13 ms·

Asked to do something illegal at work? Here's what these software engineers did

548 points by bschne 1y ago

Rygian 1y ago
> If you take one lesson from this, it’s that you can always say no. I fully understand why this is true, but it seems to ignore any retaliative measures that the management could take against the person who says no. With the benefit of hindsight, any such retaliation would be weaker than ending up in an orange suit. But the person has to find the guts to say "no" without that hindsight.
- OskarS 1y ago
  I would argue that you have a moral and ethical responsibility to say no when your manager asks you to do something illegal, even if it does cost you your job. The law is the law, and there is no excuse for breaking it. Your manager is certainly culpable, but if you act against the law, you are culpable as well. The exception is if you fear literal physical violence against you or others, or are being blackmailed or something, then of course you are being coerced and have no choice. But "losing your job" does not rise to that kind of coercion, in my opinion. Not saying it's easy, it's a horrible situation to be put in and I have huge amounts of sympathy for a person who has to experience this. No one is perfect and act with faultless ethics at all times. But hard or not, it is your duty as a citizen not to violate the law.
  - overscore 1y ago
    > I would argue that you have a moral and ethical responsibility to say no when your manager asks you to do something illegal, even if it does cost you your job. When your access to food, housing, heating and healthcare for your family are dependent on your income, you may find yourself facing very difficult decisions. Most parents will risk whatever legal ramifications to care for their kids and that's inherent moral and ethical, even if the downstream outcome is not. That is because it is the socioeconomic system rather than the individual who is acting immorally. > The law is the law, and there is no excuse for breaking it. This is an infantile view. The law is a framework and there are lots of circumstances where breaking it is not only excusable, it's the only moral action.
    - deleted 1y ago
      [deleted]
    - deleted 1y ago
      [deleted]
    - philipallstar 1y ago
      > When your access to food, housing, heating and healthcare for your family are dependent on your income, you may find yourself facing very difficult decisions This is the time when your ethics are tested. Anyone can do the right thing when they're getting paid for it.
      - tpoacher 1y ago
        There's a nice Jordan Peterson quote: > There was a lesson to learn from the holocaust. We're always reminded that: "Never forget, we've learned our lesson." "What was the lesson?" That's the question. The lesson is, "You're the Nazi". No-one wants to learn that; If you were there, that would have been you. You might think "Well, I'd be Oskar Schindler and I'd be rescuing the Jews." It's like, no, afraid not. You'd at least not be saying anything. And you might also be actively participating. You might also enjoy it. Hindsight theoretical morality is very different from experience on the ground, where peer pressure, stress, uncertainty, exploding situations and fog of war come into the mix.
        GuinansEyebrows 1y ago
        [flagged]
        DennisP 1y ago
        Seems like a better lesson would be "don't be the Nazi." It's not like it's impossible. The Nazis arrested 800,000 Germans for active resistance activities, and several hundred thousand Germans deserted the military, many of those defecting to the Allies. https://en.wikipedia.org/wiki/German_resistance_to_Nazism https://en.wikipedia.org/wiki/German_resistance_to_Nazism It wasn't a huge percentage, but we don't know how many actively resisted without getting caught, or resisted in more passive ways. And that was resistance against the Nazis, who had no qualms about killing resistors. Risking or quitting your job to not only do what's right, but avoid getting in trouble with your government, isn't in the same ballpark.
  - surgical_fire 1y ago
    "losing your job", for a lot of people, is extremely effective coercion. We are not talking about luxury here. A lot of people depend on their salary to pay rent and put food on the table. This is even more pressing if you have a family that depends on you, if you are in need of healthcare, etc. What your post fails to recognize is that in the current system, labor is already a form of coercion. You need to work because the option is homelessness and starvation. If you can avoid those even when unemployed, you are extremely privileged.
    - em-bee 1y ago
      If you can avoid those even when unemployed that would be all developed countries except the united states
      - rfrey 1y ago
        So yes, the extremely privileged
        em-bee 1y ago
        privileged? sure, but extremely? nowadays even in china everyone gets healthcare, working or not, so we are talking about almost a quarter of the worlds population.
      - snypher 1y ago
        380k homeless in UK. 262k in Germany. 122k Australia. 650k in USA. The per capita math is left for the reader but I don't believe there is much distinction here .
        throwaway-0001 1y ago
        You're right, the numbers are very close to recent official figures. I looked them up to calculate the per capita rates. So USA is actually better than other countries? Kind of defeats these arguments here - interesting. (By the way I’m not from us) Based on the latest available data (mostly 2023) and current population estimates: * *UK:* ~56.0 per 10,000 people (1 in 178) * *Australia:* ~45.4 per 10,000 people (1 in 220) [using 2021 census data] * *Germany:* ~31.0 per 10,000 people (1 in 323) * *USA:* ~19.4 per 10,000 people (1 in 515) The per capita distinction is more significant than the raw numbers suggest. (Note: Methodologies for counting vary by country, which can affect direct comparisons.)
  - array_key_first 1y ago
    I think, for most people, getting the shit beaten out of them is a preferable outcome to losing their job. For most people, their job is the only thing standing between them and being homeless, losing their car, losing their kids, their partner, etc. This is why having a culture that treats firing people as no big deal leads to wack ass incentives. You can make people do almost anything if you threaten their job enough.
    - deleted 1y ago
      [deleted]
    - DennisP 1y ago
      The cases in the article were software engineers in the US, and at FTX. Two were engineering directors and the third was a senior engineer. If any of them didn't have plenty of emergency funds set aside, they should have seriously rethought their spending.
      - tverbeure 1y ago
        I know plenty of people who saved for years to get a downpayment for a house and then used all of that for just that. After that, it will take a while to replenish their emergency fund with very little margin of error. A job loss would be devastating.
        DennisP 1y ago
        My claim is that that's a bad decision, for exactly that reason. Job loss can happen for any number of reasons, often without warning. Getting a mortgage without any cushion for job loss is a huge risk. Note also that I'm talking about highly-paid software engineers, not about people in general. Lots of people in the US make way less money than senior software engineers, and they manage to get by. Live at that level and secure your emergency funds first, and you'll be a lot more comfortable dealing with any ethical quandaries at work.
        tverbeure 1y ago
  - exe34 1y ago
    > But "losing your job" does not rise to that kind of coercion, in my opinion. it depends how many friends and family you have in the area that can host your whole family that is now homeless. it depends how much disruption you are willing to inflict on your kids definitely right now as opposed to maybe in the future.
  - swiftcoder 1y ago
    I think the risk is somewhat higher than just losing your job - you are potentially burning your whole referral network in the process (especially if you end up with your name in the press during any resulting prosecution). For a junior engineer it may not be that hard to fly under the radar, but senior/staff level folks tend to be well known by the execs. And execs talk, they call their friends to vet future hires... burn your execs, and maybe you don't work in that town again
    - scaramanga 1y ago
      Probably for the best... Like, anyone who would work with some of my previous employers, are places I wouldn't want to work anyway. It's a big wide world out there.
      - phatskat 1y ago
        > Probably for the best... Quite. One of my first gigs was at a large real-estate aggregator. The people were great but the highest levels of the company did - A pet “adoption” site, in quotes because to my knowledge the pets weren’t real and it was a subscription service with no means of cancellation outside of a voicemail box - A kind of Craigslist-esque site for selling home improvement services that was wildly vulnerable to XSS - I discovered that during an unannounced client demo when my own manager had said “you guys try to break it” - We were a PHP shop from the beginning. One day, engineering gets pulled into a meeting room and told that they’ve been developing 2.0 in an office downtown, with a separate team, in ColdFusion. They fired the lead engineer on the spot and most of us left or got fired shortly thereafter. They did offer to train us in CF, but the bad blood was too thick for my taste. All that is to say, if I ever get wind of the owner or CEO being involved anywhere that I’m working, I’ll probably be walking.
- pydry 1y ago
  This is why whistleblower laws need to be stronger (e.g. retaliation means automatic jailtime even if the whistle was wrongly blown) and rewards need to be larger.
- creer 1y ago
  The threat of retaliation - in the form of being fired, harassed or moved to a dead end position - is very scary to a younger engineer. But from a rational point of view it's not very strong (HOWEVER many managers or CEOs are far from rational.) - Firing someone has large costs to the employer. You have the job because you are needed. Same for side-lining someone or not promoting them. - Firing someone removes the final incentives against that person reporting the deed to the govt. It pushes that person toward reporting instead of softer "negotiated" steps such as continuing to argue for legal alternatives or discussing it with an intermediate rather than outright reporting. And many corporate legal or accounting people are amazing at finding alternative ways to achieve the same result in a not-illegal manner. - A lawyer can help you much more once there is retaliation. The company might end up fighting both the fraud reporting AND the retaliation. Just firing someone is not a great "solution" for the company. Letting you believe that they will ... that's very powerful. (and probably all this is caveat: in countries where retaliation is illegal enough and commonly taken to court or settled. which is not worldwide.)
- themafia 1y ago
  That retaliation is in and of itself a new illegal act.
- eur0pa 1y ago
  You can absolutely, most definitely always say "no". Their carrot (money) comes and goes, and their stick (also money) is not enough to be concerning.
