283

I am a team lead in a company located in Manila, and I am currently writing an app that has a seriously questionable feature request for its Android users -- which is to secretly record its surroundings using the phone camera. When I asked the CEO why we have to write this feature, I am told that it would achieve user safety and it would give cops leverage by way of investigation in case something in the videos can be used as evidence.

Having this feature is impossible for iOS users, so that leaves Android. This, of course, could place the company under serious fire for invading users' privacy when we get found out. In fact, as far as my country's laws go, it not only illegal, it is unconstitutional. This argument fell on my CEO's deaf ears, citing the legalistic "terms of service" that users would be made to agree upon, and he pointed out in jest that I should not question his business ideas.

Developing this feature is also problematic from a development standpoint. Operating the camera from the background would put too much toll on the phone's battery. Uploading the videos would also be vampiric on the user's internet connection. Lastly, it is impossible to do on iOs.

While the entire development team agrees with my assessment and is just as uncomfortable with the feature request as I am, the product owner explains to me that while the feature is truly useless, it still has to be made so as to attract investors. And it did please the investors based on the last meeting with them.

My team has thus far insisted that Apple does not allow its developers to run the camera in the background and that we have agreed that instead of a video recording, we would instead take pictures every ten seconds. But I am a hardliner about this and I do not want us developing anything close to this feature.

As this feature is definitely "marketing-driven" as the product owner suggests, I want to know counter-arguments from an investor's standpoint so that the feature would be scrapped in its entirety.

In general, how do I become diplomatic about this matter? I believe I can still talk some sense into the CEO. I have no qualms leaving this company on account of the poor management but I love my dev team, their superior skills, and the workplace culture that we have cultivated. As much as I would want to use our value to the company as leverage against the CEO--If you insist that we do this feature, we will leave--I wish to be charitable still.

Thank you!

David K
  • 30,066
  • 21
  • 108
  • 140
Jenny Tengson Mandani
  • 1,711
  • 3
  • 13
  • 25
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. –  Mar 27 '19 at 06:30
  • 30
    As far as I know newer release of Android do not allow the use of microphone and camera for background processes, so I doubt the feature you mention would even work on newer versions of Android (then obviously only a tiny fraction of users actually use those versions...) – Giacomo Alzetta Mar 27 '19 at 08:25
  • 1
    @GiacomoAlzetta Even older versions require visible preview of camera input on screen for the capture to work. – Tomáš Zato Mar 27 '19 at 12:02
  • 85
    I would like to thank you for standing up and taking an ethical position, when it would have been easy to quietly comply. I wish I could be more helpful. – sdenham Mar 27 '19 at 14:15
  • 13
    Personally, I'd suggest brushing up on your resume and deleting this question altogether. Then, when the app comes out, simply make an anonymous post somewhere (e.g. AndroidCentral.com) alerting users as to what it does. Someone will watch the app, confirm the behavior, and then your (hopefully former) company will sink like a rock under the bad press. – Doktor J Mar 27 '19 at 14:29
  • 9
    BTW, if your CEO is this stubborn and willing to violate the law for profit, this is NOT a place you want to continue working at. Even if you win this battle, there will soon be another over the horizon as someone cooks up another half-baked unethical idea and tries to push it.

    Find a business that's rapidly expanding their development team (has multiple positions open), put in your resume, and recommend your colleagues do the same. If you all happen to get hired there at the same time, no one "recruited" anyone else, so noncompete clauses shouldn't trigger ;)

     – Doktor J Mar 27 '19 at 14:33
  • 56
    Strange that no one mentioned this earlier. There is a War on Drugs going on in Philippines. See https://en.wikipedia.org/wiki/Philippine_Drug_War . Suspected drug dealers are being extrajudicially killed with governments’s approval. I strongly suspect that “law enforcement” mentioned wants to use OP’s app in this war. With such context, OP may be in real physical danger if caught hindering those plans. And all those “call the police”/“go to court” suggestions may not help, but endanger OP further. Rule of law is not respected now at Philippines. – Neith Mar 27 '19 at 16:44
  • 2
    A point to note - Investors put money in companies because they want some return on it. If the company is going to be shut down because it put an illegal feature on its software, investors aren't going to see any money back. – T. Sar Mar 27 '19 at 18:24
  • 2
    @T.Sar unless the investors want a direct line into the servers for this app and want to use it for their own covert surveillance. Why be concerned about money when you could deploy a significant power grab by putting spyware in a popular enough app? Any politician or government agency would probably metaphorically kill to have the legal right to have exclusive access to such a thing. Money could then also be made under the table by people paying to access such secret data. It's certainly marketable if done in a way that doesn't reveal its presence. – user64742 Mar 28 '19 at 03:32
  • 1
    One thing is clear. If you don't do anything about it, somebody else on your team might. Which could well leave you liable to criminal prosecution. Better check with Law SE or lawyer. – Gnudiff Mar 28 '19 at 06:34
  • @TheGreatDuck I'm not sure if investors would openly invest on such a thing of there is any chance of legal backlash. As things currently are, it would very easy to an employee or affiliated person to throw the metaphorical feces on the metaphorical fan. Then again - I have no idea who those investors are, and I'm old enough to know that when money is on the line greed becomes an almost unstoppable force. I hope this project doesn't go forward. – T. Sar Mar 28 '19 at 10:20
  • 1
    You should tell your boss about the SuperFish scandal. This is a good example of how malwares typically end. At some point, people will notice they are being spied on by this app, anyway. Technically, it won't be hard to prove by end users who happen to know a bit about Android development. And then, your company will loose all reputation and be dismissed out of business. Not a smart move if your boss wants to keep his job. – dim Mar 28 '19 at 14:34
  • @T.Sar I would more be worried about government interest in the feature. It's one thing when you're a private company, it's significantly different when you're a government agency attempting to gain more power or control. – JMac Mar 28 '19 at 16:32
  • @JMac The question at hand is about a private company. More so, by the Phillipines' data privacy laws, nobody can record this type of data without explicit consent. – T. Sar Mar 28 '19 at 16:43
  • @T.Sar The question also explicitly mentions that those features would be used to "give cops leverage by way of investigation in case something in the videos can be used as evidence". This highly implies that at very least, government would be taking advantage of this. It's not clear what involvement the government has with the private company; but the question seemed to imply that they would get some benefit from law enforcement for allowing them to use this feature. You say nobody can record this data with Phillipenes' laws, but supposedly law enforcement is using this service. – JMac Mar 28 '19 at 16:48
  • @JMac This action is illegal in Phillipines and those images hold zero value in court: "Section 4. Any communication or spoken word, or the existence, contents, substance, purport, effect, or meaning of the same or any part thereof, or any information therein contained obtained or secured by any person in violation of the preceding sections of this Act shall not be admissible in evidence in any judicial, quasi-judicial, legislative or administrative hearing or investigation". The Gov can't use those recordings at all. The manager is just blowing excuses. – T. Sar Mar 28 '19 at 17:30
  • @JMac You can read more about it here – T. Sar Mar 28 '19 at 17:33
  • @T.Sar The issue is that there are fairly widespread allegations that law enforcement in the Phillipenes has been engaging in government sanctioned extrajudicial executions. This means that the government could act outside the law, allowing police to use this information to find potential targets for execution. So the concern would be that "used as evidence" and "law enforcement" are being loosely used in that description, as it would be illegal evidence, and law enforcement wouldn't technically be enforcing the law. – JMac Mar 28 '19 at 18:10
  • @JMac Goverment sanctioned extrajudicial executions aren't really outside the law, are they? That said, I understand what you're saying, but all of this is irrelevant. You have investor money coming in - this people don't want to help anyone, they want pictures of naked kids. – T. Sar Mar 28 '19 at 18:13
  • @T.Sar They are outside of the law by definition. The president of the Philippine's can say "Go kill every suspected drug dealer that you find" to his police, and they can go and do it. The judicial system in the Philippines would still exist, and not allow that. The word of the President (especially informal) is not enough to technically overturn the laws; but the President can also act as if those laws are not in place. If the government doesn't stop him, it's still not legal; but can happen. – JMac Mar 28 '19 at 18:26
  • In this case, the government has shown interest in acting outside the law, and finding and executing suspected drug dealers. This is a potential motivation for the company to develop this, because there may be government support that comes with it. In such a shady situation, the company could turn this into extra profits; shareholders may even allow it, depending on the culture and how beneficial this could be, and if it could be traced to them, or if someone else would take the fall. – JMac Mar 28 '19 at 18:30
  • @JMac The government so far denied those allegations, but yes, you have a very good point. – T. Sar Mar 28 '19 at 19:36
  • How can this be illegal if your ToS includes a description of this feature? What if you develop something take makes fair use of this, would that still be illegal? Furthermore, AFAIK Android asks the user if they will give this permission/lists the permissions required for this app when the user installs it. – d-b Mar 29 '19 at 06:09
  • Just to clarify -- is this about (#1) morality, (#2) legality, or (#3) authority? Technically for #2 you can try to appeal to #3 (government/legal authority) to be granted some sort of legal pardon in this by the government. If you cannot get #3, you will not be protected otherwise for violating #2, so this whole thing would be more of a personal concern to you then. (*todo: mention something about #1 later...) – ManRow Mar 29 '19 at 09:51

