8 ms·

Is this fraud? And if so, to what extent am I responsible?

• tamimio 3y ago
  Before continuing to the main topic, as soon as I read “Decisions are taken by the (non-technical) directors” I would suggest you look somewhere for another job unless that person has outstanding leadership experience (clearly not), this dynamics (non-tech is dictating on tech) will be the most infuriating and frustrating experience you will have to put up with, I have been in that position before, in fact, I have seen small companies turning into chaos after replacing the tech-manager with non-tech one (usually sales or business), as those usually lack the technical background, and to stay ahead of the technical folks, they pull all political shenanigans and psychological manipulations. Now to your topic, you are to be blamed: - Never ever claim something is done when it wasn’t, especially in cybersecurity, this will always fire back and I have seen it firsthand, you will be liable when the first breach happens since you gave the green light from a technical perspective. - You are supposed to protest the company's position yet they threw you in front of the bus at the first corner (when the client asked for evidence)? What do you think it will be when legalities hit later? - You are being used, and sorry to burst your bubble, bullied too, it is clearly what type of work environment when you get a WRITTEN email with a slur, not even verbal. - From my experience too, going to higher management will not do anything (like a CEO) in small companies, as usually they are all the same, in fact, the CEO will be using the director as a shield to take the shit later, and the director is using you as a shield, you get the idea. The course of action if I were you: - Meet with the client and be transparent, say you never said that, no pentesting is ever done, and be clear the director said it. I would even go the extra mile and record that call, just ask for consent first. - Give your resignation right after the meeting, and be clear about the reasons why, you will thank yourself later. - Edit: I would also make a CYA (cover your arse) folder, I usually do that in similar situations, document everything. You can of course take legal advice, but since nothing is actually done (assumed in the negotiation phase) and unless there’s hard evidence (like those emails you mentioned are clearly asking to falsify it), I don’t think it will be worth it, but I’m not a lawyer.
• turquoisevar 3y ago
  OOP should brush up their resume and ask the director per email what exactly he expects OOP to say and show during the zoom call because to their knowledge no pentest has occurred and as such no documents are available. Then forward all correspondence to his private email, or, if this is blocked (doubtful either way such a small organization) take photos of the correspondence, and await the inevitable outcome. The people here in the comments that are cosplaying as Socrates with questions like “What really is a pentest” and “Who knows what the client really want” will face the “find out” part of their nonsense soon enough.
• montroser 3y ago
  Yes, it's fraud. Just because your boss asks you to lie, does not make it somehow okay. Time to look for a job elsewhere...
  • Dylan16807 3y ago
    If a secretary had combined the answers from different people into a single document and gave it to the boss, would they also be guilty of fraud if they didn't believe all the answers? OP didn't write the incorrect answer, OP didn't attach their name to it (as far as I know), and OP didn't send it to the client.
  • convolvatron 3y ago
    ignoring the legal implications. if you have a choice do you really want to spend you life lying for other people so they can pretend to be successful? you could actually do something with yourself instead.
    • xwdv 3y ago
      If lying to people pays really well and you can get away with it your whole life many people will gladly take that option.
• wirrbel 3y ago
  Clearly, the engineer should print out the whole paper trail. And the lesson learned is to let people write their lies into documents and not do it for them.
  • closewith 3y ago
    The OP isn't an engineer, but this really highlights the difference between real engineers and software developers who like to pretend they're engineering. If the OP was an engineer, the answer would be lose their license and never work again in the field.
    • Dylan16807 3y ago
      > If the OP was an engineer, the answer would be lose their license and never work again in the field. Even for documents that their name isn't on?
    • deleted 3y ago
      [deleted]
    • closewith 3y ago
      To reply to a now deleted comment, I do believe in software engineering. It's just clear that the OP is not engaging in it.
    • gremlinunderway 3y ago
      Yeah unfortunately you can chalk this up to the early 90s obsession with libertarianism and anti-regulation. Establishing strong regulatory bodies would be and continues to be antithetical to the Silicon Valley Ayn Randian obsessed cult of free marketers. Regulatory bodies in the past were setup ultimately by government legislation (though typically run arms-length or fully independently thereafter), and until government starts actually taking these things seriously no software developer will ever be an "engineer" unless there are actual licensing and standards by authoritative bodies.
    • gaganyaan 3y ago
      This sort of snobbery is pretty silly. Do you think engineers didn't exist throughout all of history until someone decided to start handing out pieces of paper?
• bhouston 3y ago
  The whole situation is sketch. Find another job. No one should ask you to lie outright like this.
