106

I am the most senior technical employee at a small company providing software as a service to other businesses. The company only has about 10 employees, so one of the directors does a lot of the sales & marketing.

One client they are trying to get is funded by local government, so (rightly) has strong security checks as part of their procurement process. One such check is ensuring that we penetration 'pen' test our software.

The director asked me to fill out a procurement document that had been sent to them by the client, including a question about pen testing. I, truthfully, wrote that we had never pen tested our software. (It's worth pointing out at this point that even as the most senior technical employee, I don't have decision making abilities. Decisions are taken by the (non-technical) directors, often in different directions to what I, with a technical background, would take. I've been lobbying to implement stronger security practices such as pen testing since I started at the company in 2020, but that advice has not yet been taken.)

The director was not very happy with the document that I had produced (at one point writing 'what the f***' in their email correspondence with me), and they asked me to rewrite the document with the, quote, "more political" answers that they would provide. They provided me with an answer to the pen testing question that essentially said "we did pen testing when we launched, but haven't done it since". I made sure they were aware that this wasn't true, changed the answer in the document to theirs verbatim, exported a PDF and send it back to them as requested.

At that point, I was confident in my personal ethical position. Yes I had produced a document that was factually inaccurate, but when I sent it, I was very clear that I thought the sections that were not written by me were not accurate. I don't think any reasonable person could interpret this as dishonesty. At no point did I present something as fact that I knew wasn't fact.

The director then chose to forward this to the client, without my "this is not accurate" warning.

The client came back and asked to see evidence of the pen testing that had taken place. The director simply responded with "this is a question for our technical manager, [my name], I'll set up a zoom so you can talk"

I now feel like I'm going to have to defend the company's position "we have pen tested", knowing that it is not true. Which leads to my questions:

Have I done anything fraudulent so far? (To be clear, I'm not looking for legal advice, just opinions from people who may have been in a similar situation.)

If I take this zoom meeting, and toe the company line (which I know to be false), am I committing fraud which I could be personally liable for? (Again, not looking for legal advice, just opinion.)

If this is fraud, how can I explain that I don't want to be a part of this to the directors? And is such an issue worth resigning over?

17
  • 16
    Perhaps the better question is, if they fire you for refusing to lie, do you have legal recourse?
    – nuggethead
    Sep 17, 2023 at 21:11
  • 30
    I know this comment will probably be deleted but I feel like we need a collective emoji summation of the situation: 🤦🏻‍♂️ Sep 17, 2023 at 22:02
  • 6
    Side question - do you have the authority to approve and organise a penetration test ? It may get-around this whole issue, keep you employed, and help improve the company's product.
    – Criggie
    Sep 17, 2023 at 22:37
  • 35
    Find that email you sent and print it out or forward it to your personal email. Do it right now.
    – Qwerky
    Sep 18, 2023 at 8:37
  • 12
    Am I the only one that is a bit concerned by the fact that a 10-person software company has space for, apparently multiple, non-technical directors?
    – xLeitix
    Sep 18, 2023 at 8:43

15 Answers 15

124

I am not a lawyer, but... the common understanding of "fraud" is obtaining money or other advantages dishonestly by deception. If the client has made it clear that pen testing is an important part of this procurement decision, and your boss has made it clear that he wants you to deceive them about this, it's hard to see how that wouldn't be fraud. Whatever we want to call it, it's clearly unethical.

Moreover, since it relates to your area of responsibility, if it does blow up there's a good chance you'll be left holding the bag.

It sounds like you're hoping for a way to stand aside from this issue, let your boss commit fraud or not as he chooses without making you part of it. Leaving aside the morality of allowing that to happen, it's unlikely that this is an option.

Speaking from experience of seeing a similar scenario play out before, my experience of such people is that they're unlikely to accept "do what you like, just don't involve me" as an answer. You know he's doing something shady and very likely illegal; he knows you know. That makes you a threat. Making you complicit in that shady behaviour would make him safer, both because you'd have reason to keep silent and because he'd have somebody to throw under the bus if he got found out.

But if he can't have that, then the next best thing is to get rid of you, probably without warning. From there, if you try to make waves, he can represent you as "disgruntled ex-employee" and present the lie as being your idea.

