I was contracted by a business to develop software that generates leads for their sales team. A few months before the project deadline, the client issued a change order that added some questionable features, namely:

  • mass scanning of domain names

  • web software and cms fingerprinting, including plugins, themes, and server type with version #s for everything

With the business being in the web security field (ssl certificate sales), I was told it was for analytics/better assisting clients with their site needs. This seemed reasonable and I continued with development.

As time progressed, It became apparent this client is actually running a fraudulent telemarketing operation. This involves making cold calls in volume and impersonating the call recipient's preexisting web hosting provider. Key to this scheme is the sales rep having technical details of the call recipient's site (ex. SSL expiration time, domain registrar, etc). These details are used to:

  • strategically place calls to the website owner during key expiration times

  • more easily impersonate their existing web host by having info that "only they would know"

Given this information and my potential liability as the developer, I voiced my concerns and stopped all development. I'm now being sued for the money paid to me prior to the change order plus the deposit I took for the change order.

Can I be held responsible for completion of software that clearly violates federal cyber law and could hold me accountable for nefarious acts being committed by the client?

TL;DR Can I be sued for refusing to complete illegal/questionable software features, knowing the buyer intends to use it for fraud?

  • You're being sued; do you have a lawyer? If not, you really need one. – BlueDogRanch Dec 22 '19 at 4:00
  • Not only a duplicate with several answers and other duplicates, but you need your own lawyer, so this instance of the question is also off-topic. – Nij Dec 22 '19 at 4:33
  • The client is taking this up in small claims, but yes I'm getting a lawyer. Thanks for the feedback – arctangent-dev Dec 22 '19 at 6:51

Did you break your contract?

Does you contract contain a term that says you can terminate it if you have ethical or legal concerns? Did you follow that clause?

Assuming there is nothing illegal in the software itself, only in your understanding of your client’s use of it, the contract is binding.

Now, you do not have to complete a contract if you don’t want to but you will be liable for the damage you cause your client. Given that you have produced some of what you were required you are entitled to payment for that and they are entitled to recover the losses they suffered from your breach. However, if they are doing something illegal they will not want to go anywhere near a court so, invite them to sue and hire a lawyer if they do.

  • That might actually pan out. This was pretty useful – arctangent-dev Dec 22 '19 at 22:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.