Is this fraud? And if so, to what extent am I responsible?

The big mistake here was editing an engineering statement to say something false.

If you're an honest person, assume that your job under that director (and probably at the company entirely) was over as soon as they asked you to make a fraudulent engineering statement. Even if they backpedaled when you resisted, you're not a team player with them, and you're a threat to someone very dishonest.

At that point, options:

* just leave;

* consult a labor attorney (you can get a free initial consultation); or

* go above the director's head, probably (in a small company) to the owner/CEO, whatever attorney is on staff or they retain, or HR (though, you're still probably over at the company, even though they'll diplomatically pretend that you're not, because you are in 100% corporate butt-covering territory now, in a place that puts someone very dishonest as a director).

Do not lie to the government, even if you are following orders. In the US, federal and state law differ, but most have some variant of the federal false claims statute: https://www.law.cornell.edu/uscode/text/18/287

> Whoever makes or presents to any person or officer in the civil, military, or naval service of the United States, or to any department or agency thereof, any claim upon or against the United States, or any department or agency thereof, knowing such claim to be false, fictitious, or fraudulent, shall be imprisoned not more than five years and shall be subject to a fine in the amount provided in this title.

This has been interpreted very broadly to encompass pretty much anything you submit to the government in support of the government paying you or your company money.

Probably nobody will notice, and you probably won’t get prosecuted. But this stuff comes to light all the time if something goes sideways, or if the government is investigating something else.

> "we did pen testing when we launched, but haven't done it since".

Well… was it before you joined the company?

You tell them in that case that was before your time and you quote your boss.

I’m not sure why you replied no to begin with, if you didn’t know. You should have asked your boss about it first and take his word.

During the zoom call, you can simply reply that your boss told you so and ask him to produce the old report if it’s still in his possession.

Anyways I think these tests (iso 27001) should be held regularly to mean anything. Being compliant in 2021 doesn’t hold the same “level of guarantee” in 2023.

And that last part is up to your client’s policy.

Do they need a recent third party audit or whatever… you should ask them questions and check with your boss if it’s worth the spending.

If I was going to get fired it’d be for telling the truth. Saying no is allowed. If they fire you for telling the truth and there is evidence to support your position then sue the fuck out of them for unfair dismissal.

My current company won’t let me near customers.

This is IMHO why programming/IT should be treated as a "real Engineering" in some cases, or at least have one of the devs (head of the project?) have a proper degree.

I studied a different Engineering, and in multiple courses the emphasis was in the actual approval/signing. The only practical difference between a technician and the Engineer in many cases was that the Engineer could actually sign off the project (or not). And thus it was made very clear that signing a document like in this Workplace question would be a big deal, since the responsibility was theirs to make sure things were compliant.

I was in a similar position once, but it was an audit questionnaire about our usage of software - we only had one production instance licensed, not the backup instance or development instances. My director wanted me to state that we only used the one instance, I refused and said I'd leave the pertinent sections blank (for the director to fill in), but I wasn't going to lie about our usage.

That's when I started looking seriously for a new job, and had left the company within a month, a few months later they went out of business after they had to pay hundreds of thousands of dollars in back licensing fees since the vendor had evidence that their software product had been used beyond the single production instance.

I think if they'd been upfront about the usage, the company would have negotiated a fair license fee going forward without pushing for past usage to be paid too.

So this person lays out a complicated issue concerning contracts and fraud and ends with

> To be clear I'm not looking for legal advice, just opinions from people who may have been in a similar situation

I'm going to go ahead and say they are going to dig themselves deeper in the hole.

I would go with "I was not present for any penetration testing at launch, and I'm unable to find any reports related to it. However, penetration testing done that long ago would have little current value anyway. What I will do is talk to my leaders and get regular penetration testing scheduled, and get that schedule to you asap".

Clearly, the engineer should print out the whole paper trail.

And the lesson learned is to let people write their lies into documents and not do it for them.

Sounds like a "winning move" did not exist from the start for this poor fellow. Either your director fires you for speaking the truth or you possibly become accomplice in fraud. All you can do is cut your losses. If they go into that zoom meeting I hope they won't toe the company line. Getting fired, or losing the customer seems like the least worst option.

It's actually not clear to me if the director is also their boss. It's written as if they are but not spelled out anywhere I can see.

Dear god, if this ever happens to you, get the hell out. Management that will lie/screw over customers will think nothing of lying/screwing over YOU.

And this is why the tech industry management is so hated. The OP gave an ethical example but it happened to me in a different way.

