Slashdot Mirror
Telling Your Superiors Their Financial Data Is At Risk?
alterimage asks: "I'm a Computer Science major at night, working by day in Accounting for a major telecom provider, with clients consisting of most the entities on Fortune's Top 20 Most Admired Companies of 2006 list. Daily, I see customer payments in excess of $50,000 come and go. Strangely enough, rather than have these payments conducted by an IVR system or over the Internet, the majority of these payments are conducted over the phone with individuals such as myself, who are instructed to write down, document all the specific banking information, and to keep them on hard-copy in an unlocked file cabinet that is accessible to anyone. Having experience with social engineering and fraud, I've already advised my boss that it's probably not a good idea for those bank routing and account numbers to be laying around unsecured, and was told that I'm over-reacting. So I ask Slashdot: At what point should the human aspect of security be considered in the business environment? Should I just smile, nod, and play along in this situation?"
I've already advised my boss that it's probably not a good idea for those bank routing and account numbers to be laying around unsecured, and was told that I'm over-reacting. So I ask Slashdot
translation: I'm looking for a creative way to get myself fired.
and if it bugs you, just keep your head down and look for a better job. If you make a stink, the first time something goes wrong, you'll be the first guy they blame.
The theory of relativity doesn't work right in Arkansas.
Continue to make good faith efforts to change the policy. However, if you keep getting stonewalled, then let it slide; you may start making enemies if you continue past that point. It won't be your ass on the line if something goes wrong, especially if you can document that you tried to solve the problem.
To actually correct it? Wait for someone else to steal a bunch of money, it's bound to happen sooner or later. Problems don't get fixed unless it's obvious more money will be saved by fixing it than letting it stay.
SAILING MISHAP
If you have communicated your concerns to your superiors then your obligation is filled and you don't have to worry about it.
That said, if you are still worried for some reason then you should either find a way to express the problem to your superiors' superiors (if they have any) or possibly anonymously report it to the clients themselves (if you won't be endangering yourself in the process).
Good luck.
If you make a stink, the first time something goes wrong, you'll be the first guy they blame.
I had a college roommate who had a similar problem when he pointed out an ethical issue at a brokerage firm. He got busted to the mailroom. A friend who was a senior broker at a different firm told him to get out before he gets fired for something he didn't do if he wanted to work in the industry. He decided to become a tech writer instead.
I know the parent sounds like something out of Dilbert, but what he said is true.
I hope like hell you brought it up with more tact than your post (asking questions around the situation rather than making statements is one good way). Trying to understand process and procedure may not be looked down upon, trying to change it... Well, I hope you have a good boss.
Seriously, get a good job before the shit hits the fan, like all good programmers do...
You state you need to keep account numbers and routing info on accessible paper, nowhere did you mention the need to keep transaction details as well.
Account numbers and routing information aren't confidential, it's just a matter of convenience to put them on paper. It wouldn't be hard for anybody to obtain such information in legal ways.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Remember, they will never forgive you for being right.
I see even classic Slashdot is now pretty much unusable on dial up anymore.
If you don't like your job, want to be on welfare, or already know who you're going to work for next, go for it... Who knows, maybe they'll even listen!
"Don't meddle in the affairs of a patent dragon, for thou art tasty and good with ketchup." ~ohcrapitssteve
Ethical issues at a brokerage firm? I'm shocked :P
All kidding aside, I feel kind of sorry for the people who post this kind of ask slashdot. As bad as it sounds, the best course of action most of the time is just to keep your mouth shut and continue with life as usual. Most entrenched management and executives do not want anyone to rock the boat and will make your life a living hell not only in your current job, but also possibly in the industry as a whole if you do rock the boat (and I don't care how big you think your industry is, most of the people at the upper levels know, or at least know of, each other).
Unless your job is specifically to do security audits, just let it go. Chances are they don't want to hear it and won't be happy if they *do* hear it.
I used to be bright-eyed, idealistic, and naieve with respect to this sort of thing. It lasted all of five minutes. Now I'm more of a hopeful cynic (expect the worst and hope it doesn't happen) lol
Offtopic: I think this makes you It again...
Everything I need to know I learned by killing smart people and eating their brains.
You have a moral responsibility to encourage data to be safe.
If you push it, you're quite likely to get stonewalled, destroy your future at the company, and possibly hasten the demise of your job.