Get legal advice, don't dawdle, and start looking for new jobs ASAP because resigning may not be your decision. Take printed evidence of what happened and keep it somewhere your boss can't get. My leaning would be towards tipping off the client, but that is probably an area where you'd be much better off taking advice from a lawyer than from the internet.

Footnote: people like your director love to give instructions verbally, because it gives them the option of denying it later or claiming they were misunderstood. ("Will no one rid me of this turbulent priest?")

A work-around for this situation is to put those instructions in writing for them afterwards, something like this:

To: MyBoss BCC: MyHomeEmail Hi Boss, just wanted to confirm my understanding of our conversation this morning. My recollection is that you'd like me to speak with Client and give them the impression that we have done pen-testing already - please let me know by COB today if I've misunderstood anything here, otherwise I'll proceed accordingly.

Better if you can bury that "please acknowledge in writing that you're soliciting for me to commit fraud" in among some more innocuous points, so it's not quite as obvious what you're doing.

This may not save your job in the long run, but it gives you at least some insurance against later denials.

9
  • 8
    Audio or audio/video recording the boss telling you to do something fraudulent would be nice to have.
    – user135112
    Sep 16, 2023 at 17:38
  • 41
    @Gantendo, audio/video recordings might be a great idea or they might be illegal in that jurisdiction under these circumstances. Louis needs to talk to a lawyer first.
    – Jetpack
    Sep 16, 2023 at 20:15
  • 7
    @Gantendo When recording isn't viable, a useful alternative can be to follow up the conversation with an email - "please confirm my understanding of what we just discussed". I've added this to my answer. It's not a perfect solution by any means, but better than just leaving it at a deniable unrecorded conversation.
    – G_B
    Sep 17, 2023 at 3:01
  • 1
    Better if you can bury that "please acknowledge in writing that you're soliciting for me to commit fraud" in among some more innocuous points, so it's not quite as obvious what you're doing. That's certainly one approach. The other, more risky from an employment standpoint, but arguably more ethical, is to be incredibly blunt, and say "My understanding is that you would like me to lie to the client, is that correct?" Sep 17, 2023 at 21:09
  • 37
    There is email trail of "what the f***" to the pen test question. OP needs to print 3 copies of this ASAP, laminate it, and put them in 3 separate locations for safekeeping.
    – Nelson
    Sep 18, 2023 at 0:35
99

Have I done anything fraudulent so far?

A good lawyer could argue "no", but you have in fact uttered a fraudulent document, knowing it will be used in a fraudulent manner by the director. You have aided and abetted a fraud.

If I take this zoom meeting, and toe the company line, am I committing fraud which I could be personally liable for?

Yes. And don't kid yourself that the director will let you off the hook. He has already told [client] that he is relying on your word that pen-testing was done, and that you told him that you can present evidence on demand.

If this is fraud, how can I explain that I don't want to be a part of this to the directors?

You say, "You have asked me to present [client] with evidence that we have pen-tested. But there is no such evidence, because we have not pen-tested. Do you want me to lie to [client]? If so, exactly what do you want me to tell them? Please write it down so I get the details right."

Is such an issue worth resigning over?

You don't have to resign. You're gonna be fired.

14
  • 87
    +1 for "You don't have to resign. You're gonna be fired."
    – user135112
    Sep 16, 2023 at 10:53
  • 13
    @Wowfunhappy It is the "Please write it down" part that could potentially save OP's ass in a hypothetical lawsuit. If OP has received instructions, in writing, from the boss it will be harder to scapegoat OP.
    – user135112
    Sep 16, 2023 at 17:12
  • 17
    @LoremIpsum Indeed. The idea is to gather evidence, and then run. You don't want to work for a company that does this kinda stuff. Decent chance this is the tip of the iceberg.
    – user135112
    Sep 16, 2023 at 18:18
  • 8
    Generally the hope behind insisting your supervisor put something stupid in writing is the hope that they'll back down rather than do something to incriminate themselves. Sep 16, 2023 at 18:44
  • 12
    Get a lawyer now. Writing down the unambiguous equivalent of "I'm ready to lie on behalf of the company, just send me a script" is a question that is unlikely to end up answered in writing and is entirely likely to be used as part of the process of firing and scapegoating you. Sep 17, 2023 at 18:47
73

The client came back and asked to see evidence of the pen testing that had taken place. The director simply responded with "this is a question for our technical manager, [my name], I'll set up a zoom so you can talk"

You're being set up to fail here: because the two options you have on this call are to lie to the client (which could easily constitute fraud, and you'll probably get called out on since you have no evidence), or to go directly against what your director has said and then deal with the fallout of that (note that if they try and fire you then you have a strong case for unfair dismissal, and potentially protection under whistleblowing laws - talk to a lawyer).

