69

During last months the project manager (PM) from a client requested many times to remove some security features we put on their web portal to “ease our day-by-day operativity” (their own words).

Initially these requests were calm and we managed to stop them. After a while PM became more pressing, so I (as the team leader of the project) wrote a detailed email with clear evidence of the dangers that could be incurred by meeting their demands (I copied my boss, my team, our IT security division, our test/QA division and their boss). After a few days PM replied to me only (all other recipients removed) in a very unprofessional way (all capital letter sentences, direct and personal insults, threats of lawsuits for incompetence, etc) ordering me to apply their requests or “to be prepared to face very serious consequences” (again their own words, capital letters removed by me). I immediately discussed the topic with my boss and she suggested to do what PM had requested and she would have sent an email (with all the previous recipients copied) saying we did all the requests but stressing again our concerns. So I removed the security features and she wrote the email.

From that day to yesterday, total silence. Yesterday morning PM wrote me that their security team found out someone entered illegally in the portal and some private data from their customers was found online. PM also said that this was “all my fault” because they were unaware of the possible consequences of “your choice to disable our portal security features”. Looking at how PM described what had happened, I noticed that this was (literally, step by step) one of the scenarios I highlighted as a potential security threat. I went to my boss again, and she decided that we had enough of PM. So for next week she will organize a call to discuss the situation with me, she, our division general manager (2 levels above my boss, so 3 above me), a senior coworker from our security division, PM and their boss.

Although I think I did nothing wrong and I can count on my boss, I'm also afraid there may be consequences for me. How can I be fully prepared for this important call and cover my back? How should I behave during it?

  • I don’t see where your being blamed for the data loss by your boss? Who exactly is blaming you? Seems like it’s your IT coworker? Why are you worried about their statement? Do they have the power to fire you? – Donald Mar 18 at 12:26
  • 1
    @Donald PM is blaming me of the problem. I trust my boss and my company. I have no fear of being fired. I just want to be 100% sure that I've done everything correctly and I want to know if I need to be prepared in a special way for the call – Jack Jack Mar 18 at 13:03
  • I don't know if it would affect anything, but is there any standard verification process for changing features? Like is there any chance that they could claim that you didn't follow proper procedure for implementing the change? (maybe it's time to discuss that with the company too?) One scenario I imagine is where someone else gets access to the email, and is requesting the feature be removed for nefarious purposes. I know at least one situation where someone tried to do this with their contract billing address; but the client thought something was off and called to verify first. – JMac Mar 18 at 17:09
  • 1
    Is there some doubt or dispute that this "very unprofessional" email is real and legitimate (i.e. sent by PM) ? Emails are easy to fake. – fraxinus Mar 18 at 20:00
  • @JMac when a change in features on project requires a code change, a document is required in order to go ahead with the request. When a configuration change is required an email with the proper recipients is enough. Here we were in the second scenario, so the email was the appropriate way to ask, standard procedure was followed – Jack Jack Mar 19 at 7:30
39

How can I be fully prepared for this important call and cover my back? How should I behave during it?

Sounds like your boss has it covered.

Talk it over with your boss. Ask her if there's something else you should do as preparation. Then follow her lead.

Bring your notes to any meeting. Only use them when your boss asks you to do so.

Don't be defensive. Act like you have done everything asked of you in spite of your professional recommendations - because that's exactly what happened. Indicate that you continue to be happy to do whatever is requested.

Start thinking about how you can re-implement the security features that you were told to remove. Prepare estimates for doing so.

And don't be so worried. You have handled this professionally. Laying out the options and your professional recommendations was smart. Kicking it up to management when your warnings were overridden was perfectly appropriate. Doing what the well-informed PM required was correct. And clearly, your boss has your back. This is all good.

| improve this answer | |
  • @PatriciaShanahan Because this portal is highly configurable, the restore is a simple configuration file modification and an application restart – Jack Jack Mar 18 at 11:53
  • 2
    @JackJack that's as maybe but (a) the customer doesn't need to know that and (b) but should still be billable. – AdzzzUK Mar 18 at 12:56
  • 19
    I would also add that future such requests should be replied with a "we need a formal requirements change request and sign off" as opposed to just email. This helps the paper trail and everyone who needs to becomes aware. – pboss3010 Mar 18 at 13:40
111

You highlighted the security concerns. Everyone was aware of what would happen. You have a paper trail.

