Employee Outsourced Programming Job To China, Spent Days Websurfing

New submitter kju writes "The security blog of Verizon has the story of an investigation into unauthorized VPN access from China which led to unexpected findings. Investigators found invoices from a Chinese contractor who had actually done the work of the employee, who spent the day watching cat videos and visiting eBay and Facebook. The man had Fedexed his RSA token to the contractor and paid only about 1/5th of his income for the contracting service. Because he provided clean code on time, he was noted in his performance reviews to be the best programmer in the building. According to the article, the man had similar scams running with other companies."

Comments

Part of me says, "Good!"

[Maow]

I'm a bit torn on TFS.

On one hand, companies outsource "our" jobs with absolutely no remorse at all.

On the other hand, ... fingers?

Re:Part of me says, "Good!"

[Anonymous Coward]

well.. and the fact the employee here was collecting a 400% markup..

employee did employer a favor.. proved his own job could be outsourced better at a fraction of his salary. fire the employee, keep the contractor.

Re:Part of me says, "Good!"

[kiddygrinder]

yeah as if, i'm sure if i told my boss i was doing this they'd be so keen to keep paying me to do it rather than firing me and doing it themselves whilst keeping 4/5 of my salary.

Re:Part of me says, "Good!"

[History's Coming To]

The major issue is handing over access keys to a corporate VPN to a random bloke in another country. Frankly, I'm quite impressed with the general concept, but introducing a huge security breach isn't going to make you popular, he should have just had the guy email him code and the ctrl-V it himself, cutting the security breach out, he'd probably never have been caught unless there was something unexpected in the code.

Re:Part of me says, "Good!"

[indeterminator]

my boss

I quoted the problematic part. s/boss/client/ and all is well. Independent contractors do this all the time.

Some other important things: (a) You want to get permission from your boss/client *before* making the arrangement. (b) You *don't* want to disclose the rate of your subcontractor to your boss/client. (c) You *definitely* don't want to send your *personal* RSA token and access credentials to your subcontractor.

Re:Part of me says, "Good!"

[TheLink]

Was he using the same contractor for everything? If he wasn't then maybe he's a competent project manager with a good eye for talent.

It's not so easy to get good results from outsourcing. So some of his 400% markup might be justified ;).

Re:Part of me says, "Good!"

[ByOhTek]

Yes, it's bad if the employee has 400% markup, but good business if the company does it.

Re:Part of me says, "Good!"

[adrn01]

Employee is in wrong position, if was able to successfully find / hire / manage a highly competent programmer in China.

Re:Part of me says, "Good!"

[arth1]

On one hand, companies outsource "our" jobs with absolutely no remorse at all.

On the other hand, ... fingers?

On the gripping hand, the problem is giving your personal RSA encryped access into a company's network to unidentified third parties.
Perhaps this developer could provide his services for a fifth of the going rate because he also snooped around and collected and sold data.
Clandestine data mining and illegal data bourses is no longer a SciFi concept; it happens every day.

Re:Part of me says, "Good!"

[Anonymous Coward]

Maybe the Chinese programmer didn't do it himself either, but hired an Indian programmer for 1/5 of what he got ...

Re:Part of me says, "Good!"

[ByOhTek]

Note: that was sarcasm - there should have been a question mark at the end. They should be put on equal footing, or because the employees are more likely to spend the money (i.e. not invest which aggregates more money to them), and therefore keep a pool of money that will help draw and encourage investors, even in a stagnate economy... I can even seen putting some favoritism towards the employee doing it.

Re:Part of me says, "Good!"

[eulernet]

VPN is not really the problem, since VPN access tends to be quite limited in scope.

I think that the main problem is that a random guy in China has a local copy of all the source code of the company.

If access to the code required some NDA, the company is now in pretty deep shit.

Anyway, kudos to the chinese guy, he seems to be a good coder and had to work at an unusual work schedule.

Re:Part of me says, "Good!"

[Luckyo]

This was mt first thought as well. If employer's management has any common sense, at this point the man should be pushed into management ASAP. People who can do outsourcing that well are very rare.