Personally, I would be looking for a new job at this point: because a company that expects you to lie to clients to win business is not one I'd want to work for, and your director is expecting you to do it or you'll be thrown under the bus. Not a good environment.

But shorter term, there's one other option to consider: go and get a pentest. If you can arrange one quickly enough, you can probably stall the client with something along the lines of "We're actually undergoing a pentest next week, and we should get the report by $date that we can share with you".

Oh, and given there's a real chance you could end up in an employment tribunal over this (especially if they try and bring disciplinary action against you or fire you), document everything, make copies of emails and correspondence about this, and store it outside of corporate IT. Always cover your arse.

6
  • 10
    This answer appeals to me. Even if they hire a company (or a kid from an agency) to do the most basic of checking, this meets the factual requirements for "we've done some testing"
    – Richard
    Sep 16, 2023 at 12:08
  • 11
    @Richard But the pen testing was put to the client as being done in the past. IMHO there is no win" scenario as anything that the OP does reveals to the client that they have been lied to, (or continues the lies if you want to fake the date of the pen test)
    – Peter M
    Sep 16, 2023 at 14:34
  • 20
    @PeterM it's certainly not a perfect solution, and is still somewhat dishonest. But the client will probably only care about the most recent pentest report (and may not really care at all - this is often just a compliance tickbox exercise). Given that OP has been put between a rock and a hard place, I think that it's probably the least bad option, and should buy them some time to go and find a better company to work at.
    – Gh0stFish
    Sep 16, 2023 at 15:18
  • 1
    Good answer. While being fired from the company for refusing to lie is still quite likely, this is the one answer that might actually salvage this situation and possibly even buy back a small measure of respect. Customer will almost certainly only care about the latest pentest and be willing to wait a few weeks for the results, so it could well be doable. Ideally leave a few weeks margin so your team can fix some of what the pentest finds, then get the updated report.
    – Thomas W
    Sep 17, 2023 at 23:03
  • If there are failures on the pen test, the OP has questions to answer about a fast-tracked and paid-for test that the Directors clearly don't see the value in anyway (the buck presumably ends with the most senior developer) and the client is lost. This just increases the pain, if anything
    – roganjosh
    Sep 18, 2023 at 11:53
26

Have I done anything fraudulent so far?

Yes. You created a document which contains false, misleading, or inaccurate information, and distributed it to others. It doesn't matter if you were explicitly told to do this, if you provided separate information explaining the deception, or if the person you gave it to understood the deception. At the point that you created and distributed it you expressed a lie to another person. The creation AND distribution are the key points - if it never left your procession then there's no problem. If you didn't create it then there's no problem. Adding your signature to something someone else created is the same.

If I take this zoom meeting, and toe the company line , am I committing fraud which I could be personally liable for? (Again, not looking for legal advice, just opinion)

When you use the words "fraud" and "liable" then you are explicitly asking for legal advice. Consult an attorney. In some areas lying to some government employees could be considered criminal.

If we ignore legal culpability, civil or criminal liability, and just ask, "Is taking the call and maintaining the deception fraudulent?" then the answer is clearly yes. You are not an actor, paid to play a part in a work of fiction. You are an expert in your field paid to represent objective facts and professional opinions about a product you financially benefit from.

Carrying on the deception is defrauding those you convey the lie to.

Further, your director is setting you up to take full blame and responsibility. If the customer buys the product, and never finds out about the fraud, then the director wins a sale and they continue to take risks for financial gain - lying will sometimes net you a sale where it otherwise wouldn't.

If their risk doesn't pay off and the customer discovers the deception then they merely need to state "My expert told me it was pen-tested, provided this document in answer to the customer's questions, and then took a call with the customer telling them the same thing. All the communication I sent was misunderstood - I was never asking them to lie, I understood from their conversations with me that it was pen-tested and I was merely helping them understand how to fill out the form given what they told me in person."