17 Answers17

265

This of course could place the company under serious fire for invading users' privacy when we get found out. In fact, as far as my country's laws go, it not only illegal, it is unconstitutional.

You're being asked to break the law and do things that might land you in prison or otherwise in serious trouble.

This argument fell on my CEO's deaf ears, citing the legalistic "terms of service" that users would be made to agree upon, and he pointed out in jest that I should not question his business ideas.

And you've already explained this to the CEO.

Your problem isn't how to explain it, your problem is how to get out before the business is shut down.

  1. Document everything that is going on. You might need it for future "courtroom" reasons.

  2. Get out.

If you want to try explaining it again you can talk about it being illegal and unconstitutional, but imho you're past the point where "the boss doesn't know" and into "he don't care".

V2Blast
  • 335
  • 7
  • 16
Dark Matter
  • 8,042
  • 6
  • 25
  • 32
  • 116
    Get out as fast as you can. If the boss is ready to break law it means he will break labour law, need to pay you or maybe he already is in violation of some laws. – SZCZERZO KŁY Mar 26 '19 at 12:44
  • 84
    @SZCZERZOKŁY, While I agree with the general suggestion of getting out, "If the boss is ready to break law it means he will break labour law" is overstating things. That is not an inevitable consequence. Just because someone breaks one law doesn't automatically mean they will break every law. For example, the boss may simply be indifferent towards user privacy, or genuinely think that a EULA covers his ass. It doesn't, but don't just assume that this somehow proves that he's knowingly breaking a law in a way that he happily would break any law. – Flater Mar 26 '19 at 14:48
  • 1
    @Flater The easily foreseeable outcome of this is the company is going to be creating kiddy porn by "accidently" (deliberately?) photographing minors in the bathroom and/or enabling stalking. That might even be its purpose. The level of implied ethics is so low that yes, labor law might also not be being followed. – Dark Matter Mar 26 '19 at 15:06
  • @Flater Being willing to sell this type of product, and it being the boss's idea, proves that he is, at best, unethical. And an unethical person is likely to break the law to get their way - which is why it's very likely they will break more than one law. See the Sunk Cost Fallacy for details. https://en.wikipedia.org/wiki/Sunk_cost – Zibbobz Mar 26 '19 at 15:07
  • 50
    @Zibbobz: Never attribute to malice what can be adequately explained by stupidity. I agree that it's likely that this is willful disregard, but it's still possible that you're dealing with someone who genuinely thinks he's in the clear (and is very wrong about that). Also, the sunk cost fallacy is not really relevant here. Just because I speed and get caught, doesn't mean I then contemplate killing the witnesses "because I'm breaking the law anyway". Again, it's possible that this is how the boss operates, but it is in no way a given or inevitable consequence. – Flater Mar 26 '19 at 15:10
  • @Flater Let's put it this way - given that the best course of action is already to leave the company due to the shady dealings of the boss, is there any reason for this person not to take additional precautions against retaliation? – Zibbobz Mar 26 '19 at 15:12
  • @Flater If they think that EULA make them able to break constitution he may be sure there is some paragraph in contract of employment that make in invulnerable to labour law. In such case you need to assume that their false assumptions of "CYA" expand to more fields that just that one. – SZCZERZO KŁY Mar 26 '19 at 15:20
  • 8
    @SZCZERZOKŁY: You cannot assume that the boss is willfully and knowingly breaking the constitution. This isn't a matter of what is legal fact (I assume that it is indeed unconstitutional), it's a matter of what the boss' perception of their decision is. The question as posed does not prove that he is genuinely aware that this violates the constitution and knowingly choosing to continue with their decision anyway. – Flater Mar 26 '19 at 15:25
  • 21
    @SZCZERZOKŁY: As a basic example: we are currently disagreeing on something. In the end, one of us is right and the other is not. But just because one of us is wrong, that doesn't mean that this person is intentionally lying. That intent is a very important distinction between lying and being wrong. Similarly, the boss has not been proven to be willfully breaking the law. And even then, he has not been proven to therefore willing break any law he wants. You're building assumptions on top of assumptions and portraying them as an inevitable fact. – Flater Mar 26 '19 at 15:29
  • 2
    I agree that it is quite the leap to assume that the boss would be willing to break law X because he broke law Z. Some people are just plain ignorant and stubborn, not evil. Anyway, we don't have enough to assume either. It would be on the hands of the OP to decide whether to play safe and quit or not. – undefined Mar 26 '19 at 15:30
  • 1
    @DarkMatter: I agree with your comment: "labor law might also not be being followed". Which is very different to what I responded to: "If the boss is ready to break law it means he will break labour law,". My point is that this cannot be assumed to be an inevitable fact. But it does raise a valid question on the possibility of the boss playing fast and loose with other legislature as well. – Flater Mar 26 '19 at 15:31
  • 2
    @Zibbobz: Turning the question around, we cannot know what OP will do with the information that "the boss will definitely be breaking labor laws". This may lead to unfounded accusations which actually detract from OP's point if he at a later stage addresses the actually privacy violations in an official complaint ("he flung unfounded accusations before, he must have a grudge against this boss"). If OP is already told to leave, there's no reason to just throw oil on the fire that has a chance of backfiring in certain cases. – Flater Mar 26 '19 at 15:50
  • I agree with your answer but I think "Document everything" could be expanded upon. From the sounds of it, this has all happened in conversation. I would recommend OP draft an email saying something along the lines of "I, as your lead engineer, believe feature X is unethical and possibly illegal because reasons... What course of action should I take?" It may make the boss think twice if they need to put in writing with their name on it "Do it anyways, we're covered by EULA" – Bones Mar 26 '19 at 16:38
  • 1
    The follow up thing to do here is to whistleblow. You've raised it internally to no effect; now you must raise it externally else you'll be held accountable too. – UKMonkey Mar 26 '19 at 16:53
  • 1
    Also, corsiKa's law of legal advice: the only legal advice you can trust from anyone other than a lawyer is "get a lawyer." This includes strangers, friends, family, the internet, the train, the cafe, and people in the lobby of a lawyer's office. – corsiKa Mar 26 '19 at 17:55
