An Ethical Analysis of the Design and Development of HALoN for Crisis Communications

Sahana Chandramohan '26 graduated from Santa Clara University with duel majors in Computer Science and Engineering (CSEN) and Electrical and Computer Engineering (ECEN). She was a 2025-25 Hackworth Fellow with the Markkula Center for Applied Ethics. Views are her own.

 

Introduction

The pursuit of engineering, although often presented as morally neutral, is far from such: the product of our work is impactful, the process of it—design, iteration, conception—even more so. While technical systems are often framed in terms of mathematics and technical theory, as though these are objective truths, every engineered system embodies the decisions of the engineers who have had a hand in its making. Dr. Deborah Johnson states: “the very idea of technology is the idea of things that are human-made... technology is humanity at work.” In software and networking systems in particular, these human-made judgments are amplified by scale, shaping the behaviors, opportunities, and vulnerabilities of entire populations. The questions engineers must ask are therefore no longer only whether a system can be built, but whether it should be built in a particular way, and who bears the consequences when it is not.

Computer systems, amongst other technological artifacts, are intentionally designed to behave as they do. Their functionality is created with purpose: in producing artifacts of particular functionalities, designers are facilitating particular behaviors. Therefore, it is fair to assert that the development of technical systems involves the exercise of human judgment at every stage—a judgment that can never be purely objective. When an engineer selects a hardware platform or determines system behavior under particular conditions, they make choices that carry implications for values such as access, fairness, autonomy, and dignity, whether they realize it or not. In the case of our thesis project, High Altitude Long-Range Networking (HALoN) for Crisis Communications, these choices also affect the capacity of individuals to participate meaningfully in the communication infrastructure on which an increasing proportion of contemporary life depends. We are committed to ensuring equitable access to communications for vulnerable communities in periods of crisis, but understand we must design our solution with these stakeholders and their needs in mind.

We, resultantly, have found it reasonable to view the design of a crisis communication network as a combination of technical problem-solving and human-centered design. The claim that technical design is value-neutral obscures the actual design process, in which alternatives exist amongst multiple technically viable solutions. Selecting among them reflects, explicitly or implicitly, a set of values regarding whose needs the system prioritizes. Our response is to center the alignment of human values, ensuring that they must be integrated as a design requirement and subjected to the same rigor as the technical facets of our project. In doing so, we acknowledge that, more often than not, human values conflict, even amongst themselves (security and freedom, honesty and kindness, individualism and collectivism, etc.): the values we have centered, and the decisions we have made around them, are a reflection of us, the HALoN development team, and our moral priorities.

Networking technologies illustrate clearly the value-bearing nature of technical design. The TCP/IP stack is often discussed as a neutral abstraction, with clean separation across physical, network, transport, and application layers. Yet each layer embeds choices about access, reliability, privacy, and priority that have real consequences for users, consequences that are not distributed evenly. Decisions made at the physical layer constrain possibilities at layers above: implementation of the internet layer determines whose voices can be heard and when; design choices at the transport layer shape what users can reliably communicate under crisis conditions.

The analysis that follows applies the Markkula Center’s Framework for Ethical Decision Making, its Ethical Toolkit for Engineering Practice, and the professional ethical standards of the ACM and IEEE to HALoN’s three architectural layers. For each layer, the analysis proceeds in a three pronged structure: first, an identification of the ethical lenses most applicable to that layer and why they are most relevant; second, an examination of how HALoN’s design choices respond to these ethical considerations; and third, a dedicated ethical risk sweep—a systematic account of remaining risks, outstanding obligations, and conditions under which the design could produce harm rather than benefit. Following this layer-by-layer analysis, we address conditions under which HALoN might fail in its ethical duty and the potential uses of the system by actors whose values conflict with those we have designed it to consider.

