I am an experienced IT developer who recently switched to IT consulting. My current project involves fighting horrible software performance on a server farm my client has rented.
My client recently paid a huge amount for an external benchmark of this rented server farm, and the results were fine. Today I found out that the server farm's host was aware of the exact time of the tests, and they Volkswagened the test (i.e. changed the setup during the test to produce more favourable results than in real world usage) by temporarily adding additional resources to the server farm.
As it turns out, my client actually published the testing times to the host. The tests were conducted at night as not to interfere with live users, but the host needed to switch off some automated night-time tasks - otherwise the results would have been altered by long-running synchronisations that do not occur during daytime.
I should ring the alarm bell and let my client know, as I am responsible for them. Unfortunately, I gained that information through a junior developer employed by the server host, who prattled away about it (probably without knowing that these additional resources were meant to be a secret). As he has been very helpful in the past weeks -- in fact, my most trustworthy and valuable contact in the project -- I don't want to cost him his job.
Even if he did not know about the secrecy, by phoning me he acted somewhat against a standing order of using the ticket system. That helped me a lot in achieving my goals - and that brings up the dilemma.
I'm open for any suggestions, both ethical and pragmatic.
If it matters, my client would not file a lawsuit, but certainly would dump that provider, and my client is one of their most important customers.