• NotYourLawyer 3y ago
  It can be really hard to flat out refuse on ethical grounds to do something your boss tells you to do. I’ve only done it once, and I knew it meant my time at that job was coming to an end. I was gone a few months later and in a better position.
  • tristor 3y ago
    I don’t think this is hard at all, especially in the tech industry when you can easily find a different (likely better) job. I’ve flat out refused things on ethics grounds multiple times in my career (startup life is like that), and while it resulted in me leaving the company twice, once I got promoted, and most of the time I experienced no repercussions personally at all and the person being unethical was dealt with. Ethics is a personal choice and if you have strong ethics, refusing to commit fraud is effectively a no-brainer. There’s no difficulty to this decision. Your “boss” at work isn’t actually in charge of your actions, you get to choose how you want to live your life on your own terms. Most managers are incompetent and sleazeballs abound in business. There is effectively no leverage these assholes have over you except continued employment working for asshole liars.
    • NotYourLawyer 3y ago
      >There’s no difficulty to this decision. That’s just not a realistic sentiment for most people in most jobs.
      • tristor 3y ago
        A job is a job. Ethics are about who you are as an individual. It’s a policy for your life and defines your character. I’d scrub toilets before I would defraud a customer.
        • NotYourLawyer 3y ago
          Good for you. But it’s unrealistic to think it’s a trivially easy choice for a single mom with no money saved and mouths to feed or whatever.
• bdowling 3y ago
  The general answer is that we can all be held personally liable for our own torts. For example, if a delivery company driver runs into a pedestrian, the pedestrian can definitely sue the driver. Usually, however, they will want to sue the company instead, because the company has more money. The same logic applies here. The customer can sue the employee who falsified the records, but they’re more likely to want to sue the company.
• paxys 3y ago
  So this person lays out a complicated issue concerning contracts and fraud and ends with > To be clear I'm not looking for legal advice, just opinions from people who may have been in a similar situation I'm going to go ahead and say they are going to dig themselves deeper in the hole.
  • Waterluvian 3y ago
    I think this is a form of boilerplate for acknowledging that no lawyer will want to give you legal advice without a more detailed phone call, and the acknowledgement that a non-lawyer can’t really offer legal advice. The way I handle this is to ask “how strongly would you be encouraging me to get a lawyer right now?”
    • TonyTrapp 3y ago
      I'd think the same. That's why in some law forums you are expected to write your questions in the manner of "suppose the hypothetical case that person X did Y, ..." instead of "I did Y, ...". So people are only talking about a theoretical case, and not give actual legal advice.
• baz00 3y ago
  If I was going to get fired it’d be for telling the truth. Saying no is allowed. If they fire you for telling the truth and there is evidence to support your position then sue the fuck out of them for unfair dismissal. My current company won’t let me near customers.
  • dylan604 3y ago
    keeping a distance from customers/users is my preferred location as well. even designing UI is too close for my liking.
    • salawat 3y ago
      I've broken my habit of retreating from customers. After all, if you don't know their pain, how are you to be an effective yardstick of Quality? If people try to keep you away from the customers/users, you beeline to the customers
      • lostlogin 3y ago
        A stint in customer support cures this attitude. It’s a special person who can survive that for a career.
        • dylan604 3y ago
          i'm not sure cures is the word. some people might have a change of attitude, others, it will only ingrain the situation even further.
        • richardjam73 3y ago
          I think your'e overemphasising how bad it is. I worked for quite some time as a computer tech fixing problems on-site and seeing exactly what issues customers face. I didn't come across too many "bad" clients. Now maybe this is because most customers could not call me directly, they had to log a call first but most people realise that your work is just as important as theirs is.
        • 3y ago
• mjr00 3y ago
  ehhhh. Lots of hyper-conservative responses there (which is understandable, it's asking for legal advice). But assuming this is part of an RFP response, "embellishment" of answers is par for the course, and I understand the frustration of the director. First, there's always a good chance nobody on the client side actually cares about this. RFPs tend to come with hundreds of questions, most of which are put in as requirements by completely detached departments to make them feel important, but don't actually matter. If something is important, it can be negotiated. For example, if the pen test is important, you can get the client to agree to sign the contract with a clause that says if they don't get pen tests results by X date the contract is void. Second, well, what is a pen test, really? If you ever called one of your APIs to validate that your authorization or authentication code works, or you've validated that your AWS security groups are blocking external traffic to your database, congrats, you've performed a "pen test"! The client won't consider that sufficient, of course, but it's a justification for an answer on an RFP, at least. If they want more details, as they do in this case, they can always schedule a follow-up call or ask to see the pen test results document. This situation reads like an engineer who needs a bit of business/sales experience more than anything. In their discussion with the client, you can start with "we've currently only done in-house penetration testing, but are looking to contract an external vendor to do penetration testing by X date." Assuming you've done any testing, this is a true statement, and the client can determine if that's sufficient. The real solution to this is to get SOC2/ISO27001 certification, though, which makes a lot of these RFP headaches go away.