Before we begin, we acknowledge that in the Jesuit tradition of engineering education, the pursuit of technical excellence is inseparable from the responsibility to pursue what is good. Ethical reflection on systems upon which connection, voice, and survival may depend is not ancillary to engineering practice. As we have been taught, the head, the heart, and the hands must work in tandem: to separate engineering from ethics is to sever the head and the hands from the heart. Ethical analysis is both a technical and a moral necessity. Anchoring HALoN’s architecture in human dignity, equity, and care is therefore a commitment to the Jesuit values of our education, to the duty of the engineer, both the professional and the personal.

A Brief Overview of HALoN

At its barest, HALoN is a crisis communication system designed to provide temporary, rapidly deployable connectivity in environments where traditional infrastructure has failed or is unavailable. In other words, it is what we hope can operate as a minimum viable communication network required to support human coordination, safety, and dignity in moments of disruption.

The system is built on a LoRa-based mesh network, composed of low-cost, low-power nodes capable of transmitting short messages over long distances. These nodes may be deployed on the ground or, in an ideal scenario, elevated using high-altitude balloons to extend line-of-sight coverage across terrain that would otherwise obstruct communication. The network is not designed to replicate the internet nor to support high-bandwidth applications and continuous connectivity. We have intentionally optimized for the reliable transmission of short text messages and positional data under severe resource limitations; this is, ultimately, a temporary system for emergency communications.

Although this decision could be viewed as a constraint, it is the reflection of a set of core design priorities. In a disaster context, the ability to send a short SOS message or share coordinates is often more valuable than the ability to transmit large amounts of data. Furthermore, in optimizing for short, emergency messages, we were able to use lower-end hardware to implement the network, preventing the system from being cost-preventative.

HALoN operates without reliance on centralized infrastructure, like cellular towers, existing service providers, or even the internet. Indeed, we hope that HALoN will serve the needs of a civilian populace when these structures have failed, where existing systems are either damaged, inaccessible, or never present to begin with, like in the context of natural disasters, remote regions, and infrastructure-denied environments. In removing these dependencies, the system attempts to redistribute the capacity to establish communication networks to smaller organizations, volunteer responders, and local communities.

At a more technical level, we maintain the notion of decentralization in the topology of the network, as HALoN uses a peer-to-peer mesh topology, without gateway or server nodes. In other words, no one node is entirely at the mercy of any other in order to communicate, ensuring that the network maintains the values of resilience and fairness: all nodes are treated equally.

All of which is to say, HALoN is not a neutral artifact. We have codified into the system a consideration of the circumstances of our potential users, the implications of their usage, and the ethics that surround it all, as documented here.

On The Common Good and Care Ethics

The notions of the common good and care ethics provide a foundation for understanding HALoN that extends beyond any single layer of its architecture. While other ethical lenses are applied more directly within specific technical contexts, these two lenses, in our view, span the entire system. The common good, as described within the Markkula framework, is concerned with the conditions that allow communities to function in a way that benefits all members, especially those who are underserved by the status quo. Care ethics, in contrast, centers relationships, interdependence, and the obligation to respond to the needs of others with attentiveness, responsibility and compassion. The common good and care ethics lenses operate across these boundaries because the values they articulate are not specific to any one technical function. They require that the system, taken as a whole, expands access to communication in a way that neither reproduces existing inequities nor abstracts away the human needs of those meant to be served. This moral requirement, of course, cannot be met at a single layer, but belongs to the system as a whole.

For this reason, while the analysis that follows moves layer by layer, it does so with these lenses held constant. They are, in some way, the conditions under which our discussion may take place.

The Physical Layer

Ethical Lenses Applied

The physical layer of a network may seem to be the layer most removed from social and ethical consequence. It is indeed the layer where the physicality of a technical artifact is developed— the transistors, electromagnetic waves, electronic chips, antennae, amongst a variety of other components—but this does not free/unencumber it from the ethical considerations of the layers above, nor its own.

The selection of an operating frequency, for instance, is not simply a technical optimization due to signal propagation characteristics. It is simultaneously a determination of who may operate the system¹ and under what regulatory conditions. The selection of a hardware platform determines not only computational capacity but the practical accessibility of the system to organizations that lack specialized procurement relationships or technical supply chains. The deployment mechanism (whether nodes are mounted on towers, carried by vehicles, or elevated on balloons, etc.) determines what geography the system serves and, by extension, which populations are within its reach.

