Hacker News Reader

Comment by codelikeawolf | Hacker News Reader

It's worth mentioning that there is a legal definition of fraud[1]. Fraud must be proved by showing that the defendant's actions involved (5) separate elements:

1. A false statement of a material fact is made

2. Knowledge on the part of the defendant that the statement is untrue

3. Intent on the part of the defendant to deceive the alleged victim

4. Justifiable reliance by the alleged victim on the statement

5. Injury to the alleged victim as a result

So if the local government is hacked because they thought the software provided was pen tested and it actually wasn't, congratulations, you've hit fraud bingo.

Important disclaimer: IANAL

[1]: https://legal-dictionary.thefreedictionary.com/Fraud

Edit: Formatting and disclaimer

View on HN

For “injury,” I believe the payment to the party telling the lie is sufficient. You’re purchasing a service under false pretences, which is a harm in and of itself.

Yeah OP’s comment is a good reminder that this forum is not a substitute for legal advice.

But I think the author's paper trail will show #3 is not the case. He doesn't appear to want to deceive the client OR his boss. He's being pressured.

If you present a document you know to be untrue, that’s the same as lying.

OP, get a pen test scheduled and tell the client, “You know, we’ve had a lot of changes since we rolled out. Since you asked, we felt it was best to get a current pen test to reflect our present state.”

No lies (just a slight deception with the truth) and you get a legit pen test your client can rely on.

That sounds like a very reasonable course of action. However... given the circumstances the author is in, I don't think his director is the type to schedule a pen test and then wait for all the violations to be resolved in order to get the contract. (I assume the client, as a government entity, is legally required to obtain a minimum number of bids for contracts and make a decision in a timely manner.)

Lying and fraud aren't the same, which is the author's concern. Lying incurs a social cost. Fraud incurs both social and legal costs.

> If you present a document you know to be untrue, that’s the same as lying.

If you present it as true. People write untrue documents all the time and show them to people that know they are untrue.

I don't... think so? He clearly intended to create a deceptive document, and wrote separately that it was false (don't delete this, wink wink, nudge nudge). The director didn't hold a gun to his head.

Considering the legal definition of intent[1]:

A determination to perform a particular act or to act in a particular manner for a specific reason; an aim or design; a resolution to use a certain means to reach an end.

It doesn't matter if the OP wanted to deceive the client or was pressured to do it, they still intended to do it. Again, IANAL, but people are held liable for their illegal actions all the time, even if they were pressured. Also, think about the kind of pressure this manager is applying relative to the (potentially) fraudulent thing they're asking the OP to do. If the manager was holding their family hostage, by all means, lie about the pen test. I know it's easy to advise the OP to "just quit", but not everyone has the luxury of doing that for personal or financial reasons. That being said, I'd rather be out of work and struggling instead of on the hook for fraud.

[1]: https://legal-dictionary.thefreedictionary.com/intent

You'd have to convince a judge/jury/magistrate (delete as appropriate depending on country, state, criminal, civil, etc.) of that.

You could be right but do you want to take a chance when your livelihood/freedom is on the line?

“I didn’t want to deceive the client, I was just pressured to do so.”

Reply on news.ycombinator.com