14

Over a year and a half ago I was recruited by a company that told me they were writing antivirus software. I found out today that they don't have contracts with legitimate customers, and may be actually planning to sell to unscrupulous individuals. I originally thought that my work would only be used as a research tool. Recently, I started to question my employer about the need for certain features.

My concerns were dismissed, but I've recently noticed in our github logs that an external contractor is writing a "forcible" installer for "unattended installs", which seems to use some pieces of my work to install without the knowledge of the user.

What steps can I take to distance myself from this company, and (if necessary) bring attention to their activities without violating my confidentiality agreement? I don't want to be blacklisted in my industry because my boss is a lying criminal.

I work in the US, but occasionally travel to Europe and Canada.

closed as off-topic by Dukeling, Masked Man, gnat, Chris E, Mister Positive Jun 29 '17 at 11:04

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – Dukeling, Masked Man, gnat, Chris E, Mister Positive
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Given the possible personal problems for you, I can't really recommend to bust the company and to disclose all vulns ...but ... please consider doing something. ... Whatever you do, good luck. – deviantfan Jun 29 '17 at 1:55
  • 2
    Step 1: quit. Step 2: tell them anything except the fact that you're questioning the legality of their actions as a reason for quitting. Step 3: find a new job. (This is one of those rare cases where I would leave first and find new job later.) If a link to their github page should happen to find its way into a relevant cybercrime law enforcement office's mailbox, that probably wouldn't be the worst thing ever. (Maybe use a public library computer and burner email to send it, though, just in case.) – Steve-O Jun 29 '17 at 2:03
  • 16
    without violating my confidentiality agreement? At least where I live, laws override contracts between private persons/entities, but not telling anything is an easy way to become guilty. ... But I hope you're sure that the government really isn't involved. Given how the US agencies behave... – deviantfan Jun 29 '17 at 2:04
  • 6
    @gnasher729 Never heard of reverse engineering? Hackers often do that all the time, the best form of defense in that industry is to know the tricks the bad guys are using, by learning them yourself, and then using that knowledge for preventing the bad guys to accomplish their job – Draken Jun 29 '17 at 8:44
  • 1
    @Draken Thank you. My work was primarily research. – Priscus Jun 29 '17 at 12:24
30

I am not a lawyer, neither are you, so:

Get a lawyer NOW! Not tomorrow, not in a weeks time, call them as soon as you get to a phone.

Issues you might or might not face depending on the laws:

  • You might be held responsible for computer crimes, despite being coerced.
  • This post can be held against you proving your knowledge and hence complicity in the potential crime.
  • Delaying reporting it, if reporting such a crime can be considered mandatory or required in your position, beyond the time required to contact and consult a lawyer can be used against you as evidence of complicity.

I repeat: get a lawyer

Not the answer you're looking for? Browse other questions tagged or ask your own question.