The ethical lenses most applicable at the physical layer are those of the common good and of justice. The common good lens, as addressed prior, asks whether a design serves the interests of the community as a whole, and with particular attention to the members of that community who are least served by the status quo. In a disaster context, this requires examining whether the physical layer design produces coverage precisely in the locations where communication infrastructure is most likely to have failed. Is it where the most vulnerable populations are most likely to be found or does it replicate, in its coverage pattern, the same hierarchies of access that characterize typical telecommunications? The justice lens asks whether the design’s benefits and burdens are distributed equitably, whether the physical choices that make the system accessible to some users exclude others, and if so, if these decisions are ethically justifiable. This includes considerations of who is able to access the network, who bears the costs of its deployment (in terms of resource allocation, environmental impact, risk, etc.). It also requires questioning what tradeoffs are being made in the name of efficiency or performance, and whether those tradeoffs systematically disadvantage certain groups.

The ACM Code of Ethics’ requirement that computing professionals contribute to society and human well-being, and the IEEE Code’s requirement that engineers hold paramount the safety, health, and welfare of the public, apply at this layer with particular directness. A physical layer design that is technically sophisticated but practically inaccessible to the organizations best positioned to deploy it in a crisis would satisfy neither obligation in any meaningful sense.

HALoN’s Implementation

HALoN operates in the 900MHzISM band, which is unlicensed for operation in North America under Part 15 of the FCC regulations. This choice is, perhaps, more accurately described as a design constraint that aligns with our emphasis on equitable access. A system designed to operate in licensed spectrum requires its operators to obtain regulatory approval and, in most deployment configurations, to enter into ongoing arrangements with licensed carriers. These requirements are not prohibitive for large institutions like telecommunications companies, government agencies, or well-resourced NGOs with established regulatory relationships, but they represent a meaningful barrier for the community organizations, volunteer networks, and local emergency response teams that are, in practice, most likely to be present and capable in the immediate aftermath of a natural disaster. As students in a research lab, we did not have access to a unique band, but had no desire for one, as the use of an unlicensed band does support the distribution of deployment authority more broadly, making the act of establishing network coverage something that does not require institutional permission as a precondition. This is in support of one of the aforementioned design criterions—decentralization—in pursuit of fairness and access.

The hardware platform, Adafruit Feather 32u4 boards with integrated LoRa radios, was selected on criteria that include, but are not reducible to, technical performance. The Feather 32u4 is available through consumer electronics channels, is compatible with the Arduino software ecosystem, and is supported by an extensive body of freely available documentation and community knowledge. Each board can be purchased for under $30, making the costs non-prohibitive compared to other solutions. These characteristics matter ethically because they determine the effective user base of the system. A platform available only through specialized suppliers, or requiring proprietary development tools, or lacking accessible documentation, concentrates the capacity to deploy and maintain the system in the hands of those with access to specialized supply chains and technical education. Again, the design consideration of decentralization we have prioritized with HALoN was chosen in part to resist dependencies and hierarchies like this.

The high-altitude balloon deployment mechanism addresses one of the most consistent features of disaster geography: that the physical landscape disrupts communication in exactly the places where communication is often most urgently needed. Elevated nodes extend line-of-sight coverage over terrain features (mountains, dense vegetation, collapsed structures, flooded valleys, etc.) that ground-level deployment cannot overcome without fixed infrastructure. The populations most likely to be isolated by these terrain features are, with notable regularity, the populations that have been historically underserved by telecommunications infrastructure, due to this very geography.² A design that achieves coverage specifically in these locations takes seriously the distributive dimension of the common good, asking not only how much coverage the system provides in aggregate, but for whom. For the purposes of testing HALoN, we did not receive permission to deploy our network nodes on balloons, but this is the ideal deployment mechanism, and the one that we have proposed.

