The source of my case is: https://www.eccouncil.org/code-of-ethics/

1. The EC-Council (International Council of E-Commerce Consultants) is a globally recognized cybersecurity certification body founded in 2001. The organization's stated mission is "building a culture of security" across the cybersecurity industry. 
2. EC-Council requires all certified members to agree to and uphold its code of ethics as a condition of certification. These guidelines cover a wide range of professional conduct, and a violation of them can cost a member their certification. 
3. The code strictly governs how members handle private client information. Members are prohibited from collecting, selling, or transferring client's personal data to any third party without the client's consent. 
4. Members are required to only work within their proven areas of expertise and be upfront about their limitations. In other words, a certified professional cannot take on a project they are unqualified for in the pursuit of something like business gains. Honesty about one's education and experience is necessary.  
5. Members are prohibited from engaging (or even associating) with black hat hacking activities. (Black hat hacking refers to malicious hacking done for personal gain or causing harm, the opposite of this is white hat hacking, also called ethical hacking). Penetration testing (trying to break and get into a system) must be done within approved limits in a non-harmful manner. 
6. Members are barred from joining underground hacking communities that promote malicious activity. Sometimes, there is a fine line between cybersecurity research communities and shady hacking groups. Any community associated with black hat hacking is to be avoided. 
7. In regards to financial integrity, members are expected to avoid bribery, double billing, and other dishonest financial practices. Members must also disclose any conflicts of interests (where personal interests may interfere with professional duties) to all parties involved. 
8. Members are required to actively contribute to the growth of cybersecurity and e-commerce profession. This includes following practices like continuous self-studying, sharing knowledge with other members, and promoting public awareness of safe cybersecurity practices. 

Four questions to ask about this case are: 

1. The code requires members to be honest about their skill limits. Do you think most professionals actually follow this, and who should be responsible for checking that someone is truly qualified before being assigned a task or hired? 
2. Members are not allowed to associate with malicious hackers. Is it realistic to expect ethical hackers to completely separate themselves from these communities? Consider that they often need to understand how malicious hackers think in order to do their job well. 
3. If a professional uses a pirated/grey-market software (this is not uncommon in the tech industry) to discover a serious vulnerability, does the good outcome justify how the tool was obtained? There are two relevant ethical appeals to consider here. 
4. The code states that members should not be convicted of any crimes. Some famous figures in cybersecurity have criminal records but have built successful, legitimate careers. Does a past conviction automatically disqualify someone from being a certified ethical hacker? 

Three additional standard questions: 

• What does virtue ethics say about this case?
• What does utilitarianism say about this case?
• What does deontology say about this case?