Tell HN: Duty of care
I was once asked to remove a hardware safety mechanism from a medical device [1] and replace it with a software only function. Technical first, then we'll discuss wetware.
The process was started by, and results displayed on, an embedded Windows PC [2]. The PC didn't control any safety critical operations. Hardware peripherals had their own sensors, firmware, and safety mechanisms. You could incinerate the PC at any point and be fine.
There was a Big Red Button acting as a physical power cut-out. Request was to remove the physical button and rely only on a software (touch screen). Death was a remote harm, but moderate injury / user stuck in device / panic attack was plausible. And it's Windows, so duh.
Managers didn't contest my logic, but the request came down from none other than the Chairman of the Board of Directors of a publicly traded company, who was also a major shareholder and took a personal interest in the project. He ran over every layer of management until he ran into my skinny ass. I'm the runt of the litter that would have been pecked to death in the nest if his parents weren't so amazing.
I said no way. Not going to happen. Not going to do it. But I never hinted at resignation. They were going to have to fire me or go around me while I take discoverable notes.
That Big Red Button is still there to this day.
"Never doubt that a small group of thoughtful, committed, citizens can change the world. Indeed, it is the only thing that ever has." - Margaret Mead
Some suggestions for people in similar circumstances:
1. Live within your means and have savings. Hard to stand your ground if you're living paycheck to paycheck.
2. Suggest reasonable alternatives and keep cool.
3. Document. Even if it's just an email to yourself. Who, what, where, when, why, and how much. Update it as the situation evolves. Stick to raw facts you have direct knowledge of.
4. Research and cite applicable regulations or similar situations. Bring it up with company legal / regulatory affairs staff. Email them after the meeting with a summary of what you discussed.
5. Bypass chain of command. Make sure people calling the shots have been given your data.
6. Don't resign. Just put your tools down.
7. ---- I've never had to cross this line, but theoretically….
8. Sign nothing that looks like a liability release or NDA (often included in severance offers) if they terminate you.
9. Contact government regulators. OSHA, FDA, FAA, etc.
10. Nuclear option is go to the press, but I don't suggest that unless you can afford to bring a lawyer and love a shit show. You probably already signed an NDA before this point. But personally, if it involved risk of death, I'd do it.
References:
[0] https://twitter.com/LdnmaSentinel/status/1589822045592096768
[1] The studious among you will note the similarities to the Therac-25: https://en.wikipedia.org/wiki/Therac-25
[2] At one point we had requirements for hardware peripherals that only had Windows drivers. Otherwise would have gone Linux or some RTOS.
Edits: formatting