Keep a paper trail. Make sure to include others in the company in your communications - always cc one other person in all emails with this director.

If this is fraud, how can I explain that I don't want to be a part of this to the directors? And is such an issue worth resigning over?

Send to all directors:

"I incorrectly filled out that document and will contact the customer to retract it. If you'd prefer to resolve this with the customer please cc the email to me as well so I can clearly document the resolution of the error. I'm happy to meet with the customer at any point to explain the error and the current status of the software including the lack of pen-testing. I'm also happy to discuss possible timelines for pen-testing. I regret the error, and will endeavor in the future to avoid similar errors."

The company will always seek to protect itself, so making threats of any kind will cause you more problems. Resigning is a reasonable course of action if the culture of the company allows for such deception in general. If they're lying to gain customers then the chances that they'll lie to you are pretty high. If this individual appears to be an outlier, and if, during this process of revision and reconciliation, you find others are unhappy with the deception, then it might be worth staying with the company.

If resigning, get a new job first, and hand in your minimum (or two weeks) notice only after you've secured another position. Again, if they're lying to clients, then you don't want to give them opportunities to hurt you or your job prospects.


To delve further into the ethical case for this being considered fraud:

If the director just wanted a document prepared without technical expertise then they could have filled it out themselves. They could have had a secretary do it, or farmed it out to a contractor.

They clearly wanted

  1. The document had to contain incorrect information
  2. The document had to come from a person with the technical expertise to understand the question and formulate the correct answer.

That they asked for an incorrect document, and repeatedly asked and followed up with the technical expert to have them fill it out indicates that they were asking for participation in fraud. They needed a technical, expert opinion from an expert in this field to state something that was false which they could then present as correct and having come from an expert familiar with the product and its development.

I would be hard pressed to explain to anyone "Most of the time I provide correct technical documentation using the full extent of my training and expertise. Sometimes, however, I'm just a secretary, and I fill out forms and documents that I would normally handle using my expertise, but instead fill them out with answers provided by someone who is not expert in my field. I sign these forms, and there is no discernible way - looking at the document alone - to determine which role I played at the time I filled it out."

It is unethical to, as an expert, sign or create a document in your field of expertise that isn't correct. In some areas - such as civil engineering and notary public - this is often licensed and codified in law, and there are civil and criminal liabilities for creating and signing documents as a professional that are incorrect.

To do so in a field that is not regulated is still unethical at best - and likely could constitute fraud - even if there is no intention to defraud on the part of the professional who created the false document.

Again, this is from an ethical standpoint, and not a legal one.

11
  • 2
    Don't give the director a chance to further sabotage the employee.
    – Corbin
    Sep 17, 2023 at 15:19
  • 3
    "You created a document which contains false, misleading, or inaccurate information, and distributed it to others." - this is simply false. OP produced a document as was requested by his boss. If I tell you to write a document with contents of "Moon is made out of cheese" and to send it back to me, and you do that, that is not a fraud, you are doing exactly what I asked you, I'm not cheated in any way. The manager forwarding that to a unknowing client is committing fraud, on the other hand, and so is OP if he goes to that meeting and claims validity of that data.
    – Davor
    Sep 18, 2023 at 9:04
  • 4
    @Davor If I ask you to produce a document that details a plausible set of hours worked by a set of fictional employees on a task we have a contract from the government on in the format the government expects, and you do it, and I send it to the government in order to defraud them, you saying "but it was just me following orders, I never sent it to the government" won't work. The OP knew why they wanted those lies in the document, and they wrote the document, and the document was used to lie.
    – Yakk
    Sep 18, 2023 at 13:45
  • 1
    @Yakk I don't agree. The OP wrote the document as instructed and explained why it shouldn't be sent to the client. The OP never intended the document to deceive anyone. Sep 19, 2023 at 4:57
  • 1
    @Yakk If he didn't intend the document to be used to defraud anyone, it's not fraud. And he did not. He prepared the document as he was instructed to do and specifically directed that it not be passed to the client. The post is proof of this -- now that he found out the document did go to the client, contrary to his intent and direction, he is perplexed about what to do next. Your hypothetical is inapplicable because there are specific laws about IDs that do not apply to ordinary business documents. Sep 19, 2023 at 15:23
25

As I see it, you have done something wrong. You are the technical person; you should not be constructing documents you believe will be sent to a client that are untrue.

