37

Context

I work at a mid-sized company, where everything is proprietary.

As with all software companies we use distributed version control, meaning all employees have all the code on their computer at any time.

Recently the team lead for our mobile product hired a poorly performing junior dev. Eventually this team 'lead' has left the company, let's call it mutually.

Theft

Today the junior he hired was overheard saying he figured how to do something after he sent github links to someone - we (his colleagues, not managers) assumed he was applying for other jobs since the lead who was protecting him had left.

Out of interest one of us looked at his public github profile and we discovered he has released two libraries which are helper classes from our project (which I wrote and the company owns). They even aren't his work at all.

Equally worrying is the contributions for his page show a lot of heavy committing in private repos at the same time he stole the helper classes - first when he was first given access to our company code and again since his friend/lead was let go.

What next?

We are all sure he is stealing all of the company code now that he is applying elsewhere. We've all had conflicts with him in the past but have not been able to prove anything as he is very sly.

What should we do? (If anything). How should we bring this up to company management? What proof we we need? Is there a way for us to prove when a local repo is pushed to a new remote, if he did it that way?

Improve this question
12
  • 9
    I have to ask, do you think he is "borrowing" or is it "stealing"? Is it stupidty or malice? Let me explain. From an intellectual property perspective, code theft is code theft. Copying company code to a public internet forum is wrong. No disagreement. But do you suspect he copied the code for profit (or to raise his credentials), or is at all possible that he just used Github out of convenience to practice or build something for work without realizing the implications?
    – selbie
    Sep 16, 2019 at 20:37
  • 6
    @jww: Just out of curiosity: What "process" could be used (by HR or anyone else hiring people) to ensure that a person who has applied (in particular, a junior with little or no work experience) is trustworthy?
    – Heinzi
    Sep 17, 2019 at 5:02
  • 3
    @selbie Fair enough. In that case, one could always just stick to the facts. "Bob has been posting company code in a public place and I overheard him discussing sharing the code with someone else." I do agree that OP makes a lot of unbacked statements though
    – Mars
    Sep 17, 2019 at 5:27
  • 2
    @Steve-o169 an NDA is not explicitly required. It's standard for contracts to include a clause where any code written for the company belongs to the company, so the copyright infringement is there. Even without such clause, this isn't a code the junior wrote themselves which they then shared - it's still somebody else's code. It would be incredibly strange set of circumstances for this not to be considered an infringement.
    – VLAZ
    Sep 17, 2019 at 6:42
  • 3
    @jww If there really was an even somewhat fool proof way to vet people to be trustworthy you'd think all those three letter agencies that have billions of budgets would employ it. Given the fact that their process fails quite regularly (and spectacularly), clearly this is not as simple as you make it out to be. If you look at what those vetting processes usually do, they're simple to work around if you don't have any prior convictions or other obvious red flags. Predicting human behavior is a much harder problem than analysing a technical system (and that's already really hard)
    – Voo
    Sep 17, 2019 at 9:41

4 Answers 4

Reset to default
67

What should we do?

Since it appears that you can back up you claim, take all the evidence you collected to your direct manager and let them deal with it. Depending on your companies structure, you may optionally wish to copy an HR person as well. If your company has a security officer, that would be your best option.

In short, report it to the appropriate officials in your organization and then move on.

Update: As pointed out in the comments, other officials (government) may become involved, but let your company's management team deal with that.

Improve this answer
2
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Neo
    Sep 16, 2019 at 18:43
  • 5
    OP specifically asks what evidence ("proof"). All is a little vague, how about writing it out? For starters, the overheard conversation about posting stuff on github should probably be documented (this post may be enough). Then there are the libraries--those need to be... screenshotted? With proof that it's his account
    – Mars
    Sep 17, 2019 at 1:08
21

Despite your best intentions, you have exposed damaging information about your employer. It takes about 30 seconds to determine who you work for.

By posting this information on a public forum without adequately protecting your own (or your employers) identity, you have potentially opened up yourself and your employer to serious consequences. Not only does it expose a potential breach of your product(s) it shows an amazing lack of awareness of information security and the proper response to a breach.

