Get it in writing. Save a copy of said confirmation away from company hardware.

Violating software and service licenses are the kind of thing that, if they are caught, can really screw over a company. They will want someone to blame and an unscrupulous windbag will end up deleting any emails on the company servers related to their 'request' and make you their scapegoat.

Take the initiative and email your boss asking for confirmation, laying out exactly what they asked you to do. BCC a personal email account or save the email to a USB drive (whichever is safer). Ditto with any responses you receive. From there, you can choose to either get in contact with higher ups, Federation Against Software Theft (a piracy resource, but intentional license violations are pretty much treated as this anyway), or the service provider themselves.

Bear in mind that the first can wind up with you getting punished if the higher ups let your boss know, the second can trigger a witch-hunt (FAST generally do not give information about informants, but if your company are unscrupulous, they WILL be looking for who did what) and the third can lead to wasted work as your company's account gets perma-banned over the infraction soon after the code is up and running.

Like anything that touches on ethical considerations, you need to be prepared for the repercussions from your decisions.

If your company has a legal department, I would consider starting there. What you are doing is a violation of the terms of service of the API and could result in problems for your organization. This can help you get additional eyes on the terms and policies of the API creator to ensure that everyone understands them.

If your company doesn't have a legal department, what you do is up to you. However, it's widely considered unethical to misuse someone else's API. If your manager refuses to understand the possible implications of this, you have four options. You can either go along with it and you would need to live with your decision, you can refuse and deal with the outcomes which may result in an inability to move up in your organization or even termination, or you can resign and refuse to be part of an unethical organization. Alternatively, you may be able to reach out to the API creator to clarify the terms of service and, if your company is indeed violating them, self-report it - perhaps there's room for agreement, or the API creator can block your company's access to the API.

At the end of the day, no one should fault you for doing what you need to do. The ethical thing, according to the various software engineering codes of ethics that I'm familiar with, is to ensure that the API isn't misused and you comply with the terms of service. However, if you are relying on this job for money or benefits to support yourself and your family and losing it without something lined up would put you into an unsustainable position, I don't believe that anyone would fault you.

It comes down to your personal convictions.

From what I understand the misuse of the API does not appear to be a criminal offense (please don't just take my word for it, get legal advice to be sure). However, make sure that the collection and storage of data that your software is performing is legal. In Europe there are strict data privacy laws (GDPR), especially when it come to collecting data on people. The policy of the API may very well be to prevent the illegal collection of data.

People have different personal convictions and some are more ethical than others. As long as the data being collected is legal, you will have a hard time convincing your boss to take the route that you see as ethical. You have to realize that, depending on their culture and personal convictions, your boss might not view the misuse of an API as something unethical.

As I see it you have a few options:

1. You can obey your boss and use the API against its policy. Be aware that this is not likely to be a one time thing and more requests like this are likely to come in the future. The more of them you say yes to the harder it gets to say no down the line.




2. You can refuse to use the API against it's policy. This will likely not sit well with your boss, with the extreme case being that you might lose your job.




3. You can suggest an alternative solution. It probably requires some creativity but you might even find an API where it's not against their policy to implement it in the way your boss is asking of you. This has the potential of not upsetting your boss (too much) while allowing you to stick to your convictions.

In your case I would suggest giving all you have to make option 3 work, only resorting to 1 or 2 if all else fails.

You've raised this as a concern and have your manager's instructions in writing that you're to code the API as the requirements stand (and against the API's documented guidelines).

They also have fully indicated their understanding that the code might well break when and if the API is updated to close this vulnerability/backdoor.

If so, you may as well carry out the instructions and code.

When and if things go sour, you'll be ready to change that code, so bear this in mind with your intended development path to make the rectification easier in the future.

You haven't given enough information in your question to determine whether your boss's request is unethical and/or illegal and/or in breach of their contract/ToS with another party. These are all vastly different matters that you should treat differently.

If the request is illegal, you should not do it on your employer's behalf, even if you don't think it's particularly unethical. When they're caught, they'll make you the scapegoat. You can refuse to take part (and, depending on jurisdiction, probably have protection if they retaliate against you for this), but you might still find yourself working in a hostile environment, or out of a job if the fallout brings down the company.

