Personal and legal liability with respect to inexperience?

Question

I am a recent Bachelor's graduate in computer science - I have been employed in the field for less than a year.

My current employer is asking me to design and implement a relatively advanced information security schema, and it makes me somewhat uncomfortable. I am willing to try my best, but I have not been formally trained in security at all, and have no workplace experience in engineering security.

How can I best communicate that, "if you trust me with no qualifications to design this system, and something goes wrong, that's your fault for not hiring an actual information security expert?"

Also - is there any way that this could impact me legally? I do not want to be legally liable if I am fully aware of my inexperience and lack of qualifications.

I am a contractor, not a full-time employee.

Answer 1

Honesty is the best policy here.

Thanks for giving me this assignment. You realize of course that I'm not a security expert and I'm going to have to spend time researching this, and even then it might not be a great solution?

And see where things go from there.

Depending on the need/solution, you might want to get an external consultant in to take a look over your proposal and get things tightened up before deployment.

It's doubtful that this will impact you personally if something goes wrong - your boss/others should examine/test/approve whatever you propose which ensures that any liability with lies with the company, and not with you (you're just following orders after stating your limitations, after all).

As part of due diligence, make sure that you have emails/paperwork demonstrating that the business is happy with you working on this and are aware of your lack of expertise in this area. Print the pertinent emails out - sometimes problematic emails have a habit of "disappearing" from Exchange accounts.

Answer 2

As a contractor (information in the comments), you also have to be very wary of accepting this work without the knowledge and agreement of your own employer, the contracting company, as they may have some legal liability in this. If you are your own company, then turn down the work.

To explain further about turning down the work, if you are a sole person contractor, then you might have legal liability in the millions of dollars (maybe even hundreds of millions) if you accept the contract. Security breeches can cause huge amounts of damage to a company and to their clients.

The fact that you know that you are unqualified would probably make it even more likely there would be serious breech and more likely they would win a case. There is no circumstance where it is safe for you as a contractor on your own to take this contract. If you doubt me, consult a lawyer before accepting the work.

Answer 3

Any answer you get is based on an assumption:

1. You're a contractor who's actually a misclassified employee. (Very common in the USA.)
2. You're a contractor who's really a contractor.
3. Agency contracts with Client ('current employer'), but you're an employee of Agency.
4. You're actually an employee of 'current employer'.

If the assumption is wrong, then the answer is probably wrong too.

If you're operating as a "true" contractor, then you should consider yourself as a vendor and act accordingly (see Adam Davis' answer.)

In any event, it is smart to be worried about the stuff that you're worried about, but it sounds like you'd benefit from some professional legal advice. Anybody can answer on the internet, including Law.SE, and those who do are not responsible for their advice. A professional will review your situation, challenge the assumptions, and they'll be liable for their advice.

If I were to advise someone in your shoes, I'd be highly suspicious about whether they're misclassified employees, because that makes a huge difference in the analysis, the potential consequences, and the avenues for redress (and, most importanty, who's to blame).

Many attorneys offer free initial consultations, and you might get some good guidance out of it, steering you down a different path than you imagined.

Answer 4

There are probably entire books on this subject and it's impossible for anyone to give you a definite yes or no answer. However the cases where employees have been found liable are extremely rare.

You are acting as an agent of your company and are generally assumed to be acting in good faith. Your boss knows your experience and has directed you to complete a task that is lawful. So as long as you don't intentionally screw it up, or intentionally implant malware or lie to your boss about what you've been doing, you're almost certainly going to be fine.

If you're really worried, be sure to document your processes carefully and ask to have your work reviewed by someone more senior (this is a good idea anyways).

Answer 5

As a contractor you are at increased risk and liability than if you were an employee.

Consider purchasing Errors and Omissions insurance, which will provide you with some protection, but be aware that even that may not cover you if you're working outside your proven area of expertise. If another expert can sit on a witness stand and point out a dozen things you did incorrectly, you may still be liable for any resulting damages.

Also, consider starting an LLC, which should further insulate your work from your personal finances, so even if you are determined to be responsible for damages, you may better protect your personal finances.

As a contractor you are responsible for understanding your area of expertise, and providing work product that meets minimum professional, expert standards.

If you feel uncomfortable with this you can either take classes or instruct yourself until you believe you can do the work to a high standard, or you can insist on oversight - essentially several meetings with a security consultant who provides the needed sign-off on the design and plan, or at least prevents you from making the simplest mistakes. If you can't do either of the above, consider bowing out of the project.

Answer 6

As a contractor you live or die on your contract -- you should have some boilerplate written up by a real lawyer that indemnifies you against liability for consequential damages, and if you will be doing a lot of this probably an LLC to limit your personal liability.

That aside, I would differ from the other answers in that the fact that you have been hired to do the job indicates that the employer feels that your qualifications are sufficient.

Whenever you start a new contract there is likely to be some research and learning to be done -- if you are diligent in this there is no reason for you to share your self-doubt with the employer. Just work to remedy any gaps in your knowledge, then do the work to the best of your abilities.

tl;dr: Make sure you are protected from liability, bite off as much as you can chew, and chew like hell! :)

Answer 7

In addition to the other fine answers, I would suggest hiring a third-party infosec auditor familiar with this type of development to validate your application/plan. In a few hours of time you can share your requirements, plan and get their feedback/suggestions which will definitely help bulletproof your development. Also, if there are any ISO standards for this time of work, you should definitely set out to maintain compliance in your applications.

Answer 8

As a contractor you must have personal indemnity insurance. Depending on which country you live in this may be a requirement by law. I worked as a contractor in the UK and this was a requirement before starting work. If you do not have it already, get insurance!

Professional indemnity insurance is designed for professionals who provide advice or services to their customers. It protects your business against legal costs and claims by third parties for damages arising from acts, omissions or breaches of professional duty in the course of your business.

It is inexpensive and it means that if you make a mistake that results in a security breach and/or cause damage to the company, your insurance will cover you up to millions of pounds/dollars.

Equally if you feel uncomfortable doing this work, it is your right as a contractor to turn it down. You may lose the contract. Perhaps discuss your concerns with your employer, ask if they can afford to send you on a training course before you begin the work.

Answer 9

I would handle both aspects of this, in the same way. I would do this by email (puts it in writing, removes deniability and any claim that you his anything...)

"As you know, I am not security qualified, and security needs to be done properly. While I would do my best, I need to emphasise that in my view, I am not the right person to do this specific task, as it needs very specific qualifications and/or proven experiences. Frankly I think Im the wrong person for this. Please reconsider carefully if I am the person you want to task with this. That said, as you know I try to do all I can, so if you do want me to do this, despite my concerns, please could you explain how exactly you want me to go about it, given my inexperience."

If you want to."lay it on thick", end the last sentence with: "... so the client still gets the high standard expected , and is not at risk of being affected due to the above."

Not only does this make clear you are being professionally concerned and amicable to any reasonable solution/direction, it also puts it in writing, which means its a lot harder to pretend they didn't know, or ignore it. Having it in writing can be a good, if innocuous, motive to a company, to reconsider a possibly damaging decision and ask themselves "what if it comes back to bite us"