If you plan a long future at this company and can live with the moral ambiguity, shut up and leave it until you're higher up in the chain.
If you can live with possibly losing career opportunities, make your complaints, but target the right person. Usually most companies will have someone who's actually supposed to make sure data is secure and privacy is assured. Find them and explain things to them.
If you really don't care about the job, make a good list of all the problems, written out and carefully phrased, and push it as far up the chain as you can. You'll get shit for it, maybe tossed, but with those concerns sitting on the CEOs desk, it's quite unlikely they'll get forgotten.
At the end of the day, it just depends on your personal moral standing.
If I knew the wedgies I gave you back in 6th grade would have resulted in this . . . I might have taken a moments pause.
If you warn people and they don't listen you've done your part.
Remember Enron? WorldCom? Both had major telcom billing fraud components. You may be looking at a fraud.
If there's an internal audit department, they should know about this. They have Sarbanes-Oxley responsibilities to check that internal audit controls are sufficiently tight.
Sarbanes-Oxley has whistleblower protection: "Sarbanes-Oxley creates severe criminal penalties (including substantial fines, and up to 10 years in prison) for retaliation against whistleblowers who raise concerns about violation of any federal criminal statute, not simply laws limited to financial fraud." So if your boss threatens you, you can threaten back.
Also, "Congress required corporate Audit Committees to create mechanisms for receiving anonymous employee concerns about financial improprieties." Find out how that channel works and make a report.
The burden of proof is on the employer in these cases. This law has real teeth.
Here's a lawyer who specializes in Sarbanes-Oxley whistleblower claims.
As a proof of concept, steal as much money as you possibly can. As payment for this security evaluation, keep the money and retire to a country with no extradition to the United States.
One little implementation detail: don't get caught.
Extra credit: put the blame onto your criminally-negligent boss.
You're a junior employee by the looks of it, possibly part time, taking phone orders.
There is every likelihood that your employer has safeguards in place that you don't know about, and even that they don't want you to know about.
Three Squirrels
Obvious incompetence is normal in the telecommunications industry. Once you are found out not to be incompetent, you will certainly be let go, possibly following a promotion to recognize your ability. If you do not believe this, I strongly suggest you purchase every Dilbert book you can find, and study them thoroughly. Scott Adams once worked in the telecommunications industry, so it's the best reference available for your line of work. If only I was kidding, unfortunately I am not.
Good luck.
It sounds like you're getting account information to create an Electronic Funds Transfer (EFT) or electronic draft whereby the company authorizes a transaction for $50,000 or whatever and you "take" the money from their account. It is the same thing as having a company 1) write a check, 2) submit it to you, 3) you deposit it, only to 4) have the funds transferred to your account. Your company is simply performing step 1, skipping step 2, 3 happens electronically and 4 happens essentially overnight.
They are giving you the SAME information that you could obtain from a written paper check, no more, no less. Now, obviously these companies have millions of dollars at any given time in their accounts and this alone makes them targets for check fraud; people creating their own checks and trying to pass them. The solution to this problem came about many, many years ago and is what makes the EFT system more secure than any other form of payment.
I am the accounts payable rep for Massive Corp. I'm going to authorize a payment for $5mil to your company: Dark Fiber Telco. I give you the check number (or transaction number or transaction code) and my bank account number and routing code. I enter the details into my Accounts Payable system which every afternoon uploads a delimited text file to our bank providing them with a list of checks written and their dollar amount. This is very similar to how credit card terminals upload their batch at the end of business day.
Meanwhile, DFTelco enters the data into their Accounts Receivable system which initiates the electronic draft, (which along with any paper check, EFT or ACH is all generically referred to as an "item"). When the item clears the Federal Reserve and is presented to Massive Corp's bank, if the dollar amount of the item doesn't exactly match the check number and dollar amount that Massive Corp uploaded, it is rejected and returned non-paid to the sender.
Very simple, very secure, and presenting your biggest customers with an IVR HELL system will only piss them off. They expect, and deserve, to speak to a human being and that is what your company provides. I wouldn't sweat it.
As an aside, I had an insurance agent come out to my property for a claim. The agent wrote a check from his checkbook and handed it to me, and then he had to enter the dollar amount and check number into his computer, over a VPN connection to his corporate office, so that the check would clear the bank.
