Should I disclose I know sensitive information about a company relation that I wasn't supposed to know?

Question

The story goes like this:

• I am currently interning at one technology company.

• I am probably going to intern at a security consultancy company.

By reading information about the security consultancy, I've figured out that they seemed to have dealt with current (tech) company on a topic that could be described as (quite) sensitive. This was from reading materials that the security consultancy made public.

• The company name have been shortened, but is enough to make me notice by chance and am 85% sure I'm correct. This slight degree of disclosure seems intentional. I'm not sure about the motive for this.
• I'm fairly certain they have contact (it is inferred rather than implied).
• Knowledge that I have acquired after signing an NDA with my current employer (technology company) lets me piece the details together. No NDA with security consultancy yet.
• My work is not classified (albeit a little sensitive) and neither are the released documents. I'd probably guess this knowledge would rank between confidential and secret in government domain.

Question:

Do I have an (moral/ethical) obligation to reveal to my current employer that I (probably) know stuff that I shouldn't know between them and the company I might intern with?

(I like my current company and wouldn't like to them to figure this out later and take it badly from some reason. I think they are on good terms, but still.)

Answer 1

Here's the way it is:

If no one asks you whether you know anything about it all, don't volunteer the information.

Most likely if the information was that sensitive no reference would be made to it in public materials, so for all you know you're blowing it all out of proportion anyway.

But asuming that it is super secret, why would you walk up to your potential employer and basically say "I know what you did last summer."

Leave well enough alone, and congrats on the new job.

Answer 2

Hold your horses - I may have read the question incorrectly and it will would change my answer.
It is not clear on later / former. Not clear on which company released the report.

Question:

Do I have an (moral/ethical) obligation to reveal to my current employer that I (probably) know stuff that I shouldn't know between them and the company I might intern with?

Going to assume you have the NDA with you current company.

You read some public information and attached that to some sensitive information. Disclosing ANYTHING about the sensitive information is disclosing sensitive information. Even if you don't disclose the information directly saying I know this company is really X based on access I had to sensitive information is a breach of security. A leak (intentional or not) does not make the information public. If you know the information (or anything about it) to be sensitive then you have an obligation to treat it as sensitive.

If the sensitive information is about your current company then you are not disclosing anything sensitive to you current company.

You read a public report. That is not something you shouldn't know. Give a copy of the report to your current company and tell them it may be disclosing more than they want.

Cannot go the security company and say I think you are talking about my current company as then you would be violating you NDA (in my opinion).

If you disclose to the security company you suspect a prior relationship based on knowledge of sensitive information then the security companay will think this guy is not very good at keeping sensitive information to himself.

I work in IT and have had security clearance. Many times I have had to pretend I don't know. You only discuss or acknowledge sensitive information with a 3rd party when your boss tells you to.

Answer 3

Is there an actual problem that you discovered

The first step in determining of whether to disclose or not to disclose is if you found something that has an impact. Would the information you found have an impact on your current employer (tech company) if the media came to the same conclusion as you and decided to broadcast it to the world? If not then there is no point in reading any further you have no obligations in anyway. Let it go and look forward to your new job.

Types of obligations

Per the wording of your question you do not have a moral or ethical obligation to let your current employer know, even if it has the potential to hurt the company. If you signed any document like what people sign when they get a government clearance then you would be legally obligated to report this information (this likely does not apply to you, but you should know what you signed when you started working for them). If your job description included things like security, public relations, or interacting with the security company in question, then you would be obligated to act upon it since that would be part of your job (again I am assuming this does not apply to you).

I could only think of one reason to share it with your current employer despite not being obligated to which is: You don't want to risk your current company getting damaged. If your company gets damaged it can mean downsizing which could mean loss of employment or the work place becoming toxic.

Sharing can be dangerous

Lastly note that if you do share this with your current employer there is a slim chance that this can go far differently then you would expect. For example it could turn out that it was your company that produced the document and the security company has no responsibility or knowledge of this. As a result they (tech company) could try to react by suppressing all information on it, discrediting those who know of it, and/or retaliating against the person who exposed it (which in this case would be you).

Answer 4

Assuming you're dealing with government classified information. Check with your company's security department.

One of the classification considerations is whether unclassified information can be combined to discover classified information.

The company likely has a strong security policy (you likely should have been briefed on it during an orientation). Check any resource or self-help documents related to security and ethics.

I know that I am encouraged to report any potential violation. As someone uncleared, if I learn something classified, it is my responsibility to report it ASAP. If I don't, I am responsible for a security breach.

There is no down side here. You demonstrate that you care about company security, and potentially save the company a HUGE problem. Go talk to security right now.

Answer 5

First off, you got the information through legitimate means, so no moral quandary there.

Second, I'd hire you on the spot for being that clever and maintaining such high legal and ethical standards.

Third, you've got one heck of an answer to the old "Why should we hire you" question.

That said, you should not reveal the information unless you are doing so to advance your career.

You may want to approach the management and show them how their obfuscation failed, but only if you have a way to demonstrate how you would have done better.

You have a real opportunity here that you can put on your resume that will make you shine like a star:

-Discovered security vulnerability in public documentation linking collaboration between two companies. Reported to superiors, protecting company from X dollars in potential losses.

EDITED to say:

You're clever, but keep this close to the vest.

Here's the question you need to ask yourself before proceeding: "If I were not employed by this company, could I have discovered this on my own" If it's "yes", then you may want to approach the company. If no, then keep it to yourself, you've breeched security, though unintentionally, and it could be an embarrassment to the company.