Also, most importantly, your boss will have your back. So, relax and print the documents right now and highlight your warnings as mentioned by TheoreticalMinimum in the comments. Bring those as proof when asked. You are completely safe on this.

| improve this answer | |
  • 66
    +1 for 'print the documents' - files go missing from servers – Dave Gremlin Mar 18 at 10:24
  • 66
    Especially print the threatening e-mail that the PM sent only to the OP. That is the smoking gun for it being the PM's decision to remove the features. – Patricia Shanahan Mar 18 at 11:13
  • 9
    Print also all the headers of these mails. – fraxinus Mar 18 at 20:02
  • 1
    OP is safe as long as his company wants to "win" the argument more than they want to keep the client as a client. OP should begin preparing their CV – Richard Mar 18 at 20:08
  • Note "all the headers" in @fraxinus's comment. Many mail readers only show a summary by default. You should see a series of lines saying "Received from X by Y...", where X and Y are servers in a chain from the sending machine to your mail server. – Patricia Shanahan Mar 19 at 3:58
28

Already good answers but one thing to add

How can I be fully prepared for this important call

You should discuss with your boss exactly how this meeting is supposed to go, especially if you don't have a lot of experience with this type of thing

  1. What's the goal and desired outcome of the meeting?
  2. What's the agenda and who is going to drive?
  3. What is your roles, when should you speak up and when should you shut up?
  4. What exactly are the supporting documents you should have. What form should they be in and when & how should they be presented. Review them upfront
  5. What are some key-phrases you should be using? Write them down and memorize them.
  6. Discuss what possible reactions/arguments the other party might have and how you will answer/react to them

If you go into a potentially controversial and stressful meeting, it's helpful to be well prepared. The more you can anticipate what exactly is going to happen, the better you can react, the more at ease you will be and the more likely it is you will get the desired outcome.

One of the potential meeting strategies is to find the weakest person on the other side of the table and start hacking them: try to get them frazzled, riled up, or confused so they say something wrong or inappropriate. Make sure that's not you.

Remember: you are fine. You did all the right things and have documentation to back it up.

| improve this answer | |
  • 3
    I think this is very good advice. Be aware who the participants of the meeting are, what the outcome is, what you should say (and how to phrase), and what you should not say, and which phrases to avoid. The OP mentioned that "private" data was leaked. It's not 100% clear what that means, but if it includes protected personally identifying data, there may very well be legal blame, even criminal, going around. The OP did nothing wrong, so should avoid phrases like "I'm sorry", that may be construed as accepting responsibility. – Jörg W Mittag Mar 18 at 18:59
13

Already lots of good answers, but an additional point I haven't seen well-covered about your behavior during the meeting. Remain calm.

Judging by the tone of the emails you have received from this customer, be prepared for them to yell at you, blame you, and just be generally unpleasant. Let them. Let them say everything they feel like they need to say and don't interrupt. Let them wear themselves out and don't take it personally. Then when it is your turn to talk, you can calmly present your printed emails where you outlined all the risks and they approved the changes anyway. They are going to try and drag you into a shouting match, but it is really hard to do that with someone who won't engage. Don't let them drag you own to their level.

You did nothing wrong and have the documents to prove it. It's likely this customer actually knows they are in the wrong, but is trying to pin it on you to save themselves. If you let them get under your skin and get worked up, that's their last chance to drag you down with them. It won't work if you stay calm and professional.

| improve this answer | |
-1

After a few days PM replied to me only (all other recipients removed) in a very unprofessional way (all capital letter sentences, direct and personal insults, threats of lawsuits for incompetence, etc) ordering me to apply their requests or “to be prepared to face very serious consequences”

If you haven't already done so, go ahead and export those emails to somewhere else in case you cannot access the emails for whatever reason.

Next, you told your boss and showed the emails explaining everything that could happen that did happen. Now it's a waiting game. Should they throw you under the bus, you can bet your emails will mysteriously disappear and you fired.

| improve this answer | |
  • 1
    All emails were already forwarded to my boss, she red them. She also wrote the last email by herself. – Jack Jack Mar 19 at 7:34
  • @JackJack Out of curiosity, did you forward them before or after you made the changes? – EJoshuaS - Reinstate Monica Mar 19 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .