89

In the past I have found out that clients were being spied on. This happened twice; in both times I told them. And in both times I got burned for it. I have no regrets and I got a clear conscience. However, I am about to go telling for the third time, so I just have to ask about this. First, some background.

The first time, I pointed out to our liaison within the client company some spying devices we had found in their offices. We found those while mapping their wired infrastructure. They freaked out and told us to remove those devices immediately (they were afraid of industrial espionage). A couple days later someone higher ups in the client demanded compensation for stealing their equipment. Turns out one corporate level was being spied on by another level higher up, without the lower level knowing so. This led to a huge mess. They accused us of stealing the devices but we didn't keep them, we handed those to the police. Seems like a couple of those were illegal just to own. Lots of meetings to explain things to everybody, we almost didn't get paid, and we never got a contract with that client again.

The second time was worse. We were changing the whole wiring of a client's apartment (data, power and phone lines), when we found lots of spying devices of such sophisfication as we had not seen before. The client was away from home, traveling. I emailed him pictures of some of the devices, and he replied telling us to destroy them. Emphasis on destroy. When we stepped out of the apartment we were all arrested. The client was being spied on by the federal police (who had men watching outside the apartment for any suspicious activity). We don't have terrorist threats in Brazil, this guy was most probably being watched on due to involvement with white collar crime (he's a polictician). Still, it was a hellish situation, which took a lot of time, red tape and lawyers to get out of.

Back to present, and in another client's apartment. There was an AC socket which we thought was on a line completely disconnected from the main electric bus, yet we could read the signal from the device we use to map wires coming out of there. Usually this means the wires are not properly connected to the socket. When we opened it, there was a really small camera there. We just left it there this time.

I'd like to tell the client. I neither can nor want to imagine why someone would want to spy on her. I'd really like to dismiss it as just a case of a suspicious husband, which is common around here. If it is the federal police again, me and the staff can get into some real trouble - but I have talked to them, and we all feel our conscience weighting on us.

Is there some sensible approach for these kinds of situations? What are the ethics involved in such cases?

closed as off-topic by Joe Strazzere, IDrinkandIKnowThings, Jim G., jcmeloni, gnat Oct 30 '13 at 17:03

  • This question does not appear to be about the workplace within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Comments deleted. Please use comments to improve/clarify the question. For extended discussion please use The Workplace Chat. – yoozer8 Oct 29 '13 at 13:48
77

Wow, that's some story. While I've never encountered anything remotely that extreme, I've been on both sides of conversations that go like this:

Consultant: Are you aware of $dangerous_thing?
Customer: Ack, no! Kill it!
Consultant: I'm not authorized to do that right now. Here's what I need you to do...

In the corporate-spying case, the issue seems to have been that the person telling you to remove the devices didn't have the authority to have you do that. And it sounds like a case of he-said/she-said; there's no paper trail and you're being accused of things you didn't do as a result. Any time you encounter this kind of scope creep, it's wise to step back and make sure that the new work is authorized, that you'll get paid for it, and so on.

A common way to do this is to write up a work order and have the client sign off on it before you do the work. (You can include a statement about the signer being authorized to represent the client, if it's a company.) It needs to be the client's problem, not yours, if the work isn't actually authorized. You can meet your ethical obligation to inform your client without immediately moving on to taking action.

I don't know what you could have done to anticipate the police case, though.