- pavel_lishin 1y ago
  > But the person has to find the guts to say "no" without that hindsight. Not that I would recommend a night's stay at a local lockup (2/5 stars, the beds are awful, the toilet facilities are worse, and the roommates leave much to be desired), but doing so certainly puts things in perspective going forward.
sltr 1y ago
Software developers should sign a code of ethics, like other professions do and then cite it when asked to do unscrupulous things. This would work for activities that aren't illegal but still unethical, like defaulting user privacy choices to open/public. Citing professional organizations like ACM or IEEE would deter retaliation.
- pcthrowaway 1y ago
  The code of ethics would need to be absolute, enforceable, unambiguous (without lawyers to interpret), and universal to really eliminate these activities.
  - baobun 1y ago
    If you are to be found in violation by DAO jury vote, you will be blocked from all private torrent trackers and usenet groups (we just have to make sure all of them mods are onboard mkay), with threat of ban for repeat offenders. You may also find your support tickets everywhere languishing and x months of CAPTCHA-hell on every website.
  - pjc50 1y ago
    You can never make these kinds of things unambiguous. People are really creative about inventing interpretations to make things ambiguous in their favor, and rule systems are really complex. More to the point is trying to be an ethical island in an unethical society, You'd have to deal with constant attacks from the "anti-woke" crowd.
  - criddell 1y ago
    Software engineering could become a real profession with licensing like mechanical, electrical, chemical, civil, and other engineering professions. If you do something unethical, you could be sued for malpractice and lose your license to practice. The code of ethics for Professional Engineers works even though it isn’t any of the things you say are necessary.
    - thyristan 1y ago
comrade1234 1y ago
I was working with someone on a large government project. At the beginning I told him that we cannot pad our hours at the end of the year to run the contract out and then make up for it with extra hours in the next year like we do with business clients because it is illegal and further because it's a $1M+ contract could lead to prison. Of course I found out that he was going into our billing software and adding hours to me. I had to talk to a lawyer and he recommended I report it to the gao. I compromised by quitting and reporting it to the liaison on the project (a professor). It was very stressful because if I hadn't reported it he could say that I reported those hours, not him, and I could have ended up in prison. I think the liaison just buried it in the end.
- potato3732842 1y ago
  You had record of your correspondance with the lawyer. All you had to do was report it to the liaison and keep punching the clock. Unless you were getting paid more because of the overages the enforcers dgaf about you.
  - comrade1234 1y ago
    There were other issues... this was the final straw.
  - krageon 1y ago
    They do care - they care because they have an inflated impression of their own importance and you seem guilty, so you must be.
  - ajross 1y ago
    > the enforcers dgaf about you. This is the attitude that lands otherwise-normal-seeming people in jail. They dgaf about you until they do. Maybe the prosecutor needs an easy win. Maybe they have a wealthy patron you offended. You don't know. And casual cheating becomes criminal very quickly. Charlie Javice, to get back to the core subject, seemed to genuinely think she was on the right side of the line. All she was doing was faking some numbers for investors, right? Nine times out of ten, investors have already bet on the company and want to see it do well, and even if they catch a founder fibbing are likely to see more value in suffering along with it than in blowing it up. Except in this case the investor was JP Morgan, not an incubator, and they had the prosecutor in the rolodex. Startup culture, our culture right here, absolutely encourages cheating. And it doesn't give you a clean instruction manual to figure out how to stay out of jail, because there isn't one. The point above, while technically about government contracting, is absolutely of a piece with the same dysfunction. I think a lot of people in our world need to spend a little more time in introspection.
exasperaited 1y ago
I have promised to resign (and fully would have) when asked to implement something that would put customer security and privacy at risk, when such concerns were in their infancy; more than half a lifetime ago but in the dot com era when I had actual value. Our client, a very large organisation, became aware I had an ethical concern my own bosses didn’t share, listened to me and changed their policies to eliminate my concern. People who work in the Valley for fifty, a hundred times more than the poorest in their own country often do not seem to feel the same way anymore. This is not a question of abstract ethics, but a question of simple professional integrity. If the thing is bad and risks harms, you don’t do it. It’s part of why I work for myself now; it’s not difficult to spot people who do not have a strong sense of ethics and simply not work for them. I work in a couple of fields where there are many non-ethical players, and can do so with a clear conscience.
cess11 1y ago
This is good advice not only for people who encounter fraud, but also those whose employers are profiting from war crimes and the like.
- lemonlearnings 1y ago
  So Google, Amazon, Oracle, Microsoft etc.
  - DonHopkins 1y ago
    Kids these days always forget about IBM. https://en.wikipedia.org/wiki/IBM_and_World_War_II https://en.wikipedia.org/wiki/IBM_and_World_War_II https://en.wikipedia.org/wiki/IBM_and_the_Holocaust https://en.wikipedia.org/wiki/IBM_and_the_Holocaust
    - cess11 1y ago
      They're still at it: 'In June 2025, IBM was named by a UN expert report as one of several companies "central to Israel's surveillance apparatus and the ongoing Gaza destruction."' https://en.wikipedia.org/wiki/List_of_companies_involved_in_the_Gaza_war https://en.wikipedia.org/wiki/List_of_companies_involved_in_...
- henry2023 1y ago
  You were downvoted for saying it's bad to profit from war crimes. I'd like to understand how people could possibly disagree with that.
n4r9 1y ago
Another recent classic case of this is the revelations that Uber were targeting law enforcement based on user behaviour, and refusing to offer them rides in areas where they were breaking regulations. I mentioned this at some point last year, and someone replied saying that they'd enthusiastically volunteer to take part in that project (assuming no personal risk). People's ethics are not always what you'd expect (or hope).
- avidiax 1y ago
  I used to work for Uber, but not on this feature or anything related. Apropos to the article, as a programmer for this feature, what you are actually asked to do is write a greybanning engine. It can take various features (geofence, denylist of phone numbers/emails/device identifiers/payment, etc.) and use it to calculate a score that applies a greybanning policy. The policy may be that the cars in the app are now fake, the ride will never come, your CC is "denied", etc. Nothing illegal or unethical about this feature, as written, but it is a "dual-use" technology. The feature has been used to literally save lives. There were taxi-affiliated people in South America that would call an Uber and then, at best, trash the car and beat the driver. At worst, they'd kill the driver. Those people need to be greybanned, along with scammers, criminals, and abusive people of all sorts. The local market administrators, however, definitely might ban users that the know to be police ticketing the drivers, might ban any account signup from the police station, might ban city credit cards, etc. You, as the programmer on this feature, can't defend against that unethical use of it. If you work at the insurance company and get asked to write a rules engine but not the rules, this same thing applies to you.
  - n4r9 1y ago
    Thanks for the info! I've always wondered about the inside dev perspective on it.
mgilroy 1y ago
I was asked to sign off on an R&D tax claim for my team's work. I reviewed it and said no. Was then sent to a meeting with the accountants who explained the claim was based on what the CEO had told them. We went through the details and the agreed with me on most things. I also discovered that we were entitled to claim for things I wouldn't have known about and the CEO discovered that just because the credits were for R&D the legal definition didn't allow for normal development work. In this instance nothing intentionally illegal was being attempted. However, had the original claim been made it could have been considered fraud. In these sorts of situations I always ensure that the company put me in contact with the professionals that can indemnify both the company and me from any wrong doing. Provided we tell the truth.
- benoau 1y ago
  This happened to me too, the claim was outsourced to a contractor who had never interacted with myself or anyone on my team - the only devs in the company - resulting in a purely fictitious depiction of what we did.
andy99 1y ago
It's easy to armchair quarterback these things, and in retrospect, the actions that innocent people should take are probably obvious. At the time I don't think it would be so easy. There is lots of pressure not to take action, because of the feeling you're overreacting, because you've had things explained to you in a way that minimizes or removes the criminality, and because your job is at stake. And crucially there is never some black and white issue. If your employer told you to murder someone, it would be easy to say no and know you did the right thing. If they tell you to incrementally go along with some grey area thing you're not sure the legal status of, it's way harder to know what to do. People still have to be accountable for their actions of course, ignorance is no excuse. But we all should hope we're never in such a situation to begin with rather than thinking we'll know how and when to act.
- Timshel 1y ago
  > And crucially there is never some black and white issue. The three example given are quite black and white ...
  - pautasso 1y ago
    Here are a few more examples: https://leanpub.com/unethical-software-engineering/ https://leanpub.com/unethical-software-engineering/ Covert Surveillance EMAIL PIXEL INJECTOR STEALTHY INPUT LOGGER Monetization at all costs AGGRESSIVE ADVERTISER AD BLOCKER DETECTOR PAY TO WIN ADDICTION PEDDLER ARTIFICIAL SCARCITY HOARDER DRM RUG PULLER OBSOLESCENCE PLANNER Digital Fraud CYBERSQUATTER SNEAKY TERMS DEGRADER INTEROPERABILITY BREAKER Ranking Manipulation FAKE REVIEW GENERATOR SEARCH RANKING KICKBACKER Unethical Artificial Intelligence Practices TRAINING DATA HARVESTER BOT PRETENDER DECEPTIVE DEEPFAKER
    - DoctorOW 1y ago
      You should probably disclose this is your own book you're advertising.
zero_k 1y ago
