28

I have been assigned to develop an integration to one of my employer's applications to an external system developed by our client. Our client's specification for the integration that has some blatant flaws related to security. The flaws would allow an unauthorized user access to the system to view restricted data.

I have pointed out the flaws and their potential security risks if they are implemented as designed, and provided an alternative without the flaw, but (in short) have been told "do it the way we specified" by the client.

Does a programmer have an ethical responsibility NOT to implement code with known security risks? At what point do a client's requirements outweigh the ethical responsibility we have as software developers to create secure applications?

Improve this question
7
  • 9
    You've pointed out the risks, but did you also point out the likelihood and (possibly more importantly) the impact of these risks to some aspect of their operations? Are you sure that the client fully understands the risks and have documentation to that effect?
    – Thomas Owens ♦
    Commented Jul 22, 2013 at 17:57
  • 7
    I have been tossing this over in my head lately in some of my work. If we make the same comparison relative to a bridge builder, in which he's asked to build a bridge that doesn't have those annoying, obstructive supports underneath it, or can only bear the weight of two cars, then for his reputation's sake, he'll likely just refuse. I'm thinking there really must come a point when it's an engineer/person's duty to refuse. Granted, the vast majority of design grievances don't come close to risk of human injury/death.
    – Katana314
    Commented Jul 22, 2013 at 18:09
  • 2
    @Katana314 There's definitely no risk of physical injury or death with my current scenario. That one's definitely easier to answer... But you hit the nail on the head, I think. Additional searching led me to the ACM's Code of Ethics, which seem to reinforce our responsibility to identify and make known any foreseeable problems.
    – Nick Orlando
    Commented Jul 22, 2013 at 18:16
  • 3
    @TheSoftwareDev Fair enough, but I'll just add that sometimes human risks can be deeper than we realize. A security risk allowing a hacker to easily take people's info and steal their identity, leaving them homeless to later commit suicide; A social network flaw that allows a stalker to intercept a woman's private communications about meeting at a restaurant, then physically follow and trap her; it's a bit morbid to think THAT creatively, but we may sometimes forget how far-reaching our projects might be used.
    – Katana314
    Commented Jul 22, 2013 at 18:20
  • 1
    @gnat Not really a duplicate. The linked question is about the general approach to software ethics, this one asks how much of a fight the OP should put up before saying 'not my problem anymore'.
    – rath
    Commented Jul 25, 2013 at 21:30

1 Answer 1

Reset to default
40

I think you've done your part by pointing out the problem and suggesting an alternative. If they insist that you do things that expose them to a certain level of risk, you should make sure you have a paper trail (and back-ups of it) showing that they explicitly requested this, knowing the risks involved. If you're really concerned, you could tell them that you'd gladly do what they want, if they first sign some sort of legal document/disclaimer in which they acknowledge the risks associated with what they've asked you to do (and of course get a lawyer to draft such a document). I personally don't know of any precedent for such a document for this situation, but I'm sure you could find a lawyer to help you with this. If your company has a legal department, it might be something they should get involved with if there's a potential for corporate liability. And of course, if it's this serious you should discuss this with your manager as well.

I think the only situation where it might be OK to simply refuse to do the work would be if this is software for a system where the flaw that you're worried about could lead to the system being compromised in such a way that it could result in the very likely loss of life/serious personal injury or some sort of catastrophic property loss.

Improve this answer
7
  • 4
    Or personal liability ... i.e., if it'll get you fired or worse
    – Dan Pichelman
    Commented Jul 22, 2013 at 18:19
  • 5
    There is no document that the client or employer could sign that would grant the OP immunity from civil suit. He may, depending upon the nature of his employment, fall under the definition and protections of an agency relationship with his company, providing a liability shield, but in absence of such a shield, "I was only following orders" is not a defense no matter how well-documented. The plaintiff/prosecution can simply say "you could have just quit; even if someone else would have done it, it would be on their head now, not yours".
    – KeithS
    Commented Jul 22, 2013 at 22:47
  • 2
    The best the company could do is guarantee coverage of the OP's financial liability including court and legal costs. The company cannot go to jail for him if it turns out he broke a law.
    – KeithS
    Commented Jul 22, 2013 at 22:50
  • 1
    @BazzPsychoNut: It sounds like the OP has already tried to point out the risks and explain them, and is being ignored. If they are unable/unwilling to simply refuse to do the work, I think they must cover their ass as much as possible and they should also consult with a lawyer (who I suspect would give them more specific advice for the situation, and also tell them to cover their ass).
    – FrustratedWithFormsDesigner
    Commented Jul 29, 2013 at 19:01
  • 1
    +1 for the paper trail, and also be careful if you are involved in the deployment. While it's unlikely to come to it, there are plenty of laws (the Data Protection Act in the UK for example) which mean negligent handling of personal data can become serious offence.
    – Matt
    Commented Jul 29, 2013 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.