Bsrgvty

I work in the information security department of a fairly big transportation company. Recently, my team leader added me and my colleague to a WhatsApp group and told us to gather as much as information as possible about a couple of members of the public who criticized the company on a social platform. They want us to gather every information we can find online ("even shoe sizes") and create separate reports for each person that criticized the company.

According to my team leader, this request came from the upper management and we should finish the task quickly. But I feel like this request is unethical and maybe even illegal according to the law. My team leader doesn't come from an information security background, so he doesn't have the technical capabilities to do this himself. Nor has he any ethical problems with the task, it seems to me that he just wants to please upper management.

I have been finding excuses to not do the task, but my team leader is pressuring me to do it. I can't lose my job because economy is really bad here right now. But I also don't want to lose my self-respect or commit a crime.

I am in a dilemma. One part of me says I am overreacting and should just do the task, but another other side of me feels like this is wrong and I should decline this request, no matter the consequences. I believe talking to my team leader about my concerns wouldn't work because he wouldn't listen to me and he would just try to persuade me to do it.

Should I do the work anyways? Should I refuse and report this to HR/someone else?

Just putting aside the ethical aspects here, there are very real legal considerations.

In many jurisdictions, the work done by private investigators is regulated, with training and licencing mandatory. I assume you've had no training around the types of information you are legally allowed to store, and to what lengths you are to go to in order to collect it.

In addition, there are legal requirements (for example GDPR) that must be adhered to when obtaining information about an individual. For instance, with section 14 of the GDPR, you are required to inform the person you are collecting information on them and the purpose of this data collection (of which you don't seem to be aware). (Interestingly there are exceptions in the case of investigations, but it gets very complicated.) Now, the GDPR may or may not apply to you, but are you well placed to understand your legal requirements in this area?

This is a very complex area, and I wouldn't feel comfortable wading into it on the basis of a Whatsapp conversation. In addition, the lack of a paper trail and, I assume, documentation on how the data is to be stored does not look good.

If I was in your position, I would probably try to have a conversation, face-to-face if possible, with someone from the legal department (you say it's a large transportation company so I'm guessing there is a legal department). They may advise against doing the work, which gives you a concrete reason to push back. However, this is no substitute for getting your own personal legal advice.

It's important you don't send anything in writing indicating that you will do the work until you are sure such work is legal.

Recently, my team leader added me and my colleague to a Whatsapp group and told us to gather as much as information about a couple of people

This is big red alert to me, and the request looks completely unethical. If your team lead wanted you to get information for any official purpose, why is he not using office emails or messaging? How does a Whatsapp group substitute for an official mode of communication?

gather every information we can find online ("even shoe sizes")

This looks like a case of snooping on an individual to me for the team leader's personal agenda - and that is not what information security needs to be doing.

Can you please provide insight to me on what to do here?

CYA. Leave a mail trail, keep asking questions over email (Like which profiles need to be watched for, what information needs to be collected, are there any leads from previous investigation, any time window to look out for etc). If he gives a go ahead over email but you still have concerns, don't hesitate from looping in your skip level manager for FYI. In case you are not satisfied with the answers you get, ask them if they have a sign-off from the legal team (this usually gives cold feet to many ill thought ideas).

Fulfill this request only if you get directions on the proper channel with everyone being on the same page.

This is definitely an interesting situation...and not at all a pleasant one.

You’re not overreacting. This is definitely a unmoral task given to you, or rather to the team lead, that was delegated to you.

What the company plans to do with said information is hard to know, but they will probably go on some kind of smear campaign, to publicly discredit the critics if they decide to do anything...or use it for blackmail. Depending on your country this can be highly illegal and linked back to you...assuming anyone cares that is.

This info depending on what you can find, could be used in the extreme cases to ruin their lives, or just embarrass them...or nothing at all depending on what you find.

So what are your choices? Do you feel like you can live with the idea that you personally will be responsible for supplying information on people for a corporations vendetta against normal people who criticize what the company you work for does? ( seems like the critics might have been criticizing for a good reason)

Or do your ethics say, ‘holy snap, i don’t want to work for a company that might want to ruin other peoples lives’ ?

Would the guilt of this action be something you can live with?

Unfortunately times are tough where you are so its hard to say quit right now and start looking, (though i suggest you do that anyways, cause the company you work for seems shady) but in the end its your choice.

As a tip, companies willing to be shady to the public, rarely have issues doing the same to their employees...especially using their employees as scapegoats.

Your other option is to do the work, but turn up with no information, you’re the expert afterall...you just couldnt find anything..., or do the task and whistleblow to the papers afterwards. Or go to the police...of course with documented evidence. Ensure the job you’re given is in emails or some written form, print and keep those locked away sonewhere, encase you need them.

Whistle blowing is also potentially dangerous or career ruining...so be careful about that.

I would stand my ground and refuse to do it and starting looking for another job.

There is a comment above by @Bob Jarvis

If a job isn't worth doing, it's not worth doing well. Couple that with the fact that names are far more common that you'd think. I suggest that you find information about the "person" you've been tasked to track which is innocuous, uninteresting, non-pictorial in nature, and which is actually about three or four different people, none of whom are the person who works for your company. If someone criticizes the information, shrug your shoulders and point out that you're not a trained investigator.

I agree, this is a good time to do a half-assed job.

Get their public social media information, organize it into a good looking report, and turn it in. Job done.

If they ask for more, tell them to write down specifically what they want.

Edit:

Comments make a good point that this is less than ethical, and depending on copyright law, perhaps illegal. However, this method allows one to avoid disagreement with supervisors, and perhaps retain an otherwise decent job.