  • OP is not being asked to break the law - writing software to access a device's camera is absolutely not illegal. Shipping it to users without telling them may well be, but OP is not doing this. – ESR Mar 26 '19 at 18:26
  • @Flater "Just because someone breaks one law doesn't automatically mean they will break every law" While this is true, the CEO has already set precedent that he's willing to do so. There's no reason to think that he'd stop there if he thought it'd be convenient to break another one. "don't just assume that this somehow proves that he's knowingly breaking a law" But it looks like OP already informed CEO that he'd be breaking the law and got ignored; it looks like that's pretty much the very definition of doing something knowingly. – code_dredd Mar 26 '19 at 23:16
  • 2
    @ESR knowingly and willingly assisting someone in breaking the law is often by itself a crime. So writing software to access a device's camera absolutely can be illegal, if it's done with the intent and purpose to create and install illegal spyware on target devices. – Peter Mar 27 '19 at 01:44
  • @code_dredd: "There's no reason to think that he'd stop there" I fully agree with. What I'm saying is that there's no reason to know for a fact that he is or will break other laws. I never said it's not possible; I just said it's not conclusively proven. Even if he is willing breaking the privacy. Which I still contend; I've worked with manager who dismiss information when they think they know better. Again, your interpretation of willfully breaking the law is possible, even likely, but it is not conclusively proven. That is my only point. – Flater Mar 27 '19 at 09:17
  • @code_dredd: Just as a basic example: what if the boss simply received bad legal advice, from someone whose legal expertise he trusts more than OP (his employee)? It's perfectly possible, and it completely absolves the inference that the boss willingly breaks the law, which in turn absolves the inference that the boss must therefore be willing to break any other laws. And I repeat again, I'm not saying it's impossible that the boss is willingly doing all these things; I'm merely stating that it's not definitively the case. – Flater Mar 27 '19 at 09:19
  • @Flater It's not attributing to malice what can be attributed to stupidity. The CEO has demonstrated that they're stupid enough to ignore the advice that they're going to be breaking the law. They're stupid enough to not research it themselves. This can be applied to labour law in just the same way - apart from people might not even advise him it's illegal.... except the lawyers; later. One can easily attribute willingness to break a law to willingness to break other laws not because of malice - but whatever thought process resulted in them being happy to break it. – UKMonkey Mar 27 '19 at 15:20
  • @UKMonkey: The notion that someone who breaks a particular law is definitely going to break any law is nonsensical. You may have missed my last comment, directly above yours, which contains a reasonable example of why you cannot definitively conclude that the boss is intending to breaking any other laws. – Flater Mar 27 '19 at 18:37
  • @Flater an app that secretly and covertly records video surveillance is most certainly pure and simple malice. The feature is not a software optimization, nor is a customer request by the consumer. The only reason to place it there is to deliberately violate privacy. Yes, the company owner might be in agreement with labor laws, but trust is something that disappears the moment one thing that breaks it is done. Asking an employee to break the law/do something unethical is a violation of that trust. Therefore assuming the worst case scenario if you proceed to rat them out is a smart tactic. – user64742 Mar 28 '19 at 03:23
  • @UKMonkey not to mention that this is deliberate malicious action toward their user base, since there is no good reason whatsoever to covertly make recordings and save them in a place inaccessible to their user base. Stupid would be not hashing passwords or having poor security or recording data on user interaction with the app and maybe selling it to advertisers. Having their phone serve as a recording device to then potentially be sent to the government or anyone with cash is... definitely something quite highly suspicious and flat out creepy. – user64742 Mar 28 '19 at 03:29
  • 1
    @TheGreatDuck: Therefore assuming the worst case scenario if you proceed to rat them out is a smart tactic. Assuming additional things is going to detract from your case made about other things you know. OP knows for a fact that it is unconstitutional, that he spoke to his boss, and that the boss dismissed it. If OP then peppers in some unfounded accusations; it leads people (e.g. the police/court) to wonder how much of OP's story is built on unfounded assumptions. It's best to stick to the facts. – Flater Mar 28 '19 at 09:14
  • In the Philippines right now, the "investors" may be the law enforcement establishment, in which case he simply needs to get out of that situation. It is not his career at stake, but his life, whether he complies or not. – pojo-guy Mar 28 '19 at 13:03
  • @Flater why in the world would he accuse his boss of not following labor laws? We're saying it's highly likely that the boss is also violating such laws and hence they have more reason to leave. Please explain how we got onto the subject of "he should immediately go report his boss for labor law violation"? We said he should leave (and report the boss for doing unconsitutional behavior) rather than just get transferred off the project and risk having to endure other unethical behavior. – user64742 Mar 28 '19 at 23:22
  • @TheGreatDuck: The advice for OP (leave - which I still agree with) has nothing to do with whether the boss is violating labor law. Asserting that the boss is definitely breaking labor law (which is what I responded to) is irrelevant. At best, OP doesn't do anything with that information and it's simply an irrelevant addition. At worst, OP does something with this information, which is then liable to backfire if it turns out to be an unfounded accusation. My point is that we shouldn't be pretending that uncertain tangential information is conclusive and relevant information. – Flater Mar 29 '19 at 08:44
  • @pojo-guy You'd assume the OP would then be clearly granted some sort of legal pardon by the said government/law-enforcement "investors", right? ; ) – ManRow Mar 29 '19 at 23:33
  • @manrow when the law enforcement are breaking the laws, as is happening in the Philippines today (extrajudicial executions of alleged drug dealers for example), all bets are off. Dead men don't tell tales, plausible deniability, etc. – pojo-guy Mar 30 '19 at 04:02
  • 1
    @pojo-guy Then, given such a dysfunctional government/legal authority, your original advice makes more sense--however hopefully this would not turn out to be a "damned if you do"-"damned if you don't" scenario for the OP. – ManRow Mar 30 '19 at 10:43
160

Since your boss doesn't care that this is incredibly invasive, warn him that starting on Android Q, to be released later this year, Android will (finally) block apps from recording video and sound while not in the foreground. Therefore, it will be the same situation you have with iOS.