The US Postal Service also does the same thing for Money Orders. Law Enforcement can actually log in to a LE only site provided by the USPS and check the validity of any US Postal Money Order based upon the $ amt and item number so they can see if someone is trying to "wash" a money order to alter the dollar amount, or creating a downright fraudulent Money Order.
-joel
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
Smile, nod, and move a few $M to your private swiss bankaccount. While drinking margarita's on some tropical island, send your boss an "I told you so" email.
Hey, it works in the movies!
Bank routing and account numbers are different from credit card numbers. There's very little you actually can do with a routing and account number because these two don't give you any authorization to do any withdrawals from that account (at least if the US system has some basic degree of sanity).
At least over here (Europe), giving your account numbers to other people and have them deposit money to your account is a very common way of receiving payments. They can deposit to your account, but they cannot withdraw from it.
Now, if you were talking about credit card numbers, that would be a different beast altogether.
Investigate if you might be covered by whistleblower protection laws!
This is blinging
Before you embarrass your boss, make sure your not embarrassing yourself...
BTW It's never good to embarrass your boss anyway.
The first knee-jerk reaction a manager will do to someone who points out security flaws is fire the person, and possibly find some way to press criminal charges. Barring that, from the time you tell them about the flaw, for the rest of the time you work at that place (as well as subsequent places if people know each other), if *anything* happens to breach security, you will be called in front of management (and possibly police) to explain yourself why you did not do the break-in, even though its brain-dead obvious you have nothing to do with the breach.
Its just not worth it. I have had friends fired at jobs on the spot (as in the mgr calling for security and having two guards escort the person out, then calling for a "forensics" expert to go through the person's comp to find anything to have him arrested for) because they pointed to management that the place had wide-open wireless, or wireless with brain-dead security settings.
This is assuming its not your field of responsibility to watch that data, so when (not if) its stolen, its not you being roasted by the various corporate regulations, but the people have the data left exposed, who are failing in their basic job duties.
I know I sound cruel and heartless, but business is business, and its better to shut up and let people take the fall than try to be "honest" and point out holes which results in you being the next guy who gets the axe (and bad character/job references) come "rightsizing" time.
If you *have* to alert people, find a way to do it anonymously, but securely. Don't just send anonymous E-mail or a SMS message to them (as it can be read by people who could take advantage of the issue.) Remember, ethics are important in the work world, but you are not trying to make an eighth in Honesty to complete your Ultima IV Avatar-hood.
Dear alterimage,
Based on the recommendation made to me by a reputable official of the commercial sector of the South African Chamber of Commerce who guaranteed me of your reliability and trustworthiness in business dealings, I wish to entrust a large amount with you believing that it will be of our mutual benefit; this has to be highly confidential...
-- www.globaltics.net
Political discussion for a new world
If you make a stink, the first time something goes wrong, you'll be the first guy they blame.
There are ways to handle this. It does require a lot of tact and diplomacy to make it sound like your entire concern is for the wellbeing of the company and the manager especially, and that it was your boss's idea in the first place. Unfortunately, tact and diplomacy are traits that Computer Science Majors tend not to have a lot of practice in... Computer Science is a culture where if you do something wrong, you want to be told about it as soon and as unambiguously as possible.
The human aspect of security must be considered at every point of the business - logistics, management, janitorial, accounts, catering... In most environments humans are by far the weakest link - human error, social engineering and downright laziness.
Have you identified and spoken with the Information Security Officer? It is his/her responsibility to ensure that business units are following documented and management approved procedures for the handling of sensitive information, whether it be electronically or otherwise. If you have concerns, then speak to them about it. It's not all doom and gloom - It may well be that there are compensating controls in place to deal with this, even though they may not be obvious to you.
I've been in InfoSec consulting for many years, and nearly every client I have started at has had terrible controls in place for accounts/treasury etc. Just make sure you discuss this with the right people as matters like these are highly sensitive and could damage your reputation/make you look foolish if you don't follow proper channels.
I'm the sys-admin for my company I work for (when not coding). Only the boss and myself knew the password for the entire domain, and everyone was happy. One day, during a software demo I need to pull some files off my machine for the demo. Boss says "come back once the files are on the public share, and we'll re-test". I say "Not to worry; i'll go through the admin share" (\\machinename\c$ or such) - I'll just log you into my machine as network admin.
