Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 82 posts

Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

#21

Post by marcosdumay »

AussieOdyssey wrote: post #9
zhte415 wrote: post #3

Anonymously heads-up the country-level information security officer of the bank in question with a link to the Github repo. CC the country head. Working on code without security background checking confirmed is an absolute no. This will completely torpedo your employer, but that might not be so bad if this is their attitude to information security. Edit: As anonymous as you can. Have a lawyer present. Don't take advi…

The consultant is running wireless hotspots to copy the software. All I want is the contract money they agreed to pay me for this project. They froze the payment because I complained about this, at best unethical, behaviour.

Get a lawyer and another job. Putting that data on GitHub may not be a crime, but what they are doing to you may be one.

Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

#22

Post by dr_win »

warninger wrote: post #20

A word of warning - it's quite straightforward to do a Google search for 'site:github.com {bank_name}' for the large Australian banks, and find a repository that looks like the one you describe. You might want to contact the HN admins and ask them to completely scrub this entire thread, as it could well get you into trouble.

I don't get your comment. Assuming we are not talking about public repos here. OP's employer did set up a private github repo where contractors collaborate on bank's code. This cannot be searched by google. The problem OP has is that the code should not be hosted outside bank's own infrastructure and contractors should not have access before they pass background checks. According to my understanding.

Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

#23

Post by CodeWriter23 »

Seems like if you notified one of the higher ups in charge of security at the bank, they would probably take care of it. And maybe you could parlay this into your own consultant agency by being honest and promising to follow the rules and take their security seriously. But definitely consult a lawyer. I have no stake in your future. And free advice is often worth every penny you pay for it.

Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

#24

Post by vickfoo »

dr_win wrote: post #22
warninger wrote: post #20

A word of warning - it's quite straightforward to do a Google search for 'site:github.com {bank_name}' for the large Australian banks, and find a repository that looks like the one you describe. You might want to contact the HN admins and ask them to completely scrub this entire thread, as it could well get you into trouble.

I don't get your comment. Assuming we are not talking about public repos here. OP's employer did set up a private github repo where contractors collaborate on bank's code. This cannot be searched by google. The problem OP has is that the code should not be hosted outside bank's own infrastructure and contractors should not have access before they pass background checks. According to my understanding.

it's a public repo

https://news.ycombinator.com/item?id=13679334

Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

#25

Post by steve_g »

A. Shut up now. B. Stop talking about this. C. Shhhh! Shut up! D. Get a lawyer

It sounds like you're a good guy who want to do the right thing. But no one here can fully understand your situation, and it is not smart for you to be discussing this here. Find a lawyer who can give you good advice and protect your interests.

Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

#26

Post by raleighm »

will_hughes wrote: post #14

First of all - get a lawyer. Secondly - get a lawyer. I don't know what state you're in, but Reddit's /r/AusLaw has a thread[1] which has the various law societies in each state, who can give you advice, and information about community legal centres. [1] https://www.reddit.com/r/auslaw/comments/1u776a/looking_for_...

Multiple forms of bad behavior here: working w/out clearance; making confidential code publicly available; conditioning payment on illegal/unethical conduct.

Definitely a lawyer - a new one, since if you were satisfied with the first one you wouldn't need to come to HN.

Some questions to ask the new lawyer:

- Under applicable law, would you prevail in court to get your fees if you could only fully "perform" your obligations to contractor's satisfaction if you violated law? I'd expect answer to be yes, which could be noted to contractor's in-house counsel.

- Under applicable law, in your situation, if the contractor continues to sit on the complaint without action, is there any possible argument that you would be required to escalate to the bank or a regulator? That's critical info for your own protection and also could inform what your lawyer says to contractor's in-house counsel, if you go that route.

Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

#28

Post by bdavisx »

If I were you I wouldn't worry about doing anything about the code being on Github. You need a lawyer to get the money you're owed, and then find another job.

As far as the bank goes: this is what they get when they outsource their work to an unscrupulous company. The company you're working for likely cheats both ways - don't expect to be treated any better in the future. They probably screw a lot of their employees over. They seem to have no issue doing illegal things. You don't want to be working for a company like this.

Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

#29

Post by contravariant »

AussieOdyssey wrote: post #7
viraptor wrote: post #6

Earlier quoted context omitted.

Talk to a lawyer. Especially because you're asking about Oz advice on a primarily us site, so common understanding of the law may be different. And whatever you do, consider if you can afford getting both fired and sued right now - even if people tell you you're right. Also I'm assuming that's 100% the public GitHub service and not an on-site, or specially negotiated GitHub enterprise system?

100% public github because they want to give access to new employees who do not have access to enterprise system.

Please tell me you're not saying they're using a public repository (one reachable to anyone, even people not logged in to GitHub).

Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub

#30

Post by pbasista »

I am not clear on one important detail: Is the code being pushed to a public or private GitHub repository?

In any case, there are 2 issues:

1. Your employer (the consulting company) does not want to pay you for the work that you have done.

2. Your current assignment involves supposedly illegal activities (putting the customer's (i.e. bank's) code to GitHub) in which you do not want to participate.

In order to resolve issue #1, get a lawyer, analyze your contract and if its terms were indeed broken, sue the company.

In order to resolve issue #2, simply do not do it. Quit the job. If the matter bothers you and you want to stop the supposedly illegal practices from occurring again, talk to the customer (i.e. the bank, not your employer). They must have some means of internal whistleblowing. Find out what it is and how to raise a concern. It should be possible to do it anonymously. As soon as you do it, your part is done. From that point on, it is their responsibility to take the matter further, should they wish to do so.

Post reply on HN