  • mvdtnz 3y ago
    Absolutely nothing you said in this post is true or valuable, other than your final sentence. You appear to be far too comfortable with lying to clients.
    • cj 3y ago
      Remember that the goal of most security/procurement questionnaires isn’t _security_ … it’s _conpliance_ Compliance is not security. For buyers, they often just need to check a box so that they can maintain their own compliance obligations. They probably don’t care all that much about your security if you can check all the boxes. Pen tests are a joke. You can get perfectly acceptable pen tests (from compliance perspective) done for $2k in less than a week and the testers will try to find a couple things but their goal isn’t to evaluate your app’s security. Their goal is to make you happy with the report you’re paying for (and you won’t be happy if it has a list of 100 security bugs) Note: I don’t like that this is how compliance works. I wish compliance were more closely tied to security. But that’s simply not reality.
• lencastre 3y ago
  Tricky. 1/ Normally lying in bids can get your company barred from competing in bids for several years, if these are financed by something like the World Bank, the disqualification can be extended to other geographies. 2/ Your director likely has DnO insurance. 3/ Whose signature is at the bottom is the bid? 4/ Tell the truth, or at least, don’t lie. Disclaimer: not a lawyer.
  • mjr00 3y ago
    > 2/ Your director likely has DnO insurance. At a 10 person startup? No, their director is most likely a 30-year-old sales rep with an inflated title...
    • H8crilA 3y ago
      Fraud is a crime, what good is "insurance" here?
• rnk 3y ago
  Yes. Be sure to save or print the email trail to protect you.
• oldandtired 3y ago
  The rule to use is this: If your employer asks you to do something and there is no moral imperative to to what is being asked, even if you do not think it is wise to do it, just do it. If your employer asks you to do something that has some moral imperative, you need to ask yourself if doing this makes your moral standards, are you willing to compromise your moral standards or will you stand upright and be the man and face the consequences from your employer. Either way, you will face consequences and if you fail your own moral standards you have to live with that.
• tyingq 3y ago
  I would go with "I was not present for any penetration testing at launch, and I'm unable to find any reports related to it. However, penetration testing done that long ago would have little current value anyway. What I will do is talk to my leaders and get regular penetration testing scheduled, and get that schedule to you asap".
  • hn_throwaway_99 3y ago
    I wouldn't put that t exactly like that, but I would talk to the director and put something similar. Most compliance frameworks like SOC 2 have a requirement for an annual pen test, so if the pen test was over a year old it wouldn't matter anyway. Best approach would just be to talk to the director and say something along the lines of "Our next pentest is scheduled for date XYZ and we can send you those results upon completion". People who tend to freak out in situations like these where "let's lie" is their go-to, when an honest approach is possible that will likely get the job done, scare me.
  • paulcole 3y ago
    > However, penetration testing done that long ago would have little current value anyway. What I will do is talk to my leaders and get regular penetration testing scheduled, and get that schedule to you asap". Just leave that out. No point in saying it other than to make more trouble and work for yourself.
    • pipo234 3y ago
      The OP sounded like he was actually interested in putting security concern's on the company's strategic agenda. So the "trouble" might be beneficial.
      • tyingq 3y ago
        Yes, the idea was to make a commitment that would then be hard to avoid. They can fire you I guess, but it's a reasonable course of action to get some pen testing in place.
      • 3y ago
• cj 3y ago
  Edit 2: after seeing the replies, my revised advise is to schedule a cheap pen test (can be done in less than a week for less than $2k) and tell the client “Our next pen test is scheduled for next week”. Doesn’t need to be harder than that. Pen tests for satisfying compliance requirements are easy, cheap, and quick. - My advice: get on the zoom call and when asked about the pen test, repeat something like “we have a security policy in place that obligates us to do a penetration testing at least annually” (Assuming you have such a policy. If you don’t, then you and your company is out of your league selling to governments) Assuming you have a basic set of security policies (almost all of which will say you’ll do pen tests annually), just repeat the line like “we have a security policy in place that obligates us to do a penetration testing at least annually” And if you’re asked again more specifically whether you’ve done one in the past year, don’t answer directly and repeat the quote again. The key here is do say the maximum amount of (positive for your company) truthful information and deflect or redirect away from questions where the truth would hurt the sale. Engineers often have trouble with this because it’s most engineers have a tendency to want to answer questions directly and literally. And, make sure the sales rep is in the call. If the client backs you in a corner and you don’t know how to redirect or deflect, then you hand the baton to the sales guy. Edit: Or, just do a freaking pen test. You can get one done in less than 2 weeks for less than $2k.
