135

My boss just asked me to create a fictitious log entry to say that a user's account was updated before it was, to win a dispute.

I feel this is not right because I am trying to start a career in working with data technology. Whether or not I get caught, the integrity of my data will be questionable, and my character compromised.

What would be the best way to handle this?

I have a far more professional company wanting to pick me up, and they are willing to hold the position for me until I finish the project at my current job. We are roughly a month out; should I cut and run now?

Sorry this is a little off topic, but I know some established professionals frequent here, and just need to know the best way to go about handling this with character.

This question was IT Security Question of the Week.
Read the Mar 30, 2012 blog entry for more details or submit your own Question of the Week.

Community
  • 1
  • 32
    "Should I cut and run now?" What's stopping you from leaving? The request is unethical. Why not leave right now? What's preventing you? – S.Lott Jan 25 '12 at 17:02
  • The reason I haven't transfered is because I'm the only person working on the project. I'm close to finishing it and the President of the other company understands that I want to see the project through...trying to do what is right to my current employer.. –  Jan 25 '12 at 17:04
  • 116
    You owe no loyalty to people who want to force you to commit fraud. –  Jan 25 '12 at 17:27
  • 32
    The request may be more than unethical, it is probably a civil wrong and could even be a crime. You should leave immediately and consult an attorney in order to protect yourself. –  Jan 25 '12 at 17:27
  • 2
    @FeralOink Back in Programmers.SE where it originated. This question applies to all developers who work with data, not just security professionals. – Izkata Jan 26 '12 at 15:17
  • @Izkata Well, I can't disagree with you on that! The question ***does*** apply to developers who work with data too. When I worked in children's managed care, we had a X-functional "Data Security" group spanning Security and Development, I forgot about that... – Ellie Kesselman Jan 26 '12 at 16:34
  • 1
    Always do the right thing. Don't do anything you know is wrong. – John Robertson Jan 25 '12 at 21:35
  • @Izkata - the question was closed on Programmers. We felt it was suitable here. – Rory Alsop Jan 26 '12 at 18:09
  • So what happened? – Keith Thompson Jan 29 '12 at 18:30
  • 6
    +1 for giving this proper thought. Seen to many blindly following orders. – Nils Munch Jan 31 '12 at 13:59
  • 1
    Quit now and consider reporting your boss to whomever has authority over the situation. – Matthew Flynn Jan 25 '12 at 17:01
  • This questions sounds like something from the CISSP exam. – rook Apr 08 '12 at 02:23
  • So how did it play out? – Niek Jun 11 '12 at 15:02
  • I don't do such things. Something to keep in mind is that things may end up in court - this may be illegal as well as unethical, or it may just be a "tort" (a civil "wrong"). I am not a lawyer. – Tangurena Jan 25 '12 at 18:08
  • 1
    Ask for the request in writing. After you get it, decline. No matter what the short term outcome, make plans to shed this boss one way of another. – ddyer Apr 08 '12 at 01:19
  • @Niek I bet he is dead :/ jk – Ceeee Jun 10 '15 at 08:43

16 Answers16

126

Ask your boss to put the request in writing before you do it.

Make sure to keep a copy of the request in your own personal files. Ideally a paper copy at home, or maybe an email in your own personal email account.

You say that you already have a better job to go to, so just give your notice now and leave the company as soon as the notice period is up. Presumably you have a notice period? A contract of employment?

If you don't have a better job to go to, then find one as fast as you can.