LoRa’s low bandwidth is a constraint that we accepted deliberately, as it so happened to best align with our needs: reliable delivery of short text messages and positional data constitute the minimum viable communication for life-safety purposes. Optimizing for this use case serves a wider population more equitably than optimizing for richer communication features for a narrower one, so it was a feature that we were happy to work with.

Ethical Risk Sweep: Physical Layer

Several risks at the physical layer require direct acknowledgment. The glaring first among them is that the 900 MHz ISM band is shared. Under conditions of high device density, which are of high probability in the urban and semi-urban disaster scenarios where HALoN is most likely to be deployed, interference from consumer electronics, industrial equipment, and other emergency communication systems operating in the same band can degrade HALoN’s reliability substantially. This is not a failure mode that testing in low-density environments will reveal, and therefore, it has not been one that we have been able to test thoroughly, but we acknowledge the possibility.

The battery capacity of LoRa nodes, while favorable compared to many wireless technologies, is not unlimited, which is a tradeoff we were willing to work with. Nodes operating continuously in a sustained disaster response scenario will exhaust their batteries, but given that HALoN is a temporary system with low energy usage, we do not anticipate it to be an issue of note. That said, the design’s current documentation does not provide deploying organizations with sufficiently specific guidance on expected operational lifetimes under various conditions. We acknowledge that this guidance is necessary for organizations to plan battery replacement or supplemental power arrangements, so this represents an outstanding documentation obligation.

Finally, the system as currently designed requires some technical background to deploy. The physical setup of nodes and the initialization of the network are not tasks that can be reliably performed by non-technical personnel. This does represent a genuine barrier to deployment by some of the community organizations the system is intended to serve, and it is a barrier that future design iterations must address.

The Internet Layer

Ethical Lenses Applied

The internet layer is the layer concerned primarily with how a message finds its way from origin to destination. The operative design problem at this layer for HALoN is not routing in the traditional sense, but scheduling within a highly constrained, intermittently connected LoRa mesh carried by balloon-borne and ground nodes. It is the management of when nodes transmit, what they transmit, when they listen, and the timing of all these states under various constraints. It is thus clear that the ethical content of the internet layer in HALoN is concentrated in its scheduling decisions, and that these decisions carry implications for a setof values that impact the civilians we hope to serve.

The ethical lens of justice is the most directly applicable at this layer. Our scheduling protocol allocates a shared resource, the per-node transmission queue, across competing messages originating from users and relay nodes operating under energy scarcity and mesh constraints. The terms of that allocation are not technically determined in any simple sense: multiple scheduling strategies are technically viable for a given network configuration, and the selection among them reflects, explicitly or otherwise, a set of priorities about whose transmissions receive preferential access and under what conditions. In a network designed for post-disaster or infrastructure-denied communication, these priorities ought to be intentional to best support equitable processing of communications or should not exist at all.

The rights lens applies in a related way. At the very minimum, we argue that users have a right not to be arbitrarily interfered with in their attempt to communicate, meaning the scheduling protocol must not systematically block or suppress their messages for reasons unrelated to legitimate network constraints. In other words, all nodes must be treated alike. Furthermore, given the crisis-centric context in which this system is designed to operate in, equitable opportunity to transmit information engages with the rights lens, since this information may be tied in turn to a right to safety or security.

The utilitarian ethics lens is also applicable at this layer in a way that complements the justice and rights analyses. A scheduling protocol that causes battery-constrained nodes to transmit during predictable periods of high contention, consuming energy without delivering messages, is a protocol that fails, in a specific technical sense, to serve the interests of the nodes and users it governs. There is an account of integrity in the design that requires that the protocol allocate resources fairly, and that it allocates them in ways that are genuinely useful to the nodes that depend on it.