I was being pushed to release a small feature during the holiday season. While we were on track to release it, the CTO announced that we should not release anything during the holidays so that customers can take a breather and that our company is not responsible for their failures. So, we waited to roll it out until after the holiday since the CTO himself asked us to exercise caution.

Come review time, my manager berates me for not releasing fast and for "constantly missing deadlines". I asked why the CTO is asking us to exercise caution and why he is asking us to push. I asked what would happen if there were to be an outage during the holidays.

This infuriated the manager and he had it for me for a long time. And he was only furious because I caught his BS. The only reason he wanted me to go faster was to make himself look good. But if something were to fail and if the CTO checked, I was to be the fall guy.

Aside from the "all managers are not like this" trope, can anyone tell me why engineers should trust such managers when they play such games with us?

Yes, it's fraud. Just because your boss asks you to lie, does not make it somehow okay. Time to look for a job elsewhere...

ehhhh. Lots of hyper-conservative responses there (which is understandable, it's asking for legal advice). But assuming this is part of an RFP response, "embellishment" of answers is par for the course, and I understand the frustration of the director.

First, there's always a good chance nobody on the client side actually cares about this. RFPs tend to come with hundreds of questions, most of which are put in as requirements by completely detached departments to make them feel important, but don't actually matter. If something is important, it can be negotiated. For example, if the pen test is important, you can get the client to agree to sign the contract with a clause that says if they don't get pen tests results by X date the contract is void.

Second, well, what is a pen test, really? If you ever called one of your APIs to validate that your authorization or authentication code works, or you've validated that your AWS security groups are blocking external traffic to your database, congrats, you've performed a "pen test"! The client won't consider that sufficient, of course, but it's a justification for an answer on an RFP, at least. If they want more details, as they do in this case, they can always schedule a follow-up call or ask to see the pen test results document.

This situation reads like an engineer who needs a bit of business/sales experience more than anything. In their discussion with the client, you can start with "we've currently only done in-house penetration testing, but are looking to contract an external vendor to do penetration testing by X date." Assuming you've done any testing, this is a true statement, and the client can determine if that's sufficient.

The real solution to this is to get SOC2/ISO27001 certification, though, which makes a lot of these RFP headaches go away.

Time to start planning your exit.

The larger problem:

The boss doesn't have technical expertise and will not defer to the judgment of the person who does, lacks ethics and is not going to stop their crap. It will only stop if someone else stops them, probably via tossing them in jail at some point.

It's worth mentioning that there is a legal definition of fraud[1]. Fraud must be proved by showing that the defendant's actions involved (5) separate elements:

1. A false statement of a material fact is made

2. Knowledge on the part of the defendant that the statement is untrue

3. Intent on the part of the defendant to deceive the alleged victim

4. Justifiable reliance by the alleged victim on the statement

5. Injury to the alleged victim as a result

So if the local government is hacked because they thought the software provided was pen tested and it actually wasn't, congratulations, you've hit fraud bingo.

Important disclaimer: IANAL

[1]: https://legal-dictionary.thefreedictionary.com/Fraud

Edit: Formatting and disclaimer

> At that point, I was confident in my personal ethical position.

Eh, what? OP knew what sales was going to do with that email. Having sales wordsmith an answer is fine, but if you think it's factually inaccurate, don't send it back to them filled out in the form.

The rule to use is this:

If your employer asks you to do something and there is no moral imperative to to what is being asked, even if you do not think it is wise to do it, just do it.

If your employer asks you to do something that has some moral imperative, you need to ask yourself if doing this makes your moral standards, are you willing to compromise your moral standards or will you stand upright and be the man and face the consequences from your employer.

Either way, you will face consequences and if you fail your own moral standards you have to live with that.

The whole situation is sketch. Find another job. No one should ask you to lie outright like this.

Kinda wonky responses. If your boss asks you to provide them with a document that says ‘this’ and you send that back to them, how does that constitute fraud? The fraud is the one that then forwards that factually incorrect information to the client.

People go on about having a document that you signed and attested as correct, but as far as I can see nothing like that was indicated by OP.

You become party to the fraud when you take that call and make false claims. So don’t do that.

You can't commit a crime just because your boss told you to. If your boss asks you to break in to a building and steal something you will still be in trouble for doing it, even if you have a paper trail showing your objection. Same should apply if you knowingly provide fraudulent information to a government agency.

You might get a lesser sentence if you can prove that you were pressured into it by your employer but you're still ultimately liable for your actions.