Of course it will take sometime until Android Q has a significant marketshare, but you could ask him if developing a functionality that will be rendered useless in the near future is worth the trouble.

Therefore, you don't need to be "diplomatic". You can show him hard, technical facts.

https://www.theverge.com/2018/3/7/17091104/android-p-prevents-apps-using-mic-camera-idle-background

Disclaimer: I've misread the article. Apparently background recording is already blocked on Android P, the current version, which means there should already be a larger marketshare where this kind of stuff wouldn't work.

undefined
  • 5,413
  • 5
  • 21
  • 28
  • 1
    Won't upvote, because it essentially advises corrupt boss "your idea won't work because technical reasons, but yea, could for you for thinking of it". I reckon a better solution would be a firm "hahaha, no, and I quit" (the latter bit to be added as soon as any alternative is found) – rkeet Mar 26 '19 at 14:32
  • 9
    IMO quitting isn't a good option because OP states that she would like to continue working in this company. That's why she wants to be diplomatic. By talking strictly from a technical standpoint there won't be any harm, either for the OP, company or the users. – undefined Mar 26 '19 at 14:35
  • 41
    This answers the question ("how can I talk my CEO out of this?") and it doesn't take anything else off the table. +1 from me. – Ruther Rendommeleigh Mar 26 '19 at 14:35
  • 9
    @rkeet That's a better solution iff you don't need to eat – Lightness Races in Orbit Mar 26 '19 at 15:44
  • 11
    @rkeet Alternatively, "hahaha, no, and I quit" does nothing to prevent the boss and company from doing this harmful practice, while "your idea won't work for technical reasons" does. Your solution is basically just "not my problem". – Lord Farquaad Mar 26 '19 at 17:07
  • 1
    This is the best answer for OP's stated question. While it may be in our collective interest to /burn it with fire/... it's better for OP to keep his job and for the company to retain an ethical employee's influence – Thomas Zwaagstra Mar 26 '19 at 20:40
  • @LightnessRacesinOrbit see below for Farquaad, same – rkeet Mar 26 '19 at 21:01
  • 1
    @LordFarquaad Quitting makes you not land in prison, though free food there I suppose... Could stay, do the job the boss wants (clearly has no issue with the law being broken), so you do it. You end up the fall-guy, as your name is the one on the commits creating this law-breaking piece of code. Boss does the basic CYA: "No idea why OP would build that, I never asked for it, check the emails". - Also, look at it this way: OP's a dev. If OP places on LinkedIn "I'm looking for a job", she'll have the first offers by day's end. - Also, having left from company: call cops for law breaking issue? – rkeet Mar 26 '19 at 21:03
  • 7
    @rkeet GustavoMP never suggests that OP break the law. On the contrary, they suggest a course of action that would prevent the CEO from pursuing this idea. Not only will OP not be implicated in anything, but fewer people would be harmed if OP can prevent this immoral behavior from happening in the first place, which is commendable. Further, OP has stated they're "a hardliner about this and I do not want us developing anything close to this feature." OP being complicit is neither a consideration in the question nor in this answer. – Lord Farquaad Mar 26 '19 at 21:08
  • @LordFarquaad Indeed, answer doesn't say OP does it. Answer suggests OP should be ok with a boss thinking these kinds of things are ok. Then there's the PO saying it still has to be made so as to attract investors. As such, would still have to be made, however much of a hard-liner OP is against such a thing. The fact the boss(es) even think this is ok, and breaking the "just a little" with such things would be ok, is a giant no-no, a setup for a scapegoat, basically a "leave now or feel you were a part of 'this' (fiasco?) for the rest of your professional life, willingly!" type of beacon. – rkeet Mar 26 '19 at 21:14
  • 2
    @rkeet you seem to be operating under the assumption that this development is happening no matter what OP does. Given that assumption, this Q/A has no purpose. If that's your belief, you're welcome to write a frame challenge answer. – Lord Farquaad Mar 26 '19 at 21:25
  • 1
    @rkeet: Not saying the OP must stay at this company. Saying "just change jobs" may be easy for you but is not always the case – Lightness Races in Orbit Mar 27 '19 at 01:06
  • Would this not just change the problem from the boss wanting to illegally and intrusively always record video, to, the boss wanting to illegally and intrusively take photos every 10 seconds (as they intend to on iOS)? – user56reinstatemonica8 Mar 27 '19 at 12:27
  • OP could also note that even older versions of Android (all the way back to KitKat) have hardware inconsistencies re: the camera, especially in regards to headless recording. This 'feature' will likely fail on many models, and could introduce crashes or other issues that marketing will be concerned about. – CCJ Mar 27 '19 at 15:18
  • @rkeet If there is no realistic way to whistleblow this employer without causing a huge stink in their country and other people refusing to hire them, then doing as much due diligence to convince the employer not to do this is a good tactic. I'd personally rather know that I convinced them not to make this "feature" and prevented such an exploit then be complicit by leaving without saying a word lest I ruin my own career. Of course the employee can still leave, but maybe the employer is naive and needs hardware reasons to not do it. If they agree to cease development then the asker is good. – user64742 Mar 30 '19 at 03:53
143

  1. Document everything, starting now. You will likely need it.

  2. Do not start building this feature. Do not prioritize it, do not write tickets for it, do not task your team with anything to do with it.

  3. If management wants to chastise you over dereliction of duty, allow them to do so, and simply ignore everything they say. Document these situations as well.

  4. Go as high as you can in the food chain. If your boss won't listen, go to their boss. If their boss won't listen, go to their boss. And so on. What you should explain to them is the worst-case-but-possible scenario that you could get in trouble for. Other answers suggest going the child porn route, and that's not a bad idea, but if you can think of something more dangerous then go for it. I would do something like this:

    (to CEO) Hey, John [or however you want to address the CEO], I'm having an issue with this new feature we're developing. I know the purpose of the feature is [explain what product management told you], but I feel like we could get in a lot of trouble for this. For example, what happens if we're recording and we accidentally record an underage child changing their clothes? That gets us in a lot of trouble, not with the customer, but with the police directly. I don't think an EULA handles that use case, because minors can't legally give permission to record pornography of themselves. We should rethink this.

