3. Research Methods Used
3.1. Introduction
This research investigates software companies that operate in Ethiopia. Among the available software companies, we selected the participating companies purposely based on the richness of the information they have and their willingness to be involved in this research work. These companies ranged from small (having less than ten employees) to large companies (having more than 100 employees) regarding development tasks. They also have between 5 and 29 years of work experience.
Almost all the selected companies are engaged in the provision of affordable information technology (IT)-based solutions to any business enterprise and customers in E-Government, enterprise resource planning, human resource management, inventory and stock management, medical software, customer relationship management, mobile applications, etc. In this section, we discuss the preparation of data collecting tools, participants’ demographic information, data collection procedures, and data analysis techniques.
3.2. Preparation of Data Collection Tools
Firstly, about fifteen interview questions were developed. Twelve professionals in the field of computing evaluated these questions to check the questions’ validity. These professionals are PhD holders and professors. Constructive and essential comments and feedback were obtained from these scholars. The questions were modified using comments and feedback from them. Finally, thirteen edited and modified interview questions and five focus group discussion questions were used to gather the data.
3.3. Research Site and Participant Selection
This research investigates the ethical concerns of requirements engineering by taking seven cases of software companies that operate in Addis Ababa, the capital of Ethiopia. Among the available software companies, we selected the participating companies using purposive sampling based on the richness of the information they have and their willingness to be involved in this research work. These participating companies ranged from small (having less than ten employees) to large companies (having more than 100 employees) regarding development tasks. For confidentiality purposes, we used codes for the participating companies. Except for one company, which has five years of experience, most of them are well-experienced and have more than eight years of experience. The oldest company, company B, has twenty-nine years of experience in developing software products and services. In general, the years of experience ranged from five, only one company, to twenty-nine years. Companies A, B, C, D, and F have been in the industry from sixteen to twenty-nine years. The youngest company, company E, has only five years of experience. On the other hand, company G has more than ten years of experience.
Table 2 gives information about the involved software companies and participants.
As shown in
Table 2, the participating companies have different sizes and years of experience. This helped us to make the research results applicable to various types of software-developing companies in terms of their size and maturity levels.
In this research, the participating companies and individuals are selected for purposive sampling. The seven participating case companies are selected in accordance with the richness of the information they have and their willingness to participate in the research. In the research, small, medium, and large software companies are considered. After selecting the companies, thirty-five willing experts who have theoretical as well as practical experiences and knowledge of software development, particularly requirements engineering processes, were selected.
Among the 35 participants, 62.9% (22) of them were male and the remaining 37.1% (13) were female. The age of the participants ranged from 25 to 50 years old. Additionally, most participants had worked in his/her employer software companies for more than five years. Regarding participants’ qualifications, 2.9% (1 participant) had a PhD, 71.4% (25 participants) had MSCs, and the remaining 25.7% (9 participants) were BSC holders in computer science, software engineering, and information systems.
Table 3 depicts the demographic information of the participants.
3.4. Data Collection Procedure
To answer the research questions, we designed interview and focus group discussion questions. In the beginning, we developed fifteen interview questions and five focus group discussion questions. Most of the interview and focus group discussion questions were similar. However, we used them to triangulate the results and to achieve valid and representative data from the participants.
The questions addressed ethical concerns during the requirements engineering phases of SDLC. The interview was audio-recorded, with the average length of the interview being 45 min. During the interview sessions, we used probing questions to discover relevant ethical concerns in a detailed manner. We conducted two focus group discussions with four members each. On average, each of the focus group discussions took an hour. These focus group discussions were very open and interactive sessions. Moreover, before starting the interview, as well as the focus group discussion questions, each participant agreed and signed a consent form.
The interview and focus group discussion questions were designed in accordance with the research questions. The research has three research questions. Here, we discuss each of the research questions with respect to the designed data collection tools.