It's your choice, but if I were you I would email your directors now setting out the following:

  • a large customer requires our software to be pen tested
  • we have not done pen testing despite my repeated advocating for it
  • I filled the customer's technical questionnaire truthfully
  • I was told to change it, which I did
  • Upon reflection I believe this ethical misstep will cause the company great risk, and would like us to:
    1. schedule a pen test ASAP
    2. tell the client tomorrow there was an error in internal status reporting and there is a scheduled pen test
6
  • 3
    This is a great answer. Documents like the one OP filled out are a good indicator of what the market expects. They can use it as evidence that the company should be doing pen-tests, and improving their security stance.
    – xer0x
    Sep 16, 2023 at 20:27
  • This is surrender to the whims of the director, which should not ever happen in the face of technical requirements.
    – Corbin
    Sep 17, 2023 at 15:19
  • @Corbin thanks, but I don't understand: what is surrender to the whims of the director?
    – Rob Grant
    Sep 18, 2023 at 11:43
  • The director wants to lie. This is a whim: a desire which should not be taken seriously. In the face of technical requirements -- what we would elsewhere call engineering requirements -- such desires should be ignored.
    – Corbin
    Sep 18, 2023 at 13:53
  • 1
    One possible adjustment if you want to allow for face-saving on all sides is to say something like "I was told that we'd done pen-testing in the past, before I joined the company, so I changed the answer." "As I've been unable to find any documentation from that testing and it would be outdated anyway, my technical recommendation is that we'd need a new test." The key idea is to still preserve the fix-it focus, but without accusing anyone (including yourself, but also including the director) of anything more than a breakdown in communications. Then look for a new job.
    – Josiah
    Sep 18, 2023 at 20:49
5

You either are going to resign/be fired or to commit fraud. The latter you don't want to do, both ethically and legally.

So, as long as you have paper trail of their fraudulent plans and their instructing you to be a part of it, just pretend you accept your director's instructions and during the call explain to the client that he was lied to by the directory and no penetration testing has ever been performed. At least you walk away with a clean conscience and you cannot be fired for cause.

5

Producing a pen testing (or a security audit) report is no small feat.

Shop around for a reputable third party to do the pen testing for your company. Then prepare a report outlining the cost of pen testing and the time frame it can be done within. Doing the pen testing will take time. And fixing all the issues, the pen testing will uncover, will take time as well, probably several months.

Then call the client ahead of schedule on the phone and have a private talk with them. Ask questions. Ask about their timeline. Find out if they're serious. For all you know, they may not be. And suggest the idea of a 3rd party doing it.

If they ask about seeing the previous pen testing report, insist on producing a more up-to-date report. Be like a broken record if you have to. And if you must throw someone under the bus, throw the director under the bus (but only do so as a last resort).

But most likely, the potential client is not interested in a half-baked out-of-date report anyway.

3
  • Slapdash maintenance does not replace regular maintenance.
    – Corbin
    Sep 17, 2023 at 15:18
  • 2
    If OP repeatedly refuses to acknowledge the existence of the previous report, the client is going to figure out pretty quickly that it doesn't exist.
    – G_B
    Sep 18, 2023 at 0:19
  • In that case, if the client keeps on insisting, throw the director under the bus. But it's better to have that conversation privately without the director being present. That's why I'm suggesting, he calls ahead of time. Sep 18, 2023 at 17:18
4

You are being setup to take the blame for fraud.

Your manager and every other corporate officer will deny all knowledge of this, blame everything on you, and very possibly leave you with criminal and/or civil charges.

You should discuss this matter with your lawyer and see how you can protect yourself. If you do not have a lawyer, you need to find one.

Do not do anything else with this matter before you talk to your lawyer.

3

The solution is simple: Ask the director what he intends to be done? Let him understand that you can't just make something up that will stand under scrutiny.

Usually it's solved by you missing the meeting that day and someone else handling it with some vague crap. It happens all the time in many scenarios where hard questions will be asked.

0
1

At that point, I was confident in my personal ethical position. Yes I had produced a document that was factually inaccurate, but when I sent it, I was very clear that I thought the sections that were not written by me were not accurate. I don't think any reasonable person could interpret this as dishonesty. At no point did I present something as fact that I knew wasn't fact.

