88

I work in the information security department of a fairly big transportation company. Recently, my team leader added me and my colleague to a WhatsApp group and told us to gather as much information as possible about a couple of members of the public who criticized the company on a social platform. They want us to gather every information we can find online ("even shoe sizes") and create separate reports for each person that criticized the company.

According to my team leader, this request came from the upper management and we should finish the task quickly. But I feel like this request is unethical and maybe even illegal according to the law. My team leader doesn't come from an information security background, so he doesn't have the technical capabilities to do this himself. Nor has he any ethical problems with the task, it seems to me that he just wants to please upper management.

I have been finding excuses to not do the task, but my team leader is pressuring me to do it. I can't lose my job because economy is really bad here right now. But I also don't want to lose my self-respect or commit a crime.

I am in a dilemma. One part of me says I am overreacting and should just do the task, but another other side of me feels like this is wrong and I should decline this request, no matter the consequences. I believe talking to my team leader about my concerns wouldn't work because he wouldn't listen and he would just try to persuade me to do it.

Should I do the work anyways? Should I refuse and report this to HR or someone else?

82

Just putting aside the ethical aspects here, there are very real legal considerations.

In many jurisdictions, the work done by private investigators is regulated, with training and licencing mandatory. I assume you've had no training around the types of information you are legally allowed to store, and to what lengths you are to go to in order to collect it.

In addition, there are legal requirements (for example GDPR) that must be adhered to when obtaining information about an individual. For instance, with section 14 of the GDPR, you are required to inform the person you are collecting information on them and the purpose of this data collection (of which you don't seem to be aware). (Interestingly there are exceptions in the case of investigations, but it gets very complicated.) Now, the GDPR may or may not apply to you, but are you well placed to understand your legal requirements in this area?

This is a very complex area, and I wouldn't feel comfortable wading into it on the basis of a Whatsapp conversation. In addition, the lack of a paper trail and, I assume, documentation on how the data is to be stored does not look good.

If I was in your position, I would probably try to have a conversation, face-to-face if possible, with someone from the legal department (you say it's a large transportation company so I'm guessing there is a legal department). They may advise against doing the work, which gives you a concrete reason to push back. However, this is no substitute for getting your own personal legal advice.

It's important you don't send anything in writing indicating that you will do the work until you are sure such work is legal.

  • 62
    Thank you Gregory. I am sure the data that would have been gathered would contain GDPR sensitive stuff. This is very shady. I will tell my team-leader I won't do it, if it comes down to me being fired well I stood up for what I believed in. – SoonToBeUnemployed Aug 10 at 17:06
  • 12
    There shouldn't be any question of firing, if what you're being asked to do is illegal. (Of course, how much protection you get will depend on which jurisdiction you're in.) Though whether you'd want to continue working for such a company is another question… – gidds Aug 11 at 10:42
  • 17
    The GDPR has, I was astonished myself, consequences outside the EU as well: for example if the data deals with EU citizens, then regardless where it is stored, some parts of the GDPR are applicable. – Willem Van Onsem Aug 11 at 13:51
  • 6
    "Hey, Team Leader, I don't know whether this is ethical, but I'm pretty sure I'm too mature to participate in childish nonsense like this." – B. Goddard Aug 11 at 18:11
  • 23
    If you get fired over this, then you're in a perfect position to sue them for wrongful dismissal. But check yourown legal advice for that in your jurisdiction, and make sure you have evidence to show. Could turn out to be more lucrative than staying working for them! – gbjbaanb Aug 11 at 18:37
45

Recently, my team leader added me and my colleague to a Whatsapp group and told us to gather as much as information about a couple of people

This is big red alert to me, and the request looks completely unethical. If your team lead wanted you to get information for any official purpose, why is he not using office emails or messaging? How does a Whatsapp group substitute for an official mode of communication?

gather every information we can find online ("even shoe sizes")

This looks like a case of snooping on an individual to me for the team leader's personal agenda - and that is not what information security needs to be doing.

Can you please provide insight to me on what to do here?