The first research question investigates the practices of software companies regarding ethical concern considerations during requirements engineering processes. To carry out this, three interview questions (interview questions 2, 3, and 4) and two focus group discussion questions (focus group discussion questions 2 and 5) were designed. These questions helped to assess the practices of software companies in their utilization of professional codes of conduct, guidelines, and the way they were exercised in day-to-day activities to take into account the ethical issues of requirements engineering.
The second research question addressed the fundamental ethical concerns that should be considered during requirements engineering processes. To answer this research question, we designed five interview questions (questions 5, 6, 8, 9, and 10) and two focus group discussion questions (questions 2 and 4). The findings from this investigation are discussed under
Section 4.3.
The third research question investigates whether there are methods/techniques that companies use to identify ethical concerns during the requirements engineering processes. To gather data through this research question, three interview questions (questions 7, 11, and 12) and one focus group discussion question (question 3) were developed. The findings from this investigation are indicated in
Section 4.4. Sample interview and focus group discussion questions are indicated in
Appendix A.
3.5. Data Analysis
To identify the important concepts of the findings, the collected data were transcribed and read repeatedly. The data were organized to make them suitable for analysis. To analyze the collected data, four qualitative coding strategies were used. In this research, before conducting a detailed analysis, we used holistic coding. This coding strategy is used for grasping the main themes and categories that are generated from the data. This coding technique helped us to obtain the overall sense of content and to prepare part of the data for further coding and categorization processes. Moreover, we used initial coding to examine each part of the data closely. Then, we generated initial codes from each distinct section of the data. In addition to the above-mentioned strategies, by using in vivo coding, some important actual words of the respondents were taken as they are. Furthermore, we used attribute coding to discuss the participating software companies and individual participants’ demographic information.
4. Findings with respect to the Research Questions
By using the above coding strategies, we carried out different stages of the coding process. In the first stage, we identified anchor code labels for each of the three research questions. At that juncture, using holistic coding, the overall concepts of the corpus were identified and coded with groups of data. Moreover, after catching up on the core points of each group of data, we applied a detailed analysis of each word, phrase, and sentence carefully. Then, in the second stage, relevant statements were coded, and they were put under their respective anchor codes. Additionally, some vital actual statements of the respondents were taken directly using in vivo coding. In the third stage of the coding process, the list of initial codes was compiled. In the fourth stage, these codes are grouped based on the anchor codes or based on the research questions. In the fifth stage, each code is depicted with its respective frequencies. In the sixth stage, categories are generated and examined to develop themes that address the research questions. Finally, we obtained major themes from the research findings. In this section, we present the major findings of the research corresponding to each theme.
4.1. Importance
The first concern was investigating the awareness of participants regarding the importance of clearly considering ethical concerns during software requirements engineering processes. Regarding this, all the participants replied that clearly considering ethical concerns during requirements engineering processes is essential. Mainly, the participants discussed two major categories. These are considering ethics in requirements engineering processes, which help to obtain high-quality software and minimize ethical concern violations. This implies that if we consider ethical concerns in the early stage of the system development life cycle, it is possible to ensure privacy and security issues, enhance software project success, refine artifacts, and enhance ease to use, enabling the retrieval of in-depth information, and so on. Additionally, considering ethical concerns helps to minimize ethical violations. This indicates that considering ethical concerns helps us to elude deceptive requirements, protect confidentiality, respect social values, and find complete requirements, and so on. In this regard, we indicate a few respondents’ responses as follows.
One respondent replied that “Requirements engineering is the first phase of system development, and it is a foundation. As a result, if there is something wrongly done in this phase, the problem will be reflected in the design, architecture, and all other phases of SDLC. Besides, the problem done in this phase will have a high impact on the other phases. As a result, requirement engineering is the foundation for other phases, and it is a very critical one.” As he said, “there is one saying, ‘a well understood problem is half done.’ So, we have to work carefully and with great effort to get valuable and quality software.”
