IT Employment

Ask something
Discussion Locked

Ethical question regarding network security.

0 helpful
25 replies

by Member 27332238 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm an IT trainee at a school. I discovered that a student had in
the past found an exploit in our system to access the internet
without restriction or cost (to him), and passed this information
to other students. The hole was closed with a new system, but I
discovered the student's website, and felt obliged to tell my
boss. So things are now going sour for the student, who seems a
nice enough guy.
The dilema is: I started an email correspondence with the
student just as this started. We are writing about website
creation, and stuff in general, and I want to know if it's right to
keep writing, and if I should tell him my part in the whole affair.
I'm keeping all the correspondence, and will try to only talk
about our shared interests, but maybe you guys think I should
fess up, or stop writing altogether. I'm pretty sure I know what
I'm doing, but this forum always comes up with Gold. So let me
know!

25 replies

by tim

I believe that you are doing the right thing. I would keep up my correspondence with the student and just not bring it up.

by amcol

You did the right thing, the ethical thing, when you informed your boss of the possibly criminal violation being perpetrated by your fellow student. Good for you. Your IT career is off to an excellent start, and you're exactly the kind of person this profession needs.

What you're feeling right now isn't a sense of ethical obligation, it's guilt. You owe this other student nothing...no explanations, no information, no purging of your soul by "confessing" your actions. You feel guilty because you're thinking you ratted him out and now you need to unburden yourself or you haven't the right to have any kind of relationship with him. Not so.

You're not being any more or less virtuous by keeping your actions to yourself. If the student finds out by other means that you were the whistle blower, that doesn't mean you lied or hid the truth or did anything nefarious in any way. If that were the case, it would be an acknowledgement that you did, in fact, owe him an explanation...which you absolutely do not.

Have your relationship with this person, feel good about it (if you can, considering you're talking about someone who's less than honest), and more to the point feel very, very good about yourself and what you did. And what you're doing.

by Member 27332238

Thanks. That helps, but a clarification:
He's a student, and I'm a trainee admin. I guess it's not a big
point, but I guess I'm wondering if what you say applies when
he's a kid, and I'm an IT professional. I mean, anything more he
says on the topic (and it did get a mention in an email he sent) I
feel like I should pass on again to my boss. I hinted at this in a
reply, but I wonder if I should spell it out: "I will tell my boss."

by amcol

Doesn't matter if you're a student, a professional, or a Martian. You did the right thing to begin with, and as I said before you owe no one any explanations. If you're thinking he "trusted" you as an adult or as a professional and you somehow betrayed that trust, I would say you have a larger responsibility to your employer and the ethical obligations of your profession. You did what you did to avoid betraying all of THAT.

Your post is a little vague as to what additional information this student is providing you, whether it's about him continuing his unethical (or possibly even criminal) behavior or whether he's just providing further clarification on what he did before. Doesn't really matter...you have no obligation or responsibility (ethical, moral, or legal) to warn him that if he continues to do so you'll pass that information along to the proper authorities. That should go without saying.

There's another consideration here. Depending on the situation, the details of which are known only to you, he may actually be trying to enlist you in his subterfuge. By informing your boss of the information the student is providing you, you're not only perfoming your ethical obligation you're also protecting yourself.

by absolutely

It's not your responsibility as a professional, or as a person, to keep secrets for other people. If you want to warn him first of your professional responsibilities in the matter because it will help you feel better, do so. But please, don't bother yourself with the idea that anybody else's unethical behavior is your secret to keep.

by jmk1024

You did the correct thing by notifying your supervisor. If you do decide to mention it, dont be surprised if the student decides to stop writing to you.

by itengineerguy

I applaud your honesty. IT staff members have to be trustworthy. I too have been challenged over the years, several times, with similar dilemmas. But never forget you are going to be responsible for millions of dollars in equipment and data. Management needs to be able to trust at least one person to always keep the companies best interest in the forefront.

by olddogs

Back in the days of yor... Or to put it another way. In 1983 I was the systems programmer for a commuity college. I was hot on the trail of what I knew was a student hacker. When I finally caught up with him it happened to be one of my Dungens&Dragons buddies... oops, yes, so we are both geeks from way back. I did report him as well as taking measures to lock it down. Fast-forward to modern days. He is a very successful IT person (as am I) and we are still friends. We both look back and laugh now. Him for his foolishness (he was trying to impress a fellow student, who by the way was not impressed.) I laugh because he really had me running. ;-)

by jmgarvin

If he is a true friend and you truely did the honest thing (and he was being dishonest), then if this ends your friendship he is scum anyway.