  • lostdog 3y ago
    I would go with, "I was not involved with pen testing, but <director> has assured me that it was done." But really the right thing to do is to have a conversation with the director where you tell him that you want to support the company as well as possible, but saying that a pen test happened is not something you can do. You want the director to feel that you are reasonable and supportive, but realize that they have to find someone else to claim that the pen test occurred.
  • gaganyaan 3y ago
    Why be misleading? The directors are clearly wanting him to be a scapegoat. Just get on the zoom call and say you've never done pen testing, and your director lied to them. Also look for another job, this one has a short lifespan remaining one way or another
• codelikeawolf 3y ago
  It's worth mentioning that there is a legal definition of fraud[1]. Fraud must be proved by showing that the defendant's actions involved (5) separate elements: 1. A false statement of a material fact is made 2. Knowledge on the part of the defendant that the statement is untrue 3. Intent on the part of the defendant to deceive the alleged victim 4. Justifiable reliance by the alleged victim on the statement 5. Injury to the alleged victim as a result So if the local government is hacked because they thought the software provided was pen tested and it actually wasn't, congratulations, you've hit fraud bingo. Important disclaimer: IANAL [1]: https://legal-dictionary.thefreedictionary.com/Fraud https://legal-dictionary.thefreedictionary.com/Fraud Edit: Formatting and disclaimer
  • kradroy 3y ago
    But I think the author's paper trail will show #3 is not the case. He doesn't appear to want to deceive the client OR his boss. He's being pressured.
    • bdowling 3y ago
      “I didn’t want to deceive the client, I was just pressured to do so.”
    • codelikeawolf 3y ago
      Considering the legal definition of intent[1]: A determination to perform a particular act or to act in a particular manner for a specific reason; an aim or design; a resolution to use a certain means to reach an end. It doesn't matter if the OP wanted to deceive the client or was pressured to do it, they still intended to do it. Again, IANAL, but people are held liable for their illegal actions all the time, even if they were pressured. Also, think about the kind of pressure this manager is applying relative to the (potentially) fraudulent thing they're asking the OP to do. If the manager was holding their family hostage, by all means, lie about the pen test. I know it's easy to advise the OP to "just quit", but not everyone has the luxury of doing that for personal or financial reasons. That being said, I'd rather be out of work and struggling instead of on the hook for fraud. [1]: https://legal-dictionary.thefreedictionary.com/intent https://legal-dictionary.thefreedictionary.com/intent
• erulabs 3y ago
  Make it known you will not lie. If you're pressured or pushed to lie, resign. If you're fired for not lying, contact an attorney. The world only gets better if people do the right thing whenever possible. The right thing here is not to assist with immoral behavior and deceit.
  • salawat 3y ago
    This. And yes, I've walked that walk.
    • lostlogin 3y ago
      What happened? Were you fired?
      • salawat 3y ago
        Once, early on? Yes. Paperwork said laid off, but conversations around the time about how precarious the point in my career that I was at painted a different picture. Not going into gorey details. Suffice to say, I will not lie. I will not engage in the calling of a spade anything other than what it is either. Results and actions speak louder than words, and with mine I truly seek to never through my actions to make the world worse. Still find jobs. Still build things. Still help worthwhile projects get pff the ground. Gotten pretty good at it too. Still not afraid to walk out the door the minute things begin smelling of fish.
    • ChrisMarshallNY 3y ago
      So have I. I was not fired. In fact, it probably helped my career. It was scary. I was a pretty brand-new, low-level manager, at the time. But I also live a life of rigorous Integrity, and will resign, instead of doing unethical stuff.
      • tavavex 3y ago
        How did it help your career? Did the people who wanted their asses to be covered seek retribution?
• DoreenMichele 3y ago
  Time to start planning your exit. The larger problem: The boss doesn't have technical expertise and will not defer to the judgment of the person who does, lacks ethics and is not going to stop their crap. It will only stop if someone else stops them, probably via tossing them in jail at some point.