I wish I could tell a story. Alas, I can't. It turns out that large corporations are excellent at hiding evidence of wrongdoing, and will do everything to cover the backside of high-level execs, because stock price matters. When it's bad, the exec leaves for a "better opportunity", and none will be wiser. The stress of the honest, serious engineer(s) remain, and the exec gets a free ride to their next big beautiful step up the ladder. In retrospect, don't follow internal reporting guidelines, and don't talk to internal lawyers. They either are incompetent or competent, but paid to swipe stuff under the rug -- you'll never find out either way. Instead, go to the relevant regulatory agency, write a detailed report to them, and let it play out.
- ruszki 1y ago
  It depends on the country. It’s not possible to operate large companies in Hungary without paying to the prime minister’s family. When I lived there, I signed a paper at a large multinational company as a simple developer. The paper’s only purpose was to channel EU funds to the family. I was naive, and I thought that it’s a real project, with real work. It wasn’t. Later I realised why some of my coworkers were against it, but I didn’t believe that that company would go down on that route. I was really naive.
  - anonymousDan 1y ago
    Looks like Trump has taken a leaf out of Orban's notebook. What a depressing situation to be in.
    - deleted 1y ago
      [deleted]
    - gadders 1y ago
      [flagged]
      - ajoberstar 1y ago
        It's not even the same ballpark.
pjc50 1y ago
> Frank was a student loan startup founded by Charlie Javice in 2016. In 2019, Javice was featured on the Forbes “30 under 30” There was a joke going around Twitter about "30 under 30 doing 30 to life", because the startups involved were getting more and more outlandish to the extent that bystanders suspected that fraud was going on. Became a Guardian article: https://www.theguardian.com/business/2023/apr/06/forbes-30-under-30-tech-finance-prison https://www.theguardian.com/business/2023/apr/06/forbes-30-u... Of course, a fraud can stay afloat for a lot longer than you expect. The really tricky case is when you're ordered to do something illegal or unethical for which there is substantial political cover. An executive order, for example. You cannot rely on anyone to back you up simply because of the letter of the law. Also: > The reality was that this was a very deliberate double charge. I could not share this fact at the time – as the company threatened me with libel after I informed them of this detail UK libel law routinely covers up all sorts of things which the public would benefit from having revealed, simply by the threat of an expensive lawsuit. It makes investigative journalism really uneconomic.
- bloak 1y ago
  > UK libel law routinely covers up all sorts of things which the public would benefit from having revealed, simply by the threat of an expensive lawsuit. It makes investigative journalism really uneconomic. But the worst horror stories date from before it was last reformed, in 2013, I think, and I feel the need to patriotically point out that Australian libel law is even worse!
  - noir_lord 1y ago
    Another country having worse legislation doesn't really impact on how bad ours is though. Bad is bad.
- bsenftner 1y ago
  I've been doing this tech nonsense at moderately high levels for over 45 years now, and over the years I've had business dealings with members of these "30 under 30" lists, and every single fucking time it's a conman, a grifter. I don't even bother with heavily marketed individuals nor their flagships anymore. They are nonsense.
bschne 1y ago
I'm quite firmly on the side of "don't do bad stuff", even way before crossing the line to wondering how you'd look in the proverbial orange jumpsuit. But two things about this are often under-discussed IMO. Firstly, personal costs can be high even before full-blown whistleblowing, the struggles of which are well reported. The best case is usually that you're looking for a new job. It is clear to me that that's better than committing a crime or gravely unethical action, but not everyone always has good alternatives, enough financial safety, and no major economic responsibilities to cover at home. This also goes for mental costs: I have previously come close to burnout spending months trying to rectify a clearly very bad and doomed situation. The only reward at the other end was the bitter vindication of seeing a project I deeply cared about crash and burn from afar after cutting my losses. And I personally know people who suffered far greater damage and took longer to recover from it, even in cases where they merely uncovered some big skeleton in the closet that was not even the fault of anyone currently in charge or clearly malicious. In many cases, management will be somewhere between actively complicit and themselves stuck in a bad situation with barely enough (perceived) agency to fix things the right way, which doesn't help. Secondly, short of "going to war" and dedicating your entire life to changing something, saving yourself is usually the best you can hope for. That's obviously better than being complicit and possibly liable. I also like being able to sleep at night knowing I have principles. But if you have the righteousness to refuse to become complicit, it's quite frustrating to come to terms with the fact that you mostly won't be able to set things straight properly unless you are in a very influential position. I know that's often not really my responsibility if I'm not higher up, but it still doesn't sit right with me that I can't do more.
- gampleman 1y ago
  > not everyone always has good alternatives, enough financial safety, and no major economic responsibilities to cover at home. I recommend planning for this (if you can). Set money aside sufficient to cover your costs until you can get another job so that you can quit at any time. Negotiate your deals so that you don't end up with substantial golden handcuffs (i.e. cash > equity, especially with long vesting periods). This helps a lot with maintaining an ethical position, but is also helpful for other negotiations. Effectively you are maintaining a good BATNA[1]. [1]: https://corporatefinanceinstitute.com/resources/valuation/what-is-batna/#:~:text=BATNA%20is%20an%20acronym%20that,is%20if%20negotiations%20are%20unsuccessful. https://corporatefinanceinstitute.com/resources/valuation/wh...
moron4hire 1y ago
Many years ago, I was working for a consulting firm doing work for a, erhm, "large insurance provider headquartered in Illinois". I was building a tool their insurance adjusters could use to use GPS devices to check how far houses were from the coast line and deny flood coverage to anyone within a certain boundary. Note that this was during the time of Selective Availability, so GPS devices were only good to 100m precision. The client saw my first version where I marked an "indeterminate" buffer zone to account for the precision problem. They complained it was "confusing" and insisted I use the raw value without any buffer. Oh, and also, round the numbers in such a way to put all indeterminate points inside the denial zone. This would effectively add hundreds of square miles to the denial zone. A denial zone set by law, i.e. this was the some the government was allowing the insurance company to blanket deny flood coverage. Giving them the benefit of doubt, I explained that the proposed changes didn't make mathematical sense and would over count people near the edge of the denial zone. I had access to some market data at the time and was able to estimate it would be a few thousand extra homes. They did the standard "avoid acknowledging the issue" whenever someone is trying to pressure you into doing something unethical it illegal. I told my boss at the consulting company. He started putting the screws on me. Told me we needed to do this. Told me my job was on the line. Intimated it would be hard to find a new job considering the client was the largest employer in the area. Told me he could get anyone to do it. I had two weeks of PTO planned, during which I was supposed to come back to Pennsylvania and move my stuff out to Illinois. After my PTO, I was supposed to show back up in Illinois. Instead, I went to our HQ in PA (much to the surprise of everyone, "what are you doing here"), told the CEO what happened, and when he doubled down on doing the wrong thing, I quit on the spot, no notice period. I learned later they did not "get anyone to do it". My actions put the contract in a lurch, the client dropped my former employer, and cancelled the project. I feel pretty good about that one. There have been other issues since then, but I've noticed a pattern. They always happen at places I had to talk myself into joining. There were red flags and I rationalized them away, "well, I'm just over reacting. I don't have any evidence anything is wrong here. It's just the way people talk that's bothering me. And I really need this job." Since I've gotten more stable and better about not taking jobs that show red flags, somehow the ethical issues seem to have magically gone away.
- fred_is_fred 1y ago
spicyusername 1y ago
Quitting is usually a good first response.
cakealert 1y ago
If you asked to do something fishy then document it and consult a lawyer. Don't do anything that is above the bare minimum required to cover your ass. You get nothing for doing the "right thing" and are likely to be penalized for it - word will get around and future employers have no interest in figuring out if you were right nor will they care, you will have proven to be disloyal or worse an idealist.
swills 1y ago
I really do not know what to think of someone facing up to 75 years in prison getting 3 years of probation.
- singron 1y ago
  The media is terrible about reporting on "maximum sentences". The federal sentencing guidelines are super complicated and lazy journalists usually just add all the maximum numbers up and write these egregious numbers. In reality, a lot of the charges are deduplicated, can be served concurrently, or are automatically attenuated by factors like being a 1st time offender.
- rossdavidh 1y ago
  I believe it's mostly because of cooperating with the prosecution of the ringleader.
jmward01 1y ago
'You can always say no...' That is like something from a bad movie about spouse abuse. 'Just leave' plays well on TV but the reality is often that a job is someone's life. Just saying no and leaving will have real, and likely massive, harm to the person. Where do they go? What do they do? Do they actually have 6 months of savings to look for a new position and explain why they left their last one? How about the money to spend on hiring lawyers to help them? We need functioning protections for whistleblowers that are well advertised, well funded, -not- subject to the whims of whoever is in office and that actually allow people to 'just say no' and not have their lives shattered.
jcz_nz 1y ago
In 2010 WellPoint was found to be automatically targeting insurance policies of women with breast cancer for cancellation, using any pretext. Angela Braly was the CEO at the time, now at ExxonMobile. WellPoint was the second largest health insurer in the US at the time. This required a lot of business analysis and software development - and people had to realize what this code was doing. I’m guessing bonuses were paid on the back of the “savings” this generated.
- jcz_nz 1y ago
  At the very least, these folks need to have their names permanently attached to this atrocity. These weren’t decisions made by “a corporation” - these people sat across a meeting room table and actually concluded that targeting breast cancer patients was an acceptable means to an end. Lori A. Beer was the CIO at the time. Now at JP Morgan.