HALoN’s Implementation

HALoN’s scheduling approach emphasizes time-slot and scheduled transmission fairness among nodes under the specific constraints of a LoRa mesh. The design prioritizes the equitable distribution of transmission opportunities by structuring when nodes are able to transmit, ensuring that no single node can dominate access to the network simply by virtue of its location, processing speed, or any alternate factors. Rather than allocating the channel directly, the scheduling architecture coordinates access through per-node timing and queue management, using time-division multiplexing to reduce contention and collisions. In effect, the system enforces a shared timing logic that prevents repeated overlap, distributing the cost of waiting across participants in a more controlled and consistent way. In a mobile balloon-assisted topology, where link availability will fluctuate, this distributional property is especially important.

Within this structure, the queue learning message scheduling algorithm at each node plays a critical role in determining how individual messages are ordered for transmission. Because each node operates under partial and shifting knowledge of the network, the algorithm adapts to local conditions such as congestion, retransmission history, and message backlog (aka queue length). This allows the node to make more informed decisions about which messages to prioritize, rather than relying on a static or purely first-come-first-served policy. Importantly, this adaptive behavior helps prevent persistent starvation of certain messages while still responding to real-time constraints, reinforcing the broader goal of fairness at the system level. In a mobile balloon-assisted topology, where link availability will fluctuate, this combination of global timing structure and local learning is especially important for maintaining consistent and equitable access to transmission opportunities.

Traditional scheduling approaches, such as First-Come, First-Served (FCFS) or Shortest Job First (SJF), offer procedural simplicity but fail to dynamically balance the competing ethical demands of a crisis network. FCFS respects strict procedural fairness but risks catastrophic channel congestion, while SJF maximizes throughput but systematically starves users attempting to send larger messages, regardless of intent. Furthermore, neither option is intelligent enough to adapt to the dynamicity inherent to many crisis environments. It is in resolution of this conflict that we implemented the aforementioned queue-learning scheduling algorithm. At every transmission window, the scheduler evaluates each packet based on a six-component state vector, where each vector factors into the final decision.

To maximize the common good, the algorithm penalizes packets with high retrans-mission counts (Rp), poor destination link qualities (Lp), and larger packet sizes (Zp). This prevents monopolization of the transmission channel by any one message, ensuring that the system serves all constituents fairly. However, to ensure justice and protect individual rights, the algorithm offsets these efficiency penalties through Message Priority (Pp) and Message Age (Ap). The longer a message remains undelivered, the higher its score becomes, acting as a safeguard against starvation and ensuring that individuals with poor network links are not permanently silenced in the name of efficiency.

Ethical Risk Sweep: Internet Layer

A large risk concerns the interaction between scheduling and the dynamic topology changes produced by balloon drift and ground-node mobility. Algorithms calibrated for a relatively stable topology may perform poorly when a high-altitude relay drifts out of range. During the period of topology adaptation, messages scheduled to transmit through the impacted nodes will experience delivery failures that the scheduling protocol is not yet fully positioned to recover from independently. Prolonged communication blackouts during mobility events undermine the system’s purpose, which is to allow for connection during these very communication blackouts.

Moving from a deterministic schedule to a reinforcement learning model introduces a distinct set of ethical risks. The primary risk is algorithmic opacity. Under extreme congestion, a user’s life-safety message may be repeatedly delayed by the queue-learner for various issues (eg. the local link quality is poor and the packet is penalized). While the Age (Ap) metric is designed to eventually force the message through, the sender has no transparent way to understand why their transmission is being delayed.

Furthermore, a significant risk concerns the inherent tension between network utility and individual crisis needs. The system deliberately penalizes packets larger than a particular threshold to keep the channel clear and ready for efficient use. However, in a disaster, complex messages (such as detailed medical supply requests or multi-point coordinate routes) are inherently larger. The system will systematically deprioritize complex coordination efforts in favor of simpler, shorter messages, perhaps going as far as influencing the type of disaster response the network can facilitate. We, however, believe that the decisions we made around accessibility, decentralization and fairness which result in this behavior, still stand, but acknowledge their potential impact.

