 patient records are stolen, and explain what the trust may be required to do as a result.(4)

(c)Evaluate whether the ethical practice of 'responsible disclosure' (privately reporting vulnerabilities and giving organisations time to fix them before publishing details) is an adequate solution to balancing the interests of security researchers, organisations and the public. Using this scenario to support your answer, discuss whether current UK legislation, such as the Computer Misuse Act 1990, adequately supports ethical security research.(9)

(Total for Question 12 is 17 marks)

Mark scheme · A1.5 Legal, Moral, Cultural and Ethical Issues

Question 1

(a) B1 Computer Misuse Act (oe)
(a) B1 1990
(a) Answer: Computer Misuse Act 1990
(b) B1 Section 1: unauthorised access to computer material (oe)
(b) B1 Valid justification linking scenario to definition, e.g. Callum knowingly caused the computer to secure access to data (his grades) and knew this access was unauthorised, cao
(b) Answer: Section 1 offence: unauthorised access to computer material.
(c) B1 Section 3: unauthorised act with intent to impair the operation of a computer or the reliability of data (oe, allow 'unauthorised modification of data')
(c) B1 10 years, cao
(c) Answer: Section 3 offence; maximum sentence up to 10 years imprisonment.

Question 2

(a) B1 Data Protection Act 2018
(a) B1 UK GDPR / General Data Protection Regulation (oe)
(a) Answer: Data Protection Act 2018, incorporating the UK GDPR.
(b) B1 Identifies the storage limitation principle (oe)
(b) B1 Explains that data must not be kept for longer than necessary for the purpose it was collected
(b) B1 Applies this to the scenario: the athletes have left, so there is no ongoing purpose, so the records should be deleted or anonymised
(b) Answer: This breaches the storage limitation principle; data has no ongoing purpose once an athlete leaves and should not be retained indefinitely.
(c) B1 Identifies that health data is 'special category data' under the UK GDPR (oe)
(c) B1 Explains that special category data requires an extra lawful condition, normally explicit consent, before it can be processed/shared
(c) B1 Explains a consequence/harm, e.g. potential discrimination against the athlete, loss of sponsorship, distress, breach of trust
(c) Answer: Sharing special category data without explicit consent (or another Article 9 condition) is unlawful and can cause serious harm to the athlete.

Question 3

(a) B1 Open source: the source code is made available and users may view, modify and redistribute it (oe)
(a) B1 Proprietary: the source code is kept private/hidden and copying, modifying or redistributing it is restricted by the owner (oe)
(a) B1 Valid comparative point, e.g. open source can be cheaper/more customisable, proprietary can offer more guaranteed support/quality control
(a) Answer: Open source licences allow access to and reuse of source code; proprietary licences restrict access and reuse to protect the owner's rights.
(b) B1 Attribution: the user must credit Nadia as the original creator (oe)
(b) B1 NonCommercial: the user may only use the engine for non-commercial purposes, e.g. not sell a product built with it (oe)
(b) Answer: Attribution = must credit the creator; NonCommercial = may not be used to make money.
(c) B1 Infringement of Nadia's copyright / right to reproduce and distribute her own work (oe)
(c) B1 Valid remedy, e.g. injunction to stop further sales, damages/compensation, account of profits
(c) Answer: Copyright, Designs and Patents Act 1988; infringement of copyright; remedy such as an injunction or damages.

Question 4

(a) B1 Freedom of Information Act 2000
(a) B1 Public authorities/public sector bodies, e.g. councils, government departments, state schools, NHS (oe, any one example accepted)
(a) Answer: Freedom of Information Act 2000; applies to public authorities.
(b) B1 Valid exemption reason 1, e.g. information is commercially sensitive (ongoing supplier negotiations)
(b) B1 Valid exemption reason 2, e.g. information contains personal data of named staff, protected under data protection law
(b) B1 Reference to the process, e.g. a public interest test must be applied to qualified exemptions, or the request must be answered within 20 working days
(b) Answer: Exemptions may apply for commercially sensitive information or personal data; qualified exemptions are subject to a public interest test.
(c) B1 Valid benefit, e.g. increases transparency and public accountability, builds trust in how public money is spent
(c) B1 Valid drawback, e.g. significant staff time/cost to process requests, risk of releasing information that harms commercial negotiations
(c) B1 Balanced comparative or concluding comment linking benefit and drawback
(c) Answer: Benefit: greater transparency/accountability. Drawback: administrative cost and risk of commercially damaging disclosure. A balance must be struck using exemptions.