Similarly, the other respondent said, “Of course considering ethical concerns have many benefits. In requirements gathering activities, the more we go into detail the more information we will obtain. Nevertheless, this is not exercised practically. Only functional requirements have got high focus and will be gathered in most situations.”
Additionally, the other respondent said that “Considering ethical concerns helps to avoid requirements duplications, to give priority and attention to critical ethical issues according to organizational behavior, needs and wants. …”
“Considering ethics in requirements engineering helps us to respect social value, to empower customers, to protect confidentiality and privacy issues, to protect unauthorized access of information, to avoid unnecessary and unwanted requirements, to avoid deceptive requirements, and so on. However, as I know there are no laws/rules/regulations, which make developers accountable for their products. There is no legal ground to punish those developers who omit ethical concerns and issues. Something should be done to make developers liable for their faults. That thing may be a procedure, policy, or something else. There should be legal procedures, which enforce the inclusion of ethical concerns and the accountability of software developers.”
4.2. Practices
We were inspired to conduct this research to investigate the ethical concerns of software requirements. This research has its own research objectives and research questions that should be answered. The main objective of the research was to investigate the ethical concerns of requirements engineering and have these propose a framework for requirements engineering ethics as the future investigation that will be follow this research. The first research question, “How are software engineers practicing the integration of ethical concerns of software during requirements engineering processes?” is answered by performing research objective one: “Investigate how ethical concerns are being put into practice during RE.”
To investigate the practices of software engineers in the direction of integrating ethical concerns during requirements engineering, we assessed software-developing companies. In this regard, the practice was assessed with respect to industry practices, the usage of professional responsibility code of conduct standards, and guideline utilization practices. Regarding industry practices, except one, all the participating companies have a traditional way of carrying out requirements engineering processes. The single company is trying to focus on the early identification of ethical concerns, especially security aspects of ethics during the requirements engineering processes. Some of the manners in which this company is practicing include ensuring security issues by paying great attention to them. Additionally, the company is using issue-tracking software (such as requirements traceability matrices and document matrices) for filtering requirements. Further, this company is dividing departments in accordance with employees’ specialization, such as business analysts, solution engineers, database designers, developers, and architects. In this regard, respondents replied, “this helps us to improve our performance and to produce quality software”. Regarding the use of professional responsibility code of conduct standards, respondents of six companies replied that they do not have any professional responsibility standards of systems development that they follow in their day-to-day work. One company claimed that it uses the IEEE code of ethics via the customization for requirements engineering. However, some employees of this company said, “We have not” and others stated only limited practices of IEEE. Similarly, almost all the companies, except company F, stated that they currently do not have any guidelines in place for considering ethical concerns throughout software development lifecycles.
In general, the findings refer to the absence of industry practices, professional responsibility code of conduct standards, and other guidelines within the companies for integrating the ethical concerns of software during requirements engineering processes.
4.3. Fundamental Ethical Concerns
The second research question, “What are indispensable ethical concerns of software, which should consider explicitly during requirements engineering processes?”, is addressed through research objective two: “Find out ethical concerns which should be clearly integrated with requirements engineering processes”. This objective is achieved through investigating fundamental ethical concerns (interview question five and focus group discussion question four), factors/hindrances of being ethical (interview question six), assessing the time taken up by hard challenges during their software development (interview question ten), and exploring the main ethical violations that occurred during software development (focus group discussion question two). With regard to this research question, we received two broad groups (themes) of problems. The first theme entails problems that are very critical, i.e., serious problems associated with ethical concerns of requirements engineering. We named this theme “fundamental ethical concern theme”, which covers the critical ethical concerns obtained from participants during interviewing and focus group discussion sessions.
Regarding these different opinions and reflections observed among the many discussions of participants, we present here only a few.