Re:Part of me says, "Good!"

[Dcnjoe60]

Employee is in wrong position, if was able to successfully find / hire / manage a highly competent programmer in China.

I don't think you want this guy as your program manager. Look at the facts. He was paid $X and paid somebody to do his job for less. He isn't making any extra money and in fact is taking home less money than if he did the job himself (and since he isn't a business, he can't even deduct the outsourcing expense from taxable income). The guy still had to show up at work each day (where he would just surf the net), but his outsourcing activities didn't free him up to do other programming which would bring him additional revenue.

No, the only reason to do something like this is because you are incompetent at the job you were hired for and need to cover that up, or you are an idiot because you are giving away a large chunk of your pay so you can surf the net. Neither of those are qualities that I would want in a manager.

Re:Part of me says, "Good!"

[beowulfcluster]

Maybe the Indian programmer hired a laid off American programmer who figured it was better than nothing.

Re:Part of me says, "Good!"

[beowulfcluster]

If you're only doing it at one place then you might be an idiot, but if as reported with this guy you're doing it at several jobs...? Suddenly you're taking home a lot more than you'd do if you were doing a real job yourself, and you're watching cat videos while doing it. If you have multiple clients who are all satisfied enough with the work your team does that they want to keep hiring you, what more do you need in a manager?

Re:Part of me says, "Good!"

[LordLimecat]

You mean, except for the whole "some random dude in another country now has his RSA ID and noone was the wiser", ya sure.

Re:Part of me says, "Good!"

[BVis]

The major issue is a dishonest employee. While he may be crafty, he still took credit for others work and tried to cheat the system.

That's the American Dream, 2013 style. Hard work only gets you more hard work, but exploiting the hard work of others makes you rich. As others have pointed out, employers do this all the time, and not only is it accepted, it's expected. But when a peon.. whoops, excuse me, the proper term is "an employee", turns the tables on them, well, we can't have that, can we. Companies don't like it when you don't eat the shit you're given.

To me, yes, what this guy did was wrong and dishonest. But, to a lot of people, the only thing this guy did wrong was get caught. Companies that work the system (legally or not) are praised as 'innovative' and 'efficient', and the execs get huge bonuses while the people who do actual work struggle to make ends meet with their salaries that don't keep pace with inflation. And, should the companies get caught doing something that's actually illegal instead of just morally reprehensible, they pay a fine (which is generally less than the amount of savings/extra profit they realized through the illegal activity) and get a stern talking to. But, when this guy does the same thing, he loses his job, gets his reputation ruined, and may very well go to jail. God Bless America.

Re:Part of me says, "Good!"

[dubbreak]

VPN is not really the problem, since VPN access tends to be quite limited in scope.

And my experience says the opposite. Whatever you'd have access to locally as a user you'd have over VPN. How would you do your job otherwise? The point of VPN is to make it a secure connection so you can have access to whatever you'd have access to locally.

If the company has an NDA, is ISO registered, has to follow any government security protocol (I worked at a private Canadian company that followed US security regulations in order to sell to US gov) etc.. this could lead to trouble. Of course sweeping it under the rug would have been better than advertising it if that's the case.

I agree on the kudos. Finding good people is tough enough locally. Outsourcing is hell. In a contracting type situation (as long as it didn't have a no substitution clause) this would have been perfectly ok (if not better than ok since it appears good code was actually written). The interesting part is whether the company would have paid the same had they known. They were quite willing to pay a wage of X when they thought it was the local guy producing the code, but my guess is they'd want to pay a small % of X for the Chinese worker even with this guy managing him. In reality, since he was producing the best code in the company, he should have been getting the biggest wage (reward your stars and all that).

Re:Part of me says, "Good!"

[dubbreak]

This.

A contractor or consulting company would do this no problem. That's a b2b relationship though. Employees are supposed to be subservient, "Yes mastah, whatever you need mastah."

If we ignore any issues with security it's really hard to fault the guy. The point as an employee is to do your job and do it well. The code he (had) produced was apparently commendable. He did his job well though not by the traditional solution (working hard and doing it yourself). Does that make it the wrong solution?