This worried my boss - "What? You can access any machine's drives if you're the network administrator?".
I try and explain that yes you could; it's by design; the admin being the super-power on the network - full access to everything, etc. This leads him to the next question of "What? Even you could access even my PC? I've got sensitive information on here?!". I reply "Yes, even yours if I really wanted to".
Unimpressed, he changes the network admin password.
Precisely 1 hour and 20 minutes later; I get an email saying "User xyz can't access a file YYY on the abc share - what's the problem?". I explain the permissions on the file probably got corrupted/lost and resetting the file-system permissions for the root directory structure should flush out the problem.
He gives me the new network admin password. Problem was fixed in 2 mins.
In conclusion, us geeks rule the world. On modern IT systems, someone, must have complete power over all. That is why we are geeks because we can do what others cannot.
And it's true what they say; being a sys-admin is a power-trip.
*evil laugh*
The machines! They're all miiiine! Aaaalll mine!!!!
throw new NoSignatureException();
Parent is totally correct. When this operation melts down, it will reflect poorly on those aware of the problems and you brought visibility to a fucked up system. Your name will be dredged up from email records and you will be shown the door, rudely. You will have to find another industry to work in, don't plan on any recomendations. The other plan is to take the bank routing and account numbers, setup a quick exit to a foreign country and steal as much money as possible before you can be detected. There is no third choice. Been there, done that (the first, not the second).
....from your new beach house in the Caymen islands.
"Physics is to math as sex is to masturbation." -R. Feynman
Simon,
Is that you?
Send me a sample set of the account numbers, and I'll show you how to do it...
Explain your concerns to your supervisor via e-mail. By doing it with e-mail, you are making a record of your worries. This way, if any information is stolen, you can wave your e-mail around saying, "I told you so!" This leaves you in a pretty strong position to spearhead improvements to the system and score yourself a raise.
I would make a 5 slide presentation as to what your concerns are. Make it brief, but make the security concerns clear. Present this to your boss. If he still doesn't react... well, you tried. You have a record of your concerns and you clearly made a strong attempt to do something about it. The only thing you could possibly do after that is go over your bosses head. This generally is not a terribly wise idea if you want to stay with this company for the long term. You take a gamble when you go over your bosses head, and it is a gamble that a lot of people loose. Unless someone above your boss decides to champion your cause, you will just wind up with a boss that is pissed off at you who can make your life miserable. Even if a champion takes up your cause, unless they change who you report to, you still could have a boss pissed off at you.
I probably would not risk it unless you really don't care all that much if you get fired. Just do your best, make a record, and practice your smirk for when data is stolen... oh, and if data is stolen, be sure to forward your old e-mail to your bosses boss.
I have people coming to me every day with problems. After a while, you just feel like 'shooting the messenger', even if it's wrong. Why not sit down & think about how you could fix this, and then suggest this to your boss? If he still blows you off, at least you've managed to document the problem & CYA in a positive way... Send a copy of the document by internal mail & keep a copy of everything at home, or better still at a non-obvious location.
I was in a similar perdicament once and found that there is a "language" barrier between management and techies. Management speaks in terms of money while we speak in terms of technology. If you can convey the issue in terms of money then he's more likely to listen.
I believe that one can be non-naieve (sic) and still Do The Right Thing. Yes, it could have negative immediate consequences, but the alternative could have significantly worse long term consequences...
It's a simple matter of complex programming.
The sad thing is, his unlocked filing cabinet is probably more secure than having the information sit on some server where hackers from Bulgaria can steal it and blackmail the company.
Tsunami -- You can't bring a good wave down!
Comment removed based on user account deletion
Introduce your boss to Kevin Mitnick
Quality Hosting e3 Servers
If you're giving the routing number and account number of your checking account to 3rd parites to make payments over the web then you're not treating the data as though it were confidential. Now, in addition to any employee at your bank, any random person at the company of the 3rd party has access to this information. They could rack these things up for a year and then sell them on the internet. Or maybe their web server gets hit by a worm which steals all these numbers along with credit card numbers.
I like your analysis that this is a cryptosystem with the "routing + account" number standing in for both the public and private key. A proper crypto system would allow you to pay someone with some information and a public key, perhaps with a one-time use bit of some sort. This would prevent funds-extraction by 3rd parties (who bought your information on the internet after you paid the first 3rd party for something) because the information couldn't be used to extract money from your account without a new one-time thingy. Meanwhile, never provide your "routing + account" number to anyone (except your employer for auto-deposit... life is all about risk-reward trade-off). Instead, use credit cards to pay third parties so you have better consumer protection against fraud.
