I am leading one of the software development teams in a company. We are completely responsible for a technical side of our product (development/QA) that we've been developing for ~3 years. My company hired IT consultancy services some time ago. I was informed that the consultant will be managing the project on a senior technology level, in order to replace the former technical manager who moved to another department. Recently these things happened:
- Consultants requested access to our source code.
- we noticed in one of shared calendars that our product was demoed to a third-party outsource company. We asked our management about it, received a reply that it was a sales demo
- a person with a generic Gmail address requested access to a QA document in our Google docs. We looked up that person's name at LinkedIn, two of the three matches work for the above-mentioned outsource company. Again we asked our management if this a security breach - no reply yet
- my team members noticed that somebody is using consultant's credentials to access our system, and the IP addresses match the ones used by - guess - the outsource company (
whois
data)
We were not explicitly communicated about any third-party companies testing/studying our system. I clearly realize that my company owns all of the source code and projects, and no one is obliged to notify me or my team about strategic decisions. Still, there is a conflict here between business interest (not letting people know so that not to undermine development progress) and team's interest (actually knowing in advance so that to e.g. start looking for another job).
Now my question is: is it ethical/professional to explicitly ask the management about these activities, basically clearly letting them know that we are aware of it and would have preferred to have been informed earlier?