Kromster
  • 183
  • 5
MarkJ
  • 1,068
  • 1
  • 6
  • 7
  • 9
    Make sure you document your refusal to perform the task as well as the request. And absolutely make sure you have a copy of this documentation at home. – HLGEM Jan 25 '12 at 19:06
  • 2
    @computer_nurd I recommend you talk it all over with someone you know & trust, not just us strangers! Anyway... Do you definitely know that the change is fabrication? In which case its possibly even criminal (fraud): don't do it. Or is it possible that the database is wrong due to operator error, and the boss has some paperwork (e.g. accounts dept) that proves it? – MarkJ Jan 25 '12 at 19:38
  • 3
    In which case, you don't necessarily ask for the paperwork, but you can say "this is an important change, I want to be sure I get it right, especially with this ongoing legal dispute. I don't myself know of my own knowledge what the true facts are, please can I confirm that this is what you want me to do. *exact details here*" Maybe in an email so the boss can just say yes. And so you have a record of what he said & when. Forward it to your Gmail or somewhere. If the boss is honest, he may be a little irritated but will do it. Otherwise don't change the database. – MarkJ Jan 25 '12 at 19:42
  • 1
    @Computer_nurd - Because it is a customer dispute. I think you need to consult a lawyer. If you are contracted through another company as your employer they may even have one for you to talk to for free. You may have obligations now because your boss involved you. Failure to meet those obligations could cost you. Talk to a lawyer ASAP. – Chad Jan 25 '12 at 20:13
  • If your company has an ethics code, you may want to check in wtih HR... Even if you get it in writing you are still complicit in the fraud. – It Grunt Jan 27 '12 at 19:38
  • 1
    -1 if I could -- you don't advise OP "don't do it." – Heath Hunnicutt Jan 27 '12 at 22:20
  • First off there is no way the boss is going to put it in writing. But that's not really germane. The ONLY answer is for the OP to quit. Right friggin now. Whether he has another job waiting or not. – NotMe Jan 31 '12 at 16:35
  • @HeathHunnicutt I did discuss that in some comments, some of which have now been deleted. Presumably by a moderator, it wasn't me. Luckily my answer is still there in a couple of comments above - starts "Do you definitely know that the charge is fabrication..." – MarkJ Jan 31 '12 at 17:24
102

Don't do it. I did something unethical once for an executive and I am still troubled by it to this day. For legal reasons I cannot tell anybody.

It is unethical and you have another job lined up. Don't let him bully you. If he fires you then make sure you have in writing his request and you have legal grounds to sue for wrongful dismissal in most jurisdictions. That would be a pretty cut and dry case and you would make out greatly if he were to fire you, especially since you can just show up at the other job and not miss any income.

I would talk to an attorney who specializes in employment law too, most will give you at least a half-hour consultation for free.

Don't make the same mistake I did.

maple_shaft
  • 1,092
  • 1
  • 8
  • 18
  • 4
    Thanks for the reply from experience. I will not do it. Time to start getting the change in motion! –  Jan 25 '12 at 17:31
  • 12
    Really don't do it, this is one of those times where putting your badge on the desk and walking out the door would be a reasonable move. Depending on what is in that log doing so *MIGHT* even be a criminal act. So I would say NO and not budge an inch –  Jan 25 '12 at 18:22
  • 3
    Make sure you have as much documentation as you can (in a location outside of work) just in case your boss tries to throw you under the bus. But get out of their as soon as possible one way or the other. –  Jan 25 '12 at 18:26
  • 2
    That was pretty much my first thought on reading the question. Point blank refuse to commit fraud and if they are stupid enough to fire you for that, then you have a very strong case for unfair dismissal. – Mark Booth Jan 25 '12 at 18:33
  • 7
    My opinion is to take from the top two questions. Get the request in writing, THEN refuse to do it. You have a job lined up and it'll be hard for you current employer to blackball you when you have proof of such a request. – user606723 Jan 25 '12 at 19:40
  • 4
    @user606723 "Get the request in writing, THEN refuse to do it." Lying to a liar doesn't make you honest. I get the impression that it's a "Put it in writing to Cover My Ass and I'll do it" then don't do it... not exactly keeping the high ground on that route. – WernerCD Jan 26 '12 at 22:59
  • 3
    @WernerCD: So get the request in writing without saying you'll do it. The request does *imply* a willingness to do it, but not explicitly. – Keith Thompson Jan 29 '12 at 18:25
42

Does your company have an ethics officer, internal auditor or internal council? If so, then you should contact that person, explain what you have been asked to do (in writing), and let them handle it. If it is a small company without any of these positions, then take your concerns to the owner/president (also in writing).

As far as your company is concerned, this is the best way to handle this. The possibility exists that your boss is acting on his own and against company policy; this would allow your company to deal with him in an appropriate fashion. If you don't do this, your company could claim that they never knew anything about it and that you must be the problem. After all, with the level or integrity that your boss seems to have, he may deny ever asking you to do this.