    Another way you can come at this is from a user engagement perspective:

    Hey John, [...]. Because this feature uses the camera constantly, it will use a lot of battery power. Since it uploads the video to our servers, it also uses a lot of user data. What do you think would happen if our users suddenly see their batteries decreasing rapidly and their data usage spiking, and then find out it's our app that did it? Would you use an app which causes a significant drain on your phone like this? Do you think our users will? What will you tell your investors if user engagement falls off a cliff due to these issues?

    See what he says. If this doesn't convince him, then:

  5. Make them fire you, or, better, make them force you to quit. Come into work every day and do everything they ask as normal, except do not do this project. Then they have 2 choices: Abandon the project, or fire you and bring in someone who will do the project. In the first case, you win! In the second case, if they fire you then you should contact a lawyer. Bring all the evidence you have concerning the project, the concerns you raised, who you raised them to, everything. Remember, document everything. You likely have a case (IANAL). If they force you to quit, then on top of the above legal case, you may also have a case for constructive dismissal; the tl;dr of Wikipedia is that the definition (IANAL) is when your company makes your life a living hell, but does not fire you, to the point at which you have no choice but to quit.

  6. If you get wind of the project being redirected (i.e. your team is removed from it and another team is given the task instead), contact the local authorities ASAP. You likely have protection as a whistleblower. Dump everything you have to the authorities as soon as you can and in as much detail as you can.

V2Blast
  • 335
  • 7
  • 16
Ertai87
  • 45,600
  • 9
  • 73
  • 144
  • 18
    Best answer BY FAR. Several answers say to "document everything." This answer goes into highly specific detail about what to document, and how to actually proceed, and when to go to the authorities. I hope this advice is followed. – Wildcard Mar 26 '19 at 20:14
  • I would say that authorities should be notified now. I'm sure their reaction would be "no crime has been committed since the app hasn't been released" BUT not reporting that a crime is being planned is likely also illegal – UKMonkey Mar 27 '19 at 15:32
  • 1
    @UKMonkey I'd give the company the benefit of the doubt. Maybe they're not completely insane and can still be reasoned with. I'd only go to the authorities once it's clear this company is dead set on breaking the law. – Ertai87 Mar 27 '19 at 15:43
  • 3
    He said he's talked to the CEO about it and he doesn't care, so there's nowhere higher to go unless there's a board of directors (not much chance of them listening to a developer). The rest of your answer is good though. – nasch Mar 27 '19 at 17:40
  • 6
    @nasch He did say he believes he can still talk some sense into the CEO. I wouldn't go to the authorities until that vein of inquiry has been wiped out. No point in slinging mud at your own company until you're sure they deserve it. – Ertai87 Mar 27 '19 at 19:45
  • #4 but in writing (email). That way it's documented. I would also end up with "Is this even legal?" – ventsyv Mar 28 '19 at 18:01
  • @ventsyv The CEO is (seems to be) sure that what he's doing is legal, and it appears that avenue has already been raised by OP previously. To avoid sounding like a broken record, it would probably be better to omit that. It's certainly implied by the rest of what I've suggested, but it sounds kind of hysterical especially since it's already been said and rejected. – Ertai87 Mar 29 '19 at 15:17
64

Since it seems that your CEO is either a bit clueless (at best) or morally bankrupt I don't think you're going to get anywhere with persuading them that this is abhorrent. Especially given they are just casually brushing off such fripperies as it being rather illegal. What you might have some success with is point out some of the myriad ways that this could easily become utterly ruinous for both them and the company.

e.g. If this "feature" captures images/video of an underage person getting changed - congratulations your company is now on the hook for producing, transmitting and storing indecent images of children! Can't see investors flocking to a company with that one on their record.

But I have to say why waste your time? At the end of the day scumbags gonna scumbag and life's too short to waste it working for or being diplomatic to scumbags. I'd honestly just recommend leaving as soon as you have something else to go to and make sure no-one you know ever installs or uses this app or anything else the company produces.

motosubatsu
  • 107,822
  • 51
  • 290
  • 367
  • 2
    Yeah, maybe go to the police* AFTER you left. *the police might not be the correct authority here... – Hobbamok Mar 26 '19 at 13:49
  • 40
    @Hobbamok Assuming OP is interested in taking legal action, I would suggest speaking to a lawyer before they leave the company. I don't claim to know the best course myself, but a lawyer who specializes in whistle-blowing and who knows the locals laws would. By speaking to such a lawyer beforehand, OP still has all options open - speaking to them after leaving may limit the ability to build a successful case against the company. Again, this is all assuming OP has any interest in taking action at all. – Steve-O Mar 26 '19 at 14:02
  • "Can't see investors flocking to a company with that one on their record." Don't assume every "investor" in a product like this has the same respect for the law as you do. – alephzero Mar 26 '19 at 15:30
  • 3
    @alephzero I wouldn't suggest that nobody would be willing to invest in a company with something like that, but it's going to narrow down the list a fair bit. – motosubatsu Mar 26 '19 at 15:36
  • Wasn't this the exact plot of a 'Silicon Valley' episode? Spoiler: $21 billion in COPPA fines. – Marc Bernier Mar 26 '19 at 17:53
  • I would add there are many anti-terrorism laws in many countries that forbid taking photos in certain areas - airports being an obvious example. Imagine if the app ends up picking up top secret government information.

    Now imagine the police breaking into the company premises and finding the combination of the images...

     – UKMonkey Mar 27 '19 at 15:26
15

TLDR: Openly, brazenly start collecting documents that prove you were not a decider in this matter, that you advised management against this feature for privacy reasons, and are simply following orders to retain your good job status. Ask the boss flat-out to give you a letter stating exactly that. This may sober him up.

If that doesn't work, I'd find another company who wants a good team, and take your team with you.

The eavesdropping is a very big deal

Eavesdropping is a criminal charge that varies by state or nationality. Some are "1-party states", where if 1 party in the room gives permission, it's legal.

Most others are "all-party states", meaning everyone being recorded must give permission.

The user doesn't know about your company's eavesdropping, which makes this 0-party; no one in the room is aware. That makes it a crime just about everywhere. What will your criminal defense be? Language buried deep in the EULA? Juries aren't going to accept that because then you would be accusing your customers of breaking the law by not reading the EULA thoroughly enough. Juries, who don't either, will say "no sale".

The feature would send customers through legal hell

But it gets worse. Consider Curtis, your customer, and imagine he's in a civil lawsuit about something totally unrelated. The plaintiff subpoenas from you all the data you have about them. You hand over the eavesdropped content (which makes perfect sense to your boss, since he's such a help-the-police guy). Plaintiff recognizes the eavesdropping, and blows up, assuming Curtis did this.

  • In an all-party state: Curtis is up the creek. This smokes any chance of a settlement, and horribly prejudices the civil case: Curtis loses HARD. Then the judge refers it to the DA for criminal prosecution; Curtis must be punished. The whole time, nobody knows how this happened. All parties assume Curtis did it on purpose. Curtis assumes he accidentally turned on some feature he's unaware of.

  • In a 1-party state, Curtis is safe from legal peril, because he had a right to eavesdrop. But if he says he did it on purpose, he enrages the plaintiff. So he is better off saying the app did this without his permission, which will not be believed. Showing it's true will calm the plaintiff and create a "common enemy".

