Get it in writing. Save a copy of said confirmation away from company hardware.

Violating software and service licenses are the kind of thing that, if they are caught, can really screw over a company. They will want someone to blame and an unscrupulous windbag will end up deleting any emails on the company servers related to their 'request' and make you their scapegoat.

Take the initiative and email your boss asking for confirmation, laying out exactly what they asked you to do. BCC a personal email account or save the email to a USB drive (whichever is safer). Ditto with any responses you receive. From there, you can choose to either get in contact with higher ups, Federation Against Software Theft (a piracy resource, but intentional license violations are pretty much treated as this anyway), or the service provider themselves.

Bear in mind that the first can wind up with you getting punished if the higher ups let your boss know, the second can trigger a witch-hunt (FAST generally do not give information about informants, but if your company are unscrupulous, they WILL be looking for who did what) and the third can lead to wasted work as your company's account gets perma-banned over the infraction soon after the code is up and running.

Like anything that touches on ethical considerations, you need to be prepared for the repercussions from your decisions.

If your company has a legal department, I would consider starting there. What you are doing is a violation of the terms of service of the API and could result in problems for your organization. This can help you get additional eyes on the terms and policies of the API creator to ensure that everyone understands them.

If your manager refuses to understand the possible implications of this, you have four options, but no one can tell you which one you can or should do:

• You can go along with it and you would need to live with your decision.


• You can refuse and deal with the outcomes which may result in an inability to move up in your organization or even termination.


• You can resign and refuse to be part of an unethical organization.


• You may be able to reach out to the API creator to clarify the terms of service and, if your company is indeed violating them, self-report it - perhaps there's room for agreement, or the API creator can block your company's access to the API.

The ethical thing, according to the various software engineering codes of ethics that I'm familiar with, is to ensure that the API isn't misused and you comply with the terms of service. However, if you are relying on this job for money or benefits to support yourself and your family and losing it without something lined up would put you into an unsustainable position, I don't believe that anyone would find fault with your actions.

but it would probably never catch someones eye.

Don't be so sure. Companies serving popular data (maps, etc.) where there are acceptable-use policies relating to mass-downloading will often have some kind of detection mechanism in place to enforce those policies. Too many requests from the same IP address, or anything which looks like that, and you're liable to trip out those mechanisms. The result could vary from throttling, to a cutoff for the next 24 hours, to a full block.

You, your boss, and the rest of your team need to assess what happens to your product/site in the event of this third party turning off the tap. If the result would be fatal for your business, then your boss clearly has some figuring-out to do. Perhaps you need to rearchitect your product/site somehow to follow the API without the mass download. Perhaps you need to pay for a license to allow mass downloading (this is usually how these places make their money). Or perhaps your boss puts the company on the line. Whatever the answer is, the technical team need to give him options and he has to make a call.

And if your boss is not the business owner, then your boss needs to escalate the final decision. He can recommend a decision, but if the outcome could be fatal to the business then he should be smart enough to get buy-in from higher up. If he isn't, then you and your team need to escalate it yourselves.

It comes down to your personal convictions.

From what I understand the misuse of the API does not appear to be a criminal offense (please don't just take my word for it, get legal advice to be sure). However, make sure that the collection and storage of data that your software is performing is legal. In Europe there are strict data privacy laws (GDPR), especially when it come to collecting data on people. The policy of the API may very well be to prevent the illegal collection of data.

People have different personal convictions and some are more ethical than others. As long as the data being collected is legal, you will have a hard time convincing your boss to take the route that you see as ethical. You have to realize that, depending on their culture and personal convictions, your boss might not view the misuse of an API as something unethical.

As I see it you have a few options:

1. You can obey your boss and use the API against its policy. Be aware that this is not likely to be a one time thing and more requests like this are likely to come in the future. The more of them you say yes to the harder it gets to say no down the line.




2. You can refuse to use the API against it's policy. This will likely not sit well with your boss, with the extreme case being that you might lose your job.




3. You can suggest an alternative solution. It probably requires some creativity but you might even find an API where it's not against their policy to implement it in the way your boss is asking of you. This has the potential of not upsetting your boss (too much) while allowing you to stick to your convictions.

In your case I would suggest giving all you have to make option 3 work, only resorting to 1 or 2 if all else fails.

You haven't given enough information in your question to determine whether your boss's request is unethical and/or illegal and/or in breach of their contract/ToS with another party. These are all vastly different matters that you should treat differently.

If the request is illegal, you should not do it on your employer's behalf, even if you don't think it's particularly unethical. When they're caught, they'll make you the scapegoat. You can refuse to take part (and, depending on jurisdiction, probably have protection if they retaliate against you for this), but you might still find yourself working in a hostile environment, or out of a job if the fallout brings down the company.

If the request is unethical - for an example fitting your scenario, think of scraping people's photos from social media or personal info from dating profiles in a jurisdiction where doing so isn't illegal - then in my opinion you shouldn't do it, but you might lack protection in your refusal to do so. You should probably consult a lawyer.

If the request is merely in violation of your employer's contract or terms of service with another party, but not illegal or unethical, then in my opinion there's little reason not to go along with it. You might want to consult a lawyer first and ensure that there could be no cause of action for tortious interference on your part. (Note: IANAL but that's my guess at the most relevant area of law.) But otherwise it's their matter, not yours. For what it's worth, lots of APIs' terms of service are borderline unethical and unenforceable to begin with.

You've raised this as a concern and have your manager's instructions in writing that you're to code the API as the requirements stand (and against the API's documented guidelines).

They also have fully indicated their understanding that the code might well break when and if the API is updated to close this vulnerability/backdoor.

If so, you may as well carry out the instructions and code.

When and if things go sour, you'll be ready to change that code, so bear this in mind with your intended development path to make the rectification easier in the future.

You should contact an employment lawyer immediately, explain the situation, and ask for some quick advice.

A few things did not seem so clear from the question such as how serious the violation would be, whether or not it should be considered "illegal", whether or not this would really violate GDPR, etc. It does sounds at least like a violation of good ethics in the workplace. This answer is now edited to address the question regardless of how serious the violation would be.

You should always refuse to compromise on your ethics for an employer, especially in violating GDPR and copyright. Otherwise you could be liable for any such compromise or violations in the future. And you should probably quit on the spot to avoid being fired "for cause".

This does not apply for directives or procedures that may be not the most efficient or most modern. This is only about law and ethics.

No company should ever make its employees break the law.

When looking for a new job, you can always say that you refused to break the law or compromise on good ethics, and I think there are many, many companies that want this kind of an employee.

I can think of three possible responses:

1. Challenge: Say, "I need a written and signed order to do this on physical paper before I will do it." Now his claim that it's okay for YOU to do the job runs into his own sense of self-preservation.


2. Passive: Say, "It's going to take me X months to do that" where X is several times longer than you can really do it. This will be a strong hint to him that he's better off finding someone else to do it.


3. Direct: Say, "Sorry, but I can't do that. It goes against my beliefs to ignore the terms of use."

Now any of these options may result in your boss taking action against you. Even if he seems to fully accept your response on day 1, days/weeks later he could start a campaign to harass you.

Let's say that you don't help the boss do this project but he gets it done anyhow. You're still working at a company that is blatantly going against your ethical standards. How will you feel about that? If you won't feel good then it's may be time to look for another job because most likely the boss is going to get the project done regardless of your involvement.

Something else for you to consider: Lawyers write the terms but the business and technical people at the other company may be 100% okay with your company doing what your boss wants. If your company is caching data that the API company doesn't sell per request then it's harmless. Although in my experience, someone in tech at your company should discuss with someone technical at the other company before assuming that you'll be able to do business this way since the API can be switched off (deny you access) at any time for any reason typically. And that's probably bad for your business.