Forced by client to remove security feature, now client blames me for data theft

Question

During last months the project manager (PM) from a client requested many times to remove some security features we put on their web portal to “ease our day-by-day operativity” (their own words).

Initially these requests were calm and we managed to stop them. After a while PM became more pressing, so I (as the team leader of the project) wrote a detailed email with clear evidence of the dangers that could be incurred by meeting their demands (I copied my boss, my team, our IT security division, our test/QA division and their boss). After a few days PM replied to me only (all other recipients removed) in a very unprofessional way (all capital letter sentences, direct and personal insults, threats of lawsuits for incompetence, etc) ordering me to apply their requests or “to be prepared to face very serious consequences” (again their own words, capital letters removed by me). I immediately discussed the topic with my boss and she suggested to do what PM had requested and she would have sent an email (with all the previous recipients copied) saying we did all the requests but stressing again our concerns. So I removed the security features and she wrote the email.

From that day to yesterday, total silence. Yesterday morning PM wrote me that their security team found out someone entered illegally in the portal and some private data from their customers was found online. PM also said that this was “all my fault” because they were unaware of the possible consequences of “your choice to disable our portal security features”. Looking at how PM described what had happened, I noticed that this was (literally, step by step) one of the scenarios I highlighted as a potential security threat. I went to my boss again, and she decided that we had enough of PM. So for next week she will organize a call to discuss the situation with me, she, our division general manager (2 levels above my boss, so 3 above me), a senior coworker from our security division, PM and their boss.

Although I think I did nothing wrong and I can count on my boss, I'm also afraid there may be consequences for me. How can I be fully prepared for this important call and cover my back? How should I behave during it?

Answer 1

How can I be fully prepared for this important call and cover my back? How should I behave during it?

Sounds like your boss has it covered.

Talk it over with your boss. Ask her if there's something else you should do as preparation. Then follow her lead.

Bring your notes to any meeting. Only use them when your boss asks you to do so.

Don't be defensive. Act like you have done everything asked of you in spite of your professional recommendations - because that's exactly what happened. Indicate that you continue to be happy to do whatever is requested.

Start thinking about how you can re-implement the security features that you were told to remove. Prepare estimates for doing so.

And don't be so worried. You have handled this professionally. Laying out the options and your professional recommendations was smart. Kicking it up to management when your warnings were overridden was perfectly appropriate. Doing what the well-informed PM required was correct. And clearly, your boss has your back. This is all good.

Answer 2

You highlighted the security concerns. Everyone was aware of what would happen. You have a paper trail.

Also, most importantly, your boss will have your back. So, relax and print the documents right now and highlight your warnings as mentioned by TheoreticalMinimum in the comments. Bring those as proof when asked. You are completely safe on this.

Answer 3

Already good answers but one thing to add

How can I be fully prepared for this important call

You should discuss with your boss exactly how this meeting is supposed to go, especially if you don't have a lot of experience with this type of thing

1. What's the goal and desired outcome of the meeting?
2. What's the agenda and who is going to drive?
3. What is your roles, when should you speak up and when should you shut up?
4. What exactly are the supporting documents you should have. What form should they be in and when & how should they be presented. Review them upfront
5. What are some key-phrases you should be using? Write them down and memorize them.
6. Discuss what possible reactions/arguments the other party might have and how you will answer/react to them

If you go into a potentially controversial and stressful meeting, it's helpful to be well prepared. The more you can anticipate what exactly is going to happen, the better you can react, the more at ease you will be and the more likely it is you will get the desired outcome.

One of the potential meeting strategies is to find the weakest person on the other side of the table and start hacking them: try to get them frazzled, riled up, or confused so they say something wrong or inappropriate. Make sure that's not you.

Remember: you are fine. You did all the right things and have documentation to back it up.

Answer 4

Already lots of good answers, but an additional point I haven't seen well-covered about your behavior during the meeting. Remain calm.

Judging by the tone of the emails you have received from this customer, be prepared for them to yell at you, blame you, and just be generally unpleasant. Let them. Let them say everything they feel like they need to say and don't interrupt. Let them wear themselves out and don't take it personally. Then when it is your turn to talk, you can calmly present your printed emails where you outlined all the risks and they approved the changes anyway. They are going to try and drag you into a shouting match, but it is really hard to do that with someone who won't engage. Don't let them drag you own to their level.

You did nothing wrong and have the documents to prove it. It's likely this customer actually knows they are in the wrong, but is trying to pin it on you to save themselves. If you let them get under your skin and get worked up, that's their last chance to drag you down with them. It won't work if you stay calm and professional.

Answer 5

After a few days PM replied to me only (all other recipients removed) in a very unprofessional way (all capital letter sentences, direct and personal insults, threats of lawsuits for incompetence, etc) ordering me to apply their requests or “to be prepared to face very serious consequences”

If you haven't already done so, go ahead and export those emails to somewhere else in case you cannot access the emails for whatever reason.

Next, you told your boss and showed the emails explaining everything that could happen that did happen. Now it's a waiting game. Should they throw you under the bus, you can bet your emails will mysteriously disappear and you fired.