  • ragestorm 3y ago
    Counterpoint, OP is overthinking pen test = certification. He definitely needs to talk to his boss about it, but it could be a simple matter of discussion about what pen tests were performed. If a more recent and/or external one is required, simply tell them that you will work towards that. OPs goal should be to get clarity of what the client expects as a pen test.
    • DoreenMichele 3y ago
      The reality is none of us knows the whole story. We are getting one side of it. It's entirely possible the problem is with the guy asking the question and always has been. Assuming good faith, honesty and a reasonable degree of accuracy on the part of the OP, looks to me like he should probably plan his exit. Not necessarily drop his resignation today, but start making plans. It's absolutely true that if he ups his game, he may find things improve and he can work with this person effectively. Or he may not.
• rq1 3y ago
  > "we did pen testing when we launched, but haven't done it since". Well… was it before you joined the company? You tell them in that case that was before your time and you quote your boss. I’m not sure why you replied no to begin with, if you didn’t know. You should have asked your boss about it first and take his word. During the zoom call, you can simply reply that your boss told you so and ask him to produce the old report if it’s still in his possession. Anyways I think these tests (iso 27001) should be held regularly to mean anything. Being compliant in 2021 doesn’t hold the same “level of guarantee” in 2023. And that last part is up to your client’s policy. Do they need a recent third party audit or whatever… you should ask them questions and check with your boss if it’s worth the spending.
  • lolinder 3y ago
    Nowhere does the author say they were unsure whether it had happened: > I, truthfully, wrote that we had never pen tested our software. ... They provided me with an answer to the pen testing question that essentially said "we did pen testing when we launched, but haven't done it since". I made sure they were aware that this wasn't true. Three years into a job as the most senior technical employee, I'd expect him to know if there were any pen tests done before he joined. It sounds to me like this is a pretty garbage company, where the one developer with a clue feels like he has no agency. I believe him if he says they didn't do any pen testing before he was there.
• dehrmann 3y ago
  > At that point, I was confident in my personal ethical position. Eh, what? OP knew what sales was going to do with that email. Having sales wordsmith an answer is fine, but if you think it's factually inaccurate, don't send it back to them filled out in the form.
• adeon 3y ago
  Sounds like a "winning move" did not exist from the start for this poor fellow. Either your director fires you for speaking the truth or you possibly become accomplice in fraud. All you can do is cut your losses. If they go into that zoom meeting I hope they won't toe the company line. Getting fired, or losing the customer seems like the least worst option. It's actually not clear to me if the director is also their boss. It's written as if they are but not spelled out anywhere I can see.
  • ebiester 3y ago
    The winning move is to go along but then call the local whistleblowers for that government entity.
    • pipo234 3y ago
      Could be a winning move, but it's also common for whistleblowers to end up under some bus at some point. Turning against your director (and colleagues, etc.) will most certainly cost you your job. A lawsuit for disclosing secrets is also likely. Cover your ass with clear paper trail. And even then, I would prefer losing the deal getting fired. Whistleblowing is really the last resort nuclear option, IMO.
  • dragonwriter 3y ago
    The least losing move was probably to indicate that the “more political” statement provided by the boss seemed to be false, and ask for supporting information and/or to work together to find a defensibly true statement that was suitably politically acceptable. Now, if the boss is committed to outright fraud, this is still going to be a problem, but it lets you separate out that case and puts you in the best armed position if you need to go above or around them in the org on the issue, and does as much as you can to avoid the firm committing fraud and to avoid yourself being an active participant if that happens.
    • lolinder 3y ago
      > if you need to go above or around them in the org In this case, the whole company has around 10 employees, so I assume there isn't much in the way of management. I understood "director" to be the big boss, maybe sharing his position with one other.
• bowsamic 3y ago
  [flagged]
  • convolvatron 3y ago
    if we define 'software engineer' as someone whose job it is to make working software systems, then clearly anything less than the truth is counterproductive. if you take a more modern view that the 'software engineer' is mostly about marketing and sales, even inside your company, then sure. its all spin and half truth. but that doesn't have anything to do with.. you know, building stuff
    • bowsamic 3y ago
      [flagged]
• sschueller 3y ago
  You could probably still fudge out of this depending on what exactly was replied. You could elaborate that the initial pen test was one of those self trigger ones and not an external or "professional" type. Hence you do not have any documents regarding it anymore. Although not ethical the company would see this as not a acceptable metric and dismiss it when evaluating. Your written statement although a lie would not be considered fraud if it didn't get considered in evaluation. I am saying basically make your written statement worthless. Eitherway you need to make it absolutely clear to the CEO that is as far as you will go an he may as well hire an actor to represent engineering if he wants you to lie as the actor would know as much as you about a fictional pen test.