CYA. Leave a mail trail, keep asking questions over email (Like which profiles need to be watched for, what information needs to be collected, are there any leads from previous investigation, any time window to look out for etc). If he gives a go ahead over email but you still have concerns, don't hesitate from looping in your skip level manager for FYI. In case you are not satisfied with the answers you get, ask them if they have a sign-off from the legal team (this usually gives cold feet to many ill thought ideas).

Fulfill this request only if you get directions on the proper channel with everyone being on the same page.

  • 16
    Before even leaving a paper trail, the OP should consult a professional. – Jeffrey supports Monica Aug 10 at 16:16
  • 1
    I think you made some confusion - the team lead added OP to a Whatsapp group to gather information of individuals in that group, not to communicate with OP. – Marc.2377 Aug 12 at 5:50
  • Also, recommending OP produces paper trail without getting legal advice first is a terrible idea. If the team lead is anything but stupid (which we should assume he is not), he'll quickly figure out OP's intentions and OP will likely be fired for "no apparent reason". – Marc.2377 Aug 12 at 5:53
  • 10
    @Marc.2377 are you sure? I read it as the Whatsapp group being for communication (outside official office mail, probably). I can't see anything that would indicate that the targetted people are in that whatsapp group. – Syndic Aug 12 at 10:55
  • Why such emphasis on "paper trail" - 2019 version of reality WhatsApp is paper trail. – Mars Robertson Aug 12 at 14:21
4

This is definitely an interesting situation...and not at all a pleasant one.

You’re not overreacting. This is definitely a unmoral task given to you, or rather to the team lead, that was delegated to you.

What the company plans to do with said information is hard to know, but they will probably go on some kind of smear campaign, to publicly discredit the critics if they decide to do anything...or use it for blackmail. Depending on your country this can be highly illegal and linked back to you...assuming anyone cares that is.

This info depending on what you can find, could be used in the extreme cases to ruin their lives, or just embarrass them...or nothing at all depending on what you find.

So what are your choices? Do you feel like you can live with the idea that you personally will be responsible for supplying information on people for a corporations vendetta against normal people who criticize what the company you work for does? ( seems like the critics might have been criticizing for a good reason)

Or do your ethics say, ‘holy snap, i don’t want to work for a company that might want to ruin other peoples lives’ ?

Would the guilt of this action be something you can live with?

Unfortunately times are tough where you are so its hard to say quit right now and start looking, (though i suggest you do that anyways, cause the company you work for seems shady) but in the end its your choice.

As a tip, companies willing to be shady to the public, rarely have issues doing the same to their employees...especially using their employees as scapegoats.

Your other option is to do the work, but turn up with no information, you’re the expert afterall...you just couldnt find anything..., or do the task and whistleblow to the papers afterwards. Or go to the police...of course with documented evidence. Ensure the job you’re given is in emails or some written form, print and keep those locked away sonewhere, encase you need them.

Whistle blowing is also potentially dangerous or career ruining...so be careful about that.

I would stand my ground and refuse to do it and starting looking for another job.

  • A well known ride sharing company did this kind of thing and seriously damaged their brand. You're being asked, by a company executive, to do something that could be really bad for the company. – O. Jones Aug 12 at 20:50
4

There is a comment above by @Bob Jarvis

If a job isn't worth doing, it's not worth doing well. Couple that with the fact that names are far more common that you'd think. I suggest that you find information about the "person" you've been tasked to track which is innocuous, uninteresting, non-pictorial in nature, and which is actually about three or four different people, none of whom are the person who works for your company. If someone criticizes the information, shrug your shoulders and point out that you're not a trained investigator.

I agree, this is a good time to do a half-assed job.

Get their public social media information, organize it into a good looking report, and turn it in. Job done.

If they ask for more, tell them to write down specifically what they want.

Edit:

Comments make a good point that this is less than ethical, and depending on copyright law, perhaps illegal. However, this method allows one to avoid disagreement with supervisors, and perhaps retain an otherwise decent job.

