Timeline for Could the GoDaddy employee self-phishing test constitute a breach of contract?
Current License: CC BY-SA 4.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 28, 2020 at 4:43 | comment | added | JCRM | The From: address, and the two links all used the domain "gocladdy.com" and the email had a "This email is from an external sender" banner. The OP rejected my edit including this information in the question. (ref reddit.com/r/technology/comments/kjns8a/…) | |
| Dec 26, 2020 at 21:52 | vote | accept | 200_success | ||
| Dec 26, 2020 at 19:53 | comment | added | Iñaki Viggers | @200_success "the prize was actually a "new toy Yoda". The employer tried to play it off as an April Fools' joke". That is materially different because the matter leading to "toy Yoda" certainly constituted a contract, and a company is not allowed to shortchange its employee by belatedly making it look like April's Fool prank. The effort and profit that a sales contest entails is very different from GoDaddy's asking its employees something akin to "just fill in your data so I can make you a gift". | |
| Dec 26, 2020 at 19:06 | comment | added | Iñaki Viggers | @200_success "Is it possible to impersonate yourself?" No, but it is lawful for a company to validate whether its employees are complying with security policies, more so upon sending them to security training regarding social engineering. "They crafted the message to simultaneously look legitimate and illegitimate". Crafting it to also look illegitimate reinforces the company's argument that the employees ought to abide by security policies instead of prioritizing their personal benefit. | |
| Dec 26, 2020 at 15:56 | comment | added | 200_success | @IñakiViggers Is it possible to impersonate yourself? They crafted the message to simultaneously look legitimate and illegitimate, and 500 people believed it was legitimate. In the end, they've admitted that they did write it, which proves that it was, in some sense, "real", even though they tried to make it illegitimate? | |
| Dec 26, 2020 at 15:51 | comment | added | 200_success | @SJuan76 Something like that has happened! A Hooter's employee won a sales contest for what she had been led to believe was a new Toyota, but the prize was actually a "new toy Yoda". The employer tried to play it off as an April Fools' joke. She sued, and they settled out of court, so no precedent was set, but there is some merit to the argument that it was a breach of contract. | |
| Dec 26, 2020 at 12:14 | comment | added | Iñaki Viggers | @davidgo The concept of social engineering (see full name of the course) encompasses tactics such as impersonation. Hence, the fact that the email came from a GoDaddy.com address does not justify clicking blindly on extraneous links therein and/or providing information (perhaps unrelated to a "bonus") without --at least-- first inquiring of their managers. Nor does the email need to say it is a scam. The email was devised as a test of whether the employees internalized the teachings from the security course. Clarifying beforehand that it was a scam would defeat the purpose of that test. | |
| Dec 26, 2020 at 10:28 | comment | added | davidgo | @sjuan76 there were hints, but the email WAS legitimately sent from godaddy who got the responses. It was NOT obvious to 500 people it was a test. As I understand it one of the key elementsxwas they used "gocladdy" in the responsecURL ratgervthrn Godaddy. I would argue (again I'm suggesting its arguable - not necessarily winnable) that that is little different to using a different font - which would not invaludate a contract. The email did NOT say it was a scam and it was particularly cruel. (Of-course what is not mentioned is that Gidaddy had previously advised there would be no bonuses) | |
| Dec 26, 2020 at 10:18 | comment | added | SJuan76 | @davidgo The idea is that the email was composed in a way that would have allowed the employee to identify it as illegitimate (and thus void). The employee should have had no expectations of it being a valid offer. Likewise, if on April 1st a USA based business sends a message stating "April's fool" promising everybody a Ferrari, the employees could not say that it "looked like an offer of contract". The fact that GoDaddy owned the URLs should not be relevant, what should matter is that those were not the "official" URLs and should have been identified as such. | |
| Dec 26, 2020 at 2:59 | comment | added | davidgo | On the flip side, I would argue (maybe its jurisdicational) that there is a requirement of the employer to act in good faith towards the employee and that to treat this as other then a contract would mean the employer is acting in bad faith. | |
| Dec 26, 2020 at 2:58 | comment | added | davidgo | I expect you are right but I'm not sure that this is as cut and dried as your response implies. The URLs were controlled by Godaddy, I think the OP is arguing that the unrelated information is what amounted to valuable consideration and I'm not convinced that is not arguable - I also don't think the law requires an contract not to look a bit like a scam... | |
| Dec 26, 2020 at 0:11 | history | edited | Iñaki Viggers | CC BY-SA 4.0 |
added 24 characters in body
|
| Dec 26, 2020 at 0:06 | history | answered | Iñaki Viggers | CC BY-SA 4.0 |