However, it's not completely clear that the problem in the original post would be solved by such a system without disrupting the "business process" that the customers probably think they need. An obvious approach would be something like a PKI system with a little card that generated a one-time tidbit on the fly, which the customer would provide to 3rd parties to authorize a payment, and presumably to a banker to authorize a fund transfer or wire or whatever over the phone. The bank's customers may view this as inconvenient and may switch to another bank (the key generator is yet another thing they need to carry around and keep physically secure). After all, the customers clearly want to be able to make a phone call and talk to a person to perform a transaction. In any case, the bank managers will fear this customer response.
Under the existing system, the bank employees are trusted and the customer will need to detect the missing funds and report them to the bank. Many other bank employees (any teller, any banker, any computer operator) already have access to the same sensitive information as is written to paper and placed in the drawer, which is why the bank managers are not really concerned about the drawer. They know, but perhaps haven't completely thought through that the funds will have been transferred to another account somewhere, and that will be traceable. The funds may not be recoverable but the money trail could be followed from account to account to the perpetraitor... right up to the point where the bank manager and the FBI agents are watching a grainy video of somebody in a wig and fake nose-mustache-glasses pull up to a drive through window in a car that was purchased with cash and uh, donated to a rural fire department for, uh, practice extinguishing gasoline fires shortly thereafter, close their account, and drive off with the cash.
If you mod me down, I shall become more powerful than you could possibly imagine.
Very good. Now please show how that works with Microsoft (or indeed, most software)
Ask your boss if he'd like to work at McDonald's.
He's instructing you to perform a non SOX Compliant activity.
If it was the medical industry, it would also be non HIPAA compliant, as that is personally identifiable information.
I don't know whether the financial industry has a HIPAA like set of rules to follow. If they don't, they need one.
Who is general failure, and why is he reading my hard drive?
Where do you work?
I can't help you without a firm name and address. Any hopeless administrative or cleaning staff that could use some buttering up? What's the filing cabinet look like?
and contact a few of the clients.
Si vis pacem, para bellum! For evil to succeed good men need only do nothing!
just keep your head down and look for a better job
While the "look for a better job" part is probably sound advice at some point, I wouldn't say "keep your head down" is the best thing to do...not in the ethical sense in this situation and not as a means to success in general. People who always just "keep their heads down" don't stand out in a crowd, aren't recognised for their achievements (and achieve less overall) and don't advance very fast in their career.
If you make a stink, the first time something goes wrong, you'll be the first guy they blame.
Guess what? That is exactly WRONG. If you DON'T make a stink and something goes wrong, the buck could stop with YOU! The key is to make the "right kind of stink". Do not be insulting to you boss, follow professional practices and protocol (don't go over anyone's head until/if you are stonewalled, make an intelligent argument, etc) and DOCUMENT THE HELL out of the whole situation. Then...WHEN something goes wrong and your boss tries to pass the buck you have documented proof of your boss' negligence.
Keep your head down and keep your job (or maybe find a similar job elsewhere). Speak out and gain respect, and perhaps you could even end up replacing your boss. This will also keep your company in compliance with regulations like Sarbanes-Oxley. But above all, you will make sure that as much is done as possible to prevent your employer's customers from becoming fraud victims.
It seems that IT people aren't as thoroughly regulated as other professions such as doctors, lawyers and engineers. In such professions there is mandatory participation in professional bodies (the bar, medical board, engineering council/professional association). In the light of increased scrutiny of corporate governance and major security incidents such as that with TJX (TJMaxx/TKMaxx, HomeSense, Winners stores having credit card info stolen by hackers) such regulation should be seriously examined for those in MIS or senior systems analyst positions. Part of being registered with a professional body involves ethics training, including just the kind of situation as described by this article poster. In the end everyone would benefit from increased professionalism in IT.
Since he's a college student and probably NOT going to stay in this job forever, I suggest the best course is:
1. Say NOTHING to the boss about this matter from here on out.
2. Collect names and account numbers and contact information.
3. When you leave this job one day, and you will, and when you need money, and you will, contact the account holders *directly* and offer to tell them where you got your information for a fee.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
2. Collect names and account numbers and contact information.
3. When you leave this job one day, and you will, and when you need money, and you will, contact the account holders *directly* and offer to tell them where you got your information for a fee.
