Comment by ejames | Hacker News Reader

Comment by ejames | Hacker News Reader

Parent Full thread

I find myself wondering: How exactly would you go about doing the ethical thing in a situation where you realize your work is such that you're being offered hush money to stay quiet about it?

I don't mean "how" in terms of "how do I know the right thing to do", more a question of what, exactly, is the best way to do the ethical thing without getting burned.

Is it better to take the hush money and pretend to be satisfied, then whistle-blow to the FBI once your corrupt boss thinks you're happy? What kind of evidence would you need in order to convince an FBI agent, in a phone conversation, that you are calling in a real crime and not just a prank? If your law-enforcement contact asks you to wear a wire to work and have a leading conversation with your boss, should you do it? What kind of corporate espionage do you perform to make sure a corrupt business does not shred or cover up evidence?

Maybe I've been seeing too many spy movies recently, but I find myself fascinated by questions like that.

There's lots of hacker literature about what to do when you're an employee in the middle of an unsuccessful company, and some about what to do when you are attempting to catch a cracker or other computer saboteur on your network, but I don't think I've ever seen a story or essay on the subject of what to do when your company is not merely clueless but literally criminal.

Here's what I've learned about whistle blowing: you have little protections.

I was in a situation about 10 years ago where I wanted to report investor fraud to the SEC. My legal counsel told me I had no protections from being sued. My logic was that a contract (e.g. an employment contract) could not hold me liable for damages caused by reporting a crime. I was told my logic was wrong and that there are few protections. There have been various whistle blower laws for reporting specific crimes. Some of these have been repealed or allowed to lapse.

Honest people do not write software to defraud investors. Despite the story, they had no stroke of conscience convincing them to leave. You would never tell a criminal organization that you're going to expose them unless you're blackmailing them; there would be no benefit. These guys are con artists.

I think an honest, rational person would contact the FBI in private and seek their counsel on how to proceed.

Yeah, my questions don't really apply to the pair in the story; they knew from the beginning that the software was for fraudulent purposes, and simply lost their nerve after a while, then got arrested anyway on charges of conspiracy. Getting cold feet after the crime has been committed does not earn you leniency.

I suppose I'm thinking of it more along the lines of, say, the person in the next cubicle/department over who knows about such software and wonders what to do about it.

Contacting the FBI and asking the professionals what to do is the most obviously correct path. It's just a matter of curiosity that I wonder what they would say, and whether the advice would work.

Well, it seems like it might have been moderately difficult to get traction, since the SEC had been alerted several times by informed outsiders and they faded.

Also, you could view Cuckoo's Egg (Cliff Stoll) as a cautionary tale, as he had significant difficulty persuading the FBI that there were foreign spies trying to break in to sensitive sites.

Quit.

Reply on news.ycombinator.com