Question 5

(a) B1 Regulation of Investigatory Powers Act (RIPA) 2000
(a) B1 Condition 1, e.g. staff must be informed that monitoring takes place, normally via a written policy
(a) B1 Condition 2, e.g. monitoring must be proportionate/for a legitimate business purpose, not excessive
(a) Answer: Regulation of Investigatory Powers Act 2000; monitoring must be disclosed to staff and proportionate/for a legitimate business purpose.
(b) B1 Argument for, e.g. protects the business from data leaks, deters misuse of company time/equipment, supports productivity
(b) B1 Argument against, e.g. invades personal privacy, damages trust between employer and staff, may harm staff wellbeing/create a stressful environment
(b) B1 Valid evaluative link between the two, e.g. noting the tension between business interest and individual privacy
(b) Answer: For: protects business/productivity. Against: invades privacy and erodes trust. A genuine ethical tension exists between the two.
(c) B1 Identifies safeguard 1, e.g. a clear, written monitoring policy given to all staff
(c) B1 Explains benefit of safeguard 1, e.g. staff cannot be surprised, reduces the sense of covert surveillance, supports the 'informed' condition of RIPA
(c) B1 Identifies safeguard 2, e.g. limiting monitoring to work systems/work hours only, or restricting who can view the data
(c) B1 Explains benefit of safeguard 2, e.g. reduces intrusion into private communications, keeps monitoring proportionate to the business purpose
(c) Answer: E.g. publish a clear monitoring policy (so staff are informed and trust is preserved) and restrict monitoring/access to what is proportionate for the stated business purpose.

Question 6

(a) M1 Converts 300 W to 0.3 kW and multiplies by 24 hours (oe method)
(a) A1 7.2 kWh, cao
(a) Answer: 7.2 kWh
(b) M1 Multiplies answer to (a) by 2000 (ft from a)
(b) A1 14400 kWh (ft from a), cao
(b) Answer: 14 400 kWh (14.4 MWh)
(c) L1 (1-2): Basic, undeveloped identification of one or two impacts (e.g. energy use, e-waste) with little or no discussion of reduction methods.
(c) L2 (3-4): Clear explanation of two or more impacts (e.g. energy use/carbon emissions, cooling water use, e-waste from hardware replacement) with at least one reasonably developed method of reduction.
(c) L3 (5): Sustained, well-developed discussion covering multiple impacts and a clearly evaluated method of reduction, reaching a reasoned judgement about its effectiveness or limitations.
(c) Answer: N/A - levels-marked extended response.

Question 7

(a) B1 Explains that historical training data reflects past human decisions/biases (oe)
(a) B1 Explains that the model learns patterns in this data, including biased ones, and uses proxies (e.g. postcode, university) that correlate with protected characteristics such as race or class
(a) B1 Explains the outcome: the biased pattern is repeated/amplified automatically at scale for every new application
(a) Answer: The model statistically reproduces patterns in the historical hiring data, including past human bias, using proxy variables such as postcode or university as stand-ins for protected characteristics.
(b) B1 Equality Act 2010
(b) B1 Explains the concept of protected characteristics and/or indirect discrimination (a rule or practice applied to everyone that disproportionately disadvantages people with a protected characteristic)
(b) B1 Links this to the scenario, e.g. postcode acting as a proxy for race or socioeconomic background counts as indirect discrimination
(b) Answer: Equality Act 2010; the system's use of postcode/university as a proxy could constitute indirect discrimination against a protected characteristic.
(c) L1 (1-2): Limited, list-like reference to responsibility (e.g. 'developers should be careful') with little explanation or evaluation.
(c) L2 (3-4): Clear explanation of individual responsibility (e.g. professional codes of conduct, duty to report bias) and organisational responsibility (e.g. auditing systems), with limited evaluation of whether this is sufficient.
(c) L3 (5-6): Sustained, well-balanced discussion of individual and organisational responsibility, with a clear, reasoned evaluation of the need for (or limits of) wider regulation, reaching a justified conclusion.
(c) Answer: N/A - levels-marked extended response.

Question 8

(a) B1 Valid factor 1, e.g. reading direction/layout (right-to-left text for Arabic)
(a) B1 Valid factor 2, e.g. colours, symbols or imagery that have different cultural or religious meanings in different countries
(a) B1 Valid factor 3, e.g. date/number/currency formats, local data protection laws that may differ from UK GDPR, or local content/censorship rules
(a) Answer: Any three of: reading direction/layout; culturally sensitive colours/symbols/imagery; date, number or currency formats; local data protection or censorship laws.
(b) L1 (1-2): Identifies a benefit or challenge of a global platform with limited explanation or evaluation.
(b) L2 (3-4): Clear discussion of both benefits (e.g. shared access to quality resources, cost-effectiveness) and challenges (e.g. cultural imperialism, censorship conflicts, cost/time of localisation), with a reasoned evaluative judgement about achievability or desirability.
(b) Answer: N/A - levels-marked extended response.

Question 9

(a) B1 BCS, The Chartered Institute for IT (oe)
(a) B1 Valid principle, e.g. members must have due regard for the public health, privacy, security and wellbeing of others
(a) Answer: BCS, The Chartered Institute for IT; its code of conduct requires members to prioritise public safety and wellbeing.
(b) B1 Explains the potential harm to public safety, given this is a life-critical/safety-critical system
(b) B1 Explains that a professional's ethical duty of care can override a manager's commercial instruction when public safety is at risk
(b) B1 Explains a consequence of not acting, e.g. legal/professional liability, loss of public trust, risk of prosecution if harm occurs
(b) Answer: Because the system is safety-critical, Leah's professional duty of care to protect the public overrides commercial pressure to meet the deadline; failing to act could cause real harm and expose her and the company to liability.
(c) L1 (1-2): States one or two options with little explanation or evaluation.
(c) L2 (3-4): Explains a range of options with some evaluation of which is most appropriate, but the argument may be one-sided or not fully developed.
(c) L3 (5): Sustained discussion of multiple options with a clear, reasoned evaluation leading to a justified recommendation.
(c) Answer: N/A - levels-marked extended response.