The Transport Layer

Ethical Lenses Applied

The transport layer governs the end-to-end reliability of communication: whether a message reaches its destination across a multi-hop LoRa mesh, whether the sender is informed of delivery or failure, and whether the system’s behavior under degraded conditions is transparent to the people depending on it. The ethical considerations at this layer center on the obligations the system incurs toward the individual user in the moment of transmission. These are obligations of honesty, accuracy, and what the Markkula rights lens identifies as the legitimate claim of persons to information that is material to their own decisions and their own safety.

The rights lens is the primary ethical lens at the transport layer because the transport layer’s function is, fundamentally, to ensure that a message either has arrived or has not, and that the sender will be accurately informed of the outcome. In a general-purpose communication system, the failure to keep this promise is a matter of user experience.

However, in a system designed for disaster response and life-safety contexts, it is a matter of a different order. A person who has transmitted an emergency message, attempting to communicate their location or need for assistance, but lacks information about whether that message was received, is experiencing a failure of the system to discharge a moral obligation that the system’s design and purpose have incurred toward them.

The virtue ethics lens is applicable at this layer in a way that complements the rights analysis. A system that provides accurate feedback on its own performance, including accurate notification of failure, embodies a form of integrity that is not reducible to utilitarian calculation. There is a consequentialist argument for accuracy: accurate failure notification enables users to seek alternative communication paths (such as a retransmission) and thereby improves user outcomes. But there is also an argument that is not consequentialist: that a system designed to serve people in extremity has an obligation to be honest with them about what it can and cannot do, independent of whether that honesty produces better outcomes in every case. The design of HALoN’s transport layer proceeds from the determination that this obligation is real and binding.

HALoN’s Implementation

HALoN implements a lightweight acknowledgment scheme and bounded retransmission logic as the primary mechanisms to ensure users know whether a message was delivered. Upon successful receipt of a message across the mesh, the receiving node transmits a brief acknowledgment packet to the sender. The energy cost of this is non-negligible, but our judgment rests on the rights analysis: the user’s claim to accurate delivery feedback in a life-safety context has moral priority over the engineering convenience of a simpler or more power-efficient protocol that leaves the sender in silence. This mechanism ensures that the system does not offer the illusion of connectivity, but rather a verified account of it.

Retransmission logic operates through a bounded process. When an acknowledgment is not received within a specified window, the sending node retransmits the message, but after a defined number of attempts, the system reports delivery failure rather than continuing indefinitely. This bounding reflects a commitment to accuracy over false reassurance. An unbounded retransmission process offers the user no reliable information about the state of their message, creating a prolonged period of uncertainty. A bounded process that reports failure clearly, however unwelcome that report, provides information that is accurate and that serves the user’s capacity to make informed decisions. We are choosing to prioritize honesty over the appearance of persistence.

Message fragmentation handles payloads that exceed the maximum packet size of the LoRa physical layer. Fragments are transmitted sequentially and reassembled at the destination. In the event of partial delivery, the current design discards the incomplete message to avoid misleading recipients. This conservative choice reflects a judgment that, in a crisis context, a partial message may be actively dangerous. An emergency coordinator who acts on partial location data or truncated instructions may be worse off than one who received no message at all. Discarding incomplete fragments is therefore an act of protecting the recipient from misinformation. In this context, data integrity is a moral requirement for fairness and safety.

Ethical Risk Sweep: Transport Layer

The acknowledgment scheme, while correctly designed in principle, introduces a failure mode where acknowledgment packets are themselves subject to loss. When an acknowledgment packet is lost, the sender receives a false negative delivery status: it is informed that its message was not received when in fact it was. A false negative delivery status is a less serious harm than a false positive, as it leads to redundant transmission rather than misplaced confidence in a message that did not arrive. It is, however, a harm nonetheless, psychologically or otherwise, to a user whose usage of the system impacts their views on their own safety.