  - testing22321 1y ago
    Na, just ban all of them and all their families from ever having health insurance again so they can suffer the same fate they doomed others too intentionally . Make an example and all that.
    - ghssds 1y ago
      It's counter-productive to punish someone for something out of their control. One should not be punished for his parents', siblings' or childs' actions.
      - jliptzin 1y ago
        It’s not even a punishment anyway, they can easily afford to pay for their care out of pocket.
        ashdksnndck 1y ago
        Are you implying random programmers, administrators, and managers at insurance companies have generational wealth? Then why are they spending their time doing those jobs?
rossdavidh 1y ago
Having worked as a programmer for twenty years, most of that as a contractor (hence a different employer about once a year), I have never been asked to do anything illegal. This isn't said to mean no one is, but rather that, if you are asked to do something illegal, it is weird. It isn't the normal, messed up capitalist system, it isn't typical bureaucratic nonsense, it isn't the imperfect state of the world we live in. Most companies don't ask their programmers to do something illegal. Therefore, if you are, you should leave that company, pronto. They're weird and probably desperate, and it is likely to get even worse. It's not normal. Get out, quickly.
- Spivak 1y ago
  Unethical, morally questionable, in poor taste, impolite, unprofessional, or underhanded is pretty normal and you can find it in every job in every industry and you might not even realize without the benefit of hindsight that what you did was any of those things. But illegal feels different when it happens, even if you don't know exactly the law something will be off. You'll be apprehensive in a way you weren't before, people around you will act different, this little pit of anxiety will form in your stomach even if you haven't done it yet.
- heisenbit 1y ago
  Companies usually do not ask but powerful charismatic individuals close to the top do.
stack_framer 1y ago
I worked at NS8 in 2020 for just four months before it collapsed and the CEO was arrested for defrauding investors of $123,000,000. Just a few months ago, I got a modest payout due to a lawsuit over NS8 laying off almost everyone with just three days notice. It was very stressful to be without a job in the middle of Covid!
neilv 1y ago
> The smart thing would have been to do #1. [Talk to a lawyer on how to avoid assisting a crime] [...] Here's what Singh did instead: he asked for a personal meeting with Bankman-Fried and confronted him about the missing funds. If you're not sure something illegal is happening, you could do both. The lawyer might tell you what questions to get answered, to inform what you do next. (But don't do talk to anyone at the company if you think there is any risk that they will try to neutralize you as a weak link. "The coverup is worse than the crime" happens in organizations with shitty people, and you might have just discovered an especially shitty person.) As an engineer, I once told a company that it was about to accidentally do something that I suspected was seriously illegal. They were able to prevent it from happening, in time. Problem solved, no wrongdoing occurred, and no one had to quit, nor go to federal prison. Longer ago, I once told an organization about some bad things, using the appropriate internal channels. And then I had to keep going up the chain of command, when each level would suppress it, and sometimes even retaliate. Which was a rare opportunity to realize that an organization had infected its org chart with a high degree of shittiness. I'm now a big fan of people consulting a lawyer. On another occasion, not necessarily "illegal" was averted, but at least "big liability" was. I had reverse-engineered a customer's security-related protocol, for an integration, and found a grave vulnerability. (Critical info that must be inside the cryptographic signature envelope, was outside of it, meaning that an attacker could replay a captured message later, with changed data.) To interoperate with the customer's system, I'd need to implement the security thing in an unambiguously wrong and insecure way. So I told the appropriate person on my end, and thankfully they handled it well, and figured out how to break the news to the customer. That time, to be sure the appropriate person understood the severity, I mentioned that, in a different engineering field (including one in the application domain), I would "lose my license or go to jail" for implementing that. Occasionally, I briefly muse that our field could use the obligations and authority of Professional Engineers. But moments later, I realize that our field went too long without that, and I can't imagine that being implemented with integrity at this point.
thrown-0825-2 1y ago
Unionize?
- jkaplowitz 1y ago
  Could help for some cases, but at least two of the three examples in the article were engineering directors, who are generally excluded from unionization rights in the US at least. (Other countries vary in how low-level line managers are treated by their employment laws, but the closer a manager gets to the senior executive ranks, the less those employment laws allow them to do anything akin to unionizing.)
gtsop 1y ago
When ordered to do something that is clearly an illegal action, you can just say no. However, in most situations your actions won't be directly illegal, but aid someone else to illegal actions. Simply, deny to carry out the work UNLESS you are directly and clearly instructed to by EMAIL. Oh, and be sure to make this request by email as well, as a record. So send an email saying "hey i was told to do that and i am concerned about the legality, please give me clear instructions over email" This will calm them down.
kotaKat 1y ago
Slow news day? Did this really need a second chance pullback to the front page?
notthatAIguy 1y ago
wow, this was weird
jamesnorden 1y ago
>To be fair, Singh didn’t seen totally clueless, and it seems he decided to profit on the developments. Days after he found about this fraud, he took a $3.7M loan from FTX (!!) to buy a house huh...
sgarland 1y ago
The sub-linked legal document about Frank’s synthetic data generation was quite interesting, specifically how much difficulty their hired consultant (a Data Science Professor) had in creating it. It can indeed be a tricky problem to do in a manner that’s both fast and accurate, but it’s absolutely possible once you have the right datasets, which aren’t even that large. U.S. ZIP codes, telephone area codes (with enough out-of-place ones to mimic people who’ve moved and kept their cell phone number), common names, and a word list will get you rows that look plausible. Matching street addresses requires a much larger dataset, but again, it’s not impossible.
jeffrallen 1y ago
Here's another thing to think about: if you are in IT ops, you might have access to private data that could be requested, without proper judicial review, by a three letter agency. When you receive a National Security Letter with a gag rule attached, how will you react? What action can you take that is both legal and also ethical? Because it is not just bosses that might try to pressure you into taking unethical actions, it is also the state itself. For my part, I have a plan, and I've told my boss enough to trust him to read between the lines and revoke my access to make it impossible for me to turn over customer data without a warrant.
- noir_lord 1y ago
  Warrant Canary-like system? Like "I hate the color purple, so if you ever see me in a purple baseball cap..." or something similar?
  - jeffrallen 1y ago
    The problem with a NSL is that the gag rule is pretty watertight. For example, "oops, I accidentally wrote my password on a bathroom wall" is gonna land you in a world of hurt. You need to find a way to bring some of your other rights into balance (and conflict with) those of the state, to bring professionals who have a duty to protect your confidence to your defense. The power of the state is asymmetric warfare against an individual, which is what they count on. You need leverage from other competing lawful protections working on your side.
    - noir_lord 1y ago
      We have pretty much identical laws here (where here is UK) - you can be forced to backdoor things, you can't tell the customer and you can't tell anyone else in the company (not sure if you are allowed to tell your manager). There was a whole thing about it a while ago, gov said "we are listening to your feedback" and then did it anyway. Of course our system is actually worse in some ways - forgotten a password, they don't believe you (parks and rec style) "Believe it or not, straight to jail" (iirc it's a max of two years).
dwedge 1y ago
I honestly can't tell if the pragmatic engineer is a well regarded site or they are just very good at promotion on LinkedIn and hacker news. I suspect the latter but I'm getting more curious
ngriffiths 1y ago
It's funny how people's mindset shifts when they work for a company versus independent contracting, but this is another case (like salary negotiation) where it should be the same. If your client asked you to do something illegal you'd be thinking about liability and drop the client. If your employer does, you should realize not only do they not have to protect you, it's probably in their interest to turn around and blame it all on you!
bitbasher 1y ago
Thousands of engineers aid companies in user surveillance and tracking every day. Cyberstalking at scale.
monster_truck 1y ago
While not explicitly illegal, I was building out part of a product for an international company with a massive userbase (hundreds of millions) and discovered a slight issue: their api required no authentication, had no rate limiting, and an easily discoverable request format. Anyone could make a simple request with a handful of digits and get a complete history of that product, revealing very intimate details about the users in every aspect of their lives. I don't get nervous easily but it made my stomach turn, my palms started sweating. I told my boss, we told our boss, who went and pulled the CEO out of a meeting. I was given signed documentation on company letterhead that stated I raised the issue and also detailed how our company had informed the customer, along with a modest cash bonus and they bought me most of the furniture in my house (no taxes!) The company came back to us and said "we know, we built it like that on purpose". Incredulous but reassured that both myself and my employer were not facing any liability, I finished the product and it shipped. Predictably this was exploited within a few years and made national news when it was used against prominent political figures. There are still no legal mechanisms in place to enforce any kind of security for this class of product.
- aorloff 1y ago
  Sounds like from a legal perspective, everyone covered their bases. I take it you are an Oak man, then ? [Harvey Keitel voice]
deleted 1y ago
[deleted]
estimator7292 1y ago
HN should outright ban all headlines in the format "<question?> here's what <subject> did!" It could only be worse if it included "click here NOW!"

