Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In the recent past I was asked to set up a reporting facility for upper management so they can spy on what web sites users are visiting. This was done without any notice given to users. Unfortunately, I have a good friend with some rather unusual tastes who I knew would be caught! He also knew I set up the reporting...

To me, the lack of user notification was unethical. What similar experiences have you had that haven't "felt right" and left you questioning what to do? How did you deal with it?

share

locked by HopelessN00b Dec 5 at 6:34

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

2  
Don't know why this is being marked down...it's interesting. Marked up. –  Andrew H May 4 '09 at 17:00
2  
It's subjective and argumentitive. -1 –  user640 May 4 '09 at 17:02
    
It's interesting. +1 –  DarkLightA Jan 13 '11 at 20:35
    
What is ethical or moral varies not only from place to place but from person to person. Even the lack of notification to the users may or may not be legal and/or acceptable in different places. I may well do things in good conscience that others find objectionable and vice versa. This non-question is meaningless. –  John Gardeniers Jan 13 '11 at 20:54

9 Answers 9

While not exactly a task I was given, I had to recover from forced downtime.

I used to be the SA for a rather large financial site. We knew our systems inside and out, had centralized logging and great tools to sift through them.

All of a sudden (naturally very close to a deadline), all the cellphones go crazy with alert messages. Check to see that the site is down, and all SA staff drop what they're doing and start investigating.

Apache logs were fine, database wasn't throwing any errors and the caches were spinning just fine. Plenty of spare resources, network was fine and no recent deployments.

10 minutes later, I find out that one of the developer had gotten access to the site and added a die(); in an obscure module related to page generation.

In other words, the software did what it was told to do, and there was no log information that would've helped.

The GM for the company that ran the site came up with a huge grin and said he wanted to clock us. I told him to screw off, not touch my production servers, that we did have great disaster recovery plans, but his developer's incompetence made sure none of those plans kicked into gear.

If he wanted to check our response time, he should at the very least have discussed it with the CTO and asked if he could do it "some time today" or "this week". That way nobody would have been pissed off, and we wouldn't have wasted any time arguing about it.

The whole event was one of the most unprofessional ones I've encountered so far.

share

'Spying' on employee's web activity is par for the course. The only thing unethical here is if it's not stated anywhere in the employee handbook or other signed disclosures at time of hire. The long and short of it is the business owns the network and its data, not the user. As they say in my line of business, "There is no expectation of privacy".

share
2  
It's also highly illegal to spy on employees without notifying them. The fact that it's "their network" changes nothing. The only exception is if you're investigating an employee who you believe committed a specific infraction. –  Kevin Laity May 4 '09 at 19:22
5  
Highly illegal where? Laws vary greatly from US state to US state and country to country. Most employment contracts also have boilerplate giving permission for anything under the sun like this. –  ceejayoz May 4 '09 at 22:24
1  
Illegal in the UK and most European countries under data protection legislation. May also be prohibited by US federal law concerning "wiretapping". –  pjc50 Oct 19 '09 at 16:02

I had to ask a new graphic designer (in a former position) to install his cracked copies of photoshop and a few other tools because our boss didn't want to pay for them.

It infected our servers with a virus, which I think was appropriate :)

share
1  
more than apropriate it was deserved :) –  Eugenio Miró May 5 '09 at 3:42
    
fwiw - that's a clear "won't do" in my book –  warren Apr 12 '12 at 14:02

I used to work for a company where management didn't like paying for software. I managed to convince them to buy legal copies of WinXP Pro and Office 2003, but they tried everything to save money. The boss bought a laptop that came with Office Student and Teacher edition, and he discovered the clause about installing on up to three computers. He ignored the part about not for commercial use and told me to use it on a few systems. I told him it was not legal but he didn't care. I begrudgingly proceeded under the hopes that I did my due diligence and wouldn't be at fault should the company get audited. Looking back, I wish that I had reported them.

share
4  
-1 for "I wish I had reported them" .. we shouldn't do that. You told them it was improper. Ask for the order in writing before complying, or refuse to comply. Resignation may even be appropriate. But calling the software police is a bad idea. –  tomjedrz May 4 '09 at 17:37
3  
Are we not obligated to report criminal activity? Although this industry doesn't really have a regulatory professional organization like doctors, lawyers, and accountants, I feel we need to hold ourselves to a certain level of ethics. –  Scott May 4 '09 at 18:48
6  
I have to disagree with tomjedrz. While I might not report them myself. I don't think anyone who does blow the whistle on this sort of thing should be called out. I also have to disagree with Scott. I don't think we are under any obligation to report these people. I do however think that we should "hold ourselves to a certain level of ethics." I think the ideal solution is to convince these sorts of people (software pirates) to move to free software alternatives. These will often do the task required, for the same price ($0) with out being against the law. –  baudtack May 4 '09 at 19:12
3  
could have installed linux and open office. –  Berek Bryan May 4 '09 at 20:19
1  
If you get asked to install what if effectively pirated software and the organisation will not be talked out of it you need to get if you possibly can. They won't value IT and they won't value your contribution. –  Christopher Edwards May 5 '09 at 1:04

I've been asked to find a way to send copies of every email a user sends and receives to their boss. The person in question was suspected of violating their terms of employment. This kind of Big Brother investigation makes me sick to my stomach. Thankfully, the issue was resolved with out me having to look into this.

share

I Think it is managements right to monitor the network/internet Activity. However i think they should be notifying users that something like this is in place. Irrespective of that as a user working in a Corporate environment i think we should be always just presume that we are being monitored.

share
1  
Exactly. This is what I've told everyone where I work. "You can surf to any website you want, but it'll be monitored" –  Gert M May 4 '09 at 19:33

I was asked by a coworkers wife (also coworker in past but at home now because of pregnancy) to monitor/report his 'strange' activities in e-mal/ICQ/web chats/etc..

share
    
Did you say no? –  Ether Sep 20 '09 at 18:24

I was asked by my boss to customize a Linux distribution, brand it with the companies logo and other stuff and then we will sell it with out providing the source. When only 10% code was developed by my company he marketed the whole product as company's own and sold it to customers without providing the source code.

This was the only unethical thing, I am still confused if this was unethical on my part to customize the distribution as I was not part of the marketing and sale of the distribution.

Just went through this, so I thought to post my incident too. :)

share
    
It is a grey area. IMHO if you knew what your boss was going to do then it would have been unethical for anyone to work on the project. Talking illegality on the other hand, that probably rests solely with your boss. –  Alex Angas Jan 14 '11 at 1:24

I was asked to hack the mail password for a co-worker's ex.

'nuff said.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.