The biggest issue is the company "got tricked" into paying more for a cheap worker. Of course had they done the outsourcing themselves they'd probably have one or more of the worst producing low quality coders that require tons of rework (the normal reality of outsourcing).

Re:Part of me says, "Good!"

[Half-pint HAL]

People who can do outsourcing that well are very rare.

How "well" is that? He pushed a "critical infrastructure" job offshore without a full ISO security audit, putting his employer in the position where they risk losing their ISO certification and get sued into non-existance. The reason his offshoring was cheap and profitable was because he made a very, very bad job of it. He has lost his job, and the only reason he hasn't been sued into bankruptcy is the fact that his employer is sh*t-scared of anyone knowing it was them.

Re:Part of me says, "Good!"

[phillyclaude]

it's programmers all the way down

Re:Part of me says, "Good!"

[cayenne8]

It's not so easy to get good results from outsourcing. So some of his 400% markup might be justified ;).

This man is my God!!!!

Now....how can I implement something of this sort? Just need to learn my lessons where this guy screwed up.

Ok, no unauthorized VPN's into the work network, do all that from home is a start.

Re:Part of me says, "Good!"

[Luckyo]

Well enough not to be found out for a long time and be found best coder of the workplace.

Re:Part of me says, "Good!"

[cayenne8]

So money is the only thing that motivates you to work?

Of course it is....? Are you kidding?

I'd assume that is the case for most people out there.

If I won the lottery tomorrow, with enough money to never work again, I'd be out of here so fast it would make your head swim.

I'd likely not even bother coming back for my stuff at my desk (not that much there, nothing really personal).

The only reason I work...is to earn as much money as possible, which gives me the means to pay for the life and lifestyle I enjoy. If I didn't have to burn hours working for money, I can tell you, I could easily spend the rest of my life pursing happiness to the fullest!!

I like to travel, date various women, I have hobbies, I have TONS of things that I'd be doing every day if I didn't have to bother coming to a job to work.

Why would anyone work if they didn't have to?

I know there are some fringe cases out there, people who apparently actually define themselves by their jobs. They're also the ones that hit deep depression or get really overly upset if they lose their job, or something goes wrong at work at times.

I've never understood that, I guess I never will.

I'm defined by myself, and I really, really do LIKE myself....and would love to not have to work, and spend more time having fun and doing interesting things.

Are you just joking, or do you actually work for any other reason than making money?

Re:Part of me says, "Good!"

[ultranova]

In other words, he knows how to make a profit by screwing over other people and escape the consequences. Clear Wall Street material.

Re:Part of me says, "Good!"

[ultranova]

Why would anyone work if they didn't have to?

Because accomplishing things you consider valuable triggers the reward circuits in your brain. That's the reason people do volunteer work, have hobbies, etc.

Both you and the parent are confusing "work" and "job". They are not the same thing, altough if you're lucky they might overlap.

Re:Part of me says, "Good!"

[cayenne8]

My wife died in 2006 when I was 42; we were together for 20 years. We lived responsibly, partly because she was 19 years older than me and would retire way before me, so I'm debt-free and don't need to work (ever again), but do because I haven't yet figured out what I want to do with my self/life and I'd be bored otherwise. My house is quiet and lonely enough on the weekends as it is, I don't need that 24/7.

Sorry to hear about your loss, but why are you alone?

That was about 7 years ago...do you not have a bunch of other friends or people you can do things with? When you were married, did you not keep close friends then...or was it just you and her and no outside people?

You're near 50....hell, get out there, meet another woman, they are a dime a dozen out there. Get laid. Hell, if you want..get involved.

I know there is a period of grieving, but you're still in this world, and I doubt your wife would want you to be down forever. Get out and enjoy yourself. If you don't have to work for a living...get out and find something to do.

Have you ever been a tourist in your own town?

Once, when I was in between contracts for about 7mos...I got up each day....walked the dog, hit the gym for a couple hours...and in the afternoons, I'd hop on my motorcycle and do something different every day. I went to check out the various museums...stuff like that.