  • 6
    No. This is a good time to do no work at all. "but judge, I did a really half-assed job when it came to breaking the law, surely you should be more lenient on me for being an incompetent criminal?" – Stun Brick Aug 12 at 8:24
  • 4
    Reprinting publicly available information is not law breaking. – axsvl77 Aug 12 at 8:29
  • 2
    @axsvl77 That's wrong. For one, is copyright infringement. In addition, as I mentioned below, the collection and storing of personal information (even public information) can be regulated by law (for example with the GDPR). – Gregory Currie Aug 12 at 8:42
  • I was more making an appeal to ethics than law, but I understand throwing a judge in the situation confused the analogy. – Stun Brick Aug 12 at 8:42
  • 1
    @axsvl77 analogy – Stun Brick Aug 12 at 10:08
1

If you're gathering information that is publicly available then it probably isn't illegal.

Is it unethical? That depends on your personal definition of ethics. Assuming that this information is publicly available, how is this any different from you collecting information on your favorite author, or actor, or gathering information about the CEO of a large company? Have you been specifically asked to break the law? Have you been asked to collect information that isn't publicly available and that can only be gained illegally?

Whether or not it's ethical is in the context and in the intended purpose for collecting this information. Is it distasteful? Yes. Is it illegal? Probably not. Is it unethical? To some yes, to others, no. Would I do it? I'd find any and every reason I could for not doing it.

Are you willing to lose your job for taking a stand in opposition to this request? Sometimes we pay a price for adhering to our own moral and ethical compass. Are you willing to "die on this hill"?

  • Thank you for your insight. I just feel like If I do this, I would be just pleasing some power-maniac, egoist upper-management guy. Also next time they will ask more shady things. It looks like it's time to move on to more professional companies I suppose. – SoonToBeUnemployed Aug 10 at 16:49
  • 18
    With the GDPR, the handling of personal information (even public information) is very heavily regulated. So the legal question is very much a question. – Gregory Currie Aug 10 at 16:55
  • 1
    @GregoryCurrie although the GDPR has become something of a defacto industry standard (which is a good thing) a lot of us aren't actually subject to it. As they say, it depends. – Jared Smith Aug 11 at 11:45
  • 5
    @JaredSmith Well, GDPR is underpinned by law in several countries, so it's more like law than an industry standard. – Gregory Currie Aug 11 at 12:00
  • 1
    "If you're gathering information that is publicly available then it probably isn't illegal." this is incorrect. – Jonast92 Aug 12 at 13:53
0

Before making any decision, you need to consult with an external legal professional to make sure what you would be doing would not also be illegal, in addition to unethical.

You need this person to be licensed profesionnal because you'll need to provide him/her with information that could prove illegal behaviour from your company. Only a licensed professional will then be protected if/when the behaviour is exposed by someone else.

0

Give them an honest, professional answer describing what you can do:

For sure I can use information which was published to create a dossier/dossiers, but this would not include information which is not completely public, like informations from closed facebook groups etc.

It is for hard to collect more information, but I think it would be better for the company to have plausible deniability should something this come to light by one way or the other. I would suggest that these tasks is outsourced to professionals (private investigators), who should be well-versed in what is allowed here and what not.

  • Hear no evil, see no evil. The company will just use someone else, your point would be dismissed – Jeffrey supports Monica Aug 10 at 16:50
  • 10
    My observation is that in the moment when you force somebody to actually put his signature below something dubious and thus enforce liability, they suddenly are much more careful in what they ask for. – Sascha Aug 10 at 16:53
  • @Jeffrey My colleague did his part without complaining. I tried to voice my concerns to him but it seems like it's not a big deal to him. – SoonToBeUnemployed Aug 10 at 17:12
  • Yeah, that's what make this answer not to useful – Jeffrey supports Monica Aug 10 at 17:52
  • 1
    @Jeffrey: That's why OP needs to forward the team leader's request to the company's legal department asking for an opinion on whether it can be done. Then legal will already be aware after OP says no and they try to get someone else to do it. – R.. Aug 11 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.