• unyttigfjelltol 3y ago
  The conduct to this point was wrong. At best we're talking about an undocumented, out-of-date pentest that the writer doubts occurred-- and whatever occurred would not be recognized as a pentest under current industry standards. Sounds like an interesting conversation with the client, director, and possibly whoever runs the company. If the company adds to that performing an actual industry-standard pentest-- which it passes easily-- perhaps its reputation does not receive the hit it deserves. If the software doesn't pass, might be simpler to withdraw the submission than proceed with the meeting.
  • l33t7332273 3y ago
    > whatever occurred would not be recognized as a pentest Unless they specifically claimed compliance with some standard, then there is no single and universally recognized Pen Test definition.
• nine_zeros 3y ago
  And this is why the tech industry management is so hated. The OP gave an ethical example but it happened to me in a different way. I was being pushed to release a small feature during the holiday season. While we were on track to release it, the CTO announced that we should not release anything during the holidays so that customers can take a breather and that our company is not responsible for their failures. So, we waited to roll it out until after the holiday since the CTO himself asked us to exercise caution. Come review time, my manager berates me for not releasing fast and for "constantly missing deadlines". I asked why the CTO is asking us to exercise caution and why he is asking us to push. I asked what would happen if there were to be an outage during the holidays. This infuriated the manager and he had it for me for a long time. And he was only furious because I caught his BS. The only reason he wanted me to go faster was to make himself look good. But if something were to fail and if the CTO checked, I was to be the fall guy. Aside from the "all managers are not like this" trope, can anyone tell me why engineers should trust such managers when they play such games with us?
• EPWN3D 3y ago
  I'm not sure what you expected to happen, but you should be archiving all your correspondence with your director in personal storage and start looking for another job. Whether this is fraud depends on your jurisdiction, but the fact that you're even asking the question probably means there are some uncomfortable conversations in your future. I'd say do one of two things: 1. Attend the Zoom and bring the original copy of the document you produced. Explain that you had nothing to do with any alterations, and that there has never been pen-testing of any kind. Then let them fire you. Again, save every piece of correspondence in storage that is under your control -- personal cloud, printed copies in your basement, whatever. 2. Resign effective immediately and cite that you were asked to make false statements to a client. Then file for unemployment and dare them to contest it.
• prakhar897 3y ago
  I have a similar story. I was working at a Big Startup, on ML side of things. All the senior engineers in my team left and me and a few others became the senior-most engineers (with <1 YOE). The models we built were contributing 100M$+ to the top line of the business. My then manager tasked to do some data analysis to determine whether building a "new nonsensical ML Model" was the right way forward. I like a diligent bee crunched the data and came to the conclusion that "we shouldn't build the new model". I showed the results to my manager who laughed and told me to do it again. It's also important to note here that my team lead and old manager had left the company. This person was completely new and a senior manager. I in my naive mind (and oblivious to politics) thought he's telling me to say that the results "do make sense". and that's what I said. We even presented the results to product people who gave us go ahead. Since we were doing such pivotal work, even the company's CTO was involved and tracking our progress. The next few months were one of the most painful times of my life. Immediately after the meeting, we were tasked to actually build those models. I knew that they wouldn't bring any results, everyone else in my team knew, even PMs knew. Everyone except the manager. I led a few interns and we built the damn models and got the expected result which is 0% improvement. What happened next taught me a lot about life. Their was a meeting (which I wasn't a part of) where everyone senior who had their ass on this project came together. They invented a "new metric of success" and asked us to train ML models optimizing for that. We trained the models and obviously since the optimization target changed, we saw improvement. Then we created charts according to that metric which were obviously good. the PMs showed slides to Upper management. and all was well again. The best part of the new metric was that the actual results will only be visible years down the line. So we called it a success regardless. I switched my job soon after that. I learnt from this experience to just say "NO" firmly on doing things I'm not comfortable with. and always keeping a text trail. The manager was kind of an oddball so I never fully got whether he actually knew this from the start or was just plain incompetant.
  • catlover76 3y ago
    I don't find this all that similar to the situation in the StackExchange post, tbh. Yours is a situation where people in control of the goal posts changed said posts to avoid looking incompetent; OP situation is some kind of Trumpy boss directing an employee to outright lie to the government so the company can obtain a contract .