And if you like computers...tinker with those.

And start to embrace some 'alone time'. I love my alone time, make use of it to do things that having someone around all the time can distract you from, like maybe learning a new language.

And hell...TRAVEL. If you have the means, go somewhere. How about this spring, go rent a bungalow in Key West and go party on Duval street and dine out for a week? Plenty of people to meet there or anywhere else you travel.

There's not a lack of things to do in this world at all, just pick something and GO.

Good luck. Again, sorry about your wife passing, but after 7 years, you really need to be moving on and enjoying the rest of your life. Your a the midpoint now, don't waste time!!

Outsourcing

[Janek Kozicki]

Now, who is going to complain about job outsourcing? Market & economy have laws that can't be broken. No matter how hard some countries try to.

Re:Outsourcing

[erroneus]

Yeah something of a double-edged sword there. Of course their argument is about knowledge and all that, but in reality, many outsourced jobs go to contract companies who then sell the jobs out to other, unknown entities. All the companies out there having things made by slave children invariably claim no knowledge based on these types of practices.

Also, outsourcing happens on our soils as well. I once spent some time with a company that sold our services to another company and the markup rate was 50% or more of what I was getting. I was rather disgusted at the notion. It was impossible for me to get that job, but by going through one of these companies, I could get it and there I was, "the same damned person."

But we people routinely get angry at people who do the very same things we do... or we simply get angry at the wrong people. Case in point: A guy finds his woman has been with another man. The guy gets angry and goes after the other man. Say what?! This guy is doing what pretty much every other guy would do when it's being made available to them. Why get pissed off at another guy who is doing what you would be tempted to do? I wouldn't. The real problem was the woman and sometimes she is blamed and other times even forgiven. Ridiculous.

So the business who is likely to outsource (call centers and stuff like that) finds one of its employees is paying someone else to do the work he was hired to do. On one hand, they shouldn't care. On the other, there are security concerns... sort of. If they thought he was a safe employee, they now know it was just an illusion like all of our other notions of being safe. (But we gave up our freedom, our right to self-defence and lots and lots of money to taxes and we're NOT safer? I'm shocked! Shocked I tell you!)

Well, there is certainly much to talk about with regards to this and a lot of perspectives to weigh in. But most of us definitely feel companies like Verizon 'deserves' this though it would only make a difference if most everyone was doing this... which they aren't. Can't be. So, kudos to the scammer. May he never be given another job like this or in the industry again. You are scum just like the companies who outsource our jobs. It doesn't make it right when you do it, any more than when they do it. That they get upset when someone did it to them shows perfectly that they know what they are doing and who they are doing it to. That they feel justified in doing it while others shouldn't just shows their hypocrisy.

Re:Outsourcing

[mwvdlee]

Also, outsourcing happens on our soils as well. I once spent some time with a company that sold our services to another company and the markup rate was 50% or more of what I was getting. I was rather disgusted at the notion. It was impossible for me to get that job, but by going through one of these companies, I could get it and there I was, "the same damned person."

If you would have gotten sick, died or otherwise unable to work, would you have been replaced at no additional cost?
If your expertise wasn't up to the required standards, would you have been replaced at no additional cost?
If you turn out to be a criminal, could they sue you for all damages or just a small fraction of it?
It's all about insuring risks.

Re:Outsourcing

[erroneus]

No it's holding women to a standard. It's not misogynist.

When a couple are in a 'relationship' it is an agreement of sorts that does not extend to the world. And if that agreement is breeched, only one of the two parties can be responsible for it. A third party cannot be responsible for breeching that agreement.

What I find to me extremely weird is the unexplained "lower standard" we expect of women. We don't expect them to keep their word or their promises or to keep secrets. We expect that it is somehow a woman's perogative to change her mind without cause, notice or explanation. I'm not sorry that I heartily disagree with this notion. Men and women are people and I hold them both to the same expectations of honor and integrity.

So once again, if a girlfriend cheats, I am not going to blame the handsome, charming stranger. I am going to hold her accountable for her actions. How is that misogynist?

Legality?

