How to let clients know that they are being spied on

Question

In the past I have found out that clients were being spied on. This happened twice; in both times I told them. And in both times I got burned for it. I have no regrets and I got a clear conscience. However, I am about to go telling for the third time, so I just have to ask about this. First, some background.

The first time, I pointed out to our liaison within the client company some spying devices we had found in their offices. We found those while mapping their wired infrastructure. They freaked out and told us to remove those devices immediately (they were afraid of industrial espionage). A couple days later someone higher ups in the client demanded compensation for stealing their equipment. Turns out one corporate level was being spied on by another level higher up, without the lower level knowing so. This led to a huge mess. They accused us of stealing the devices but we didn't keep them, we handed those to the police. Seems like a couple of those were illegal just to own. Lots of meetings to explain things to everybody, we almost didn't get paid, and we never got a contract with that client again.

The second time was worse. We were changing the whole wiring of a client's apartment (data, power and phone lines), when we found lots of spying devices of such sophisfication as we had not seen before. The client was away from home, traveling. I emailed him pictures of some of the devices, and he replied telling us to destroy them. Emphasis on destroy. When we stepped out of the apartment we were all arrested. The client was being spied on by the federal police (who had men watching outside the apartment for any suspicious activity). We don't have terrorist threats in Brazil, this guy was most probably being watched on due to involvement with white collar crime (he's a polictician). Still, it was a hellish situation, which took a lot of time, red tape and lawyers to get out of.

Back to present, and in another client's apartment. There was an AC socket which we thought was on a line completely disconnected from the main electric bus, yet we could read the signal from the device we use to map wires coming out of there. Usually this means the wires are not properly connected to the socket. When we opened it, there was a really small camera there. We just left it there this time.

I'd like to tell the client. I neither can nor want to imagine why someone would want to spy on her. I'd really like to dismiss it as just a case of a suspicious husband, which is common around here. If it is the federal police again, me and the staff can get into some real trouble - but I have talked to them, and we all feel our conscience weighting on us.

Is there some sensible approach for these kinds of situations? What are the ethics involved in such cases?

Answer 1

Wow, that's some story. While I've never encountered anything remotely that extreme, I've been on both sides of conversations that go like this:

Consultant: Are you aware of $dangerous_thing?
Customer: Ack, no! Kill it!
Consultant: I'm not authorized to do that right now. Here's what I need you to do...

In the corporate-spying case, the issue seems to have been that the person telling you to remove the devices didn't have the authority to have you do that. And it sounds like a case of he-said/she-said; there's no paper trail and you're being accused of things you didn't do as a result. Any time you encounter this kind of scope creep, it's wise to step back and make sure that the new work is authorized, that you'll get paid for it, and so on.

A common way to do this is to write up a work order and have the client sign off on it before you do the work. (You can include a statement about the signer being authorized to represent the client, if it's a company.) It needs to be the client's problem, not yours, if the work isn't actually authorized. You can meet your ethical obligation to inform your client without immediately moving on to taking action.

I don't know what you could have done to anticipate the police case, though.

Answer 2

This should be covered under your contract really, but in general, yes, you do ethically, and probably legally have a obligation to let your client know.

There's no way, without being told, that you're going to know whether $nefarious_device is something that the client's organisation, law enforcement (who in turn might not be entirely honest in many jurisdictions) or industrial espionage.

On the other hand, unless you're explicitly hired to sweep for, and remove such devices, its not really your job, its no different from finding porn on a system - there's graduated response, and in general, its best to leave authorised folks to deal with it.

Firstly, as always, cover thine ass. Get your legal folks to work out what's the best way of dealing with such a situation, and have it on your contract. If its not specifically part of your job scope, removing such devices need not be your responsibility. Let the client handle it.

Telling your client that you found spying devices however is a responsible action. Removing it is a jar of angry snakes as you have found (granted, this is significantly worse than anything I have heard of).

That said, considering surveillance of that sort is illegal, why not ask the client to call the police and tell them? If its theirs, they know they've been caught with their hand in a cookie jar (or better yet, they'll be stepping on each others toes). If its not the police, its no longer your problem.

Answer 3

First of all, the 'spy device' might be there because the legal resident/owner/business wants to see who's breaking into her place. Of course, maybe they are spying on you, to see if you're doing your job. Parents with young children also have 'nanny-cams'. These are all devices they know they have and want to have.

So the opening gambit in this situation might be to ask the owner, "Is there anything I should watch for while I work? Any past issues? Any odd wiring that you know about?" This is non-confrontational and covers everything from shoddy wiring to a known security device.

In future situations you might point out to potential clients, whether personal or corporate, that you have run into situations where spying equipment was encountered, and you had to deal with suits and cops as a result. Rather than dealing with this question after you've found something out, you can get advice from the client on what approach you should take.

If you put a piece of tape over the socket, if the lady knows she'll just remove it. If she asks you why it's there, you can say you found a problem with it. If she asks you 'what kind of problem?' - simply show here the camera without saying anything or otherwise disturbing it (perhaps other than pulling it out of the junction box). She might want to discuss whatever you've found 'out of earshot', since there may well be audio plants.

What it sounds like is you've made a presumption that the spying was criminal and acted first and asked questions later. It's better to get potential context first, then figure out who to inform and what to modify.