How do I teach ethics in hacking? I teach a course on hacking every other year.  It's a very difficult class, and it only attracts kids who are really enthusiastic about delving deep into the bowels of gdb, stackframes, format string vulnerabilities, buffer overflow attacks, and the like. 1   

At the beginning, I give a short lecture talking about ethics.  The basic analogy that I draw is to a locksmith: a good locksmith can get into your car, and can get into your house. But an honest locksmith does not, because the lock that is in place communicates that he or she is not supposed to enter.  Thus, a good lock is there to keep out honest people.2  

From there, we arrive at this fine distinction: if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it. Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.

The question, then, is is this a sufficient message to impart?  If not, what more need be said?  Bear in mind that it is not actually a course in ethics per se.  I really can't spare more than about 15-20 minutes to impart the most important ideas, so I really want to make that short time count.

¹  The course largely emphasizes security holes from the 90's and the 00's. This isn't to prevent them from being able to work in modern system, but because you can study the attacks we focus on in relatively pure forms using virtual machines from that time, so we don't have to spend time working around more advanced security features. And learning about those attacks in any depth is already plenty hard!

² The lock may not be effective against, say, a determined burglar. But it helps people who generally wish to stay honest avoid temptation and conquer moments of ethical weakness.
I like your locksmith comparison, but I don't agree with the following assertion:


  From there, we arrive at this fine distinction: if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it. Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.


What is wrong is to use your hacker skills in order to perform unethical actions. Hacking per se is not unethical, as it is not ethical or unethical to use a key to open a door. For the sake of comparison, a locksmith can ethically use her skills to open the door to your apartment... if you called her after you lost your keys. But if she opens the same door when you're away in order to steal your stuff, the same action becomes unethical, because the goal is now different.

Aside the goal, one has to think about the yield of a hacking attempt, i.e. what one would do when he actually found a weak point in a system. Let me illustrate this with an example.

When I was a student, I was talking with my friend about IT security and we started talking about SQL Injection. Long story short, I tried to connect to the University website using his name and " OR 1 = "1 as a password, and it worked. I got access to his account, his personal information, and, if I remember well, his e-mails. This is the actual hacking action, which, by itself, is not ethical or unethical.

From there, I had an ethical choice:


I could behave unethically and use this weak point to my advantage. For instance, I could push further, trying to connect to the system as a teacher, in order, for instance, to change my grades, or even sell a service to other students to “improve” their grades for a small fee. I could also spy on other students, stealing their personal information.
Or I could contact IT security staff, telling that they have a slight issue. This would be ethical.
Or I could do nothing, which would be an ethically-neutral action.¹


Same hacking action leads to three different yields with very different ethical aspects associated with them.


  if a security feature is designed to keep you out


What about a system which has no security features? Would you feel ethical doing whatever you want simply because security was not implemented?

Take an example of online games where each player competes against others. One system implemented a cheat protection system which could be easily circumvented given enough programming skills. Another system has no cheat protection whatsoever. How would cheating be unethical only in the first system, but not the second one?

Taking the same example of video games, imagine a different game where the competition notion doesn't exist—there is no online mode, and the score of an individual player is irrelevant for others. The system has a cheat protection system. Why would hacking this system be unethical?


  Therefore, we should only study hacking using "practice locks", such as programs in our virtual machines.


What about the locksmith who's opening the door of my apartment because I lost my keys?



¹ By the way, I did the ethical choice and contacted the staff. The staff never replied, not even to thank me, which taught me two things: ethical choices are rarely rewarded and if someone is acting ethically just to get a reward, he's not that ethical after all.