548 points by bschne 1y ago

> If you take one lesson from this, it’s that you can always say no. I fully understand why this is true, but it seems to ignore any retaliative measures that the management could take against the person who says no. With the benefit of hindsight, any such retaliation would be weaker than ending up in an orange suit. But the person has to find the guts to say "no" without that hindsight.

OskarS 1y ago
I would argue that you have a moral and ethical responsibility to say no when your manager asks you to do something illegal, even if it does cost you your job. The law is the law, and there is no excuse for breaking it. Your manager is certainly culpable, but if you act against the law, you are culpable as well. The exception is if you fear literal physical violence against you or others, or are being blackmailed or something, then of course you are being coerced and have no choice. But "losing your job" does not rise to that kind of coercion, in my opinion. Not saying it's easy, it's a horrible situation to be put in and I have huge amounts of sympathy for a person who has to experience this. No one is perfect and act with faultless ethics at all times. But hard or not, it is your duty as a citizen not to violate the law.
- overscore 1y ago
  > I would argue that you have a moral and ethical responsibility to say no when your manager asks you to do something illegal, even if it does cost you your job. When your access to food, housing, heating and healthcare for your family are dependent on your income, you may find yourself facing very difficult decisions. Most parents will risk whatever legal ramifications to care for their kids and that's inherent moral and ethical, even if the downstream outcome is not. That is because it is the socioeconomic system rather than the individual who is acting immorally. > The law is the law, and there is no excuse for breaking it. This is an infantile view. The law is a framework and there are lots of circumstances where breaking it is not only excusable, it's the only moral action.
  - deleted 1y ago
    [deleted]
  - deleted 1y ago
    [deleted]
  - philipallstar 1y ago
    > When your access to food, housing, heating and healthcare for your family are dependent on your income, you may find yourself facing very difficult decisions This is the time when your ethics are tested. Anyone can do the right thing when they're getting paid for it.
    - tpoacher 1y ago
      There's a nice Jordan Peterson quote: > There was a lesson to learn from the holocaust. We're always reminded that: "Never forget, we've learned our lesson." "What was the lesson?" That's the question. The lesson is, "You're the Nazi". No-one wants to learn that; If you were there, that would have been you. You might think "Well, I'd be Oskar Schindler and I'd be rescuing the Jews." It's like, no, afraid not. You'd at least not be saying anything. And you might also be actively participating. You might also enjoy it. Hindsight theoretical morality is very different from experience on the ground, where peer pressure, stress, uncertainty, exploding situations and fog of war come into the mix.
      - GuinansEyebrows 1y ago
        [flagged]
      - DennisP 1y ago
        Seems like a better lesson would be "don't be the Nazi." It's not like it's impossible. The Nazis arrested 800,000 Germans for active resistance activities, and several hundred thousand Germans deserted the military, many of those defecting to the Allies. https://en.wikipedia.org/wiki/German_resistance_to_Nazism https://en.wikipedia.org/wiki/German_resistance_to_Nazism It wasn't a huge percentage, but we don't know how many actively resisted without getting caught, or resisted in more passive ways. And that was resistance against the Nazis, who had no qualms about killing resistors. Risking or quitting your job to not only do what's right, but avoid getting in trouble with your government, isn't in the same ballpark.
- surgical_fire 1y ago
  "losing your job", for a lot of people, is extremely effective coercion. We are not talking about luxury here. A lot of people depend on their salary to pay rent and put food on the table. This is even more pressing if you have a family that depends on you, if you are in need of healthcare, etc. What your post fails to recognize is that in the current system, labor is already a form of coercion. You need to work because the option is homelessness and starvation. If you can avoid those even when unemployed, you are extremely privileged.
  - em-bee 1y ago
    If you can avoid those even when unemployed that would be all developed countries except the united states
    - rfrey 1y ago
      So yes, the extremely privileged
      - em-bee 1y ago
        privileged? sure, but extremely? nowadays even in china everyone gets healthcare, working or not, so we are talking about almost a quarter of the worlds population.
    - snypher 1y ago
      380k homeless in UK. 262k in Germany. 122k Australia. 650k in USA. The per capita math is left for the reader but I don't believe there is much distinction here .
      - throwaway-0001 1y ago
        You're right, the numbers are very close to recent official figures. I looked them up to calculate the per capita rates. So USA is actually better than other countries? Kind of defeats these arguments here - interesting. (By the way I’m not from us) Based on the latest available data (mostly 2023) and current population estimates: * *UK:* ~56.0 per 10,000 people (1 in 178) * *Australia:* ~45.4 per 10,000 people (1 in 220) [using 2021 census data] * *Germany:* ~31.0 per 10,000 people (1 in 323) * *USA:* ~19.4 per 10,000 people (1 in 515) The per capita distinction is more significant than the raw numbers suggest. (Note: Methodologies for counting vary by country, which can affect direct comparisons.)
- array_key_first 1y ago
  I think, for most people, getting the shit beaten out of them is a preferable outcome to losing their job. For most people, their job is the only thing standing between them and being homeless, losing their car, losing their kids, their partner, etc. This is why having a culture that treats firing people as no big deal leads to wack ass incentives. You can make people do almost anything if you threaten their job enough.
  - deleted 1y ago
    [deleted]
  - DennisP 1y ago
    The cases in the article were software engineers in the US, and at FTX. Two were engineering directors and the third was a senior engineer. If any of them didn't have plenty of emergency funds set aside, they should have seriously rethought their spending.
    - tverbeure 1y ago
      I know plenty of people who saved for years to get a downpayment for a house and then used all of that for just that. After that, it will take a while to replenish their emergency fund with very little margin of error. A job loss would be devastating.
      - DennisP 1y ago
        My claim is that that's a bad decision, for exactly that reason. Job loss can happen for any number of reasons, often without warning. Getting a mortgage without any cushion for job loss is a huge risk. Note also that I'm talking about highly-paid software engineers, not about people in general. Lots of people in the US make way less money than senior software engineers, and they manage to get by. Live at that level and secure your emergency funds first, and you'll be a lot more comfortable dealing with any ethical quandaries at work.
        tverbeure 1y ago
- exe34 1y ago
  > But "losing your job" does not rise to that kind of coercion, in my opinion. it depends how many friends and family you have in the area that can host your whole family that is now homeless. it depends how much disruption you are willing to inflict on your kids definitely right now as opposed to maybe in the future.
- swiftcoder 1y ago
  I think the risk is somewhat higher than just losing your job - you are potentially burning your whole referral network in the process (especially if you end up with your name in the press during any resulting prosecution). For a junior engineer it may not be that hard to fly under the radar, but senior/staff level folks tend to be well known by the execs. And execs talk, they call their friends to vet future hires... burn your execs, and maybe you don't work in that town again
  - scaramanga 1y ago
    Probably for the best... Like, anyone who would work with some of my previous employers, are places I wouldn't want to work anyway. It's a big wide world out there.
    - phatskat 1y ago
      > Probably for the best... Quite. One of my first gigs was at a large real-estate aggregator. The people were great but the highest levels of the company did - A pet “adoption” site, in quotes because to my knowledge the pets weren’t real and it was a subscription service with no means of cancellation outside of a voicemail box - A kind of Craigslist-esque site for selling home improvement services that was wildly vulnerable to XSS - I discovered that during an unannounced client demo when my own manager had said “you guys try to break it” - We were a PHP shop from the beginning. One day, engineering gets pulled into a meeting room and told that they’ve been developing 2.0 in an office downtown, with a separate team, in ColdFusion. They fired the lead engineer on the spot and most of us left or got fired shortly thereafter. They did offer to train us in CF, but the bad blood was too thick for my taste. All that is to say, if I ever get wind of the owner or CEO being involved anywhere that I’m working, I’ll probably be walking.
pydry 1y ago
This is why whistleblower laws need to be stronger (e.g. retaliation means automatic jailtime even if the whistle was wrongly blown) and rewards need to be larger.
creer 1y ago
The threat of retaliation - in the form of being fired, harassed or moved to a dead end position - is very scary to a younger engineer. But from a rational point of view it's not very strong (HOWEVER many managers or CEOs are far from rational.) - Firing someone has large costs to the employer. You have the job because you are needed. Same for side-lining someone or not promoting them. - Firing someone removes the final incentives against that person reporting the deed to the govt. It pushes that person toward reporting instead of softer "negotiated" steps such as continuing to argue for legal alternatives or discussing it with an intermediate rather than outright reporting. And many corporate legal or accounting people are amazing at finding alternative ways to achieve the same result in a not-illegal manner. - A lawyer can help you much more once there is retaliation. The company might end up fighting both the fraud reporting AND the retaliation. Just firing someone is not a great "solution" for the company. Letting you believe that they will ... that's very powerful. (and probably all this is caveat: in countries where retaliation is illegal enough and commonly taken to court or settled. which is not worldwide.)
themafia 1y ago
That retaliation is in and of itself a new illegal act.
eur0pa 1y ago
You can absolutely, most definitely always say "no". Their carrot (money) comes and goes, and their stick (also money) is not enough to be concerning.
pavel_lishin 1y ago
> But the person has to find the guts to say "no" without that hindsight. Not that I would recommend a night's stay at a local lockup (2/5 stars, the beds are awful, the toilet facilities are worse, and the roommates leave much to be desired), but doing so certainly puts things in perspective going forward.