Both of these end in an interesting problem for you. Curtis's best bet is to prove that you do indeed eavesdrop. He already has subpoena power because of the civil suit. So he'll use it to get the same records about any of plaintiff's staff (turnabout is fair play) -- or better, the judge. Can you imagine the civil court judge looking at photos of himself naked?? The judge will have confidence he did not turn this on. He will say to the D.A. "At first I didn't believe defendant, but the company did it to me too". Curtis is out to save his bacon, not get your company, but to save his bacon he must nail you.

All this to say, getting caught is inevitable. It will be viewed by every US state as your company committing a criminal act for money, and presumably lots of other nations and provinces as well.

It will particularly enrage the EFF, ACLU and privacy organizations, especially if it's uncovered that part of your boss's motivation was to "help law enforcement".

Now, when your company gets caught, I don't know how things work in the Philippines, but it sounds like there'd be an internal scramble to blame the next guy. Your boss would obviously have an advantage there, and would try to sell it as "I had no idea OP and her developers were doing that, send them to jail not me".

Sober up your boss, by covering your tail

So your top job is to cover yourself (CYA) and your team against that possibility. What you want is a "get out of jail free card" that shows management was fully aware of the privacy issues and wanted the project built anyway, and their reasoning. Now, when your boss sees you trying to collect those CYA documents, that's going to sober them up right quick: Why do my subordinates think they need this? The boss may have indulged in fantasy when it comes to the legal implications, now he's thinking. Fair chance you will get a memo saying "drop the feature".

I considered this a final answer, but some are contemplating what happens in a mad world where your boss goes "here you go, here's a letter making me fully responsible for legal consequences".

At this point your "get out of jail free card" would become a Nuremberg defense. Aside from any contemplation of whether Nuremberg bears on complex questions of law, I honestly don't foresee you hanging around to find out. If your boss persists, you've got a great team and I expect you to find better work and take your team with you.

Harper - Reinstate Monica
  • 14,137
  • 2
  • 31
  • 59
  • So, do these "get out of jail free cards" actually work? I thought it'd be the responsibility of anybody who sees a crime happening, to at least report it. – Sudix Mar 27 '19 at 12:06
  • 1
    This sounds like The Nuremberg Defense, which has questionable legal standing. The only way to get out of this one is to expressly refuse to be a part of it whatsoever, and even that might not be enough, if you had reasonable knowledge that it was going on without you being a direct part of it, but you also failed to do everything within your power to stop it (including contacting law enforcement). – Ertai87 Mar 27 '19 at 15:20
  • @Ertai87 You do have a point, especially given the jurisdiction. In the US at least, the Nuremberg defense only fails when the crime is obvious: you can't put a foot soldier in a catch-22 between direct orders, and a possible Supreme Court decision, that's why nobody went to jail for interning the Japanese. But in the Philippines, the legal system is a bit more wild-west, and I could foresee them casting blame all the way down the stack. Anyway, I never imagined OP would actually comply.. Edited. – Harper - Reinstate Monica Mar 27 '19 at 16:44
  • 2
    @Sudix Edited. I never honestly expected OP would actually comply. I imagine the pursuit of the "get out of jail free card" to sober up the boss and make him consult counsel, a discussion that I expect to end with "OH. Nevermind then." – Harper - Reinstate Monica Mar 27 '19 at 16:45
  • -1. OP is in Philippines, and the answer is centered on American legal framework. – Neith Mar 27 '19 at 16:54
  • @Neith first, OP excepts to sell this app in the US and Europe.. Second, do you really know how Phillipine law differs? Can you enlighten us or are you just guessing? – Harper - Reinstate Monica Mar 27 '19 at 16:58
  • 3
    @Harper didn’t see OP mentioning Europe or US anywhere. Point me if I missed it. As for the law, first, IANAL, but Wikipedia says Philippines legal system is mixed, not pure common law as in US. https://en.wikipedia.org/wiki/List_of_national_legal_systems Second and most important, current Philippines government openly defy rule of law: https://en.wikipedia.org/wiki/Philippine_Drug_War Also see my comment on the question body for that. – Neith Mar 27 '19 at 17:11
  • I am speechless... – Harper - Reinstate Monica Mar 27 '19 at 19:27
9

If you do not want to make this a fight:

You know you're making an app that is against Google's rules on privacy (specifically camera use), so please do immediately report it. I think it's anonymous, but you can pretend to be a user I guess. I'm sure the same thing can be done for IOS. Act surprised this happened, and then get busy "fixing it" back to how it was.

This isn't the best way, but is a non-direct way to protect your users, if it proves impossible to kill this idea before development.

V2Blast
  • 335
  • 7
  • 16
Nathan
  • 4,502
  • 4
  • 23
  • 34
  • 1
    Your first link goes to a page in German (I think). – Justsalt Mar 28 '19 at 18:38
  • 1
    @Justsalt: It's Swedish. Here's the English page: https://play.google.com/intl/en-US/about/privacy-security-deception/personal-sensitive/index.html – V2Blast Mar 29 '19 at 02:13
  • Whoops. Thanks for the edit @V2Blast – Nathan Mar 29 '19 at 08:06
  • No problem! Glad to help :) – V2Blast Mar 29 '19 at 21:30
  • But how do you know those rules & terms of privacy apply to the Phillipines? Different countries have different laws that a global corporation like Google must honor as individually and territorially as necessary. Those terms of service linked might not necessarily apply in the Philippines territory. – ManRow Mar 29 '19 at 23:48
7

Did you consider the humorous approach?

Maybe it's late for this, but your CEO may be overwhelmed with soft-toned legal boilerplate stuff he reads everyday that he is indeed not grasping the gravity of the situation.

If I was asked to develop a feature that would secretly record video and upload it from users phones, my answer would be something like:

"For real? We are gonna get SO MANY celebrity nudes! Is FamousPerson in our user base? We are so going to jail... Were is the iCloud hacker serving time again?"

This is meant to send the "this is illegal" message with a catch phrase, that he's likely to remember.

Others have given good enough "serious professional answers" but to avoid sounding reckless, here's my version of it: Simply don't do the code, try to get written documents/requests from your boss specifying what is to be developed. Once you do, that is your evidence. If the company is big enough, there should be a compliance channel for this kind of whistle blowing. If company is small, once you get fired you can sue the company.

As usual, a boilerplate text is due here: I am not a lawyer! Seek specialized help instead of relying on what may sound as legal advice from this website!

Mefitico
  • 3,632
  • 2
  • 14
  • 38
6

I don't disagree with the answer by Dark Matter, but I wanted to offer you an option that isn't mentioned there.

In many companies there is an ethics officer, whose job is to ensure that the company complies with ethical standards. I'm guessing your company doesn't have one, but future readers of this might try that. Also sometimes contacting the company lawyer is effective. Lawyers have an obligation to uphold the law, and if they know their client is engaging in illegal activity they are much less able to ignore it than other people.

