I Worked for a Criminal Organization

https://openmonstervision.github.io/blog/posts/that-time-i-worked-for-criminals/

by bsdpunk • 6 years ago

264 226 6 years ago

openmonstervision.github.io

htfu• 6 years ago

Interesting read! Sounds like however it turns out... they had it coming.

How common are setups like this, anyone know?

fxtentacle• 6 years ago

You have an interesting writing style, describing your experience as if you're watching the weather drift by.

theawesomekhan• 6 years ago

True, he writes blissfully

ikeboy21• 6 years ago

They insisted I never talk to any LEO

Nothing wrong with this ...

PTR records, Enabling Spam

Doesn't say why that's illegal. At best it says they had customers that broke the law.

Often both the CEO and Vice President would talk openly about how one of our clients was violating the TOS of several companies.

Not criminal even for the client, at least assuming the HiQ v Linkedin case is upheld. And not illegal for the company. Maybe civil liability under tortious interference? Pretty high bar there, though. And that's all assuming there's an actual ToS - the one example given is of Google search results. Manipulating your own website in the hopes Google treats it favorably can't be seen as violating any agreed ToS.

The stuff Micfo was accused of in court, and the stuff OP is claiming are criminal acts, are disjoint.

ghostbrainalpha2• 6 years ago

At best it says they had customers that broke the law.

Did you see the part at the top where the CEO admitted to being all of those "customers"? They were playing a shell game, and while this guy didn't do the criminal activities he definitely was working for the "legitimate front end" of a larger criminal organization.

ikeboy21• 6 years ago

I read the entire post. Can you please quote the part you're referring to?

busterarm2• 6 years ago

Even if you take the OP at face value, they're an unreliable narrator at best.

They have questionable character and moral standards by their own admission. That's before even considering the effects of their mental illness.

I would never hire this "perpetually unemployed" person. Everything they say points to something being off.

kevin_thibedeau• 6 years ago

So 1%'ers can use shell companies to get what they want, but ordinary corporations can't use their free speech rights to spend money for the same?

blincoln• 6 years ago

> They insisted I never talk to any LEO
Nothing wrong with this ...

Depending on where they're located, failure to report certain types of crime to law enforcement may itself be a crime.

hrktb• 6 years ago

Reporting the issues to the legal department, which then deals with it could be a ways around this.

For blatant issues (i.e. there's a dead body) you'd still be expected to act on your own, but on any greyer area you'd be covered.

dannyw• 6 years ago

In many, if not most companies, taking legal matters into your own hands without involving your company’s legal team will surely get you reprimanded if not fired.

Just like how you would get fired if you sent out a legal demand letter to another company without legal being in the loop. Law enforcement is no different: they are not your friend.

preinheimer• 6 years ago

So Micfo was one of our suppliers, they remain the only one to have mailed us chocolate at Christmas.

The chocolate wasn't great, but it's more than any of our other providers have mailed us :).

dang• 6 years ago

This is related to https://news.ycombinator.com/item?id=22354357.

hackermailman• 6 years ago

Not uncommon in some cities in Canada to find out you're working for a criminal outfit if writing point of sale/restaurant software where they want you to produce one receipt for the customer and a different one for the restaurant or salon or shady car mechanic that then pockets the unreported tax aka a 'zapper'. Profitek was busted once, InfoSpec Systems, zappers are in high demand

frandroid• 6 years ago

No wonder the Québec government swooped in and mandated a government POS terminal for the food service industry. :)

stef25• 6 years ago

They did that here in Belgium too. Didn't take very long for one of the few official manufacturers of said terminals to jailed after presumably installing a few custom features.

cat199• 6 years ago

government POS terminal for the food service industry. :)

and how did procurement for that contract go?

nitrogen• 6 years ago

Are these used to inflate records of customer bills for laundering, or to deflate customer bills for tax fraud?

didericis• 6 years ago

pockets the unreported tax

I’d assume tax fraud is much more common than money laundering. Maybe drug dealers and the like create enough of a market for “reverse zappers” to exist; not sure.

gruez• 6 years ago

where they want you to produce one receipt for the customer and a different one for the restaurant or salon or shady car mechanic that then pockets the unreported tax aka a 'zapper'.

Isn't this super easy to discover if you use any sort of electronic payment? Salons and restaurants might be cash based, but who pays their mechanic in cash?

samplatt3• 6 years ago

A lot of non-regular-maintenance jobs are easy & quick to do but break the law - for example, deleting the catalytic converter or EGR from the exhaust system will give your engine better performance and economy, but is illegal since it increases emissions.

Lots of places will do it anyway on a cash job if they think they can get away with it, because it's relatively easy money. A shop replaced my failed catalytic converter ($1200+ replacement) with a straight pipe ($20 pipe and $200 of time) many years ago because they (correctly) assessed me to be a broke-ass student who wouldn't tell on them.

vl• 6 years ago

But how exactly are you going to discover it? If transaction is deleted from the local log, you need to subpoena all payment processors and cross-reference, which takes non-trivial amount of effort.

I new a guy who was developing hacked firmware for POSes in the 90ies. One of the cool features he had is that at the end of the day the owner could unlock secret mode, enter amount of sales he wanted, and POS would create entire fake log spaced through the day and print it on tape, update electronic counters and then lock, and again behave like normal terminal ready for inspection.

PappaPatat• 6 years ago

My first sale of my selfwritten software (about 35 years ago) was for a car driving instructor. The initial sales conversations where difficult. I thought they did not see the advantages of having their planning & bookkeeping in a computer...