One participant said that ethical concerns could be categorized under nonfunctional requirements. He said, “Nonfunctional requirements are very vague to capture them, they are costly to test them. Users could not identify them correctly. Since there are these and other similar problems, taking non-functional requirements as a requirement are very challenging.” Furthermore, he replied that in our country context, even functional requirements are not stable. Having these unstable functional requirements taking non-functional requirements such as ethical concerns is a very difficult task. This is because it requires capacity in finance, platform, and other aspects.
The other respondent stated that most of the ethical concerns are personal. That means they are related to the way a person acts. As he said, “The challenge regarding requirements engineering is that in most cases, even though there are frameworks and guidelines, practically the proposed framework is not used. The other challenge is lack of knowledge both from the customers’ and business analysts’/requirements engineers’ side. The ability to identify requirements, to hear, to gather, and to appropriately document those requirements is a very challenging problem. Besides, from the customer side, they do not know how their business is doing.”
Another participant said, “The fundamental challenge during requirements engineering is the frustration of customers to use an automated system. Because they assumed that automation might cause them to lose their jobs, might cause overload (workload), bring them towards it. Due to this, when they are asked to give requirements, they could not be willing to give the real requirements (both functional and non-functional requirements). They hide every piece of asked information. In addition, unclear business process, ambiguous requirements, unfulfilled infrastructure, and usage of outdated tools and technologies are the other ethical concerns that I observed.”
In the same way, the other person said, “Customers might not be willing to give all necessary formats, documents, and reports. There is a tendency to hide them. Some of them may be due to lack of knowledge, but most of them do it purposely for some reasons, such as some of them may be afraid to be jobless because of automation, some of them may lose unnecessary benefits associated with corruption, etc. …”
In general, in the analysis, we found fundamental ethical concerns and grouped them into six categories: requirements of identification problems, quality-related problems, performing unpermitted activities, unwillingness to give requirements, knowledge gaps, and lack of legal grounds/rules for accountability. The corresponding codes of some of requirements identification problems include insufficient requirements engineering processes, incomplete requirements, lack of attention, focusing only on functional requirements, not identifying “to be” requirements, not identifying the real needs and wants of customers, unclear requirements, the presence of ambiguous requirements, omitting requirements, etc.
The other category under this theme is quality-related problems. In addition to requirements identification problems during data collection, we obtained problems, which were associated with quality. Some of those include security concerns, privacy concerns, cyber-attacks, confidentiality issues, usability issues, and others. Furthermore, performing unpermitted activities is another category. As most of the respondents stated, there are many unethical activities within software companies, such as lack of honesty in work, carelessness, adding evil code to source code, plagiarism, and so on.
The other category under this theme, fundamental ethical concerns, is an unwillingness to give appropriate requirements to engineers. From the customer’s perspective, many of the customers become reluctant to give necessary data of the intended system. As mentioned above, this is the main problem from the customer’s perspective. Some of the codes under this category are unwilling to give clear, real, appropriate, and precise requirements, being impure and too complex requirements.
The other one is the lack of legal grounds/rules for accountability. This category shows the absence of rules and regulations for software development in the country. As respondents of company E said, “We are rendering services for service giving organizations. However, in practice, this is too difficult and challenging. Because we develop services, and we give that package to service provider companies. Those companies may make the consent manually/by hand or orally and they may send authorized messages without an agreement to get wrong benefits from that person …”. Additionally, as they said, “As we know, there are no laws/rules/regulations which make developers accountable for their product. There is no legal ground to punish those developers who violate ethical concerns and issues. Hence, there should be something that makes developers liable for their unethical activities. That thing may be a procedure, policy, or other. There should be legal procedures which enforce the inclusion of ethical concerns and the accountability of software developers.”
The last but not the least category is the knowledge gap. As discussed above, there is a lack of knowledge about both technical people and customers.