I would have sent the document in an email with my position specified in it. I have had to deal with business partner making up similar lies often. And I would always leave an email trail. You need to protect yourself.

I don't see how you have committed fraud as you have only sent the document internally and have presumably verbally told them you are unhappy with it. However, you could still be held responsible in the future.

In New Zealand, for example, the Companys Act specifies that if an employee performs an act that a Director normally would, then that employee is held accountable as if they were a director. Legislation in your country is probably softer.

Going forward, I would advise you not to lie to a Client. Instead, tell your manager that you can not lie to a Client and they have to come up with another solution. Eventually it is up to you. You either lie to a Client (and take a risk of getting prosecuted) or you take a risk of getting fired.

2
  • He changed the text to something untrue in a document which he knew would most likely be sent to the client (why else would he be asked to change it?) Sep 17, 2023 at 8:05
  • 1
    This answer is counterfactual; the question was not about what they should have done in the past, but what they ought to do in the future.
    – Corbin
    Sep 17, 2023 at 15:18
1

IANAL, so I cannot comment on whether you are specifically liable.

I have been an engineer and consultant supporting sales for a technical company, so I have been involved in similar situations. At this moment you are on thin ice ethically.

You are not thinking about this properly. You are essentially asking how you can participate in lying to the customer without being culpable yourself. That circle cannot be squared - you are either in the deceit or you are not.

... how can I explain that I don't want to be a part of this to the directors? And is such an issue worth resigning over?

You should make crystal clear, in short direct declarations, that you will not lie, misrepresent or deceive, nor will you facilitate others lying, misrepresenting, or deceiving.

Yes, it is an issue worth resigning over. In fact, you should find another job and leave regardless of how this plays out. They have revealed their character. Now you get to demonstrate yours.

Consider .. if they lie to customers, why would you not think they will lie to suppliers and employees? Can you trust them and do you really want to work for them?

0

Here is a step-by-step guide to protecting yourself during the meeting. For better advice, talk to a lawyer.

  • Before the meeting, ensure that you have a copy of the original questionnaire, filled out with your original answers.
  • Be prepared to speak over your director, if they plan to attend.
  • As the first order of business, start the meeting by explaining that there's been internal confusion over the questionnaire. Explain that some specific questions need to be clarified.
  • State in no uncertain terms that no pentesting has taken place. Be prepared to interrupt your director. Also be prepared to be kicked from the call, if this is a teleconference.
  • As soon as you're off the call, within maybe two minutes, send a copy of the original questionnaire to your client's point of contact along with a brief explanation.

You will likely be dismissed from employment regardless of what you do, but this plan will allow you to punish your director and employer for trying to lie about technical requirements, as well as making it obvious to your client that you have their security and compliance in mind.

0

Oof, polish up your resume. You should actively seek to leave this company.

You should have stopped filling out the form and had a discussion with your superiors when you discovered the pen-testing question.

As the most senior technical employee you should have immediately got the ball rolling for some sort of pen-testing implementation. Then, it would have been perfectly honest to write:

We are in the process of implementing pen-testing.

For now, forward this debacle trail to your personal email. Legally, you're probably safe. Career-wise, you may have given yourself a black-eye. It's certainly unpleasant but I don't think you've committed career-suicide.

0

Go talk to the director (or even better, his boss) and say you'll not lie. Tell them you'll tell the client you are working on getting pen testing done but if they don't want to authorize it, you'll just tell the truth to the client.

-1

Have I done anything fraudulent so far?

Nuanced answer. Fraud requires intent to deceive, which according to your story is not part of what drove you.

However, it would be correct to say that writing this document in the manner that you did, you created evidence that can be used to argue that you were acting fraudulently, since you wrote a statement that you knew to be false at the time of writing it.

So it depends if you're asking if you've committed fraud in spirit or in appearance. The former is a no, the latter is a yes.

Others will disagree here, as has already happened in the comments. However, I'm lenient towards your situation because you seem to have had a genuine belief that your warning would be attached to the document, as reflect in your statement here:

The director then chose to forward this to the client, without my "this is not accurate" warning.

I do think think was naïve on your part. You should have seen it coming that the document could be sent through without the accompanying disclaimer. But naiveté, when genuine, is not willful fraud, which is why I'm willing to believe (for the purpose of answer the question you posted) that you did not intend to deceive the customer.

