Maryland man pleads guilty to outsourcing US govt work to North Korean dev in China

A Maryland man has pleaded guilty to fraud after landing a job with a contractor working on US government software, and then outsourcing the work to a self-described North Korean developer in China. Minh Phuong Ngoc Vong is a Vietnamese-born naturalized US citizen. He recently pleaded guilty conspiracy to commit wire fraud for …

[David 132]

Interviews??

FTA: "...qualifications Vong did not possess. In reality, he worked at a nail salon in Bowie, Maryland. Vong participated in multiple job interviews to land the position..."

Vong did the interviews? Or his North Korean alter-ego did them? Because I can't quite see how a nail salon worker whose claimed experience/qualifications were made-up, could then ace a live interview for a government software contractor. Hell, I did several interviews when I was recently job-hunting in the IT field, and the questions I was asked tended to be a little more challenging than "what oil is best for softening cuticles / how long does gloss lacquer take to harden". Perhaps it's different for government contractors, though? :)

[Anonymous Coward]

Re: Interviews??

Bear in mind the interviews were with a government software contractor, not a direct hire. The hiring company clearly didn't care so long as it raked in its cut.

[trindflo]

Re: Interviews??

Make me think the interview process was similarly outsourced.

Doesn't "Full Stack" mean we actually need a team, but aren't willing to pay for one? You just handle all the messy details and we'll take care of the profits?

[HuBo]

Re: Interviews??

Well, nail salon workers (and even kindergarteners) can now autowrite 20 to 40% of Microsoft's new code using girthy languagerie models so, no real sweat there ... after passing the online interview (teams, zoom, ...) with access to ChatGPT/Voice.

So Vong coulda done his dirty deeds, dirt cheap, with such easy bake oven tool too. But as this case involves a remote North Korean (in China), Vong's LLM would have also needed to be a properly backdoored one, that he'd use willfully through his deviances.

That makes Vong a traitor in my estimation, or an unwitting tool at best.

[ChrisElvidge]

Outsourcing

Not for the first time actually.

But, if a company can do it, why not an individual?

Could he set himself up as a company and then outsource development?

[An_Old_Dog]

Re: Outsourcing

@ChrisElvidge:

No, because

1. of national security concerns. (Though the government is delegating too much security-checking and not meaningfully-following-up on delegatees.)

2. while companies are generally, legally are allowed to outsource their stuff, no laws and enforcement thereof have been put into place to protect individual employees who outsource their jobs. The few employees who have done this and been caught have been fired with no protection from being fired for having outsourced their jobs.

3. Similarly, an unspoken-of-in-public reason for return-to-office mandates is to prevent workers hired in high-cost-of-living areas, with commensurately-high salaries, from moving to Cheapville, remoting in, and pocketing the cost-of-living differential.

[that one in the corner]

Outsourced - but fraud?

Did the older clients get (any of) the code/systems that they paid for?[1] If so, how are they relevant to the case?

As noted above, outsourcing is hardly a new idea[2].

Lying on - sorry, embellishing a - CV is hardly breaking news, otherwise many more recruitment agencies would be in the clink. Verifying such things is supposed to be a normal part of the hiring process, especially for any important defense-related contracts - isn't it? Is anyone getting slapped wrists for mising that bit of due diligence?

The main issues here seem to be about breaking security and access rules - assuming the contracts actually said "Thou shalt not install remote access on this, our laptop", that is.

Not saying that he isn't a very naughty boy, but there are gaps in this story.

[1] Or, at a minimum, did they get whatever their contract stipulated before pulling the plug - e.g. if they paid for a report that described whether or not this contractor could complete the entire system and two months later got back a one page saying "no!", then they do have what they paid for!

[2] I know we are not supposed to reference Dilbert these days, but there was a good one about PHB outsourcing some work, as it was cheaper than paying Dilbert et al, until their company put in the lowest bid for a job which turned out to be the same task, now four or five levels of outsourcing deep.

[David 132]

Re: Outsourced - but fraud?

> Lying on - sorry, embellishing a - CV is hardly breaking news

As I read somewhere recently, and indeed may have already quoted somewhere else on this site...

Me in real life: "I flip burgers at McDonald's and in the evenings, play XBox."

Me on LinkedIn: "I deliver personalized solutions in the competitive and challenging retail nutrition segment, and in my free time investigate and evaluate artificial virtual environments"

[cuthbertgraak]

Re: Outsourced - but fraud?

A friend once interviewed someone for a mainframe development position. The interviewee claimed to be a "petroleum transfer engineer" looking for an IT job. My friend later found out that the interviewee pumped gas at a local gas station.

Needless to say, the interviewee didn't get the job.

[Anonymous Coward]

Corporation

There are ways and means to use cheap labour, first you have to be a major corporation, then you have to present significant cost savings for the government and how it will still be secure. Some individual can't offer lucrative private sector career opportunities to government officials.

OK I only half mean it. Generally governments don't like outsourcing anything near sensitive to non-aligned countries. However, I would suggest that unless the infrastructure is carefully isolated nothing should be used from outside the country itself. That should apply to critical infrastructure too. The specific piece of software might not be critical but it might become a backdoor if carelessly located and connected.