You have nothing to lose, as you are planning on taking a new job anyway.

JonnyBoats
  • 1,143
  • 7
  • 8
  • 4
    +1 for this as it is the *right* thing to do. If people don't get called out for unethical actions, then they are just going to do it again and again. "All that is necessary for the triumph of evil is that good men do nothing" – mikera Jan 26 '12 at 03:53
  • 1
    but please just in case talk to your boss, maybe he is too wrapped up in winning that he does not realize that he is cheating to win. Just make sure he realizes what he is asking. – jimjim Jan 26 '12 at 12:48
  • 1
    @Ramhound - "The act deals with accounting." No, the act deals with a crime (depending on the legal and moral climate you work in). Falsification of records is a serious issue in some places. Asking an employee to do it can expose them to legal consequences. If "your boss" is ready to have you commit a crime in order to "win", then get away from him/her as quickly as possible. – robrambusch Jan 26 '12 at 16:07
25

  1. If you have your boss' request in writing in any form (paper, e-mail, etc.), make a copy for yourself that can be stored somewhere outside of your boss' control. Depending on the sensitivity of the information stored in the logs he's requested you to modify, you may also want to keep your own copy of the logs. (This is to say: If the logs have any data that is too sensitive, you probably should not be exporting them.)

  2. Consult a lawyer with experience in this field. Depending on what implications your log changes may have, it could be something that eventually comes back to bite the boss in the end. If that happens, and even if you actually didn't make the changes yourself, then you could be on the hook as well under "accessory" or "conspiracy" charges if you fail to report it to authorities. Find out what is necessary to protect yourself from this, and do it - even if it does mean reporting your boss.

  3. Don't make the requested log changes. It's not worth it.

  4. Get away from that company as soon as you can. You may want to get your lawyer's opinion on how quickly you can do this without putting unnecessary contractual burdens on yourself, but do not let that project be your only reason for staying.

  5. If your new employer asks why you're suddenly leaving so soon, you may cite an ethical disagreement with upper management and leave it at that. Again, consult with your lawyer as to how much or little detail you should disclose.

Iszi
  • 26,997
  • 18
  • 98
  • 163
  • 4
    Its possible that the actions of his boss may negate any contractual burdens on the OP. Another reason to consult a lawyer. – Chad Jan 25 '12 at 20:15
  • 1
    If the request is recorded (you have written documentation for proof) and is for the sake of fraud, calling the Attorney General would be the an appropriate action in the US. – Jeff Ferland Jan 26 '12 at 02:23
  • @JeffFerland - Seriously? I think calling the Attorney General for a private issue between Company A and Client A is a little overkill. The Attorney General serves the public. Lets start a couple pegs down the ladder shall we before we involve the Attorney General. – Ramhound Jan 26 '12 at 12:47
  • @Ramhound In this case of a publicly-traded company, it's not just Client A that's being infringed upon. The AG probably isn't a bad place to start. At the very least, they'll tell you where you *should* go if it isn't them. – Iszi Jan 26 '12 at 13:24
19

Do not do it. Even in writing it does not matter. At the end of the day its your butt on the line. If you're boss asked you to shoot someone with a gun, and you got him to write permission in writing, do you think anyone in the court would care if your boss gave you permission or not?

Regardless, you will be held accountable, not your boss. If your boss has a problem with it tell he or she that you would be perfectly happy writing a letter as to why you are not comfortable doing so.

This is actually entrapment, forcing you to break a law, but if you pull the trigger it will be on you, not your boss. If its a serious issue, you would want to report the entrapment.

Downpour046
  • 291
  • 1
  • 3
12

It is never worth doing something unethical. You need to live with yourself. Professional programmers should always be PROFESSIONAL, and part of that is always acting with integrity! If your boss' action is typical of the rest of the organization, it may be time to look for another position.

  • This. You are new to your career, so it's easy to feel like your employer "owns" you, and that you must do whatever they ask. As you grow and change jobs, you will begin to feel more like a professional: an **independent**, skilled worker who sells his/her services to employers. If you see yourself that way, there's no reason to feel pressured to do anything unethical. You aren't trapped by this employer's wants. You are free to sell your services to someone else. – Nathan Long Jan 27 '12 at 16:25
8

The idea of getting it in writing is a good one, but if he isn't the "pointy hair dude" he is never going to do it.

