Unusual query re computer hacking and employment of teenagers

[rosienickname]

OK. I could do with some advice here from people that know about employment rights, possibly internationally. And also nerdy teenagers...

My DSS is just turned 16. He's never been a sociable child, doesn't really have friends. Only social interaction is when classmates ask him round to help them build computers, which are his obsession.

He's been spending all his time shut in his room lately saying he's doing homework, but clearly isn't (school grades aren't great lately, for a bright boy at a pushy school). Recently he's taken to staying up til 2 or 3 in the morning online. We've now stopped this by turning the router off at 11, which he got quite upset about.

Anyway, he's finally told us what he's been up to. Turns out he's made contracts with people who work for a major international software company doing tests on new software. He's been working for them by attempting to break the software ( ie hack into it) as part of the tests they do. As part of this he's signed some declaration of not telling anyone about what he's up to.

He does have form for hacking having been in trouble a few years ago for hacking school computers, and I do think he's telling the truth. I'm concerned though that he could be being quite exploited by these people. He's not being paid as he says they don't pay anyone under 18. I would have thought if they don't pay them, then they shouldn't be getting them to sign aggrements, or giving them work to do. He is hoping to get an internship out of them when he's 18.

Some of his contacts are visiting quite near us (from the US) in a few weeks and DSS wants to meet them socially. DH has said he'll go with him to make sure all is OK.

I guess I'm concerned about him as he quite naive in many ways and probably really excited by the work he's doing and the new contacts/ friends. I'm concerned he could be being exploited by them to work unpaid. Or is this really something we should be proud of him having set up for himself? DSS can be very private/secrative so it's hard to get much out of him.

On the employment front even though he is 16 is he in Year 11 as in the UK you need a licence for employment up until the last Friday in June of Year 11 & we also have minimum wage for 16 year olds.

If he has been contacted by email check the message header, if the origin of the message is not the supposed company then its probably a scam. If it is correct then it might be a scam.

It sounds very dodgy. Not least is why they would use unqualified people.

Consider the scenario, company X is paying to have their systems tested by the company employing your son - do you think company X wouldn't want assurances about the people doing the testing. Even if everything else is kosher I think the company is defrauding its customers.

I do realise that people do hack into companies - I just am not clear on who or why they would involve someone else in doing it for them. DSS is bright and very techy but I'm unsure whether he'd be able to do anything an experienced hacker couldn't. Could he? Yes we clearly do need to check it out asap.

Yes he's Y11 - so not of school leaving age yet. But trouble is he's not employed (in his eyes at least) he's just "helping them out". That's what bothers me most about it - a contract of employment would mean he'd get paid but would more importantly mean that someone else was ultimately responsible for what he's doing, because he can show that he's been employed to do it.

It's not that he can do something another hacker can't - it's that they simply don't care if your DSS gets caught.

Seriously the issue of not being paid is nothing compared to the deep deep shit he is probably in....

Risk of working for nothing vs risk of a jail term, probably in the US.

Now what do you think the important issue is...

It's probably a scam.
Why would a well known company be hiring 15/16 year old boys with no contract?
I'd be worried that they were going to blackmail him into handing over cash or something.

This whole thing just has bright red flags waving all over it. Please please just put a stop to this right now and forget any worries about offending his feelings. This has the potential to screw up your sons life in a massive way if its not all 100% legit and above board.

Your son has no proof by the sounds of it that he has been "employed" to do this. In the eyes of the law(US and UK at least of not other countries too) he is most probably breaking the law.

16yo's can earn money. The fact this company are not paying him - is one HUGE indication they are taking the piss and just using your son. He isn't even getting the minimum wage from these people so they are already in breach of UK law.

There are companies that EMPLOY people to do what your son is doing. They do it legally and properly, even when it is top secret work. They probably do use young techy geeks - students usually over the age of 18.

Where is this contract your son signed? Why have you not even seen it yet? Where is the proof that this is all legit?

You need to get an employment lawyer PDQ. I dont mean to scare you but try googling Gary McKinnon and decide for yourself if you are happy for this to just continue in the vague hope your son has a career in hacking.

Think of it this way - if it is legit (and I'll eat my hat if it is) then putting the project on hold for a couple of days while you verify it won't hurt.

But if it's not legit then you're saving DSS from a world of pain.

Not having a contract is suss.
Total secrecy is suss.
Meeting up in a bowling alley is suss.

I mentioned calling the company and asking to speak to thr relevant person. Please be aware that it's important you call via the switchboard (not a direct dial someone has given to your DSS) and do actually speak to that person about your DSS specifically and ask him/her to email you the paperwork. Be aware that even if the name given is genuine that personay have had his/her identity stolen.

You and your DH really need to assume the worst here.

Sorry OP to add to the alarm bells. Wasn't there a case in the last few years where a lad from the UK hacked into a US government computer and the US want him extradited to face criminal charges? If I remember correctly he is autistic. Does that jog anyone's memory? I can't remember whether this has yet been resolved.