The bounded retransmission threshold introduces a calibration question that has ethical weight. A threshold appropriate for moderate channel congestion may produce premature failure reports under heavy congestion for messages that might have been delivered with additional attempts. Conversely, a threshold set too high extends the period during which the sender remains uncertain about delivery status. Whether the current threshold is appropriately calibrated to the range of conditions the system will encounter, including balloon drift and relay intermittency, is a question that requires field testing to answer with accuracy, and is something we cannot concretely determine without an understanding of the crisis-landscape.

Finally, the transport layer currently operates without end-to-end encryption. Message payloads, including free-text content and GPS coordinates, are transmitted in cleartext and are readable by any actor in possession of a compatible LoRa receiver. The harm this creates is most clearly visible at the application layer, but it originates at the transport layer where payload handling is defined. The absence of encryption represents an outstanding design obligation whose discharge is a precondition of responsible deployment in any context involving populations for whom location information or emergency status is sensitive. Addressing this gap is a requirement for meeting our duty of care toward users in life-safety scenarios, and is something we hope that future iterations of HALoN can address.

A Pre-Mortem Analysis: Understanding the Conditions of Potential Ethical Failure

As stated in the toolkit, it is our obligation, before HALoN is deployed, to carry out a structured examination of the conditions under which it might fail. The primary objective of this is to identify the mechanisms by which it is most likely to occur and to evaluate whether the design adequately addresses them.

The most probable single mechanism of potential ethical failure for HALoN does not require malicious intent or technical incompetence. It requires only the well-documented tendency to represent a system’s capabilities based on performance under favorable conditions while underweighting the degradation that is likely to occur under the conditions that will actually prevail in deployment. HALoN is a research prototype whose delivery success rates, acknowledgment reliability, and routing performance have been evaluated primarily under controlled laboratory conditions that do not replicate the spectrum congestion, node instability caused by balloon drift, energy management cycles, and accumulated small failures of real deployment in a real disaster environment. The gap between controlled-condition performance and realistic-deployment performance is a standard feature of prototype development; it becomes an ethical problem when controlled-condition performance is communicated to potential deploying organizations as though it were representative of what they should expect in practice.

A third mechanism, and perhaps the most probable source of real harm, is the well-intentioned but inadequately informed deploying organization. A system designed for accessibility will in some cases be deployed by organizations that lack the expertise to understand its limitations, that have not prepared complementary communication strategies for when the system fails, and that have communicated its capabilities to affected populations in terms that exceed what the system can reliably deliver. The harm produced by this failure mode requires no bad intentions; it requires only the combination of genuine desire to help with insufficient understanding of the conditions under which the system will and will not perform.

The corrective processes this analysis requires are specific. Documentation of HALoN’s limitations must be included in any materials communicated to potential deployers with sufficient specificity that the conditions under which performance degrades are understandable for non-specialists. A structured training requirement for deploying organizations, including explicit evaluation of whether the organization understands the system’s failure modes and has a plan for complementary communication strategies, must be treated as a precondition of deployment rather than an optional supplement. Community review processes, in which representatives of the populations for whom the system is intended participate in evaluating whether it serves their needs and under what conditions, must be incorporated into future design iterations.

Consideration of Adversarial and Mal-usage

The ethical analysis of a technical system would be incomplete if it addressed only the values embedded in the system’s design as it was intended to operate, without attending to the uses the design has made possible for actors whose purposes are not those for which it was built. Technologies deployed on shared infrastructure do not operate only in the hands of their intended users. The design choices that make a system accessible and deployable by legitimate actors may, and frequently do, make it accessible to actors whose purposes are at variance with the system’s intended function.

The most consequential adversarial use case for HALoN is passive surveillance. HALoN transmits over unlicensed radio spectrum in cleartext. Any actor in possession of a compatible LoRa receiver can receive, read, and log every message transmitted on the network, including sender identifiers, recipient identifiers, priority levels, free-text content, and GPS coordinates, without interacting with the network, without being known to its operators, and without taking any action detectable by network participants. In a politically stable environment with a low-risk user population, the practical consequences of this exposure may be limited. In a deployment context involving displaced populations, politically vulnerable communities, or individuals for whom location information is sensitive, the consequences are substantially more serious. A comprehensive log of who is communicating, where they are, and where they are moving represents information that could be used to harm the very populations the system is intended to serve.