The problem is that many young computery people like to push the limits. When they get caught they usually own up to it and take the heat...but some can't because they have gone too far down the REAL criminal path.

by limelight1

In the beginning when you first reported this person, that was exactly the right thing to do. Butyou say it is a student? While I agree that this student should have known better, you have come to know this person a bit better through your correspondence. DO you think you know him well enough to know if what he did was done with malicious intent? Or was it the sort of thing an immature perosn would do, harmless, but still wrong. Now I am not condoning what he did, but he has already in hot water for it, if it were me and the subject came up I think I would tell this student, "Listen, you know who I work for here, and that if it came up I would have to tell them, so lets leave it alone. not talk about it."

Just some thoughts.. . .

by Member 27332238

Update and further question:
Thankyou everyone for your replies. My head swells with every
post confirming my actions :) .
The issue I see now is that this kid still seems to be at a loss to
understand what he's done wrong. In the latest email he seems
to be searching out a reason, and justifies it saying there was no
malicious intent.
I'm not sure whether I can say to him: 'You offered other kids a
way around a system designed for your safety, and our
protection, and that is what you did wrong.'
But it may negate the proper authority going through this with
him.
Anyway, thanks for your posts so far. It has really helped me
keep a clear head about this.

by hal 9000

This person appears to believe that the world owes them and that they can do no wrong. After all if there was a hole there why not exploit it?

Well that is their reasoning anyway no matter how wrong it is.

Now as this person effectively hacked the system in this case out rather than in he still derived something for nothing and at the same time exposed the system to possible intrusion and the adverse legal ramifications that could be involved.

Perhaps just pointing him to the relevant legal sections that cover this activity would be enough but if in doubt ask those above you for a better way to handle the situation. As you do not want to be responsible for damaging their case against him.

Col ]:)

by amcol

The student is rationalizing. He's done something wrong...he may know it, he may not, but at the very least he suspects it. Somewhere deep inside himself is a nugget of guilt, or perhaps uncertainty, as to the righteousness of his actions, and he's therefore in a search to take the moral high ground any way he can.

Anyway, that's my Dr. Phil interpretation, not having a degree in psychology myself. Which is to say it just doesn't matter, because you have no responsibility here. You're not his father, his guardian, his teacher, nor his personal Jiminy Cricket. You don't owe him anything, and he's trying to use you to salve his own bruised conscience. He may be looking to you as a kind of role model, someone who can pat him on his little head and tell him "you were a bad boy but it's all right now". Don't do it. If you really want to do this kid a favor, take one of two routes: do nothing at all and stop talking to him about it altogether, which will hopefully send him a message that there's no excusing his behavior, or give him a good (figurative) shake and tell him in no uncertain terms that he did wrong and why. I'd opt for the former and not the latter, myself.

You sound like a person of empathy. Good for you. Just don't let that get in your own way.

This kid did wrong. Shame on him. You brought his actions into the light of day. Again, good for you. End of story.

by absolutely

It is impossible for a human intellect to be capable of ingenuity, creativity and rigorous logic while using your computer network, but magically lose all understanding when the issue of ethics surfaces. His pretense of not understanding why his actions were wrong is unbelievable from here.

Furthermore, it is not your responsibility to figure out what his exact motives were. You protected the campus computer network, you've done your job. You are not his therapist or confessor.

by Member 27332238

Does anyone know the Australian Law on this?
It's not my job to punish this guy, or even know what they'll do
to him, but I wonder if there is an explicit law about the issue.
Did he have a legal obligation to tell us, or just not to exploit it?

Have I made a blunder by posting about it?

by jkaras

snitch, whistle blower, rat fink, stool pigeon, Linda Trip wannabe, its me, I knew you would rat me out!!!!!! Just kidding lol.

Listen, out of all the advice given, they are right, he was wrong, and he has to face the music. I wish their was another way that his name, reputation, or future might not be destroyed, but he took that chance whether he knew it or not. I think what is best for you is ease your conscious and ensure that he learns properly from this incident is to stand by him ensuring fairness. Speak out on his behalf. When it comes time to face the music to the powers that be that he is punished fairly not made an example of. I think that in today's world we go to extremes rather than teach what and why he was wrong. There is a certain zealousy. (is this a word? lol) The only downside is that the truth may come out as you were the one who reported him. This is where he will have to learn to accept his fault not yours. Will he probably at first blame you, but after time whether short time or long time will come around.