The final option is to gather enough evidence to document what you are being asked to do, and then send it to the authorities. Or the news media. Or both.

It goes without saying that this is a nuclear option. While it is possible to do anonymously (Wikileaks?) there is a pretty good chance you will be at least suspected of being the leaker, and probably fired. Technically you are also exposing confidential information, and there is a chance that you could be pursued in the courts. In my country you would be protected by whistleblower legislation, but I don't imagine the Philippines has that.

So the consequences for you might be severe. Don't take this action unless you are prepared for them. But on the upside you would be exposing a corrupt CEO and possibly a corrupt company, which would be a serious deterrent to other companies who want to do the same thing.

V2Blast
  • 335
  • 7
  • 16
DJClayworth
  • 84,823
  • 25
  • 192
  • 283
  • 3
    Contacting the company lawyer might as well be a nuclear option for me; as the lawyer and the CEO are in great terms and was in fact in the meeting with the investors who were enthusiastic about the problematic feature request. – Jenny Tengson Mandani Mar 26 '19 at 15:58
  • 3
    I just wanted to make sure that future readers of this knew about all their options. – DJClayworth Mar 26 '19 at 16:00
  • 1
    FWIW, Manila is The Philippines, not Malaysia. Probably the same deal though. – Ertai87 Mar 26 '19 at 16:05
  • 3
    For what it is worth (FWIW) according to a lawyer's presentation I attended a few years ago at a national tech conference... whistle-blower legislation in the US only protects you if you tell appropriate government authorities - there is no protection from those laws if you tell the press or anyone else. – J. Chris Compton Mar 26 '19 at 17:24
  • A lawyer is not obliged to uphold the law, but in some countries lawyers might lose their title if they do not. In practice, the lawyer should advice the company on the legality of e.g. this feature, but that is about it. – a20 Mar 27 '19 at 15:24
6

Slightly different approach than the other (mostly very good) answers.
This answer is an attempt for you to keep your job and not have to write the feature.

the product owner explains to me that while the feature is truly useless, it still has to be made so as to attract investors

My alternative is to approach the company lawyer directly.
You have a legal issue that could sink the whole company that he might understand.

Approach the lawyer like this: (use an innocent / concerned expression)

"Hey [lawyer], I previously had a problem with that video feature - CEO may have mentioned this. But after talking to him I told [product owner] about it he said we had to do it anyway. So I went back to try to figure out how to do it because it looks like everyone is on board with it."

You are just playing the good employee so he will listen closely to what you are saying (instead of just nod and pay half-attention to someone that doesn't want to do what the CEO and the investors want to do).

"One pretty big legal issue occurred to me that I thought I should run by you."
"Because the customer doesn't know about the video, they could be in their home unknowing filming their children while they get dressed. Even if the EULA TOS exempts us from this, if it comes out that we have taken images of naked children and stored them on our servers - wouldn't that be a PR nightmare for both the company and the investors?"
"All it would take is a Mom or Dad using another app while changing a baby... or being in a bathroom with their small child. I don't know how to detect this, so I cannot prevent our storing compromising pictures on our servers.
"That would be a big deal, right? Especially since we aren't telling the parents?"
"There are apps that track how often an infant goes to the bathroom, so it is reasonable."

Best wishes on this.

Hope you will tell us how it comes out in a few weeks.

As an aside... whistle-blower laws in the US only protect you from legal action when you tell the authorities. Tell the press, or anyone else, and you're open to be sued.
I'm not a lawyer, but this information came from a lawyer who was speaking at a conference I attended several years ago.

J. Chris Compton
  • 9,392
  • 1
  • 25
  • 48
  • 1
    Even if you can't talk to the company lawyer yourself, you could insist on having his written opinion on this. This can be an eye opener for people. – Benjamin Mar 27 '19 at 06:11
6

Ask your CEO whether he will be using the app. Or whether it is possible police or politicians will use the app.

If so, tell him it is a security risk because all the engineers in the company will be able to spy on him and on others. Maybe it works as a deterrent if he is concerned himself.

Also make him aware of the commercial risk of doing this: he might lose his entire user base if they find out. Play on his ego, surely he is too smart to take such a risk?

I'm adding this answer because you explicitly ask for a diplomatic solution. Simply quitting or paper trailing is not necessarily diplomatic.

don.joey
  • 201
  • 1
  • 5
5

Some very powerful and unpleasant people in the past have used technology (for example old fashioned audio tapes) to record meetings secretly. They get the victim to admit to disliking another powerful figure and then use the tapes as a form of blackmail or simply to set opponents against each other, e.g. "This is what X said about you, and I've got the tape to prove it."

It is not impossible that someone has been searching around for a firm willing to produce this sort of software and there might be considerable bribes involved.

You didn't say what the app does. Could it be used for blackmail, or spying for industrial secrets in a certain sphere? Could it be used to predict fluctuations in the financial markets?

I would get out ASAP because if anything like this is going on, it won't be the big players who get prosecuted, it will be the ones at the bottom of the chain.

chasly - supports Monica
  • 2,196
  • 11
  • 17
5

Your boss is ordering you to engage in crime. By proceeding, you will become their accomplice because you will be knowingly engaging in criminal activity.

So threaten to quit, or otherwise refuse to proceed, but not because you dislike whatever but because they can't possibly pay you enough to compensate several years of your life spent in jail. (Or maybe they can? Provide this as an option -- they will surely refuse to pay such an astronomical sum but this will open their eyes on how inadequate their demands are to what they are paying you. (Note that income from illegal activity will probably be illegal, too, so more trouble for you and the company to conceal it and yet another premium for the inconvenience this would be causing you!) The fact that they can't demand of you more than their pay is worth is something they can't argue with.)

Share the above with your co-workers and they will probably come to the same conclusion.

P.S. In fact, the above is (roughly) what I said to my past employer when they asked if I could do some online hacking for them. They never brought up the topic again.

ivan_pozdeev
  • 526
  • 4
  • 12
  • 2
    His boss cannot pay enough because the courts will happily take away his wages as profit from crime. – Joshua Mar 27 '19 at 21:01
5

I would like to approach a resolution to this issue in a slightly different way. The question was specifically:

How to be diplomatic in refusing to write code that breaches the privacy of our users

There are two ways to approach this:

  1. Refuse to write the code
  2. Make the case that this feature will negatively impact the project vision and you feel responsibility to steadfastly object to anything that will derail the project success

They both result in the same thing -- a refusal to implement the feature -- but the latter approach roots the refusal in the general desire for the app and business success, rather than for the users privacy. User privacy is a means to application success, but vise versa is not necessarily true.

To do this I would:

  • Seek to establish common ground and good intent
  • Ground any justifications in risks that I deem are important for the CEO
  • Be enthusiastic about the project and the company, but steadfast in the refusal to implement

i.e. "I am really sorry but I cannot continue with this as it stands."

