VW fired senior employee after they raised cyber security concerns

Re:VW fired senior employee after they raised cyber security... by xiphias2 on Monday January 24, 2022 @12:09PM (#30060541)

The employee probably was too public about the issue instead of just going up his manager hierarcy. That's the professional way to do it (and if it doesn't get addressed, there's nothing more he can do).

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by onion2k on Monday January 24, 2022 @12:20PM (#30060724)

That's the professional way to do it (and if it doesn't get addressed, there's nothing more he can do).

I'd argue that if your boss is refusing to act on a serious security concern you have a moral duty to take it further up the hierarchy yourself, and to (responsibly) disclose to the government/public if the company won't listen. Shrugging and saying "Well, I tried!" isn't good enough.

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by yial on Monday January 24, 2022 @12:23PM (#30060772)

I agree - looking at the organizational directives I've worked on creating during my career, many specify that if you supervisor/manager/director does not act on an issue that is critical, that you are empowered to continue ahead and/or request followup.

There are more things and nuances specified, but the idea of "this is critical, but oh well my manager ignored me... nothing more I can do." doesn't seem to breed organizational success. (By no means I am advocating for insubordination per se.)

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by xiphias2 on Monday January 24, 2022 @12:28PM (#30060852)

I was also talking about going up the hierarchy, but I'm afraid that he went to other bosses that made his division look bad.

I would never go public without going to a lawyer first, and getting enough proofs (emails) that I did everything I could to raise alert in a responsible way inside the company first.

Edit: after rereading the article I thing we just don't have enough data to know how things happened exactly.

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by gorjusborg on Monday January 24, 2022 @01:01PM (#30061342)

With a company like VW (who has used engineers as scapegoats in the past), I'd just want to make sure there was a paper trail that indicates I did the right thing. Then I'd feel okay letting the business making the final call.

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by woadwarrior01 on Monday January 24, 2022 @12:39PM (#30061001)

I once caught a director (my manager's manager) maliciously meddling with prod servers at a medium sized SV tech company, and "professionally" reported it to HR. I was sacked, but after they generously compensated me for signing an NDA. Years later, I found that the director in question still works for the same company, albeit as a senior director. :)

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by AlexandrB on Monday January 24, 2022 @01:12PM (#30061497)

If it's a safety issue and you're a professional engineer, this is absolutely untrue and a dereliction of duty. See: https://www.nspe.org/resources/ethics/code-ethics

> 1. Engineers shall hold paramount the safety, health, and welfare of the public.

> a. If engineers’ judgment is overruled under circumstances that endanger life or property, they shall notify their employer or client and such other authority as may be appropriate.

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by ska on Monday January 24, 2022 @12:50PM (#30061179)

> That's the professional way to do it (and if it doesn't get addressed, there's nothing more he can do).

This first part of this is correct (first try through your reporting structure).

The second part is incorrect - it is precisely unprofessional to decide there is nothing more that can be done simply because your manager didn't act, which is what it sounds like you are suggesting.

Details always matter of course, but "well, I tried" is rarely going to be good enough.

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by throwawayboise on Monday January 24, 2022 @02:08PM (#30062368)

I mean you have to make the decision as to whether the issue is serious enough to be worth losing your job over, and potentially being blackballed. That's a pretty tough call for most IC engineers who have bills to pay and maybe a family to provide for.

Edit: I see the title indicates the person was a "senior" employee but I don't know what that means, since I can't read the article. Perhaps he/she was more than an IC.

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by ska on Monday January 24, 2022 @03:06PM (#30063234)

People definitely sometimes choose not to be professional, and sometimes it's clearly the right thing to do.

On the other hand, often there are lots of options between "do nothing" and "blow up my career".

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by johnnyo on Monday January 24, 2022 @12:12PM (#30060587)

The article makes no mention of the employee making any public statements or disclosures

[ Parent | on HN ]

Re:VW fired senior employee after they raised cyber security... by rideontime on Monday January 24, 2022 @12:30PM (#30060874)

What is this assumption based on?

[ Parent | on HN ]