• neilv 3y ago
  The big mistake here was editing an engineering statement to say something false. If you're an honest person, assume that your job under that director (and probably at the company entirely) was over as soon as they asked you to make a fraudulent engineering statement. Even if they backpedaled when you resisted, you're not a team player with them, and you're a threat to someone very dishonest. At that point, options: * just leave; * consult a labor attorney (you can get a free initial consultation); or * go above the director's head, probably (in a small company) to the owner/CEO, whatever attorney is on staff or they retain, or HR (though, you're still probably over at the company, even though they'll diplomatically pretend that you're not, because you are in 100% corporate butt-covering territory now, in a place that puts someone very dishonest as a director).
  • hn_throwaway_99 3y ago
    One thing that I would just highlight with your options: be extra sure to save receipts for everything - that means screenshots, even with an external camera if you're worried about corporate spyware. If you have everything well-documented, the likeliest outcomes look pretty good for you: 1. If you bring up the issue to HR or to a higher-level exec and they are competent, they will immediately either address the problem with the director or fire them for cause. 2. If you bring up the issue and they are shitty and try to fire you, it's honestly like free money for you if you have good evidence. If they're not complete idiots they'll settle in a heartbeat because their number one priority will be damage control.
  • justrealist 3y ago
    > though, you're still probably over at the company, even though they'll diplomatically pretend that you're not If you're professional about it (be factual, straightforward, and don't do a burn-the-world email blast), I wouldn't assume this to be true. Sometimes companies simply make bad high-level hires and are happy about exposing and terminating them. Or sometimes not. But the vast majority of CEOs want to know when their direct reports are lying to them and would be happy about this outreach.
    • zwerdlds 3y ago
• rayiner 3y ago
  Do not lie to the government, even if you are following orders. In the US, federal and state law differ, but most have some variant of the federal false claims statute: https://www.law.cornell.edu/uscode/text/18/287 https://www.law.cornell.edu/uscode/text/18/287 > Whoever makes or presents to any person or officer in the civil, military, or naval service of the United States, or to any department or agency thereof, any claim upon or against the United States, or any department or agency thereof, knowing such claim to be false, fictitious, or fraudulent, shall be imprisoned not more than five years and shall be subject to a fine in the amount provided in this title. This has been interpreted very broadly to encompass pretty much anything you submit to the government in support of the government paying you or your company money. Probably nobody will notice, and you probably won’t get prosecuted. But this stuff comes to light all the time if something goes sideways, or if the government is investigating something else.
  • JamesBarney 3y ago
    If the boss said "put that we pen tested" couldn't op argue that he was answering to the best of his knowledge given the information the director gave him. As long as he had the email receipts, or would there be an argument that he should have known differently and shouldn't have replied on the other directors assertion that it had been pen tested.
    • rayiner 3y ago
      He could if he thought that was correct but it sounds like he knew it wasn’t.
    • terminalcommand 3y ago
      I think this is the way to go as well. He might have simply said he wasn't at the firm when the pentesting was carried out and he would search for the documentation. He should have sent emails to his managers about where he could obtain the initial pentesting documentation.
    • dragonwriter 3y ago
      > If the boss said "put that we pen tested" couldn't op argue that he was answering to the best of his knowledge given the information the director gave him. No. If the OP was not in a position yo know if they had pen tested, and the director said that they had, maybe, but in this case AFAICT the OP was in a position to know, the director was not except through the OP, and the director dictated a statement that was “more political”, not a correction of fact, that the OP knew to be inaccurate, and the OP dutifully put it into the document intended for the customer and while in parallel repeating concerns about its truthfulness to the director.
• lowbloodsugar 3y ago
  IANAL. But yeah. And now you have a paper trail. Let them fire you. They’ll have a hard time firing you for cause. Do you really want to work at a place where the people in charge are either felony stupid, felony corrupt, or both.
• eschneider 3y ago
  Dear god, if this ever happens to you, get the hell out. Management that will lie/screw over customers will think nothing of lying/screwing over YOU.
  • marcosdumay 3y ago
    And don't lie. The OP committed fraud. If he don't double it down, he may not get any liability from it, but he did commit fraud. Do not be like the OP.
    • eschneider 3y ago
      Yes, this.
  • takeda 3y ago
    He probably was screwed either way in terms of his future at the company, but he should refused producing the document with these corrections. There was a tiny chance that maybe his resistance would make employer reconsider that. Anyway if the company requires him to produce it, it means his purpose was to be thrown under the bus if the fraud would come up. In fact it sounds like the zoom call scheduled might be exactly that (director claiming he had no idea). It is be best to have evidence stored in a safe place (or if control of the employer) if something bigger comes out of it. At this point the client has a document with clear lies signed by that engineer, and the employer won't cover for him, so it doesn't look great.
