Re: Whatever it takes to make a sale
There's the other side to this too:
mid 1990s:
A school I was providing connectivity and doing consult work for (mostly for free) switched to another ISP without telling me. First I knew of problems was when I discovered the admin and student networks had been physically connected together (no vlans) and something on the LAN was RIPing itself as a default router. Digging into the issue showed that a fly-by-night outfit had shown up during summer break when only the core admin staff were around and offered a "fantastic deal" on wiring up the classrooms plus connecting them to an ISP based about 500km away (this was in the days when ISPs were usually local outfits). The School Administrator had taken them up on the deal without bothering to consult with the IT staff. (It wasn't any kind of cheap, they'd used nasty wee 10MB/s hubs in a flat network connecting 150+ systems together, well beyond ethernet distance specs, hadn't even bothered using separate subnets for the staff and student systems and charged them top dollar for a 3rd rate installation, dropping another router on the network without disconnecting our one.)
Upon warning the School Administrator (who's supposed to cover business and legal aspects of operation and be aware of liability law) in writing that:
1: The ISP agreement they'd signed up for was 5 times my charges.
2: That it was only a matter of time before the more enterprising students would hack into the admin network
3: That if they were lucky those students would only change their own grades.
4: They risked major expense and litigation if anyone's privacy was breached.
I was shown the door, fairly unsurprisingly.
This was despite having been discussing security arrangements for such a connection for about a year beforehand with staff who were supposed to be in charge of developing networking. We'd been making plans to roll out physically separated networks and 100Mb/s managed switches everywhere in conjunction with one of the local networking specialists (not just vlans - not secure enough in everyone's eyes at the time) specifically to ensure that confidential data wouldn't leak and to keep porn out of the network. They were caught by surprise as much as I was and the worst thing was that the total cost of doing it the right way with companies which were supportive would have been cheaper than the deal agreed over the summer by that one administrator.
Somehow the staff did manage to block the ISP switch (by all accounts at this stage the administrator was huffing at them more loudly than Donald Trump if my name was mentioned), but shortly afterwards their connection was switched to a 3rd ISP, amid claims that ISP had offered them a deal which was half the cost of getting leased lines from the local telco, let alone anything else.
18 months later the school was in the news for having been hacked (by a student, of course) and student/staff personal information circulated, leading to problems with bullying targets and their families being heavily victimised on their home phone numbers even after those numbers had been changed.
At that point the school's public liability insurer discovered a copy of the letter I'd written(*) and decided the school's policy was null and void. It ended up being quite expensive for them (several million dollars) and the administrator was heavily censured by the board of governors. Despite that, security problems continued for several years afterwards until she was replaced and the school was ordered by the education department to sort its shit out.
(*) Someone sent them a copy and it wasn't me.
I don't know what the moral of this story is, other than "be vigilant" - because once someone's absolutely cocked things up and they're in a position up the food chain, they'd rather pretend that everyone else is wrong and they're right.
Another similar saga in another school in the same town had a meeting between the school's "IT lead", myself and employees of a government research institute discussing how to get the school online (the school wouldn't be paying for this, it was donated effort and connection from the institute - one of the director's daughters was a pupil). When the discussion turned to ensuring network security and the various issues with that, the "IT lead" said "I'm in charge here, I don't see what the problem is. You're the technicians and you'll do what I tell you" - at which point we all looked at each other, picked up our stuff and left without saying a word. The school didn't get its free connection.