If I take this zoom meeting, and toe the company line (which I know to be false), am I committing fraud which I could be personally liable for?

Yes, I would consider this fraud, if you stick to the "we did pen testing" statement.

However, there are ways around this. For example, you could say something along the lines of:

"I was not present for any pen testing exercise, but I did find confirmation in the company that pen testing has taken place during [period]."

This blends both approaches. You toe the company line but you make it very clear that your statement is based on information you've received, not a first hand account of having seen said pen testing. This mostly conveys the same information, but it puts in a layer of protection: if the information you received was incorrect, so too would be your statement.

In other words, you haven't said that the manager is lying. However, if someone were to find out that they were in fact lying, you can shield yourself by pointing out that your statement was based on this lie.

This is technically still a lie, since you seem to already know the manager is lying. However, I would argue that you're only really deferring to the manager having knowledge about something that you don't, and lucky you that they informed you of it! Yeah it's a white lie but this is a form of business etiquette. Don't antagonize management but don't let them bully you into things you're not comfortable with either.

Retroactively, this is also how I would've written the document. The way you phrased it seems like you are confirming first hand that pen testing took place, which is a lie, and you knew it at the time. It's better to put in the asterisk of "my statement is based on information I have received".

If this is fraud, how can I explain that I don't want to be a part of this to the directors?

It seems you've already done so and it was ignored. You can keep bringing up that point if you like but I'm not sure you'll have more luck with future attempts.

This is more of a case of not joining in on the fraud rather than preventing any fraud altogether. Stick to truthful statements but try to minimize negatively calling your management out on their lies.

Learn to deflect. Instead of "No we did no pen testing" or "Yes we did pen testing", consider phrasings such as "I am not aware of any pen testing that took place" or "I am told that pen testing took place". This appears like a yes/no but it opens the door to any uncertainty on your part.

And is such an issue worth resigning over?

Internet strangers should not decide your career for you.

However, personally, I would refuse to work with unscrupulous management who deflects responsibility and throws their staff under the bus to save their asses. When your manager first told you what to write, got their way, and then deflected the customer's scrutiny towards you; that is a massive "F*** NO" in my book.
I would take that Zoom meeting and actively work towards deflecting that spotlight right back at that manager, indicating that your statement was made based on information you received from them.

But that's just me, and this decision does not maximize job security in your current position, so I shouldn't make this decision for you.

12
  • 2
    Passing on information that one knows to be untrue, in the expectation that the reader will believe it to be true, is not a "white lie". It's still knowingly aiding and abetting dishonesty which may have harmful consequences to the client.
    – G_B
    Sep 18, 2023 at 0:22
  • @GBsupportsthemodstrike: You're not wrong but OP did seem to have the genuine belief that the revised document would not be decoupled from their explicit statement of it being inaccurate, as reflected in "The director then chose to forward this to the client, without my "this is not accurate" warning." Was it naïve of them to think that this wouldn't happen? In my opinion, yes; they should have seen this coming. But naiveté, when genuine, is not willful fraud.
    – Flater
    Sep 18, 2023 at 3:59
  • @GBsupportsthemodstrike: Putting it differently, there is a difference between a draft document and a published document even if both documents contain the same content. OP's notice of inaccuracy acts as confirmation that the document was considered to be a draft at that stage. OP naively picked a very easily circumventable way to denote the draft status (via an email) and somehow trusted that this would be respected. Naïve, but not deceitful. The manager still willfully ignored this disclaimer and then rephrased the document as if it were a finalized document.
    – Flater
    Sep 18, 2023 at 4:05
  • My comment wasn't about the draft document at all. It was about your suggested response in the upcoming meeting, which is the bit that you were characterising as a "white lie".
    – G_B
    Sep 18, 2023 at 10:41
  • 1
    @GBsupportsthemodstrike: If you want to get down to brass tacks, OP cannot conclusively prove that no pen testing took place. That would be proving a negative. Going against management who claims otherwise would be a significant exposure risk if it cannot be backed up, and it would be reckless to suggest doing so purely on the merit of OP's claim that something did not take place. There is a difference between lying and taking a claim from a superior on good faith. There's nothing wrong with only acting on what you concretely know but it is not guaranteed to be correct or the optimal response.
    – Flater
    Sep 18, 2023 at 10:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .