Otdfbt

I am not a lawyer, but this seems to go beyond the ethical realm into a legal one.

I work in IT, and my manager is trying to get my coworker and I to submit a falsified
security scan to a client of ours.

This sounds like fraud.

Contact a lawyer immediately to determine how best you can protect yourself, and to find out if you have done anything that makes you potentially liable.

A lawyer may tell you to resign immediately.

Documentation is fine, but do not make personal copies of client or company information, such as taking pictures on your phone, saving company email threads, or sending documents to a personal email account. If you have already done so, delete those immediately.

If your employer ends up getting found out (which I certainly hope is the case), your employer could retaliate by filing a lawsuit or criminal complaint against you (no matter how frivolous) based on your handling of company data.

So far, everything that manager has asked me to do related to this has
been spoken verbally. I have made several failed attempts to get him
to put anything in writing.

You don't make him put anything in writing. You put it in writing for him.

To: My Boss

Subject: Work order

Hi Boss,

As discussed, I put [unethical feature] you approached me about
yesterday on the backlog. I still have some questions on the legal
side of things and would be happy if we could talk through those
before we start working on it.

Best, it-guy

You might then have a meeting where he tells you to go ahead with [unethical feature], not to worry about the legal side, and instructs you to no longer write emails summarizing your conversations. You will forget the part about not writing emails and send something like this:

To: My Boss

Subject: Work order, follow up

Hi Boss,

Just summarizing the discussion from 2 pm: You already checked with the legal side and the proper way to go about this is that I need to do [unethical thing] and [unethical thing]. I will probably have it ready by tomorrow afternoon.

Best, it-guy

If he's ambiguous, you remove the ambiguity in the summary, which makes it his responsibility to clarify if you misunderstood.

Do not forget to print out the emails and take them home (or just snap the screen with your phone), because companies who are willing to break the law are occasionally willing to "lose" emails.

I can speak to part of this from my experience as an infosec coordinator at a SaaS business. (I can't speak to all of it, because my employer has a culture of compliance; our executives would never play this game.)

1. In most cases these requests come from a part of the customer's business who are simply checking boxes before signing off on new vendors. On cynical days I think they just weigh these reports, or wordcount them.




2. It's sometimes possible to submit a truthful scan to a customer if you include an explanation and a remediation plan. Many customers will accept that, and it will boost your credibility: corporate infosec people like transparency. (They will follow up to make sure you remediated the situation, however.)




3. It's perfectly reasonable to send just a summary of a scan to a customer; the details of your systems and vulnerabilities are actually nobody's business but yours, and disclosing them increases your attack surface.




4. I suppose it's possible to submit a fake scan to a customer to get the business. But you'd be wise to prepare a remediation plan and ask your boss to agree to implementing it if you do that.

If you do send a fake scan, and then some cybercreep successfully attacks you, what could happen? Unless you are in health care, I suppose the worst-case scenario is Equifax: disastrous publicity for your customer and you. Or your owner could send your CTO onto Fox News to lie about it, like they did when Panera had a breach. But it probably won't be that bad.

If you are a health-care HIPAA associated business entity and you have patient data, and it leaks, and somebody was negligent, that is a crime that pierces the corporate veil, meaning individuals can be criminally liable and can't hide behind an LLC. In that case you'd be wise to refuse to sign off.

Look, it's a pain in the ...neck to work for a company that doesn't have a culture of compliance. You know that. But, it's possible to use this as an excuse to start pushing for change in your company. My suggestion number 4 might be a way to get that going.

The right question for you, and for your executives, is "how can we make our customers' data safer?" Compromising about this just might get you further along that path. Just something to think about.

If you do compromise, I suggest you write a "memo to file" describing the situation, and the instructions given to you, and your actions. Print it out and take it home. It's just for you, not for your executives or colleagues. It will help you remember exactly who said what and when if you have to describe this incident a few years from now.

I, unfortunately, have been in this situation a few times in my career.

First, you cannot continue working for this person, start looking for another job.

Second, I suggest you do what another suggested. Write it all in an email and ask for a yes/no confirmation. In that email, I would point out in the email that what you understand him requiring you to do is unethical and possibly illegal. "Confirm with Yes or No, or I will not do this unethical and possibly illegal thing." I have requested a signed document or digitally signed email before, and they always refuse.

One time, I was asked to sign off something as passing vulnerability tests and I would not because they wouldn't even allow me to have the scan run. The feces hit the air movement device later. I was contacted by a Colonel in the Inspector General's office about 6 months later asking for a written deposition, because I could not produce copies of the emails (I could not take them with me).......lots of firings, but I was already gone....By then I was on the other side of the world.

Dan and dbeer covered much of my first thoughts. Copy what pieces you can and manually log the rest. Some of this is risky, but I'm focused on your assertion you are willing to lose this job over this (and I applaud you for it).

You could also respond back to his noncommittal email with copies of the original result and a doctored draft with "DRAFT" watermarks and bcc a personal email.

"Per our discussion, here are the original and a draft of the scans with the redacted results." Assuming he verbally tells you that is what he wants and to send it (and maybe to stop emailing proof), at that point you are somewhat cornered into telling him you cannot comply with sending falsified scan results. If you want to salvage the relationship, a discussion around remediation plans might be in order. Most audits I've been involved in are more interested in truth followed by a plan to improve risks. But that may not hold here.

He may check email logs and know what you're up to. If so, he should also know you have documented his malfeasance. Hopefully that would give him pause before threatening to ruin you. He might do something like threatening you with some sort of NDA by sending yourself that email. Remember that's a desperation move. The only way he can prove it is by providing evidence that he's trying to defraud a client.

In the high tech company I work for, we have a role in the organization called an Ombudsman. It's their independent duty to offer advice and guidance in ethical/legal issues like this. In our company it can be completely anonymous if needed. If your company has such a role, I would suggest contacting them for guidance, as that is their job and duty.

What worked for me in the past: Make a report which describes what you actually did, including passages which what you should do/plan to do, but mark these explicitly as "not yet done", send it to your boss and tell him to redact it as he sees it fit, sign it off and send it to the customer.

A lot of people suddenly become much more careful if it's their signature and not their subordinates signature (in my case it was about an order to their "favorite supplier" instead of the cheapest one).

If your boss still wants to do this, then run from that company and depending on the severity of the situation pass the knowledge to appropriate institutions (-> legal question, talk to a lawyer).

My thought is if you have the original scans and the modified scans, then simply burn the actual scans to a cd and drop it in the mail to the company. Include an encrypted text file with a code phrase that identifies it to you. If you ever need to go on the stand, so to speak, you can describe what is in that encrypted text file so you'll have a standing. It's also great if your boss throws you under the bus in front of the company, and you can say you included a encrypted file with a code phrase only you'd know. I think that is the best approach in terms of insurance. Otherwise I think your boss and his bosses can make up whatever they like and you have virtually no proof especially if they told you verbally.

I think that there is another option here that people may not like but that is being ignored. It revolves around the idea of who is the person who is committing fraud and how. If your desire is to continue to work at the company but avoid doing anything that could implicate you then I would recommend the following.

Create the version of the report your boss asked for then send it to him with the original attached and say the following.

I have created the report (with omitted answers) that you asked me to
prepare for company you will find it and the original report
attached to this email for comparison. I want you to know that I have
prepared the report in the hope that you will us it for internal
purposes only. I truly believe that the decision to share the edited
version of this document with company puts our company in a very
dangerous position as some of the issues in the original document are
real issues that might be exploited. In this light I urge you to use
the original.

I would then BCC the email to a personal email account as well as print out the full email (the raw email from your sent folder with all of the headers). If your boss replies and tells you to send the email to company that is the point where you say

For my own personal liability concerns I cannot in good conscience be the person to email this to company and I hope thats not a problem for you

I would say that this does a couple of different things:

a) independent of Fraud or the situation your boss gave you a work task to create a report and this may be a situation where you could get fired for not doing it creating the document and calling out it was requested makes it clear you are willing to complete tasks from your manager
(I truly understand that people wont agree with this but I see it as walking up to an ethical line without crossing it)

b) by providing the report in an email to your manager with the original it makes it very clear that the document should be considered for internal purposes. If your manager decides to use that document it is your manager who has committed fraud not you. (I will address what to do if he actually sends it later)

c) submitting this to your manager gives them a written chance to do the right thing. your manager might change their mind... hopefully.

d) BCC'ing printing and saving the email provides you with important physical evidence that might be necessary if you experience negative repercussions from this action

Finally I would argue that making the report isn't the difficult ethical question. I would say that

what is your responsibility if you know for certain that the your
manager/ the company has sent the document thereby committing fraud?

is a very complex question, I could make several recommendations in that vein but the true one that you absolutely should do is.

If your boss uses the edited report and as a direct or indirect result your company gains or otherwise continues contracts with the other company. Don't post on stack exchange, spend a couple hundred dollars and get advice from a labor attorney (that will be advice that has malpractice insurance)

For me, there are two alternatives:

1. 
   

   Do it, but protect yourself

   
   
   

   Keep a document with the actions you've took, with a date of creation / modification younger than the mail you'll send to the client with excluded vulnerabilities. In this document, put by memory your discussions with your manager, the excluded vulnerabilities, and link to the real report.

   
   
   

   Then take the actions you were told to, and send the mail with the edited report to your manager warning him for the vulnerabilities (or find another mail you already sent talking about it).

   
   
   

   If this is found out by the client, you will be protected (and even if they ask you why you did this unethical thing consciently, you could say that you were pressured to).

   
   


2. 
   

   Find a new job and get out ASAP

   
   
   

   This is a toxic environment and/or a toxic management you have here. Try to get out without burning bridges and find another job before that. Win as much time as you can without having to edit the report, so you can leave before having to do it.

   
   

َ