The system was not designed to enable this use. It was designed in a way that makes this use trivially achievable, and once deployed, it will produce these capabilities for monitoring actors regardless of the designers’ intent. Those choices pursue genuine values of access and equity and should not be abandoned without strong justification. It is an argument for implementing end-to-end encryption for message payloads. This measure is technically feasible on the Feather 32u4 platform, and something we hope to implement. Its absence from the current design represents an obligation whose discharge is a precondition of deployment in any context involving populations for whom location information or message content is sensitive.

The second adversarial use case is message injection. HALoN does not currently implement sender authentication, with the consequence that any actor with compatible hardware can transmit messages on the network claiming origin from any node. In a crisis coordination scenario, a false message claiming to originate from a legitimate network participant—a false emergency, a false all-clear, or a false resource request—can divert response capacity from genuine needs, create confusion about the state of the affected area, or delay assistance to persons requiring it. The harm this enables is not a technical nuisance; in the scenarios for which HALoN is designed, it could have direct consequences for the allocation of limited emergency response resources. A lightweight message authentication scheme, in which each message carries a cryptographic signature that receiving nodes can verify, is technically achievable and should be treated as a design requirement rather than a deferred enhancement.

There is a third class of actor that deserves explicit attention, someone we have termed the well-intentioned but overconfident deployer. The same accessibility properties that make HALoN deployable by community organizations and volunteer responders make it deployable by organizations that have not fully understood its limitations, that may communicate its capabilities to affected populations in terms that exceed what the system can reliably deliver, and that may not have prepared adequate fallback strategies for when the system fails under the conditions it will actually encounter. The design has created, in pursuit of genuine values of access and equity, an opening for a form of misuse that requires no malicious intent. The response to this is primarily a matter of documentation and training standards, as identified in the pre-mortem section; but it is a design responsibility as real as the technical obligations the analysis has named, and it is one that must be discharged before the system is deployed in any context where affected populations may rely on it.

Conclusion

The analysis presented in this document rests on the premise that the design of a technical system is inseparable from the values it embeds, that our obligation as engineers to examine those values thoroughly belongs in the design process. Our ideal result is a world of artifacts that embody both the technical values with which they were defined as well as the substantive values of the societies they are built to serve.

HALoN is a system designed in pursuit of these values: access to communication infrastructure for populations underserved by existing systems, equity in the distribution of network reliability, and the capacity of communities in crisis to communicate their needs and coordinate their response. The analysis at each layer has attempted to examine how well the design’s choices actually serve those values: where our design succeeds, where it falls short, and what our outstanding obligations are. design embodies a coherent and defensible set of value commitments, and that it also carries limitations: its current absence of end-to-end encryption, its gap between simulated performance and field-validated performance under realistic conditions, among others. We are proud of the work that we have developed but know that more must be done before the system can be deployed responsibly in the contexts for which it is intended. The ACM Code of Ethics requires that computing professionals be honest about limitations and potential problems; the IEEE Code requires honesty and realism in stating claims based on available data. These limitations are the features of a research prototype, and we hope that this honest acknowledgment is an exercise of the professional and ethical obligations that the design process incurs.

Our personal commitment with HALoN’s design is to serve, with care, honesty and intention, the people who need it most; as engineers educated in the Jesuit tradition, we also hold a commitment to the inseparability of excellence from responsibility. And it is, as our analysis has attempted to show, what must be addressed at every layer of the architecture, in every design decision, and in the system as a whole. We owe this diligence to future users of HALoN, who may ultimately depend deeply on what we have built.

 

¹ see subsequent discussion on cost prohibition and equitable grass-roots access.

² Guldmann, J.-M. (2020). The Urban-Rural Telecommunications Divide Endures: A Historical Perspective from Landline Telephony. Urban Science, 4(4), 71. 

 

HALoN and Crisis Communication Networks: An Ethics Case Study