sltr 1y ago

Software developers should sign a code of ethics, like other professions do and then cite it when asked to do unscrupulous things. This would work for activities that aren't illegal but still unethical, like defaulting user privacy choices to open/public. Citing professional organizations like ACM or IEEE would deter retaliation.

pcthrowaway 1y ago
The code of ethics would need to be absolute, enforceable, unambiguous (without lawyers to interpret), and universal to really eliminate these activities.
- baobun 1y ago
  If you are to be found in violation by DAO jury vote, you will be blocked from all private torrent trackers and usenet groups (we just have to make sure all of them mods are onboard mkay), with threat of ban for repeat offenders. You may also find your support tickets everywhere languishing and x months of CAPTCHA-hell on every website.
- pjc50 1y ago
  You can never make these kinds of things unambiguous. People are really creative about inventing interpretations to make things ambiguous in their favor, and rule systems are really complex. More to the point is trying to be an ethical island in an unethical society, You'd have to deal with constant attacks from the "anti-woke" crowd.
- criddell 1y ago
  Software engineering could become a real profession with licensing like mechanical, electrical, chemical, civil, and other engineering professions. If you do something unethical, you could be sued for malpractice and lose your license to practice. The code of ethics for Professional Engineers works even though it isn’t any of the things you say are necessary.
  - thyristan 1y ago

comrade1234 1y ago

I was working with someone on a large government project. At the beginning I told him that we cannot pad our hours at the end of the year to run the contract out and then make up for it with extra hours in the next year like we do with business clients because it is illegal and further because it's a $1M+ contract could lead to prison. Of course I found out that he was going into our billing software and adding hours to me. I had to talk to a lawyer and he recommended I report it to the gao. I compromised by quitting and reporting it to the liaison on the project (a professor). It was very stressful because if I hadn't reported it he could say that I reported those hours, not him, and I could have ended up in prison. I think the liaison just buried it in the end.

potato3732842 1y ago
You had record of your correspondance with the lawyer. All you had to do was report it to the liaison and keep punching the clock. Unless you were getting paid more because of the overages the enforcers dgaf about you.
- comrade1234 1y ago
  There were other issues... this was the final straw.
- krageon 1y ago
  They do care - they care because they have an inflated impression of their own importance and you seem guilty, so you must be.
- ajross 1y ago
  > the enforcers dgaf about you. This is the attitude that lands otherwise-normal-seeming people in jail. They dgaf about you until they do. Maybe the prosecutor needs an easy win. Maybe they have a wealthy patron you offended. You don't know. And casual cheating becomes criminal very quickly. Charlie Javice, to get back to the core subject, seemed to genuinely think she was on the right side of the line. All she was doing was faking some numbers for investors, right? Nine times out of ten, investors have already bet on the company and want to see it do well, and even if they catch a founder fibbing are likely to see more value in suffering along with it than in blowing it up. Except in this case the investor was JP Morgan, not an incubator, and they had the prosecutor in the rolodex. Startup culture, our culture right here, absolutely encourages cheating. And it doesn't give you a clean instruction manual to figure out how to stay out of jail, because there isn't one. The point above, while technically about government contracting, is absolutely of a piece with the same dysfunction. I think a lot of people in our world need to spend a little more time in introspection.

exasperaited 1y ago

I have promised to resign (and fully would have) when asked to implement something that would put customer security and privacy at risk, when such concerns were in their infancy; more than half a lifetime ago but in the dot com era when I had actual value. Our client, a very large organisation, became aware I had an ethical concern my own bosses didn’t share, listened to me and changed their policies to eliminate my concern. People who work in the Valley for fifty, a hundred times more than the poorest in their own country often do not seem to feel the same way anymore. This is not a question of abstract ethics, but a question of simple professional integrity. If the thing is bad and risks harms, you don’t do it. It’s part of why I work for myself now; it’s not difficult to spot people who do not have a strong sense of ethics and simply not work for them. I work in a couple of fields where there are many non-ethical players, and can do so with a clear conscience.

cess11 1y ago

This is good advice not only for people who encounter fraud, but also those whose employers are profiting from war crimes and the like.

lemonlearnings 1y ago
So Google, Amazon, Oracle, Microsoft etc.
- DonHopkins 1y ago
  Kids these days always forget about IBM. https://en.wikipedia.org/wiki/IBM_and_World_War_II https://en.wikipedia.org/wiki/IBM_and_World_War_II https://en.wikipedia.org/wiki/IBM_and_the_Holocaust https://en.wikipedia.org/wiki/IBM_and_the_Holocaust
  - cess11 1y ago
    They're still at it: 'In June 2025, IBM was named by a UN expert report as one of several companies "central to Israel's surveillance apparatus and the ongoing Gaza destruction."' https://en.wikipedia.org/wiki/List_of_companies_involved_in_the_Gaza_war https://en.wikipedia.org/wiki/List_of_companies_involved_in_...
henry2023 1y ago
You were downvoted for saying it's bad to profit from war crimes. I'd like to understand how people could possibly disagree with that.

n4r9 1y ago

Another recent classic case of this is the revelations that Uber were targeting law enforcement based on user behaviour, and refusing to offer them rides in areas where they were breaking regulations. I mentioned this at some point last year, and someone replied saying that they'd enthusiastically volunteer to take part in that project (assuming no personal risk). People's ethics are not always what you'd expect (or hope).

avidiax 1y ago
I used to work for Uber, but not on this feature or anything related. Apropos to the article, as a programmer for this feature, what you are actually asked to do is write a greybanning engine. It can take various features (geofence, denylist of phone numbers/emails/device identifiers/payment, etc.) and use it to calculate a score that applies a greybanning policy. The policy may be that the cars in the app are now fake, the ride will never come, your CC is "denied", etc. Nothing illegal or unethical about this feature, as written, but it is a "dual-use" technology. The feature has been used to literally save lives. There were taxi-affiliated people in South America that would call an Uber and then, at best, trash the car and beat the driver. At worst, they'd kill the driver. Those people need to be greybanned, along with scammers, criminals, and abusive people of all sorts. The local market administrators, however, definitely might ban users that the know to be police ticketing the drivers, might ban any account signup from the police station, might ban city credit cards, etc. You, as the programmer on this feature, can't defend against that unethical use of it. If you work at the insurance company and get asked to write a rules engine but not the rules, this same thing applies to you.
- n4r9 1y ago
  Thanks for the info! I've always wondered about the inside dev perspective on it.

mgilroy 1y ago

I was asked to sign off on an R&D tax claim for my team's work. I reviewed it and said no. Was then sent to a meeting with the accountants who explained the claim was based on what the CEO had told them. We went through the details and the agreed with me on most things. I also discovered that we were entitled to claim for things I wouldn't have known about and the CEO discovered that just because the credits were for R&D the legal definition didn't allow for normal development work. In this instance nothing intentionally illegal was being attempted. However, had the original claim been made it could have been considered fraud. In these sorts of situations I always ensure that the company put me in contact with the professionals that can indemnify both the company and me from any wrong doing. Provided we tell the truth.

benoau 1y ago
This happened to me too, the claim was outsourced to a contractor who had never interacted with myself or anyone on my team - the only devs in the company - resulting in a purely fictitious depiction of what we did.

andy99 1y ago

It's easy to armchair quarterback these things, and in retrospect, the actions that innocent people should take are probably obvious. At the time I don't think it would be so easy. There is lots of pressure not to take action, because of the feeling you're overreacting, because you've had things explained to you in a way that minimizes or removes the criminality, and because your job is at stake. And crucially there is never some black and white issue. If your employer told you to murder someone, it would be easy to say no and know you did the right thing. If they tell you to incrementally go along with some grey area thing you're not sure the legal status of, it's way harder to know what to do. People still have to be accountable for their actions of course, ignorance is no excuse. But we all should hope we're never in such a situation to begin with rather than thinking we'll know how and when to act.