This has red flags all over it. I work in software development. We would not hire a teenager unpaid to hack into the system as such. You would have proper contracts, HR support, benefits etc if he's indeed working for a well known firm. And testing system vulnerability would be normal but are you sure he's really legally allowed to do it? Ie is he an employer for said company? Is it on a parallel test system etc?

Do you know the name of the company? Is there an HR you fan contact to verify his employment?

It sounds to me they are using his naievity to perform criminal activities.

And you would be part of a team would regular meetings. Basically like any other team of employees just because it's about conputers doesn't mean we don't follow nornal management structures.

It absolutely is not legitimate.

I am a lecturer in computer security. There are so many reasons this is not legitimate.

Firstly, outside the naive fantasies of their parents, the idea that 16 year olds working in their bedrooms have vital knowledge of subtle exploitation techniques unknown to anyone else is just nonsense. They don't. The serious exploitation techniques come from deep research by people with vast resources, both intellectual and technical; all that sixteen year olds do is use those techniques, pre-packaged, get caught, and get prosecuted.

Secondly, someone with a PC sat at the end of a domestic internet connection does not have the technical resources to do anything useful without, in turn, breaking into other machines to harness their connectivity and computing power. They don't have permission to do that, and it is very easy to find and prosecute people.

Thirdly, without a contract of some complexity, anyone who attempts to break into a third party's systems is insane. Just as in UK law saying "I don't want to press charges" doesn't prevent someone being prosecuted for a crime against your anyway, the CPS have the power to prosecute even if the alleged victim doesn't consent. There's a de facto agreement that properly constituted "ethical hacker" pen testing outfits can do their work with the consent of the company they're attempting to penetrate, but pen testing companies are in competition with GCHQ for people with good PhDs, not kids in their bedrooms.

Even if it's not penetration testing, but software testing (ie, "when I type Cmd+U, does Pages underline the word?") again, why would anyone employ a sixteen year old, cash in hand?

There are serious jurisdictional problems with prosecuting offshore hackers, and the reason penetration testers are in demand is that in the absence of law enforcement, companies need to protect themselves. There are no jurisdictional problems with prosecuting people in the UK, and their elite cyber-ninja skills exist only in their heads and those of their parents.

www.cps.gov.uk/news/latest_news/lulzsec_computer_hackers_jailed_for_a_total_of_7_years/

en.wikipedia.org/wiki/LulzSec

I asked my friend to ask her DH about this as this is his line of work rosienickname. He says it's dodgy, a real company wouldn't do that, either your son is lying about what he's doing, or he's working for the bad guys.

What securitylecturer says. Most teenagers are script kiddies. Not security experts.

Is he not just online gaming and lying to to get you to put the wifi back on?

I work with some young people who are addicted to online gaming and you wouldn't believe the lengths they go to and the massive impact it has on their lives.

Sorry OP but DSS fits the profile for this. The late nights, school work suffering, social isolation etc.

This really does sound dodgy as hell OP. I add my voice to the PPs advising you seriously discuss this with your DSS and take some legal/employment advice.

Any legit business keen to investigate and test its own online security will be employing skilled IT professionals/'hackers' in a more formalised way (ie they're unlikely to be school kids on secret 'contracts' for no money).

LifeofBriony it was the Gary McKinnon case, right? www.bbc.co.uk/news/uk-20730627

Huge red flags for me too.Google Gary Mckinnon who escaped a US jail term by the skin of his teeth.

OP if you dont sound sure what your DSS is using your household internet connection for then it really is your or your DHs responsibility to find out.

You (or your DH) have signed a contract with your broadband company, and in the small print it says that you will ensure it is not used for anything illegal. Broadband Companies can, and do, divulge the names and addresses of households that have been detected as being used for hacking - and the first you'll know is when police officers turn up on your doorstep with a search warrant.

Until you have assured yourself that your DSS is acting completely legally and above board, then I suggest you withhold internet access from him at home. It won't stop him using wifi elsewhere, but at least it will limit his use and buy you some time to sort things out.

Looks like you've had some expert advice OP.
I instantly recalled the Gary McKinnon case. The US authorities are ruthless over this kind of thing.
Not sure whether CEOPs would help you? I think I would ring them.

I think it's clear that you need to disconnect him from all internet activity until this is sorted out. I would not let him meet these people at all. possibly your DH could go, preferably with someone else.

Thanks for all the advice - I've shown my DH this thread now and we've agreed to discuss it later.

Yoni that is who I was thinking of, thank you.

Christ, it's a whole other world out there isn't it?!

I swear I not equipped to deal with the stuff our teens throw at us! I'm programmed to soothe sore knees and read bedtime stories... I'm sorry I haven't any good advice to offer OP, but will agree you need to look into this asap.

Morning Rosienickname.... how did it go yesterday in the end. Did you get a chance to discuss? Are you any the wiser as to what is reeally going on yet?

Surely it's you and DH who should have the admin rights not your DSS

Him not getting paid is the least of your worries, I'm going to leave it at that as I don't want to be mean, but Christ!