From your postings, he appears to be bright and could have a really successful life if people give him a chance, not stone him to death or hung out to dry. He most likely will be expelled and I dont know how other schools can deny him acceptance or not? Personally I think he should be repremanded to an justifiable community service to the school for X amount of hours for X amount of time like two years to remain at the school with a certain agreed on GPA. He could work the cafeteria, pick up garbage, and do maitenance to show what kind of life he could have if he doesnt be careful. WE are interested in teaching him, not executing, humility is best. WE all have made mistakes in the past, some big, some small, and they were all about impressing someone for whatever reason. I just dont feel that his life should be destroyed, it should if he killed or did something that was "evil", not cheat.

by hal 9000

Bright enough to skirt the system for his advantage.

Now depending on just how severe the incursion was if it was only minor I would be putting him to work to lock down the systems as punishment and holding him personally responsible for any infractions when and if they occur.

Students at this level don't have enough time to play around and since he has abused his position of trust I would be making him pay in the only way he really understands make the little sod work his butt off for no benefit to himself!

However if it was a severe infraction and involved the download of material that was detrimental to the institution they have no choice but to expel him and report him to the Police for his actions, after all they have to first cover themselves before even thinking about what punishment is going to be handed out to the perpetrator of this action.

The fact that he shared this hole with other students makes it worse but if there was no major problem brought about and it was only discovered after a system upgrade I would be putting him to work to fill the gaps that must exist in the new system and working his guts out for the privilege after all if he is going to be punished he should do something that benefits the institution rather than some medial job that has no long term help to the department.

If it was me making the decisions and there was no major infraction that is what I would be doing as a means to show him that a there are consequences for ones actions and hacking in any form is unacceptable. I'm betting if he saw a car with its engine running and doors open he wouldn't dream of jumping in and going for a spin so why can he not see the same thing here because he broke the rules of at the very least the institution involved.

Punish by all mans but he doesn't need to be destroyed for a relatively minor infraction. Of course if there are some major legal implications for the place involved then it is a different story but if it was only a bit of surfing the web make him pay in such a manner that he no longer sees it as a "Cool" thing to do and hopefully make him just that bit more responsible.

Col ]:)

by itgirli

I'd let people know what he's up to. Keep a correspondence with him, don't tell him that you're ratting him out unless you REALLY REALLY feel a moral responsibility to do so. Consider yourself an informant. Give what you know to your boss and let him handle the rest. It's not your purpose to tell the kid or take anything into your own hands. The kid should understand what you do and what that means as far as your responsibility to the company (school) and your job. If he gets busted and they can trace that you knew about it and didn't let them know, kiss your career good-bye. You can stil be friends with him, but you must understand that your ethical and moral responsibility is to the person cutting the paycheck and not to some punk kid. If he doesn't know what's wrong with what he's doing (and he does) and you wish to save his butt in a friendly fashion. Let him know to go no further in it or you will be forced to turn him in. Good luck.

by hal 9000

This kid has already been reported and is now looking for sympathy for his actions as he is waiting to find out what the consequences will be.

Now what is going on with you have you had a bad week, a bad M$ patch that hasn't quite worked out right and trashed everything or what? I didn't think M$ patches where due out just yet but maybe it's last months that are causing the problems. Now what is wrong are you just having a bad case of PMPT {Pre Microsoft Patch Time" or "Post Microsoft Patch Time?" :p

After all he wasn't cheating but exploting an existing hole in the system which he was bright enough to find. And which should not only have been plugged but never been there in the first place.

Anyway more to the point how is the job hunting going?

Col ]:)

by itgirli

My contract position will be over in about a month, and I have yet to get a straight answer on a direct position.
You're right, it should have been patched. But I'd still keep an eye on the kid. The first rule is don't get caught.
I'm in a great mood today! I had 13 hours sleep last night! I feel fantastic! Never better!

by raw41

As far as letting your boss know, you did the right thing but keeping up correspondence with him from the schools network, I wouldn't do that, I would only do that from my own email at home off site and that way know one can say anthing about this. Contributing to his correspondence from on site just complicates things and encourages him to continue exploiting the security hole and brings to question how you knew and when did you know it.

by dc_guy

Lies of omission are just as unethical as the regular kind. They are both attempts to manipulate another person's behavior by not telling them the truth.

So the question becomes: Why are you going to so much trouble to not tell this guy the truth? What are you afraid he will do? Call you a bad person for soliciting his trust when in fact you're the one who was instrumental in getting him busted? Tell your girlfriend or your mom why he thinks you're a bad person? Hack your computer?

Or do you just appreciate the relationship you have with him and you don't want to lose it? He looks up to you and makes you feel like a mentor, he will probably feel differently when he finds out.