Question 10

(a) B1 Benefit: consistent, fast detection across a whole cohort supports fairness and deters deliberate academic dishonesty
(a) B1 Drawback: false positives are possible, e.g. common technical phrases, properly cited quotations, or writing conventions from a student's first language/culture may be flagged unfairly
(a) B1 Developed point linking to Sophie's case, e.g. a similarity score alone does not distinguish plagiarism from legitimate quotation/paraphrase, so context and human review are needed before judging her
(a) Answer: Benefit: consistent, scalable, fair detection across all students. Drawback: risk of false positives, especially for legitimately cited or common technical language, which can unfairly disadvantage individual students such as Sophie.
(b) B1 Point that a raw score lacks context/nuance, e.g. it cannot reliably distinguish properly referenced quotation from genuine plagiarism
(b) B1 Point about due process/fairness, e.g. a student should have the right to explain flagged sections before a judgement is made
(b) B1 Point recognising the institution's argument, e.g. efficiency/consistency at scale across thousands of submissions
(b) B1 Evaluative concluding statement, e.g. the score should trigger further human review, not act as an automatic verdict, to be considered ethical
(b) Answer: It is not fully ethical to rely on the score alone; it should be used as a trigger for human review rather than a final verdict, balancing efficiency with fairness and due process.

Question 11

(a) B1 Identifies at least two possible responsible parties, e.g. the manufacturer, the software developers, the vehicle owner/supervising 'driver', the insurer
(a) B1 Explains the difficulty: the decision was made by a pre-programmed algorithm rather than a real-time human judgement, so it is unclear whose 'choice' actually caused the outcome
(a) B1 Valid reference to relevant framework, e.g. the Automated and Electric Vehicles Act 2018 makes insurers primarily liable for incidents while a vehicle is driving itself
(a) Answer: Responsibility could fall on the manufacturer, developers, owner or insurer; assigning it is harder because the decision was embedded in code in advance rather than made by a human in the moment, though UK law (the Automated and Electric Vehicles Act 2018) assigns initial liability to the insurer.
(b) L1 (1-2): Basic identification of the dilemma (e.g. 'the car has to choose who to hurt') with little explanation.
(b) L2 (3-5): Clear explanation of the ethical challenge using relevant ideas (e.g. utilitarian vs rule-based approaches, differing priorities between individuals/cultures) with some attempt at evaluation.
(b) L3 (6-7): Sustained, well-reasoned evaluation that considers multiple ethical perspectives and cultural variation, and reaches a justified conclusion about whether universally acceptable rules are achievable.
(b) Answer: N/A - levels-marked extended response.

Question 12

(a) B1 (i) Section 1: unauthorised access to computer material applies
(a) B1 (i) Valid justification, e.g. he accessed the system without the hospital's consent, regardless of his benign intent, which is sufficient for the Section 1 offence
(a) B1 (ii) Recognises that publishing the exploit code is not itself an act of unauthorised access, so it does not directly commit the Section 1 or Section 3 offence
(a) B1 (ii) Valid nuance, e.g. this could potentially fall under Section 3A (making, supplying or obtaining articles for use in a computer misuse offence) if the code is judged likely to be used for such offences, though this is a more complex legal question than (i)
(a) Answer: (i) Section 1 offence applies to the unauthorised access. (ii) Publishing alone is not a direct access/modification offence, but could potentially engage Section 3A depending on intent and likely use.
(b) B1 Data Protection Act 2018 / UK GDPR
(b) B1 Explains the requirement to report the breach to the Information Commissioner's Office (ICO) without undue delay, and where feasible within 72 hours
(b) B1 Explains the requirement to notify the affected patients directly if the breach is likely to result in a high risk to their rights and freedoms
(b) B1 Explains a possible consequence for the trust, e.g. an ICO fine, reputational damage, a requirement to improve security measures
(b) Answer: Data Protection Act 2018/UK GDPR requires the trust to report the breach to the ICO within 72 hours where feasible, notify affected patients if the risk is high, and it may face a fine or enforcement action.
(c) L1 (1-3): Basic explanation of responsible disclosure or of a legal issue, with limited reference to the scenario and little evaluation.
(c) L2 (4-6): Clear explanation of responsible disclosure principles and of the limitations of current legislation, with reference to the scenario, and some evaluation, though it may be one-sided.
(c) L3 (7-9): Sustained, well-structured evaluation that draws directly on the scenario to weigh the interests of researchers, organisations and the public, considers the adequacy of current law, and reaches a well-justified overall conclusion.
(c) Answer: N/A - levels-marked extended response.

Legal, Moral, Cultural and Ethical Issues - Worksheets, Questions and Revision