What: A consulting company that I am (was) working for is uploading all bank software from the intranet to github on their repository. While not accessible to public, any employee of the software company can access any of the bank software. This also means that if you can get access to any employee of the company from their public profile (Repo members are public) you can access all of the bank software (inc partial live UAT database)

Why: To bypass the waiting period of background checks of the bank consultants. Any consultant joining the bank would have to wait 2-8 weeks to get the background checked and cannot access the intranet which means they cannot work but they are already billing.

How: The company runs parallel 4G networks inside the bank and all its consultants access the github to sync their code.

I emailed my manager for written permission to sync bank code to/from internet. I was requested to leave my work laptop at the bank and return to the consulting company. There, I was informed that I was unassigned from the task and I was not allowed to collect any personal belongings left at the bank and was sent a Cease-And-Desist order from their lawyer asking me to neither speak to the bank nor anyone else.

I spoke to the ombudsman who said that since I am contractor, the consultant is not legally obliged to respond. Next, I emailed Human Rights and got similar response. I then spoke to the bank HR who "would look into it" but not follow-up as I was not an employee of the bank.

I spoke to few lawyers who agreed there was something wrong but legally I cant do anything; it's up to the bank. Why am I pissed? I wanted to know if it's safe for me to push the bank code to the internet. I signed the bank compliance which stated that the bank software may never leave the intranet Beyond all that is a discrimination case that truly devastated me.

Outcome: I gave up. There is nothing you can do except resign and move on.