It's up to you to figure out why you're doing this and the decide if your reasons make it ok. Cops and members of other related professional lie to people as part of their job. They pass themselves off as friends to people who trust them so they can catch them in their next evil act. You're not doing that. You're just maintaining a personal relationship with somebody you busted for no professional reason.

I hope you're not one of my "friends." We all do stuff that we're "getting away" with because we think that particular rule is stupid. I'm sure you do too.

One thing you need to understand from the start: There is really no such thing as a secret, especially in the digital age. This guy will some day learn what you've done and how long you concealed it from him, pretending to be someone you're not.

Take that into account.

by jkaras

dont you think? Typically he should have brought it to the attention of his superiors as "I heard this through the grapevine/whisperings of an exploit and this is what I found." But that is long past, the damage is done, too late. The only thing this admin needs to figure is how to justify and ensure a fair punishment is dealt.

DO I think it was wrong in a trust relationship kind of way yes, but not his fault, just his responsibility to ensure the network. Would you risk your future/your name by keeping it quiet hoping that it wouldnt reflect badly on yourself? The whole school knows and is exploiting the system, playing stupid to what's going on isnt going to solve anything.

I have taken psyche tests for employment that ask if your grandma was stealing paper clips vs. brother/friend or co-worker stealing money/merchandise whom would you fink on or keep quiet. These tests were rediculous equating severity of worth and knowing the person evaluating your silence. I dont think everything is black and white and common sense rules. Would I want someone I trust to keep the secret, yeah, but I still know I am doing wrong banking on that I wont get caught and the more that know the more likely you get caught, silence is golden. Like I said in another post I have done wrong things and thankfully I got away with it, it was luck and careful evaluation. There have been times that I got mad lucky listening to someone else talk me into a stupid idea, it wasnt their fault it was mine for listening. I have seen people rat on eachother the minute the jig is up blaming the other like they never had anything to do with it when they were either guilty or more guilty than the other. Those friendships were over before they began. Those are the people that suck, leaving you high and dry not accepting their guilt, and others never trust them, code of theives it appears they get shunned by the community that witnesses the betrayal.

He has the ability to save the student's reputation by standing by him ensuring a fair minimal punishment that is within reason. When the student sees that he is willing to put himself on the line compared to throwing the book at him the trust will be mostly restored, but never the same or fully. That was the price he had to pay in his chosen profession and the price he will pay in the future on more than one occasion. Nobody likes a snitch, but everyone respects someone who does the right thing for the right reasons, if not then they dont know a good person to begin with. If your friend at work was downloading kiddie porn would you just have a private chat? If you did and it failed would you then rat on him? Where does your loyalty begin and end is what I guess you have to define to me to understand your point of view.

by jmgarvin

You must be one of those Lawful Good Paladins ;-) Omission is not lying, simply not speaking. You imply that by not telling the person you are manipulating them. I submit that by telling them you are also manipulating them. Not matter what you do you manipulate people to fit your world view.

Why is he going to so much trouble? Perhaps it is a friend he thinks he will lose if he tell him? Perhaps their could be negative reprocussions if the person knew? Perhaps he feels that telling the person will do no more than alert the person to be more sneaky?

I take the path of: Karma is a bitch, if you do wrong to something or someone it will come back and bite you. If you do good to something or someone that good will revist you.

by amcol

But you're not, so I don't.

Lies of omission ARE unethical. This case is not a lie of omission. The original poster declined to reveal his role in bringing unethical behavior into the light of day. He/she is perfectly correct in doing so, because he/she is under no obligation whatsoever to make such a revelation. It's not the poster who performed the unethical act, it's the student. The poster had no foreknowledge of the event, he/she only learned about it after the act had been committed. Therefore, he/she is not an accessory before the fact and had no responsibility other than to report the behavior...which he/she did.

Not reporting the behavior once it been discovered would have been a lie of omission, since that would have made the poster an accessory after the fact.

Suppose the student had solicited the poster in advance of the act and the poster declined to participate. Suppose further the student indicated he/she would commit the act anyway, and the poster did nothing to stop it. That too would be a lie of omission, in that the poster had opportunity to stop something bad from happening but did not due to inaction and/or silence.

Your position would make the poster guilty of a bad act when in fact he/she did exactly what he/she was supposed to do, something that all too many of us would not have done. As a matter of fact, your position puts the poster in a no-win situation...it would have been wrong to keep the information secret, but you're saying it's wrong to keep the revelation of the act secret, and by revealing that fact the poster could get hurt...when he/she didn't do anything wrong to begin with. I don't see any justification for an obligation to reveal that action.

This discussion is closed to new replies.