  • 19
    +1 for "It needs to be the client's problem, not yours". it's the kind of thing that makes you say "why didn't I think of that before." BTW it was not FBI because I'm not in the US. I wish it was FBI... for all I know they are more civilized when dealing with such situations (i.e.: they don't show guns before asking questions). – user10483 Oct 25 '13 at 16:40
  • 13
    I think the key is that you can (and should IMO) tell your clients, which is the question in your title, but there's a difference between informing and taking further action. – Monica Cellio Oct 25 '13 at 16:44
  • About taking further action... I always have problems with this "think before you act" thing, but thankfully I'm getting feedback on what to do this time :) – user10483 Oct 25 '13 at 16:46
  • 9
    @DanPichelman wow, really? How is Joe Random Electrician (or whatever) supposed to know if it was planted by the police or by the homeowner's nefarious neighbor? – Monica Cellio Oct 25 '13 at 18:23
  • 6
    @DanPichelman agree completely about consulting a lawyer. I'm shocked that Renan/Renan's employer didn't get legal advise about what to do in a future situation after being arrested the last time it happened. – Dan Neely Oct 25 '13 at 20:25
20

This should be covered under your contract really, but in general, yes, you do ethically, and probably legally have a obligation to let your client know.

There's no way, without being told, that you're going to know whether $nefarious_device is something that the client's organisation, law enforcement (who in turn might not be entirely honest in many jurisdictions) or industrial espionage.

On the other hand, unless you're explicitly hired to sweep for, and remove such devices, its not really your job, its no different from finding porn on a system - there's graduated response, and in general, its best to leave authorised folks to deal with it.

Firstly, as always, cover thine ass. Get your legal folks to work out what's the best way of dealing with such a situation, and have it on your contract. If its not specifically part of your job scope, removing such devices need not be your responsibility. Let the client handle it.

Telling your client that you found spying devices however is a responsible action. Removing it is a jar of angry snakes as you have found (granted, this is significantly worse than anything I have heard of).

That said, considering surveillance of that sort is illegal, why not ask the client to call the police and tell them? If its theirs, they know they've been caught with their hand in a cookie jar (or better yet, they'll be stepping on each others toes). If its not the police, its no longer your problem.

  • 4
    I like your last paragraph there. I'd even like to watch whatever ensues out of that. I'd be watching it while eating popcorn and grinning. – user10483 Oct 26 '13 at 6:20
  • 16
    Most important skill I learnt in the military. When in doubt, make it someone elses problem ;p – Journeyman Geek Oct 26 '13 at 8:38
  • 1
    @JourneymanGeek - Pretty much everyone I know who has served in the military, lives by this policy, its sort of a good policy. – Donald Oct 28 '13 at 16:11
3

First of all, the 'spy device' might be there because the legal resident/owner/business wants to see who's breaking into her place. Of course, maybe they are spying on you, to see if you're doing your job. Parents with young children also have 'nanny-cams'. These are all devices they know they have and want to have.

So the opening gambit in this situation might be to ask the owner, "Is there anything I should watch for while I work? Any past issues? Any odd wiring that you know about?" This is non-confrontational and covers everything from shoddy wiring to a known security device.

In future situations you might point out to potential clients, whether personal or corporate, that you have run into situations where spying equipment was encountered, and you had to deal with suits and cops as a result. Rather than dealing with this question after you've found something out, you can get advice from the client on what approach you should take.

If you put a piece of tape over the socket, if the lady knows she'll just remove it. If she asks you why it's there, you can say you found a problem with it. If she asks you 'what kind of problem?' - simply show here the camera without saying anything or otherwise disturbing it (perhaps other than pulling it out of the junction box). She might want to discuss whatever you've found 'out of earshot', since there may well be audio plants.

What it sounds like is you've made a presumption that the spying was criminal and acted first and asked questions later. It's better to get potential context first, then figure out who to inform and what to modify.

  • 12
    "So the opening gambit in this situation might be to ask the lady if she has set up a camera-based security system in her home. If that answer is no, then you might ask round-about whether she has husbands or lovers that would have a desire to 'keep an eye on her'" - For my family and I any service person asking questions like this will be promptly told to get out. It's a rude assumption and not the right way to approach the concern. Your point about past experience is a good one. Your idea to tag and show is great! Perhaps this can be reworded to be a better answer. – Freiheit Oct 25 '13 at 20:19
  • I made some edits. I really like @Meredith's ideas. Tag the problem then ask is a great plan. – Freiheit Oct 25 '13 at 21:25