If this gets out, you are associated with it no matter if you did it or not (be sure that there will be someone to do it). So, if you can, cover yourself as best you can, and leave as fast you can. I know, this seems cowardly, but from personal experience is better than making a fuss about it. You see, he got there by employing the same tactics, and he won't hesitate to use them to fsck you if you cross his way (or just for fun).

Never fight morons, they will drag you at their level and beat you with experience.

Tell me with whom you walk and I'm going to tell you who you are.

(these are losely translated from my mother tongue, but I hope you get the picture)

Best of luck to you, on your new job!

Community
  • 1
Sorin
  • 179
  • 5
  • 2
    I think your answer is more realistic. You have to know who you are dealing with. Advising people to behave as if everyone had ethics can lead them into dangerous situations and adverse results. – DOK Jan 31 '12 at 18:35
7

This is wrong and you should tell your boss that it is wrong. It's not reason enough to leave your job unless your current employer isn't willing to discipline your boss in any way for trying to deceive a customer. If they don't take this seriously, you should move on. No sense in working for a company that allows this practice.

Bernard
  • 201
  • 2
  • 5
  • 10
    Good point. In other words: if your boss is willing to do this to a client, xe'll be perfectly willing to do the same to you, and/or pin the blame on you when excrement collides with ventilator. – Piskvor left the building Jan 25 '12 at 17:13
  • My boss is the president...no discipline. –  Jan 25 '12 at 17:14
  • 2
    @computer_nurd: Then you should just leave. –  Jan 25 '12 at 17:36
  • 1
    @Piskvor that is why the OP gets everything in writing and then sends it offsite to an account the his company can't manipulate before quitting. –  Jan 25 '12 at 18:05
4
  1. Save a copy of the current logs and encrypt
  2. Get the request to falsify in writing
  3. Do not make changes to the logs

What to do after this point is up to the legalities you are subject to. I would be sorely tempted to inform the other party of the request and offer them the unmodified logs.

schroeder
  • 123,438
  • 55
  • 284
  • 319
4

Does he realize what he is asking? If he is focused on winning the dispute then tell him this not the way to win, it is cheating and any/all types of benefits from such an act is meaningless.

This is not only your problem, at times people become so focused on something small that completely forget themselves, in times like that a good shepherd has to bring them back to the flock.

He needs your help, but not in doing what he is asking from you, but in the way of moral guidance. This is not just a case of doing or not doing something wrong cause someone asked you to do it, it is a case of making them realize what they are asking, and if this gets done ( by either you or your replacement ) they would lose a part themselves forever.

Maybe the Ivy league or private school he went to made him thinking winning is everything, but even his mum can tell him this is wrong. Just tell him you are gonna tell his mum if he goes on with it, then tell him if that would make him feel ashamed then maybe it is not something he should be doing.

If after all your guidance it still doesn't change, then walk away, no job worth a stain on your soul.

jimjim
  • 140
  • 4
  • 4
    I've been in this situation and honestly, the boss is probably just afraid of the auditors. I spoke with the auditor's bosses in an abstract way about findings and remediation, then spoke to my boss about it. We admitted fault, flubbed the audit, posted a remediation plan and put it in place. That's what the process is for. Seeing it work put emphasis on fixing our processes, made everyone happy and took a lot of stress out of future audits. If the environment is too toxic for that kind of action, then a new job is not a bad idea :-( – mgjk Jan 26 '12 at 17:57
4

I'm once in a similar situation (it's not about log data, but deal with ethics nonetheless)

Some of the answers mention about asking your superior to put the request in writing. That sound good and nice. But it is important to know your country culture and your boss intelligence as well.

For my case back then, my superior was intelligent enough to sense my plan of protecting myself while possibly putting him in danger(it was actually so obvious the moment you request/hints at getting something in writing), I don't want to get into the details, but things are changed and I'm removed very swiftly without me expecting it to be that fast. It was painful and depressing.