If the request is unethical - for an example fitting your scenario, think of scraping people's photos from social media or personal info from dating profiles in a jurisdiction where doing so isn't illegal - then in my opinion you shouldn't do it, but you might lack protection in your refusal to do so. You should probably consult a lawyer.

If the request is merely in violation of your employer's contract or terms of service with another party, but not illegal or unethical, then in my opinion there's little reason not to go along with it. You might want to consult a lawyer first and ensure that there could be no cause of action for tortious interference on your part. (Note: IANAL but that's my guess at the most relevant area of law.) But otherwise it's their matter, not yours. For what it's worth, lots of APIs' terms of service are borderline unethical and unenforceable to begin with.

I can think of three possible responses:

1. Challenge: Say, "I need a written and signed order to do this on physical paper before I will do it." Now his claim that it's okay for YOU to do the job runs into his own sense of self-preservation.


2. Passive: Say, "It's going to take me X months to do that" where X is several times longer than you can really do it. This will be a strong hint to him that he's better off finding someone else to do it.


3. Direct: Say, "Sorry, but I can't do that. It goes against my beliefs to ignore the terms of use."

Now any of these options may result in your boss taking action against you. Even if he seems to fully accept your response on day 1, days/weeks later he could start a campaign to harass you.

Let's say that you don't help the boss do this project but he gets it done anyhow. You're still working at a company that is blatantly going against your ethical standards. How will you feel about that? If you won't feel good then it's may be time to look for another job because most likely the boss is going to get the project done regardless of your involvement.

Something else for you to consider: Lawyers write the terms but the business and technical people at the other company may be 100% okay with your company doing what your boss wants. If your company is caching data that the API company doesn't sell per request then it's harmless. Although in my experience, someone in tech at your company should discuss with someone technical at the other company before assuming that you'll be able to do business this way since the API can be switched off (deny you access) at any time for any reason typically. And that's probably bad for your business.

Do a risk assessment (https://www.ccohs.ca/oshanswers/hsprograms/risk_assessment.html) with your boss to determine whether violating the terms of the agreement is worth the risk, and identify if there are any alternatives that reduce the risk while achieving the same goal.

If you approach the problem in this way, there are four possible outcomes:

1. You and your boss determine an alternative that is lower risk and yields the same result.


2. You and your boss decide the risk is not worth it and the project does not proceed.


3. You and your boss determine that the risk is so low you'll do it anyway.


4. Your boss tells you to shut up and do it. Do a risk assessment to determine if staying in this environment is worth the risk.

If the result is any other than #4, you'll have demonstrated to your boss that you know the correct way to think about the sorts of problems that upper management contemplates every day.

Finally, remember most people violate laws every day (jaywalking, speeding, drinking underage, smoking weed, etc. - some of which involve very serious penalties) because they view the risk as worth the reward. Just because someone says to not do something isn't on its own reason enough not to do it - you have to think about the reward vs consequences.

If you are not violating a government's law (this is not clear from your question), the most likely outcome if the API provider decided you were violating their terms would simply be to cut off access and send you a cease and desist letter. In order for them to go after you/your company in court, they would need to prove to the court damages from your violation, which is likely to be negligible unless you are competing against them in some way.

My boss wants me to develop some software that consumes an external API and stores the received data in our own database.

Did you (company) reverse engineer the API to get the details/spec for it? Or was there a document given to you/found detailing the API?

The policy of the external API clearly does not allow this but it would probably never catch someones eye.

An external API doesn't want external usage? Sounds strange to me. The likelihood of them catching you is irrelevant, if you're breaking their rules you're liable for legal issues. That's a risk any clued-up business would want to avoid.

My boss knows that it is not allowed but still wants me to implement this feature.

Don't go to your boss with we aren't allowed, end of story. Go with a solution.

Get in contact with the API developer/company and ask what their policy is on external usage and persistence of the data. Detail explictly how you intend to fetch the data and where you intend to store it. If they say you aren't allowed, ask if there's a way to purchase a license/API key.

Take this back to your boss and present it as:

I got in contact with the developer to avoid potential legal issues for the company regarding the API you asked me to work with. I thought their policy was a little unclear and they got back and cleared us to use it for free/have said we can use it with an API key, but we need to pay X amount per month.

If they reject the claim and don't allow you to access it, don't then go ahead with it anyway. If you boss is still hounding you to break their policy and implement some functionality to use their API I would considering polishing my CV.