    • eschneider 3y ago
      If they ask for shit like that, they’re not good people. Get. Out.
• naet 3y ago
  You can't commit a crime just because your boss told you to. If your boss asks you to break in to a building and steal something you will still be in trouble for doing it, even if you have a paper trail showing your objection. Same should apply if you knowingly provide fraudulent information to a government agency. You might get a lesser sentence if you can prove that you were pressured into it by your employer but you're still ultimately liable for your actions. In this situation you need to put your foot down and say you can't commit fraud on behalf of the company. You could offer to either hire a pen tester, or conduct a half assed pen test yourself and report on the paper that you did an "internal" pen test, or something like that. But you should not have filled out a document with known false info. What did you think would happen once you did? That they would just throw it in the trash? Given that the consequences are already happening, you should make it clear that you aren't going to continue to lie and schedule a pen test ASAP.
• mdswanson 3y ago
  As with many "adult" decisions, sometimes it's best to just ask a kindergartner.
• Johnny555 3y ago
  I was in a similar position once, but it was an audit questionnaire about our usage of software - we only had one production instance licensed, not the backup instance or development instances. My director wanted me to state that we only used the one instance, I refused and said I'd leave the pertinent sections blank (for the director to fill in), but I wasn't going to lie about our usage. That's when I started looking seriously for a new job, and had left the company within a month, a few months later they went out of business after they had to pay hundreds of thousands of dollars in back licensing fees since the vendor had evidence that their software product had been used beyond the single production instance. I think if they'd been upfront about the usage, the company would have negotiated a fair license fee going forward without pushing for past usage to be paid too.
  • SmoothBrain12 3y ago
    Exactly, they cannot get paid from a bankrupt company. Some kind of payment schedule would be arranged
• franciscop 3y ago
  This is IMHO why programming/IT should be treated as a "real Engineering" in some cases, or at least have one of the devs (head of the project?) have a proper degree. I studied a different Engineering, and in multiple courses the emphasis was in the actual approval/signing. The only practical difference between a technician and the Engineer in many cases was that the Engineer could actually sign off the project (or not). And thus it was made very clear that signing a document like in this Workplace question would be a big deal, since the responsibility was theirs to make sure things were compliant.
  • deleted 3y ago
    [deleted]
  • Dylan16807 3y ago
    > And thus it was made very clear that signing a document like in this Workplace question would be a big deal, since the responsibility was theirs to make sure things were compliant. It sounds like OP would have refused to sign this document if asked. So is that good for OP? Or is this a situation where not signing doesn't matter?
  • neilv 3y ago
    My first real software engineering job came more from that tradition, where our division started as a startup of EEs and CEs, serving mil/aerospace/datacomm. So I started as a Software Technician I (and there was also a Technician II, before Engineer I). There were signoff matrices, etc. People were scrappy, making ambitious new things happen, but honest. Sheltered by lucky upbringing and early career experiences, I was shocked the first time I encountered someone in industry doing something dishonest. In the current "tech" industry, I'm no longer shocked, just frequently disappointed in what I see throughout much of the industry. I recently realized that some pretty ordinary tech ethics today is what, decades ago, was the stereotype of an "MBA". It was also a stereotype that "engineers" didn't trust "business people". Today, seems there's less cultural distinction between the groups, at least the stereotypes.
    • kibwen 3y ago
• Animats 3y ago
  This guy needs a lawyer. He may want to be the first one to confess at the prosecutor's office, so he's the one who gets off.
• Aeolun 3y ago
  Kinda wonky responses. If your boss asks you to provide them with a document that says ‘this’ and you send that back to them, how does that constitute fraud? The fraud is the one that then forwards that factually incorrect information to the client. People go on about having a document that you signed and attested as correct, but as far as I can see nothing like that was indicated by OP. You become party to the fraud when you take that call and make false claims. So don’t do that.
  • jabradoodle 3y ago
    Not a lawyer but I would be shocked if writing fraudulent documents because you were asked to isn't fraud in most jurisdictions.
  • runlevel1 3y ago
    When asked to do such a thing a reasonable person would know or should have known that the document would be used to commit fraud. I think the legal term is "constructive knowledge." (IANAL)
    • Aeolun 3y ago
      Sure, but there’s no functional difference between being coerced into writing a specific thing in a document, and having the coercing person write it themselves. You can refuse, but the only person hurt in such a situation is yourself.
• rospaya 3y ago
  I'm surprised by all the answers. Lying on tenders and audits is practically a sport.