Also if such a culture (of covering up) is common in your country, your future employers knowing about it (I don't know about you, but over here, some companies job applications forms require you to state whether you have been fired or forced to resign before and state the reason) might view this as a negative trait rather than something positive.

In fact, there is this local news recently about a previously highly paid engineer who has been working as a rag and bone man for some years to support his family ever since he was 'laid off' after whistle blowing on his company. Even after the news is reported, he was still unable to get a proper real job (due to age, over qualified.etc) and that is a possible consequence one has to think about too.

Bottom line is, it's good to consider the ethical aspects of it, but do think of the bigger picture too. Can you afford to lose this job in your current circumstances? What is the current situation? is this really serious? Any backup plans?.etc

Also, consider getting proofs in less obvious ways such as instant messaging your superior, e.g. ('I kind of forgotten, so just to confirm, modify this xyz record to 5?') and the moment he reply to this instant message on skype.etc, you have a record already.

Still, if the conclusion is that you rather lose the job than to do such a terrible crime, then be the one who resign. At least you will feel better in the sense that it is you who ditch your superior, not the other way round.

Regardless of whether you will do it anot, try to plot your escape as soon as possible.

snowpolar
  • 141
  • 3
  • 3
    It's actually nicely written. Reporting on your superior and doing the right thing may cause unexpected things to happen. Even if you are right and lawful your potential employees may see it as potential threat (we can't trust him at critical situations). You're also right on the alarm bells ringing when someone ask you to write it in a email... – MadBoy Jan 27 '12 at 13:06
3

I had a similar case where I was asked to cover up a code theft.

I consulted an attorney who told me that the best for would be to just leave the company and forget it. What I did was to talk with my manager and make sure he understand that this is bad thing and that I'm against it and to hear him telling me to do it anyway. ALL THAT RECORDED with my smartphone. My plan was to resign and to ask for compensation otherwise I'd publish the whole thing but a day after the recorded meeting the boss told me that he thought about it again after our meeting and that I was right. So nothing happened and nobody knows about the recording.

Ramhound
  • 496
  • 4
  • 9
baba smith
  • 139
  • 3
  • 11
    You seriously just admitted to attempted blackmail? – Naltharial Jan 26 '12 at 12:08
  • 1
    What you describe in MANY states would have been illegal. In Florida for example you cannot record a conversation you have with somebody unless they give you permission. So not only would you have been charged with Blackmail, you would have been charged with recording the conversation also, using vulgar language is really in poor taste. What you did was even worse then what your boss requested you did. – Ramhound Jan 26 '12 at 12:55
  • 2
    no, its only you who didnt seriously listen. i recorded it only in case i had to resign my work because of that. in that case having a recording makes the legal part much easier and cheaper. instead of having to prove my point to the judge i've a recording and the trial end in 2 days. thats it. in my country theres a protection under the law for employees that report corruption in the place of work. and so the recording is the proof. no blackmail at all :) – baba smith Jan 26 '12 at 14:16
  • In many states it is legal to record a conversation if at least one of the parties consents. So, if you are one of the parties, you have your own consent. – Marcus Adams Jan 26 '12 at 14:48
  • 4
    +1 for blackmail - nothing like committing a felony while complaining about one... – Jim B Jan 26 '12 at 16:40
  • 3
    recording a conversation that you're part of it is just another technology for 'taking notes'. so as far as i know in the US you can do that. its illegal to record a conversation which you're not part of it - this is tapping. – baba smith Jan 26 '12 at 16:56
  • @babasmith - Like I said...In Florida you have to get BOTH parties to agree to the recording. The evidence you describe could not be used in a court case. You could also be charged with a crime, if the other person objects, to the recording once they found out. Blackmail is still wrong. – Ramhound Jan 27 '12 at 14:50
  • @Ramhound: The vulgar language (now deleted) was in the post here, not in the conversation with the boss. – Keith Thompson Jan 29 '12 at 18:29
  • It's not a felony to record a phone conversation you are part of in many states in the US. Secondly, asking for compensation because you are put in a position to have to resign isn't that awful. – Bradley Kreider Apr 01 '12 at 03:44
  • Thinking about blackmail isn't blackmail. Many people would change their mind before actually doing such a thing. – Highly Irregular Jun 05 '12 at 10:20
2

As a professional, or at least if you ever want to be one, you should learn to say 'no' even if it costs you your job. Reading the popular answers about putting request in writing - sure, you can do so to cover your ass, but in my experience showing spine pays off way more than covering your ass.