The second theme which is obtained here is management-related problems. Management-related problems are problems that are obtained during data analysis. This theme is inclined towards software project management issues. Different concerns are discussed in this. To mention only the two of the problems, frequent change requests and being reluctant to make changes, are the major ones. Lots of concerns are identified under these categories including scope creeping, conflicts due to differences of interests, denial of agreements, unwillingness to accept the artifact, unclear business problems, weak requirements change management, etc.
4.4. Methods
The third research question, “What are the methods/techniques that can be used to determine the upholding of ethical concerns along with requirements engineering processes?”, deals with methods/techniques. Research objective three, “explore methods which are used by software companies to identify ethical concerns for the purpose of ensuring the inclusion of all the necessary ethical parameters for requirements engineering”, helps to answer this question. In the research findings, the presence/absence of ethical concern methods/techniques, identification methods, and checking mechanisms become necessary. Therefore, before determining and proposing relevant methods for ethical concerns, we investigated them via interview questions seven, eleven, and twelve. Additionally, we used focus group discussion questions two point three (2.3) and question three.
Under this theme, the methods, presence, or absence of ethical concern identification methods were investigated. Most companies do not have any specified methods to identify ethical concerns during requirements engineering processes. As most of the respondents said, they do not have any methods/checking mechanisms to do such things. Only a few of the respondents mention some methods that they use during requirements engineering. A few companies use some means of communications through discussions, workshops, and prototyping using different techniques, for instance, user acceptance testing and checklists and their own intuitive methods. Nevertheless, they mainly used these measures for functional requirements. In most cases, they are not used for nonfunctional requirements, specifically for ethical concerns. Generally, the research findings indicate that almost all companies do not have well-established identification methods and checking mechanisms whether ethical concerns are considered and incorporated during requirements engineering processes or not.
To conclude, the following table,
Table 4, depicts the summary of the major findings/themes with their meaning.
5. Discussions
In general, this research has its own objectives and research questions. The three research questions are set as follows:
How are software engineers practicing the integration of ethical concerns of software during requirements engineering processes?
What are the indispensable ethical concerns of software, which should be considered explicitly during requirements engineering processes?
What are the methods that can be used to determine the upholding of some serious ethical concerns in requirements engineering processes?
To answer the first research question, we investigate the practices of software industries with respect to industry practice, the consumption of professional responsibility code of conduct standards, and the utilization of any ethical guidelines in place to consider ethical concerns. As discussed above in the research findings in
Section 4.2, the case companies in Ethiopia do not have a well-organized way of identifying and integrating ethical concerns during requirements engineering processes. Most of them did not use any guidelines as well as any professional code of conduct standards for the integration of ethical concerns during the early phase of SDLC. Instead of this, most of the respondents suggested the need for clear guidelines, standards, rules, and policies for the incorporation of ethical concerns during requirements engineering processes at a national level.
Moreover, the second research question is “What are indispensable ethical concerns of software, which should be considered explicitly during requirements engineering processes?”. Research objective two, “To find out ethical concerns which should be clearly integrated with requirements engineering processes”, is accomplished via interviews and focus group discussions. This objective was achieved through investigating fundamental ethical concerns, factors/hindrances to being ethical, assessing the time spent on hard challenges during software development, and exploring the main ethical violations that occurred during software development. Using these parameters, we found two broad groups of themes. These themes are fundamental ethical concerns and management-related problems. As discussed under
Section 4.3, there are lots of identified issues in each theme.
Furthermore, the third research question, “What are the methods that can be used to determine the upholding of some serious ethical concerns in requirements engineering processes?” deals with methods. In the research, finding the presence/absence of ethical concerns, identification methods, and checking mechanisms become necessary. Therefore, before determining and proposing relevant methods for ethical concerns, we are investigating the available methods and techniques to identify ethical concerns in those case companies. The research finding showed that most companies do not have methods and other well-organized identification means for ethical concerns during requirements engineering processes. As discussed, they are using a traditional way of identification techniques that we used for functional requirements such as prototyping, discussions, and workshops. Only one company, company “F”, is trying to use some techniques to identify ethical concerns during requirements engineering processes such as traceability matrices and Jira tools. However, these techniques and tools do not use specific to nonfunctional requirements; they are used to check functional requirements too. This implies that in the case software companies, there is no specific method for measuring ethical concerns during requirements engineering processes.