Your immediate actions should be:

  1. Print this page to PDF for documentation.
  2. Delete this post.
  3. Contact your manager and security department.
  4. Inform them of the code breach and your post.
  5. Do not publicly discuss the incident or this post without written permission from your employer.
Improve this answer
5
  • 1
    it took me about 32s...but i forgot how to spell the OPs name 8)
    – DrMrstheMonarch
    Sep 16, 2019 at 18:18
  • 10
    Deleting the question may not be necessary (or possible). But OP can flag the question and request that a moderator anonymize it, so it will no longer be associated with their profile.
    – user2752467
    Sep 16, 2019 at 23:16
  • 1
    Moderators said they have to raise it to community team. It seems community team is just ignoring the request.
    – anon
    Sep 17, 2019 at 7:30
  • 2
    @Mars Both answers can be correct at the same time...
    – Tim B
    Sep 17, 2019 at 8:36
  • @TimB fair enoguh
    – Mars
    Sep 17, 2019 at 8:37
8

First off, Mr. Positive has already succinctly answered your question. Report this and do it now (or as soon as you can reasonably pull the information together).

I’m compelled to add a separate answer mainly because a comment alone doesn’t underscore the issue here. If you do not report this, you are missing the entire point of what Information Security is and your company is an InfoSec company! As a part of the development team, you are expected to be more of an expert than the graphic designers and accountants. And if your company has anything close to the rules that any company should have, much less a mid-sized InfoSec, even the non-technical staff are supposed to report things that look less suspicious than what you’ve laid out.

As to how to report, you indicated “We are all sure he is stealing all of the company code”. I would hope you could get the backing of some of whoever constitutes “we.” If you're concerned about how it might come across, you could try to downplay a bit with terminology like, “it seems possible” vs. “there’s no question.” But what you've described doesn't sound like you should have to worry about that.

Though it’s a hard situation, this could even be good for you. If the direct manager’s manager is going to think anything but positively of you for raising such a security concern, he has no business being in a company that provides InfoSec tools, and it’s a very good indicator you should look for better management.

I’d also add that if you have an InfoSec department, they may be worth considering as a different or additional resource to whom to report this activity.

Improve this answer
0
2

Is the git account managed on your company's servers or are you a private repo on a public profile?

The reason I ask this is because at my previous company we all had public git accounts that held private repos. Until my company got their github enterprise and managed the accounts and repo access from within. Basically it removed the need to maintain a public github account and simply used a internal enterprise account that is managed by a admin. Many of our public git profiles had helper classes and projects that are available internally but not publically. Yet because they pushed their changes to their public, it is.

I also forked a lot of people's internal project. One comes to mind is a VIM profile that my coworker had on his profile. I'd fork it, modify it for my local settings, and pushed the commit upwards but never PR it to his main repo since it wouldn't make sense. I also copied a lot of API callers that I modified for different projects that required RESTful APIs.

So there can be a lot of reasons outside of malicious reasons. I would first establish if his public account has anything that is absolutely sensitive. Don't assume malice where it can be explained by simple ignorance.

Improve this answer
7
  • Don’t assume innocence when thise capable of malice can make it look like a simple error... the stakes are too high.
    – Solar Mike
    Sep 16, 2019 at 16:53
  • 3
    One of the assumptions is damning to a human, with limited money and a lot to lose over a mistake...The other to a multi million dollar corporation who might lose a little money and maybe some reputation. We assume innocence first in western societies generally....The proper authorities with the proper info should figure out the rest.
    – DrMrstheMonarch
    Sep 16, 2019 at 18:24
  • What dou you mean by public git accounts? Github?
    – Bernhard Döbler
    Sep 16, 2019 at 20:03
  • @morbo We assume malice as a matter of courtesy, stupidity as a matter of probability.
    – StackOverthrow
    Sep 16, 2019 at 23:01
  • 1
    @BernhardDöbler There's a github enterprise that a big company can host on their own servers. Basically it's truly "private" because the company is maintaining it as if they are running their own github.companyname.com site. A public git account is something you create on github.com that anyone can see and where you can set projects to "private."
    – Dan
    Sep 17, 2019 at 12:21

You must log in to answer this question.