[Anonymous Coward]

Aside from the security issues, is such a thing legal in the US? I mean, are you required by contract to do the work you are paid for yourself?

Re:Legality?

[crizh]

Presumably the cost of the sub-contractor is deductible?

Re:Legality?

[Sique]

This is the mantra of civilization in general. One of the big advantages of being in a civilisation are the famous shoulders of giants. You don't need to invent a way to store speech in a durable way, you can use paper, pen and an alphabet. You don't even need to invent speech, you can use the language of your environment. You don't need to invent iron casting and forging, you can go to Home Depot and buy nails and screws. And yes, at first you look if you can borrow something (if it was in use before, it is probably usuable), then you look if you get it for free (with no guarantee that it works), then try to buy it somewhere and only if it is really not available at a price you see fit, you do it yourself.

Scams? What Scams? He was the MOST effective...

[Anonymous Coward]

Not only was he the most effective employee in the company but he was managing a successful software consulting service providing services to several other local companies. He delivered the goods. In fact he was more successful at managing software outsourcing than most large companies are.

Re:Scams? What Scams? He was the MOST effective...

[Anonymous Coward]

He probably was a decent coder because that it's ether random luck or he knew how to spot a decent/good programmer in the wild half a world away.

Re:Scams? What Scams? He was the MOST effective...

[Weezul]

Yes, I'd consider this a fairly good resume for managerial positions : Efficient, check. Benefitted employer, check. Dishonest, check. etc. He should simply continue with his contracting company providing developer services for clients. In fact, it's almost pathological that he chose to sit in an office all day while doing this.

But of course

[Anonymous Coward]

When corporations do it, it's efficient. When an actual human does it, it's a scam. Can this social order please collapse now? It's bankrupt.

Re:But of course

[FatLittleMonkey]

Nothing? Nothing?!

Sir, he was a Manager!

(He paid other people less than the work was worth, he routinely breached company IT security policy, and he spent all day watching cat videos. He was perfect. Give him fifteen years and he'll be CEO.)

Re:Hmm

[unix_core]

Maybe the guy in they fired in TFS is actually the guy who takes care of their database server.

Cheap Chinese Crap

[ebonum]

You know all the stuff from China is cheap and poor quality. Bunch of lazy communists over there... "best programmer in the building" Oh wait. Never mind.

Subcontracting

[Gabrill]

What's the problem? Does the employee contract have a clause against subcontracting?

Re:Subcontracting

[sesshomaru]

It sounds like it was an unauthorized access problem. Most companies you aren't allowed to let non-vetted people use their equipment or access their network.

Of course, if he had brought his idea to the company and they had liked it, they'd have said, "Oh, ok, we'll fire you and hire him for a lower salary. Thanks for the idea."

Re:Subcontracting

[L4t3r4lu5]

Not until a Chinese company starts offering this company's product at 1/5 the price.

Re:Subcontracting

[Yaa 101]

Yes, and he should have copied the environment that gave access to his subcontractors and make the copied environment update at his employers environment by scripting.

He was only half smart, his lazyness did him under.

I appaud his idea as he did the same that most corporations do, but he was sloppy doing it.

So, anybody got contact details...

[Anonymous Coward]

...for this contractor who produces clean code, cheaply, on time?

Just for...you know, research purposes.

The order of things

[Anonymous Coward]

The real (and scary) message here is that the best programmer in the building was a chinese working for 1/5th of the usual programmer's income.

Cheap, low quality asian workforce, indeed...

Google cache

[radio4fan]

google cache of page

Re:Error establishing a database connection

[vinayg18]

Or that Slashdot still has the ability to slashdot websites.

Google Cache

[twistedcubic]

http://webcache.googleusercontent.com/search?q=cache:EGh4ld_KwXUJ:securityblog.verizonbusiness.com/2013/01/14/case-study-pro-active-log-review-might-be-a-good-idea/+&cd=1&hl=en&ct=clnk&gl=us

Not news to me

[Anonymous Coward]

We did something like this more than 7 years ago.
"We" being a team of developers in Eastern Europe. Our employers were two brothers who had moved to the US and had found IT jobs. We did their work for them and had time left over for side projects. Our team of 5 people got some fraction or other from their regular salaries and it was still a good wage for us. Things have changed in the last couple of years, but not by that much.

