Ethics of GitHub Copilot

This fall, GitHub (now owned by Microsoft) announced Copilot, a replacement for the autocomplete features found in most code editors. In fact, Copilot goes far beyond filling in variable names and function calls; it uses a machine learning model that has been trained on all publicly available code on GitHub to predict what code should be inserted at a given cursor position in any open file. In the current technical preview phase of Copilot, developers can enjoy having entire functions written for them by their computers. Given merely a function name, Copilot can leverage the hundreds of billions of lines of code in its training set to infer the developer’s intent and insert the appropriate code. Copilot is an incredible technological feat. However, there are numerous ethical questions that need to be addressed if Copilot and future AI-based coding assistants are to be adopted. For instance, what does Copilot mean for copyright? Also, who is liable for complications caused by code written by Copilot?

Copyright is already enough of an issue for human coders. A key obligation for engineers, and one which makes innovation worthwhile, is to “give credit for engineering work to those to whom credit is due” (NSPE). As more developers began sharing their work with the public, standard licenses quickly became popular. For example, if a developer wished to share a library they wrote but wanted to prevent others from monetizing it, they could license the code under the GPL license. The GPL License requires that “derivative works (of the copyleft-licensed code) must carry the same license as the original code” (FOSSA). However, it is generally acceptable for humans to take inspiration from publicly-available code—even code distributed under strong licenses. The process of creating something new and transformative out of small pieces of copyrighted work falls under fair use. On GitHub, only a small portion of all publicly available code is distributed under permissive licenses like the MIT License. Yet, to make Copilot effective, GitHub trained Copilot’s AI on all public GitHub repositories. This begs the question: does training an AI model fall under fair use? In other words, can AI look at existing source code and invent something new in the same way humans can? Currently, this is more of an existential question than it is a technical one, which makes it difficult to answer. For GitHub, there are two paths: either assume that developers who have contributed public code—even decade-old projects—are all fine with an AI scouring through their work, or assume the opposite and require developers to “opt-in” their repositories to Copilot’s training set. The latter option is far more ethical, although it is unlikely for GitHub to adopt anything that hinders Copilot’s development in the short run.

Now, even if every developer opted into having their code used in Copilot’s training set, there is still the issue of liability. For illustration, consider the (unlikely) possibility that Boeing’s programmers rely on Copilot for their next commercial airplane. A few years later, a glitch in the flight computer causes one of these planes to crash, killing the passengers onboard. Who is liable? If a human developer had, say, introduced the bug in the flight computer, then that developer, or at least Boeing as a whole, would be responsible for the tragedy. But what if the malfunctioning code was entirely Copilot’s doing? One could argue that Boeing is still responsible because it is the responsibility of the company’s testing team to catch bugs in critical components. However, the state of software development will inevitably reach a point where developers trust AI programming assistants to the same degree that developers trust compilers today. Regardless of how battle-tested these AI assistants become, the possibility of a mishap will always be nonzero. And the lower this possibility dips, the tougher it becomes to blame companies for their reliance on tools like Copilot. Even then, it would be difficult to pin the blame on AI assistant providers like GitHub because they could not have done much more to prevent this error. It would not make sense to blame the developers who provided the training data to Copilot’s AI, either—even if it were possible to identify the exact code segment in the vast training set that drove Copilot into outputting the bug. The developers behind the code in the training set could never have predicted that their work would have been used by AI in the development of a flight computer that resulted in hundreds of deaths. This example involving Boeing and a plane crash is extreme, but complications on a lesser scale (think hacked medical records) are bound to happen in the next few years because, after all, not every developer will bother verifying the code produced by Copilot. As AI becomes sophisticated enough to produce field-specific code, there is no guarantee that developers will even be qualified enough to check the generated code. Given that engineers are expected to operate in their “areas of their competence” (NSPE), this is especially problematic. At the minimum, programmers ought to establish that it is their own responsibility to vet Copilot’s output. Unfortunately, this may make developers hesitant to adopt AI coding assistants.

GitHub Copilot is one of those technologies in which a tradeoff inevitably exists between progress and ethics. However, a cautious approach from both the developers and consumers of Copilot can help ensure that AI-based coding assistants change the software development landscape for the better.

References

[1] FOSSA Editorial Team. (2021). Analyzing the Legal Implications of GitHub Copilot. FOSSA.

NSPE. (2019). Code of Ethics for Engineers. National Society of Professional Engineers.