In this situation you need to put your foot down and say you can't commit fraud on behalf of the company. You could offer to either hire a pen tester, or conduct a half assed pen test yourself and report on the paper that you did an "internal" pen test, or something like that. But you should not have filled out a document with known false info. What did you think would happen once you did? That they would just throw it in the trash?

Given that the consequences are already happening, you should make it clear that you aren't going to continue to lie and schedule a pen test ASAP.

You could probably still fudge out of this depending on what exactly was replied.

You could elaborate that the initial pen test was one of those self trigger ones and not an external or "professional" type. Hence you do not have any documents regarding it anymore. Although not ethical the company would see this as not a acceptable metric and dismiss it when evaluating. Your written statement although a lie would not be considered fraud if it didn't get considered in evaluation. I am saying basically make your written statement worthless.

Eitherway you need to make it absolutely clear to the CEO that is as far as you will go an he may as well hire an actor to represent engineering if he wants you to lie as the actor would know as much as you about a fictional pen test.

It can be really hard to flat out refuse on ethical grounds to do something your boss tells you to do. I’ve only done it once, and I knew it meant my time at that job was coming to an end. I was gone a few months later and in a better position.

Make it known you will not lie. If you're pressured or pushed to lie, resign. If you're fired for not lying, contact an attorney.

The world only gets better if people do the right thing whenever possible. The right thing here is not to assist with immoral behavior and deceit.

I have a similar story.

I was working at a Big Startup, on ML side of things. All the senior engineers in my team left and me and a few others became the senior-most engineers (with <1 YOE). The models we built were contributing 100M$+ to the top line of the business.

My then manager tasked to do some data analysis to determine whether building a "new nonsensical ML Model" was the right way forward. I like a diligent bee crunched the data and came to the conclusion that "we shouldn't build the new model".

I showed the results to my manager who laughed and told me to do it again. It's also important to note here that my team lead and old manager had left the company. This person was completely new and a senior manager.

I in my naive mind (and oblivious to politics) thought he's telling me to say that the results "do make sense". and that's what I said. We even presented the results to product people who gave us go ahead. Since we were doing such pivotal work, even the company's CTO was involved and tracking our progress.

The next few months were one of the most painful times of my life. Immediately after the meeting, we were tasked to actually build those models. I knew that they wouldn't bring any results, everyone else in my team knew, even PMs knew. Everyone except the manager.

I led a few interns and we built the damn models and got the expected result which is 0% improvement.

What happened next taught me a lot about life. Their was a meeting (which I wasn't a part of) where everyone senior who had their ass on this project came together. They invented a "new metric of success" and asked us to train ML models optimizing for that. We trained the models and obviously since the optimization target changed, we saw improvement.

Then we created charts according to that metric which were obviously good. the PMs showed slides to Upper management. and all was well again.

The best part of the new metric was that the actual results will only be visible years down the line. So we called it a success regardless. I switched my job soon after that.

I learnt from this experience to just say "NO" firmly on doing things I'm not comfortable with. and always keeping a text trail. The manager was kind of an oddball so I never fully got whether he actually knew this from the start or was just plain incompetant.

I'm not sure what you expected to happen, but you should be archiving all your correspondence with your director in personal storage and start looking for another job.

Whether this is fraud depends on your jurisdiction, but the fact that you're even asking the question probably means there are some uncomfortable conversations in your future.

I'd say do one of two things:

1. Attend the Zoom and bring the original copy of the document you produced. Explain that you had nothing to do with any alterations, and that there has never been pen-testing of any kind. Then let them fire you. Again, save every piece of correspondence in storage that is under your control -- personal cloud, printed copies in your basement, whatever.

2. Resign effective immediately and cite that you were asked to make false statements to a client. Then file for unemployment and dare them to contest it.

As with many "adult" decisions, sometimes it's best to just ask a kindergartner.

The conduct to this point was wrong. At best we're talking about an undocumented, out-of-date pentest that the writer doubts occurred-- and whatever occurred would not be recognized as a pentest under current industry standards. Sounds like an interesting conversation with the client, director, and possibly whoever runs the company. If the company adds to that performing an actual industry-standard pentest-- which it passes easily-- perhaps its reputation does not receive the hit it deserves. If the software doesn't pass, might be simpler to withdraw the submission than proceed with the meeting.

OOP should brush up their resume and ask the director per email what exactly he expects OOP to say and show during the zoom call because to their knowledge no pentest has occurred and as such no documents are available.