Not scam

[gmuslera]

Was doing his job, and better than anyone else there. And got plenty of free time doing it that way, that is efficiency. If instead of coding letter by letter he took a public domain code (to avoid messing with licenses) that do the same would be a not so different situation, mainly changed the timing related the code.

But also gave to another party (that be the one that did his job is not relevant, that is overseas or in china in particular depend on your own prejudices) internal access to network/code/information without authorization. That is not scam, is a security breach, and shoudl be taken as seriously as all the other security breachs there (i.e. if he was so happy watching lolcats and visiting facebook and ebay probably others could have been doing it, and maybe sharing with the world even more internal/critical information, or downloading malware without being aware and so on)

The Onion knew it in 2009

[mseeger]

The Onion already knew about this back in 2009: http://www.youtube.com/watch?v=rYaZ57Bn4pQ

Idiot

[Migala77]

I've outsourced all my Facebooking, slashdotting and cat-video-watching, so I can spend more time programming!

I call bullshit.

[tofarr]

This story sets off my bullshit radar. Too many things about it don't make sense: 1.) Why would "Bob" give full access to company resources to subcontractors? Were I to subcontract a job, at the very least I would want to review everything before it was committed - especially if I was taking responsibility for it. 2.) What would happen if a colleague asked "Bob" about his code? Or as regularly happens on all but the smallest of tasks he had to collaborate closely with another fellow developer? There is a level of knowledge that you get from being part of a development process that you don't get otherwise. This sounds to me like an advertisement for outsourcing services.

Bellman

[water-vole]

The 18th century Swedish poet Carl Michael Bellman did something similar. The king of the time (Gustav III) liked his songs and gave him a really cushy job as head of the state lottery. Bellman new he would not be able to hold down a job so he employed someone else to actually do the work and he lived from the difference of what he got from the king and what he paid the person doing the work. He spent most of his time in pubs and wrote an enormous number of drinking songs. He is the Swedish equivalent of Robert Burns.

In the words of Steve Jobs

[moniker127]

Good coders copy, great coders outsource.

Monday is going to suck...

[ayahner]

When they realize they canned their "best programmer"

Of course, this is not unusual

[SmallFurryCreature]

Take music. The CD's are produced in China to lower costs, this is legal. You buy them from China, ILLEGAL PIRACY!

Outsource production, perfectly legal. Buy imports, pay max taxes including taxes on shipping PLUS a customs fee PLUS a fee for the shipping agency ON TOP of the shipment fee for it all... AND STILL it is often cheaper...

The global economy is there to benefit the rich, not the poor.

Re:Error establishing a database connection

[stoolpigeon]

It's front page at reddit right now as well I believe - and HN

So these arguments are bullshit....

[jkrise]

1. Programmers in the US are worth the money corporations spend on them.
2. China and India are full of crappy programmers who can't understand specs, cannot correspond in English, let alone produce quality code.
3. The value of the US currency is a true measure of its worth in global markets.
4. US corporations are killing US jobs despite the fact outsourcing produces lesser quality goods and services.

I know the plural of anecdote is not data, but still...

'Bob" is gone.

[andydread]

"Hello this is Joe, Bob's boss. Bob is no longer available to correspond with you on this project. I will be handling all correspondence with you from now on. I will be responsible for sending the payments of the sum that you and Bob agreed to. You can contact me at joe@dev.verizon.com ...."

Therefore outsourcing doesn't change the price.

[Anonymous Coward]

If mfg CDs is a fraction of the cost, then doing it locally in a more expensive job market won't increase the price of the CD much, will it.

UMAD? employer's just jelly.

[Thud457]

This sounds like something Wally from "Dilbert" would do.

When An Individual Does This, It's Fraud

[Jeremiah Cornelius]

When a corporation does this?

Good stewardship of shareholder investment.

Make the corporation illegal!