Outsourcing Your Job

I wonder if the company hired the guy in PRC who was doing his coding. Also hopefully he wasn't watching videos of cats destined for the dinner table.

http://news.msn.com/science-technology/man-outsources-his-own-job-to-china-watches-cat-videos

Man outsources his own job to China, watches cat videos

A software developer for a U.S. company paid a fraction of his six-figure salary to a contractor in China to do his work, then spent the bulk of his workday surfing the Web.

By all accounts, Bob was a model employee, a software developer who consistently wrote clean code for his company and never missed deadlines. Then investigators found out it wasn’t Bob who was doing his job.

Turns out Bob had outsourced his work to China, paying a lowly overseas surrogate a fraction of his six-figure salary to do his 9-to-5 job. All the while, Bob sat at his desk, pretending to be busy while actually surfing the Internet, updating his Facebook page and watching cat videos.

Bob isn’t his real name, but his story is real, says Andrew Valentine of Verizon’s RISK team, which uncovered the elaborate workplace scam for a business client described only as a “U.S. critical infrastructure company."

“Every now and again a case comes along that, albeit small, still involves some unique attack vector – some clever and creative way that an attacker victimized an organization. It’s the unique one-offs, the ones that are different that often become the most memorable and most talked about amongst the investigators,” Valentine writes this week on the Verizon RISK team’s Security Blog.

The scam was uncovered in 2012. According to Valentine, here’s how it went down:

The U.S. company called in Verizon security investigators after noticing some unusual activity on their VPN, or virtual private network, logs. VPNs allow employees and companies to share and access information from any computer anywhere.

The company was startled to discover that someone appeared to be accessing the network from Shenyang, China, while the worker whose credentials were being used was sitting at his desk in the office.

“Plainly stated, the VPN logs showed him logged in from China, yet the employee is right there, sitting at his desk, staring into his monitor,” Valentine writes.

The company initially suspected a hacker.

Related: Homeland Security says criminal virus shuttered power plant

Verizon investigators noticed that the network connections from China were happening almost daily, and occasionally lasted the entire workday. They turned their attention to Bob.

They examined the data on Bob’s computer and hard drive and found hundreds of PDF invoices from a third-party contractor/developer in Shenyang.

“As it turns out, Bob had simply outsourced his own job to a Chinese consulting firm," Valentine says. "Bob spent less than one-fifth of his six-figure salary for a Chinese firm to do his job for him. Authentication was no problem, he physically FedExed his RSA token to China so that the third-party contractor could log-in under his credentials during the workday. It would appear that he was working an average 9 to 5 work day. Investigators checked his web browsing history, and that told the whole story.”

A typical "workday" for Bob, according to investigators, looked like this:

9 a.m. – Arrive and surf Reddit for a couple of hours. Watch cat videos.

11:30 a.m. – Take lunch.

1 p.m. – EBay time.

2 p.m.-ish -- Facebook updates, LinkedIn.

4:30 p.m. – End of day update e-mail to management.

5 p.m. – Go home.

It was the last thing his bosses suspected of Bob, described as a skilled software developer in his mid-40s who had been with the company for quite a while. He was “a family man, inoffensive and quiet,” and “someone you wouldn’t look at twice in an elevator.”

His employer wasn’t the only one Bob fleeced. Verizon investigators uncovered evidence that he had the same scam going across multiple companies in the area.

The best part?

“Investigators had the opportunity to read through his performance reviews while working alongside HR. For the last several years in a row he received excellent remarks. His code was clean, well-written, and submitted in a timely fashion. Quarter after quarter, his performance review noted him as the best developer in the building.”

Bob, of course, no longer works for the company.

His workplace antics drew stunned and amused reaction from readers of Valentine’s blog post.

“This is nearly unbelievable. Is he overpayed or are the chinese underpayed?” one reader wrote.

“Sounds like someone read ‘The 4 Hour Work Week’ and decided to try it out,” wrote another.

One reader called Bob “an American hero” for his work savvy. “Sooo… where’s the problem? He improved his personal profit and the quality and efficiency of his work, obviously. And all that by using standard business practices – get money to do the job, then pay someone else less to actually do it,” the reader wrote.