Then forward all correspondence to his private email, or, if this is blocked (doubtful either way such a small organization) take photos of the correspondence, and await the inevitable outcome.

The people here in the comments that are cosplaying as Socrates with questions like “What really is a pentest” and “Who knows what the client really want” will face the “find out” part of their nonsense soon enough.

IANAL. But yeah. And now you have a paper trail.

Let them fire you. They’ll have a hard time firing you for cause. Do you really want to work at a place where the people in charge are either felony stupid, felony corrupt, or both.

The general answer is that we can all be held personally liable for our own torts. For example, if a delivery company driver runs into a pedestrian, the pedestrian can definitely sue the driver. Usually, however, they will want to sue the company instead, because the company has more money.

The same logic applies here. The customer can sue the employee who falsified the records, but they’re more likely to want to sue the company.

Before continuing to the main topic, as soon as I read “Decisions are taken by the (non-technical) directors” I would suggest you look somewhere for another job unless that person has outstanding leadership experience (clearly not), this dynamics (non-tech is dictating on tech) will be the most infuriating and frustrating experience you will have to put up with, I have been in that position before, in fact, I have seen small companies turning into chaos after replacing the tech-manager with non-tech one (usually sales or business), as those usually lack the technical background, and to stay ahead of the technical folks, they pull all political shenanigans and psychological manipulations.

Now to your topic, you are to be blamed:

- Never ever claim something is done when it wasn’t, especially in cybersecurity, this will always fire back and I have seen it firsthand, you will be liable when the first breach happens since you gave the green light from a technical perspective.

- You are supposed to protest the company's position yet they threw you in front of the bus at the first corner (when the client asked for evidence)? What do you think it will be when legalities hit later?

- You are being used, and sorry to burst your bubble, bullied too, it is clearly what type of work environment when you get a WRITTEN email with a slur, not even verbal.

- From my experience too, going to higher management will not do anything (like a CEO) in small companies, as usually they are all the same, in fact, the CEO will be using the director as a shield to take the shit later, and the director is using you as a shield, you get the idea.

The course of action if I were you:

- Meet with the client and be transparent, say you never said that, no pentesting is ever done, and be clear the director said it. I would even go the extra mile and record that call, just ask for consent first.

- Give your resignation right after the meeting, and be clear about the reasons why, you will thank yourself later.

- Edit: I would also make a CYA (cover your arse) folder, I usually do that in similar situations, document everything.

You can of course take legal advice, but since nothing is actually done (assumed in the negotiation phase) and unless there’s hard evidence (like those emails you mentioned are clearly asking to falsify it), I don’t think it will be worth it, but I’m not a lawyer.

This guy needs a lawyer. He may want to be the first one to confess at the prosecutor's office, so he's the one who gets off.

Tricky.

1/ Normally lying in bids can get your company barred from competing in bids for several years, if these are financed by something like the World Bank, the disqualification can be extended to other geographies.

2/ Your director likely has DnO insurance.

3/ Whose signature is at the bottom is the bid?

4/ Tell the truth, or at least, don’t lie.

Disclaimer: not a lawyer.

Yes. Be sure to save or print the email trail to protect you.

I'm surprised by all the answers. Lying on tenders and audits is practically a sport.

Edit 2: after seeing the replies, my revised advise is to schedule a cheap pen test (can be done in less than a week for less than $2k) and tell the client “Our next pen test is scheduled for next week”. Doesn’t need to be harder than that. Pen tests for satisfying compliance requirements are easy, cheap, and quick.

-

My advice: get on the zoom call and when asked about the pen test, repeat something like “we have a security policy in place that obligates us to do a penetration testing at least annually”

(Assuming you have such a policy. If you don’t, then you and your company is out of your league selling to governments)

Assuming you have a basic set of security policies (almost all of which will say you’ll do pen tests annually), just repeat the line like “we have a security policy in place that obligates us to do a penetration testing at least annually”

And if you’re asked again more specifically whether you’ve done one in the past year, don’t answer directly and repeat the quote again.

The key here is do say the maximum amount of (positive for your company) truthful information and deflect or redirect away from questions where the truth would hurt the sale. Engineers often have trouble with this because it’s most engineers have a tendency to want to answer questions directly and literally.

And, make sure the sales rep is in the call. If the client backs you in a corner and you don’t know how to redirect or deflect, then you hand the baton to the sales guy.

Edit: Or, just do a freaking pen test. You can get one done in less than 2 weeks for less than $2k.