Timshel 1y ago
> And crucially there is never some black and white issue. The three example given are quite black and white ...
- pautasso 1y ago
  Here are a few more examples: https://leanpub.com/unethical-software-engineering/ https://leanpub.com/unethical-software-engineering/ Covert Surveillance EMAIL PIXEL INJECTOR STEALTHY INPUT LOGGER Monetization at all costs AGGRESSIVE ADVERTISER AD BLOCKER DETECTOR PAY TO WIN ADDICTION PEDDLER ARTIFICIAL SCARCITY HOARDER DRM RUG PULLER OBSOLESCENCE PLANNER Digital Fraud CYBERSQUATTER SNEAKY TERMS DEGRADER INTEROPERABILITY BREAKER Ranking Manipulation FAKE REVIEW GENERATOR SEARCH RANKING KICKBACKER Unethical Artificial Intelligence Practices TRAINING DATA HARVESTER BOT PRETENDER DECEPTIVE DEEPFAKER
  - DoctorOW 1y ago
    You should probably disclose this is your own book you're advertising.

zero_k 1y ago

I wish I could tell a story. Alas, I can't. It turns out that large corporations are excellent at hiding evidence of wrongdoing, and will do everything to cover the backside of high-level execs, because stock price matters. When it's bad, the exec leaves for a "better opportunity", and none will be wiser. The stress of the honest, serious engineer(s) remain, and the exec gets a free ride to their next big beautiful step up the ladder. In retrospect, don't follow internal reporting guidelines, and don't talk to internal lawyers. They either are incompetent or competent, but paid to swipe stuff under the rug -- you'll never find out either way. Instead, go to the relevant regulatory agency, write a detailed report to them, and let it play out.

ruszki 1y ago
It depends on the country. It’s not possible to operate large companies in Hungary without paying to the prime minister’s family. When I lived there, I signed a paper at a large multinational company as a simple developer. The paper’s only purpose was to channel EU funds to the family. I was naive, and I thought that it’s a real project, with real work. It wasn’t. Later I realised why some of my coworkers were against it, but I didn’t believe that that company would go down on that route. I was really naive.
- anonymousDan 1y ago
  Looks like Trump has taken a leaf out of Orban's notebook. What a depressing situation to be in.
  - deleted 1y ago
    [deleted]
  - gadders 1y ago
    [flagged]
    - ajoberstar 1y ago
      It's not even the same ballpark.

pjc50 1y ago

> Frank was a student loan startup founded by Charlie Javice in 2016. In 2019, Javice was featured on the Forbes “30 under 30” There was a joke going around Twitter about "30 under 30 doing 30 to life", because the startups involved were getting more and more outlandish to the extent that bystanders suspected that fraud was going on. Became a Guardian article: https://www.theguardian.com/business/2023/apr/06/forbes-30-under-30-tech-finance-prison https://www.theguardian.com/business/2023/apr/06/forbes-30-u... Of course, a fraud can stay afloat for a lot longer than you expect. The really tricky case is when you're ordered to do something illegal or unethical for which there is substantial political cover. An executive order, for example. You cannot rely on anyone to back you up simply because of the letter of the law. Also: > The reality was that this was a very deliberate double charge. I could not share this fact at the time – as the company threatened me with libel after I informed them of this detail UK libel law routinely covers up all sorts of things which the public would benefit from having revealed, simply by the threat of an expensive lawsuit. It makes investigative journalism really uneconomic.

bloak 1y ago
> UK libel law routinely covers up all sorts of things which the public would benefit from having revealed, simply by the threat of an expensive lawsuit. It makes investigative journalism really uneconomic. But the worst horror stories date from before it was last reformed, in 2013, I think, and I feel the need to patriotically point out that Australian libel law is even worse!
- noir_lord 1y ago
  Another country having worse legislation doesn't really impact on how bad ours is though. Bad is bad.
bsenftner 1y ago
I've been doing this tech nonsense at moderately high levels for over 45 years now, and over the years I've had business dealings with members of these "30 under 30" lists, and every single fucking time it's a conman, a grifter. I don't even bother with heavily marketed individuals nor their flagships anymore. They are nonsense.

bschne 1y ago

I'm quite firmly on the side of "don't do bad stuff", even way before crossing the line to wondering how you'd look in the proverbial orange jumpsuit. But two things about this are often under-discussed IMO. Firstly, personal costs can be high even before full-blown whistleblowing, the struggles of which are well reported. The best case is usually that you're looking for a new job. It is clear to me that that's better than committing a crime or gravely unethical action, but not everyone always has good alternatives, enough financial safety, and no major economic responsibilities to cover at home. This also goes for mental costs: I have previously come close to burnout spending months trying to rectify a clearly very bad and doomed situation. The only reward at the other end was the bitter vindication of seeing a project I deeply cared about crash and burn from afar after cutting my losses. And I personally know people who suffered far greater damage and took longer to recover from it, even in cases where they merely uncovered some big skeleton in the closet that was not even the fault of anyone currently in charge or clearly malicious. In many cases, management will be somewhere between actively complicit and themselves stuck in a bad situation with barely enough (perceived) agency to fix things the right way, which doesn't help. Secondly, short of "going to war" and dedicating your entire life to changing something, saving yourself is usually the best you can hope for. That's obviously better than being complicit and possibly liable. I also like being able to sleep at night knowing I have principles. But if you have the righteousness to refuse to become complicit, it's quite frustrating to come to terms with the fact that you mostly won't be able to set things straight properly unless you are in a very influential position. I know that's often not really my responsibility if I'm not higher up, but it still doesn't sit right with me that I can't do more.

gampleman 1y ago
> not everyone always has good alternatives, enough financial safety, and no major economic responsibilities to cover at home. I recommend planning for this (if you can). Set money aside sufficient to cover your costs until you can get another job so that you can quit at any time. Negotiate your deals so that you don't end up with substantial golden handcuffs (i.e. cash > equity, especially with long vesting periods). This helps a lot with maintaining an ethical position, but is also helpful for other negotiations. Effectively you are maintaining a good BATNA[1]. [1]: https://corporatefinanceinstitute.com/resources/valuation/what-is-batna/#:~:text=BATNA%20is%20an%20acronym%20that,is%20if%20negotiations%20are%20unsuccessful. https://corporatefinanceinstitute.com/resources/valuation/wh...

moron4hire 1y ago

Many years ago, I was working for a consulting firm doing work for a, erhm, "large insurance provider headquartered in Illinois". I was building a tool their insurance adjusters could use to use GPS devices to check how far houses were from the coast line and deny flood coverage to anyone within a certain boundary. Note that this was during the time of Selective Availability, so GPS devices were only good to 100m precision. The client saw my first version where I marked an "indeterminate" buffer zone to account for the precision problem. They complained it was "confusing" and insisted I use the raw value without any buffer. Oh, and also, round the numbers in such a way to put all indeterminate points inside the denial zone. This would effectively add hundreds of square miles to the denial zone. A denial zone set by law, i.e. this was the some the government was allowing the insurance company to blanket deny flood coverage. Giving them the benefit of doubt, I explained that the proposed changes didn't make mathematical sense and would over count people near the edge of the denial zone. I had access to some market data at the time and was able to estimate it would be a few thousand extra homes. They did the standard "avoid acknowledging the issue" whenever someone is trying to pressure you into doing something unethical it illegal. I told my boss at the consulting company. He started putting the screws on me. Told me we needed to do this. Told me my job was on the line. Intimated it would be hard to find a new job considering the client was the largest employer in the area. Told me he could get anyone to do it. I had two weeks of PTO planned, during which I was supposed to come back to Pennsylvania and move my stuff out to Illinois. After my PTO, I was supposed to show back up in Illinois. Instead, I went to our HQ in PA (much to the surprise of everyone, "what are you doing here"), told the CEO what happened, and when he doubled down on doing the wrong thing, I quit on the spot, no notice period. I learned later they did not "get anyone to do it". My actions put the contract in a lurch, the client dropped my former employer, and cancelled the project. I feel pretty good about that one. There have been other issues since then, but I've noticed a pattern. They always happen at places I had to talk myself into joining. There were red flags and I rationalized them away, "well, I'm just over reacting. I don't have any evidence anything is wrong here. It's just the way people talk that's bothering me. And I really need this job." Since I've gotten more stable and better about not taking jobs that show red flags, somehow the ethical issues seem to have magically gone away.

fred_is_fred 1y ago

spicyusername 1y ago

Quitting is usually a good first response.

cakealert 1y ago

If you asked to do something fishy then document it and consult a lawyer. Don't do anything that is above the bare minimum required to cover your ass. You get nothing for doing the "right thing" and are likely to be penalized for it - word will get around and future employers have no interest in figuring out if you were right nor will they care, you will have proven to be disloyal or worse an idealist.

swills 1y ago

I really do not know what to think of someone facing up to 75 years in prison getting 3 years of probation.

singron 1y ago
The media is terrible about reporting on "maximum sentences". The federal sentencing guidelines are super complicated and lazy journalists usually just add all the maximum numbers up and write these egregious numbers. In reality, a lot of the charges are deduplicated, can be served concurrently, or are automatically attenuated by factors like being a 1st time offender.
rossdavidh 1y ago
I believe it's mostly because of cooperating with the prosecution of the ringleader.

jmward01 1y ago

'You can always say no...' That is like something from a bad movie about spouse abuse. 'Just leave' plays well on TV but the reality is often that a job is someone's life. Just saying no and leaving will have real, and likely massive, harm to the person. Where do they go? What do they do? Do they actually have 6 months of savings to look for a new position and explain why they left their last one? How about the money to spend on hiring lawyers to help them? We need functioning protections for whistleblowers that are well advertised, well funded, -not- subject to the whims of whoever is in office and that actually allow people to 'just say no' and not have their lives shattered.

jcz_nz 1y ago

In 2010 WellPoint was found to be automatically targeting insurance policies of women with breast cancer for cancellation, using any pretext. Angela Braly was the CEO at the time, now at ExxonMobile. WellPoint was the second largest health insurer in the US at the time. This required a lot of business analysis and software development - and people had to realize what this code was doing. I’m guessing bonuses were paid on the back of the “savings” this generated.