With these research findings, our next task will be to propose an ethical framework with its appropriate components and methods for requirements engineering processes.
6. Conclusions and Future Work
Harmonizing ethical concerns is a difficult activity. In this regard, software engineers have the influential power to consider the ethical allegations of precise software design alternatives. The field of software engineering and ethical concerns should be integrated to develop useful software that exercises ethical awareness in software engineering practices and artifacts [
40]. During software development, clearly considering ethical concerns is very useful for integrating both the technical and ethical issues of the software artifact. Software engineers are accountable for their profession and society at large [
4,
10]. Even though various approaches differ significantly in terms of their ability to deal with ethical issues, it is possible to apply ethics in the overall approaches of systems design [
10]. Requirements engineering is the SDLC foundation phase [
12,
14]. At the same time, this phase is exposed to many ethical violations. There are many cases in which requirements engineering becomes unethical [
18,
19,
20,
21].
So, in this research, we investigated the ethical issues of requirements engineering in the real settings of software industries. We took seven software industries from different sizes (small, medium, and large sizes) and maturity levels (with different years of experience), and data collection tools, interviewing, and focus group discussions were used in our study. To select companies and individual participants from each company, we also used purposive sampling techniques. Additionally, to analyze the collected data, we used qualitative data analysis techniques including holistic coding, initial coding, in vivo coding, and attribute coding strategies.
Through clear identification of the ethical concerns of requirements engineering and their consideration in the early phases of SDLC, requirements engineering, we can get quality software artifacts and services and minimizes the occurrences of ethical violations. In this research, the importance of considering ethics, practices of software industries, methods used to identify ethical issues, and fundamental ethical problems of requirements engineering were investigated. The results of the research showed that considering ethics in the early phases of SDLC is essential for obtaining high-quality software products and/or services and for minimizing the occurrences of ethical violations. However, the research findings showed the absence of industry practices, professional responsibility code of conduct standards, and other guidelines within the companies for integrating the ethical concerns of software during requirements engineering processes. The findings also indicate that almost all companies do not have any identification methods and checking mechanisms, whether ethical concerns are considered and incorporated or not. The major identified issues include requirements identification problems (such as insufficient requirements engineering process, incomplete requirements, focusing only on functional requirements, etc.); quality-related problems (such as security concerns, privacy concerns, cyber-attacks, confidentiality issues, and so on); performing unpermitted activities (for instance lack of honesty on at work, carelessness, adding evil codes to source codes, plagiarism, and so forth); unwillingness to give requirements (such as unwillingness to give clear, real, appropriate and precise requirements); knowledge gaps (such as frequent change requests and reluctance with changes); and a lack of legal ground/rules for accountability.
In general, the findings showed the absence of industry practices, professional responsibility code of conduct standards, and other guidelines within the companies for integrating ethical concerns of software during requirements engineering processes. They also indicate that almost all companies do not have any identification methods and checking mechanisms whether ethical concerns are considered and incorporated or not. Moreover, in the analysis, we found fundamental ethical concerns which are grouped into six categories as requirements identification problems, quality-related problems, performing unpermitted activities, unwillingness to give requirements, knowledge gaps, and the lack of legal grounds/rules for accountability.
Propose an ethical framework for requirements engineering which helps as a clear map concerning the integration of ethical concerns in the requirements engineering phases of SDLC. Our future proposed work will help software engineers to contribute to their profession in a usable way, both for the stakeholder of the software artifact and for the public at large. Additionally, it will help them to safeguard from undertaking unethical activities and practices, which, consequently, will bring many challenges for their career and personality.