Over a year and a half ago I was recruited by a company that told me they were writing antivirus software. I found out today that they don't have contracts with legitimate customers, and may be actually planning to sell to unscrupulous individuals. I originally thought that my work would only be used as a research tool. Recently, I started to question my employer about the need for certain features.

My concerns were dismissed, but I've recently noticed in our github logs that an external contractor is writing a "forcible" installer for "unattended installs", which seems to use some pieces of my work to install without the knowledge of the user.

What steps can I take to distance myself from this company, and (if necessary) bring attention to their activities without violating my confidentiality agreement? I don't want to be blacklisted in my industry because my boss is a lying criminal.

I work in the US, but occasionally travel to Europe and Canada.

  • Given the possible personal problems for you, I can't really recommend to bust the company and to disclose all vulns ...but ... please consider doing something. ... Whatever you do, good luck.
    – deviantfan
    Jun 29, 2017 at 1:55
  • 2
    Step 1: quit. Step 2: tell them anything except the fact that you're questioning the legality of their actions as a reason for quitting. Step 3: find a new job. (This is one of those rare cases where I would leave first and find new job later.) If a link to their github page should happen to find its way into a relevant cybercrime law enforcement office's mailbox, that probably wouldn't be the worst thing ever. (Maybe use a public library computer and burner email to send it, though, just in case.)
    – Steve-O
    Jun 29, 2017 at 2:03
  • 16
    without violating my confidentiality agreement? At least where I live, laws override contracts between private persons/entities, but not telling anything is an easy way to become guilty. ... But I hope you're sure that the government really isn't involved. Given how the US agencies behave...
    – deviantfan
    Jun 29, 2017 at 2:04
  • 7
    @gnasher729 Never heard of reverse engineering? Hackers often do that all the time, the best form of defense in that industry is to know the tricks the bad guys are using, by learning them yourself, and then using that knowledge for preventing the bad guys to accomplish their job
    – Draken
    Jun 29, 2017 at 8:44
  • 1
    @Draken Thank you. My work was primarily research.
    – Priscus
    Jun 29, 2017 at 12:24

1 Answer 1


I am not a lawyer, neither are you, so:

Get a lawyer NOW! Not tomorrow, not in a weeks time, call them as soon as you get to a phone.

Issues you might or might not face depending on the laws:

  • You might be held responsible for computer crimes, despite being coerced.
  • This post can be held against you proving your knowledge and hence complicity in the potential crime.
  • Delaying reporting it, if reporting such a crime can be considered mandatory or required in your position, beyond the time required to contact and consult a lawyer can be used against you as evidence of complicity.

I repeat: get a lawyer

Not the answer you're looking for? Browse other questions tagged .