jcz_nz 1y ago
At the very least, these folks need to have their names permanently attached to this atrocity. These weren’t decisions made by “a corporation” - these people sat across a meeting room table and actually concluded that targeting breast cancer patients was an acceptable means to an end. Lori A. Beer was the CIO at the time. Now at JP Morgan.
- testing22321 1y ago
  Na, just ban all of them and all their families from ever having health insurance again so they can suffer the same fate they doomed others too intentionally . Make an example and all that.
  - ghssds 1y ago
    It's counter-productive to punish someone for something out of their control. One should not be punished for his parents', siblings' or childs' actions.
    - jliptzin 1y ago
      It’s not even a punishment anyway, they can easily afford to pay for their care out of pocket.
      - ashdksnndck 1y ago
        Are you implying random programmers, administrators, and managers at insurance companies have generational wealth? Then why are they spending their time doing those jobs?

rossdavidh 1y ago

Having worked as a programmer for twenty years, most of that as a contractor (hence a different employer about once a year), I have never been asked to do anything illegal. This isn't said to mean no one is, but rather that, if you are asked to do something illegal, it is weird. It isn't the normal, messed up capitalist system, it isn't typical bureaucratic nonsense, it isn't the imperfect state of the world we live in. Most companies don't ask their programmers to do something illegal. Therefore, if you are, you should leave that company, pronto. They're weird and probably desperate, and it is likely to get even worse. It's not normal. Get out, quickly.

Spivak 1y ago
Unethical, morally questionable, in poor taste, impolite, unprofessional, or underhanded is pretty normal and you can find it in every job in every industry and you might not even realize without the benefit of hindsight that what you did was any of those things. But illegal feels different when it happens, even if you don't know exactly the law something will be off. You'll be apprehensive in a way you weren't before, people around you will act different, this little pit of anxiety will form in your stomach even if you haven't done it yet.
heisenbit 1y ago
Companies usually do not ask but powerful charismatic individuals close to the top do.

stack_framer 1y ago

I worked at NS8 in 2020 for just four months before it collapsed and the CEO was arrested for defrauding investors of $123,000,000. Just a few months ago, I got a modest payout due to a lawsuit over NS8 laying off almost everyone with just three days notice. It was very stressful to be without a job in the middle of Covid!

neilv 1y ago

> The smart thing would have been to do #1. [Talk to a lawyer on how to avoid assisting a crime] [...] Here's what Singh did instead: he asked for a personal meeting with Bankman-Fried and confronted him about the missing funds. If you're not sure something illegal is happening, you could do both. The lawyer might tell you what questions to get answered, to inform what you do next. (But don't do talk to anyone at the company if you think there is any risk that they will try to neutralize you as a weak link. "The coverup is worse than the crime" happens in organizations with shitty people, and you might have just discovered an especially shitty person.) As an engineer, I once told a company that it was about to accidentally do something that I suspected was seriously illegal. They were able to prevent it from happening, in time. Problem solved, no wrongdoing occurred, and no one had to quit, nor go to federal prison. Longer ago, I once told an organization about some bad things, using the appropriate internal channels. And then I had to keep going up the chain of command, when each level would suppress it, and sometimes even retaliate. Which was a rare opportunity to realize that an organization had infected its org chart with a high degree of shittiness. I'm now a big fan of people consulting a lawyer. On another occasion, not necessarily "illegal" was averted, but at least "big liability" was. I had reverse-engineered a customer's security-related protocol, for an integration, and found a grave vulnerability. (Critical info that must be inside the cryptographic signature envelope, was outside of it, meaning that an attacker could replay a captured message later, with changed data.) To interoperate with the customer's system, I'd need to implement the security thing in an unambiguously wrong and insecure way. So I told the appropriate person on my end, and thankfully they handled it well, and figured out how to break the news to the customer. That time, to be sure the appropriate person understood the severity, I mentioned that, in a different engineering field (including one in the application domain), I would "lose my license or go to jail" for implementing that. Occasionally, I briefly muse that our field could use the obligations and authority of Professional Engineers. But moments later, I realize that our field went too long without that, and I can't imagine that being implemented with integrity at this point.

thrown-0825-2 1y ago

Unionize?

jkaplowitz 1y ago
Could help for some cases, but at least two of the three examples in the article were engineering directors, who are generally excluded from unionization rights in the US at least. (Other countries vary in how low-level line managers are treated by their employment laws, but the closer a manager gets to the senior executive ranks, the less those employment laws allow them to do anything akin to unionizing.)

gtsop 1y ago

When ordered to do something that is clearly an illegal action, you can just say no. However, in most situations your actions won't be directly illegal, but aid someone else to illegal actions. Simply, deny to carry out the work UNLESS you are directly and clearly instructed to by EMAIL. Oh, and be sure to make this request by email as well, as a record. So send an email saying "hey i was told to do that and i am concerned about the legality, please give me clear instructions over email" This will calm them down.

kotaKat 1y ago

Slow news day? Did this really need a second chance pullback to the front page?

notthatAIguy 1y ago

wow, this was weird

jamesnorden 1y ago

>To be fair, Singh didn’t seen totally clueless, and it seems he decided to profit on the developments. Days after he found about this fraud, he took a $3.7M loan from FTX (!!) to buy a house huh...

sgarland 1y ago

The sub-linked legal document about Frank’s synthetic data generation was quite interesting, specifically how much difficulty their hired consultant (a Data Science Professor) had in creating it. It can indeed be a tricky problem to do in a manner that’s both fast and accurate, but it’s absolutely possible once you have the right datasets, which aren’t even that large. U.S. ZIP codes, telephone area codes (with enough out-of-place ones to mimic people who’ve moved and kept their cell phone number), common names, and a word list will get you rows that look plausible. Matching street addresses requires a much larger dataset, but again, it’s not impossible.

jeffrallen 1y ago

Here's another thing to think about: if you are in IT ops, you might have access to private data that could be requested, without proper judicial review, by a three letter agency. When you receive a National Security Letter with a gag rule attached, how will you react? What action can you take that is both legal and also ethical? Because it is not just bosses that might try to pressure you into taking unethical actions, it is also the state itself. For my part, I have a plan, and I've told my boss enough to trust him to read between the lines and revoke my access to make it impossible for me to turn over customer data without a warrant.

noir_lord 1y ago
Warrant Canary-like system? Like "I hate the color purple, so if you ever see me in a purple baseball cap..." or something similar?
- jeffrallen 1y ago
  The problem with a NSL is that the gag rule is pretty watertight. For example, "oops, I accidentally wrote my password on a bathroom wall" is gonna land you in a world of hurt. You need to find a way to bring some of your other rights into balance (and conflict with) those of the state, to bring professionals who have a duty to protect your confidence to your defense. The power of the state is asymmetric warfare against an individual, which is what they count on. You need leverage from other competing lawful protections working on your side.
  - noir_lord 1y ago
    We have pretty much identical laws here (where here is UK) - you can be forced to backdoor things, you can't tell the customer and you can't tell anyone else in the company (not sure if you are allowed to tell your manager). There was a whole thing about it a while ago, gov said "we are listening to your feedback" and then did it anyway. Of course our system is actually worse in some ways - forgotten a password, they don't believe you (parks and rec style) "Believe it or not, straight to jail" (iirc it's a max of two years).

dwedge 1y ago

I honestly can't tell if the pragmatic engineer is a well regarded site or they are just very good at promotion on LinkedIn and hacker news. I suspect the latter but I'm getting more curious

ngriffiths 1y ago

It's funny how people's mindset shifts when they work for a company versus independent contracting, but this is another case (like salary negotiation) where it should be the same. If your client asked you to do something illegal you'd be thinking about liability and drop the client. If your employer does, you should realize not only do they not have to protect you, it's probably in their interest to turn around and blame it all on you!

bitbasher 1y ago

Thousands of engineers aid companies in user surveillance and tracking every day. Cyberstalking at scale.

monster_truck 1y ago

While not explicitly illegal, I was building out part of a product for an international company with a massive userbase (hundreds of millions) and discovered a slight issue: their api required no authentication, had no rate limiting, and an easily discoverable request format. Anyone could make a simple request with a handful of digits and get a complete history of that product, revealing very intimate details about the users in every aspect of their lives. I don't get nervous easily but it made my stomach turn, my palms started sweating. I told my boss, we told our boss, who went and pulled the CEO out of a meeting. I was given signed documentation on company letterhead that stated I raised the issue and also detailed how our company had informed the customer, along with a modest cash bonus and they bought me most of the furniture in my house (no taxes!) The company came back to us and said "we know, we built it like that on purpose". Incredulous but reassured that both myself and my employer were not facing any liability, I finished the product and it shipped. Predictably this was exploited within a few years and made national news when it was used against prominent political figures. There are still no legal mechanisms in place to enforce any kind of security for this class of product.

aorloff 1y ago
Sounds like from a legal perspective, everyone covered their bases. I take it you are an Oak man, then ? [Harvey Keitel voice]

deleted 1y ago

[deleted]

estimator7292 1y ago

HN should outright ban all headlines in the format "<question?> here's what <subject> did!" It could only be worse if it included "click here NOW!"