You must be new here.
There, fixed.
Ethical concerns are different from security concerns, somewhat. If you can suggest a cheap way to increase security, you'll be very mildly rewarded or ignored.
Still, the requester should likely change jobs before any major security breaks occur, and not mention anything further about security.
So, you're telling me it will go something like this:
Employee: You might be insecure!
Boss: You're overreacting. We're fine.
Some time later...
Boss: Well, shit, we got 0wned. Employee!
Employee: Yes?
Boss: You knew we were vulnerable?
Employee: Yeah...
Boss: And you didn't do anything?
Employee: I tried, but...
Boss: You're fired! You'll never work in this industry again!
How does this make sense, even to the boss? I mean, shouldn't it go differently? Maybe like this:
Just after they get 0wned...
Boss: Employee!
Employee: Yes?
Boss: You knew we were vulnerable?
Employee: Yeah...
Boss: Wow, you know your shit after all! Here, have a promotion!
Employee: Thanks! Oh, by the way, our mailservers are acting as open relays. Want me to fix them?
Boss: Make it so!
To be fair, if the security is that bad to begin with, I don't imagine you'd be lucky enough to have a sane, intelligent, fair boss. However, you might at least have a chance suing said boss for firing you over his own mistake...
Don't thank God, thank a doctor!
Many countries, states, provinces, etc. have data retention policies; check and see if he is actually doing anything illegal in your locale. If he is, email him a URL to the appropriate laws with a line saying something like, "Hey! I just discovered this, and I thought you should know about it." Inoffensive, and you've covered yourself by letting someone higher up know about it. If you don't have any laws governing such data, I'd go with the emailing him that it would probably be a good idea to get audited. After that, it's no longer your problem.
Fully document the problem, with a fix. Cost it.
Wait until your bosses boss comes to visit. Present the report to your bosses boss.
Make sure you bypass your current boss. Your current boss won't do a thing about it while he has power over you... bosses aren't about the company/organisation/entity... they are all about themselves and having power over other people.
Seize power.
I hate to give the example of Hitler and the nazis... but... a soldier once wrote a letter to hitler telling him that his troop commander was a fool and asked for hitlers help in removing him. Hitler simply wrote back and said something like "then you must take control". Just remember: "do no evil".
Does it go on forever?
Bank routing numbers and account numbers appear on any check you write or receive. This information is just one step away from being public anyway.
There's an easy answer to this. All big public companies have an ethics or compliance hotline that you can call and anonymously report stuff like this. It usually goes directly to the audit committee of the BoD or similar. Call, and then youcan feel comfortable knowing that you've done your part, and the people who need to know are informed.
Si vis pacem, para bellum
The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian
I smell BS. Strange that you guys do business with verbal money transfers. I work at a medium sized ISP and almost all of our transactions are done by people mailing in checks every month, even the big fortune 100 customers. Reason given: You get to keep the interest earned during the "float" (although this is less and less of an excuse nowadays.) Also you get to pay late and play games with the the "f*** you if my payment is always late - waive my late charges or I'll just take my business elsewhere" routine that the big guys like to pull on the little ones.
We do ACH for customers with small monthly balances, or on request. Nobody calls us in and gives us verbal wire instructions.
You do know that extortion and blackmail are illegal, right?
Si vis pacem, para bellum
The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian
In today's international corporate world, legality is for chumps who actually care about the nation they are in or the system they are working for. Simply select the overseas addresses.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
The correct answer is to tell the companies internal and/or external auditors. If this is a publicly traded company then SOX requires this kind of problem be fixed. If you ask them to they most likely won't even reveal where the information came from (of course your boss will probably know since you already raised the issue).
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
The problem with this is that when the 'fix' trickles through the chain, the manager immediately knows who called it in, and will duely fire him/her. Whistleblowers, even through internal channels, always have problems. Catch 22: You don't tell the manager and instead call the hotline to get it fixed, or tell the manager, gets brushed off, then when a lock is added to the file cabinets from 'corporate' the next day, you get fired. Fucking corporate mofo mentality. Ugghhhh. I hate the system.