For example:

Dear ${CEO},

I am a member of the software development team working on ${APP}. I am passionate about ${STATED_APPS_PURPOSE} and have enjoyed working on ${PREVIOUS_NON_CREEPY_THINGS}.

However, I recently learned of this new feature that will require the recording of users at all times through their camera. While I understand the benefits of this feature, including:

  • ${CREEPY_BENEFIT_A}
  • ${CREEPY_BENEFIT_B}
  • ${INVESTORS_HAPPY_C}

I feel compelled to note that this new feature deviates significantly from ${STATED_APPS_PURPOSE}. It may be that I have misunderstood the nature of the requirements from this feature, but as the feature has been requested I see significant new project risks introduced, including:

  • User backlash at discovering the unexpected behaviour of the application
  • Potential violations of users privacy law ${EXAMPLE} in Manilla and within other locales
  • Punitive damages associated with the aforementioned violations of law

It is my assessment that this feature has deviated enough from ${STATED_APPS_PURPOSE} that I no longer feel comfortable with the tradeoffs the application has made, and I am thus not a suitable candidate for the ongoing development of this application.

I am reaching out to you now such that I may understand more the nature of this feature to clarify whether it should be implemented as stated, or whether our project would better grow in other areas.

Kind regards, ${YOU}.

Couching a justification in moral grounds that we know and understand are different from our own is an uncomfortable process. However, while it might be easier if our friends and colleagues shared our own values we each arrived in each others company via a different path and arguing a point to a given audience will be much more successful at homogenising the practical outcomes of our values, if not their roots.

Ertai87
  • 45,600
  • 9
  • 73
  • 144
Andrew Howden
  • 51
  • 2
3

While IT is not as professionalised as many other occupations, there are still professional standards organisations which will provide advice and assistance in these situations. In your instance, you should contact the Philippine Computer Society and notify them you have been instructed to breach their Code of Ethics.

Bardi Harborow
  • 170
  • 6
  • 1
    As much as possible I want to solve this problem diplomatically with the CEO without having to insinuate any governing body or NGO that I am having this problem. I've been poring into the documents by the National Privacy Commission and so far it has been helpful. – Jenny Tengson Mandani Mar 27 '19 at 03:43
1

Presumably the OP has reason to suppose that this app is "intended" to be used illegally, but stepping back from the general feeling of moral outrage in this thread, there is not much evidence (if any) to support that.

I can't see anything in the OP's post which doesn't fit a use case like "this app converts your cellphone into a dashcam for use in your car". In that situation, battery usage is irrelevant since the phone would be running from the car battery. And dashcams are perfectly legal in many countries (including the UK, for example), and used as police evidence in court, just like images from any other type of security camera. In some countries, the use of dashcams is almost a necessity to support road accident insurance claims and protect oneself against insurance fraud by other people, who may well be criminals themselves.

Of course the app could be used for illegal purposes as well, but so could many other items which it is perfectly legal to buy an sell - kitchen knives, for example.

If the OP doesn't want to be involved in this software project for personal reasons, that's a perfectly reasonable position to take, but IMO there is far too little information given here to jump to the conclusion that the whole project, or the project leader, is operating outside of the law.

alephzero
  • 5,849
  • 1
  • 17
  • 26
  • 11
    Could you provide a reasoning for the app recording "in the background", or the requirement that videos be uploaded? Neither of those make sense for a dashcam. In addition, adding this functionality to an existing app (that I assume had a purpose without it) instead of just making a new app seems rather fishy as well. – Ruther Rendommeleigh Mar 26 '19 at 16:28
  • 2
    @RutherRendommeleigh I agree that adding it to an existing app seems fishy. A good, valid use case I can think of is recording dash-cam video while simultaneously using GPS navigation in a separate app. That said, automatically uploading video to a private server, and not directly telling the user that you're recording, are both very big red flags. – Mar Mar 26 '19 at 17:48
  • 2
    You'll need a different example than dash cam... OP states the new feature would "secretly record its surroundings." – J. Chris Compton Mar 26 '19 at 18:53
  • 2
    Yeah it's the secret part that's the problem. Pretty much any smartphone can overtly record video, and nobody considers that to be an ethical problem because the recording function is only activated when the user selects it. There's nothing wrong with creating a video recording app; there's a problem with creating one that secretly records video. – Zach Lipton Mar 27 '19 at 08:38
1

If I were in this situation, I would give the CEO 2 choices:

  1. either he could stop this highly illegal (at least in the USA) project and everything else can go on as normal, or
  2. he can accept your letter of resignation and you will be getting a lawyer and reporting his activities to the proper authorities, whom can do what they need to do as soon as he releases this piece of software.

It is expected that you may have to do things that you don't want to do for your job, but once the issue crosses the line to illegal, there is no longer any grey space. Personally my job is definitely not worth ruining my life over by spending years in prison or in court battles.

V2Blast
  • 335
  • 7
  • 16
dmoore1181
  • 228
  • 1
  • 6
1

In fact, as far as my country's laws go, it not only illegal, it is unconstitutional

Answer: There is no diplomacy in saying "According to rule n. X, paragraph Y, etc".

You have said it in simple words. You have stated that your rules forbid using this technology in such way. Laws have obviously precedence against employer's orders. Think your boss wants you to kill somebody. Blatantly unethical or not, this will get both to jail. For sure. And you have escalated to the CEO. There is no other escalation here. You already spoke to Pope Francis, his boss is too busy to escalate. (I often use this metaphore)

From your question, I see no more than two options:

  1. Accept to work on the project in order to obey to your employer, but be aware that both your boss, you and whoever codes for the project can be accused if somebody will ever find this out. And believe me, eventually somebody will do.

  2. Refuse to work on the activity, explain in writing the reason why it is illegal. This will, in the worst case, get you dismissed. In that case you have no other choice than finding a good lawyer to help you with the case.

In such case, you could also sue your company not just for having fired you unjustly, but for committing a crime.

You will probably need to face the human consequences, e.g. to have a hard time to spend finding a new job, questions from interviewers, etc. According to the cultural context (you mentioned Philippines, but I have no record for the country), it may be harder or not for a whistleblower to find another job. I do not want to discuss this here.

And that brings us to a third option: silently whistleblow. Get all written evidence of

  • The project being approved by the chain of command
  • Your CEO approving the project despite the roadblocks

Make an envelope and send it to your government's privacy authority.

Whistleblow option 2: work on the project, get the app delivered to consumers. Then contact a software security company or a security researcher (Symantec, TrendMicro, Kaspersky, Mr. Troy Hunt) and report them anonymously that you did this by company's order. Show them as most technical information as possible to find the guilty code (your company will likely obfuscate).

The security guys will probably try to conduct code disassemblies, tests etc. to determine that malicious code is present. They value the privacy of whistleblowers.

Google themselves ban applications that implement malicious code.

Remember that all this will cause damage to your company, up to bankruptcy. You can start polishing your resume today

usr-local-ΕΨΗΕΛΩΝ
  • 2,267
  • 1
  • 15
  • 24