In the long run, spine is always stronger than a piece of paper.

Regardless of the country you're in - you're a person with a choice. Even if you were eaten you always have 2 "exits".

Vladimir Lazarenko
  • 21
  • 1
2

The absolute first thing you should do is hire a lawyer. Do not pass go, do not collect your check, do not speak to your boss or anyone else at that company UNTIL you have spoken with an attorney. Go ahead and pay their retainer.

At this point there are a lot of different things that could cause you to go to jail, depending on where you live.

In some places it is a crime to simply ignore/not report one. If this is the result of a criminal investigation your ass could land in hot water for simply turning the other way, let alone actually doing what the moron asked you to.

If it's the result of a records request caused by a civil litigation and you don't tell the company attorney about this, it could bite you. It might bite you if you don't tell the opposing counsel... Ask a lawyer what to do. Regardless falsifying ANY data submitted to a court is grounds for criminal proceedings against you.

Another tact: What if someone overheard your boss making this request of you and reported it? You could be in trouble for simply not doing anything.

At the end of the day it's entirely possible that the boss in question either modifies those records him(her)self or has someone else do it and blame you if caught. Given the bosses lack of ethics I wouldn't put it past them.

Point is, get a lawyer right freaking now.

NotMe
  • 696
  • 3
  • 11
1

Do yo work for a publicly traded company or otherwise fall under SOX? If so, could get yourself into a world of hurt.

Wayne In Yak
  • 219
  • 2
  • 9
1

First, quit and go to your new job. Leave on as good terms as you can. When asked why you are leaving, say something harmless about what a great opportunity the new job is.

Second, once you're gone and have started your new job, report your old boss. If your company has some sort of ethics process - make the report there (it can be anonymous but in this case it's obvious who is doing the reporting). If there is no ethics process in place and this is a big company you might try the audit committee. As a last resort, there's either his boss or HR. In a small company, there's the CEO or the owner.

Remember that companies in general try to avoid trouble and smooth things over. The suggestion to consult an employment lawyer is a good one.

Do not put yourself in the position of reporting your boss while you work there if you can avoid it. These situations often do not work out well.

You should check with your lawyer to see if saving a copy of the original log somewhere on your company's system (NOT taking a copy with you) is a good idea.

robrambusch
  • 119
  • 4
  • 1
    +1 for saving the current log. You can email it to yourself at your work email address. The company would be in a world of hurt if they deleted the email if they conform to Sarbanes-Oxley (look it up). (Section 802: "... fines of up to $1,000,000 and/or prison terms for 'whoever knowingly alters, destroys, mutilates any record or document with intent to impede an investigation.'" :) – Jim Jan 26 '12 at 07:25
  • 1
    @Jim: That's already the case for altering logs (as proposed here), you don't need to email them just to achieve SOX status. – MSalters Jan 26 '12 at 09:38
  • @Jim - What sort of investigation exactly? Making mention of random laws that might not even apply to the author is in poor taste. The act deals with accounting. This sounds to simply be a private dispute between a company and a client. – Ramhound Jan 26 '12 at 12:49
  • Emailing logs to yourself? Bad idea. Leave them alone, do not touch them, do not log into the relevant servers, don't get anywhere near this with a ten foot pole. – NotMe Jan 31 '12 at 16:48
  • @Chris Lively - "Emailing logs to yourself? Bad idea" - And *not* anything I suggested you may notice. – robrambusch Feb 01 '12 at 02:12
  • @robrambusch: my comment was direct at two people. The email part towards Jim. The other part about even going near them (ie: saving them elsewhere), towards you. However, I see that you removed that part of your answer. So, I'll change my vote accordingly – NotMe Feb 01 '12 at 03:14
  • Actually, I can't change my vote. Apparently it's "too old" and needs an edit. grrr. – NotMe Feb 01 '12 at 03:16