How wrong I was. It was their "creative bookkeeping" that worried them. When I offered to make that all possible ('zapping' as it is called now), they loved it. Based on their referrals I sold it many times over.

Come next customer / market: bookshops. Guess what the most important selling argument was, besides easy cataloging, inventory, searching, website publishing and reporting? Right: zapping.

Thought me an important rule: do not underestimate what your customer is NOT telling you.

skrebbel• 6 years ago

Did it bother you that you were facilitating crimes?

iovrthoughtthis2• 6 years ago

Ethics. Where were yours?

jackcodes• 6 years ago

I know that taxes ultimately don’t result in lost schools and hospitals, as it’s never that 1:1, but do you ever think you could have cost your country a hospital, a new road, or a new warhead or whatever?

Aqueous• 6 years ago

seems like you were and are helping your customers commit tax fraud and should stop

tyfon4• 6 years ago

I assume it is common to report the company to the authorities when a request like that comes in?

Where I live at least not reporting activity like that could result in a few years in jail.

badpun2• 6 years ago

In Poland you're only required to report a crime if you're a civil servant and the crime is related to your job.

dcustodio• 6 years ago

Years ago the Portuguese government encouraged consumers to submit their receipts in a portal and each submitted receipt was a entry to a raffle where the prizes were luxury cars. This way they could match the receipts from consumers with the ones reported by the shops. It felt wrong to put citizens policing the shops but it worked.

kaybe• 6 years ago

Taiwan does that too. If you leave the country you can drop them off at one of the charity boxes using it for income.

jonathanstrange• 6 years ago

The system still in place, if I'm not totally mistaken. (I haven't checked, because I usually don't give away my tax number for sheer laziness - I still don't know it by heart.)

severak_cz• 6 years ago

we have something similar in Czech republic. It's called Účtenkovka (receipt lottery) and some con men discovered it and started their scams there.

endorphone• 6 years ago

I remember visiting Italy and we were warned repeatedly to always take and keep receipts, even if just getting a gelato -- that after the transaction the police could demand it, with punitive measures if you don't have it. This system was to ensure that shopkeepers were actually keeping receipts.

The GST/HST system in Canada sort of serves the same purpose. It is an overarching tax system that seems redundant in that every business then can claim back every bit of GST they've paid out. But to do so you have to have receipts for everything, from every source, and when they randomly do an audit they aren't checking you as much as they're building a profile of every other business you interacted with.

Tax avoidance is a problem in every country.

breischl• 6 years ago

At a different level that's part of the reason receipts exist, and why you occasionally see things like "if we don't give you a receipt your order is free."

In those cases it's typically about preventing the employees from not ringing up the sale and just pocketing the cash. The receipt proves that the order was entered into the system. Same idea, just a difference of who's stealing from whom.

Hm, I suppose that scam is less of a problem in the era of credit cards.

hawkice• 6 years ago

I resigned from a software development job after being asked to write this dual receipt system for an AdTech company. Works for a lot more than tax avoidance in an industry where standard terms are revenue share agreements.

auxym2• 6 years ago

Are you implying this only happens in Canada? If so, why is that you think?

Genuinely curious, if the US has managed to implement effective anti-tax avoidance solutions, could they be implemented here?

dspillett• 6 years ago

Are you implying this only happens in Canada?

I read that as the OP saying they had specific experience/knowledge of it happing there, rather than intending to imply it happens there more than anywhere else.

mozey• 6 years ago

Lol, in South Africa we have a mobile payments app called "Zapper"

Koremat66663• 6 years ago

May be I missed it but can someone tell me what was the crime the company was committing ? Almost any company will have defensive strategies such as stalling LEOs and Warrants in whatever way they can. A lot of this is not really "crime" as in kidnapping people or shooting people dead in some alley.

Is having shell companies a crime ? I know a ton of bay area "startups" than engage in these sort of tricks to maximize the brand damage. Ask.com and other toolbar companies are great examples where they will just rebrand the same toolbar as X and sell it to 10 companies which were owned by same entity. Half the companies with "explosive" growth were using mass mailing techniques than involved spamming. Many used foreign companies to skirt US law related to spamming.

I think author is overthinking.

ikeboy21• 6 years ago

See my comment at https://news.ycombinator.com/item?id=22361670

None of the things mentioned here are crimes, as far as I can tell. The crime they were actually charged with was using these shell companies to get more IP addresses than they were "entitled" to get. See the indictment at https://www.courtlistener.com/recap/gov.uscourts.scd.250342/...

saber67• 6 years ago

[...] as far as I can tell.

It appears the law in this case feels differently.

The owners claimed under legal penalty that they had certain assets (paying customers, needs for IP addressing, etc). These statements appear to have been completely false. Thus, the trial.

And yes, lying to ARIN (or any RIR) about your customer base (need for IPv4 addressing) is just plain crappy. IPv4 addressing is a common resource - a 32-bit fixed address space - similar in concept to physical frequency allocation by the FCC.

There are 4.2B IPv4 addresses (minus some for RFC1918 and MCAST, etc). To lay illegitimate claim to them is really wrong, and more importantly, legally risky now.

dylan604• 6 years ago

Every time I sign up for any kind of banking service (loan,credit,checking,etc), there's a note about by signing the document I am acknowledging that providing false information would be a bad idea. How is it not fraudulent to deceive potential investors by using false user data/stats? I've never read any investor agreements, but I'd assume there's some sort of similar statement/clause.

sneak2• 6 years ago

Thing is... you don’t “get” an IP address. Having ARIN reserve you a netblock in their database doesn’t get you anything that you didn’t have prior to them doing that.

IP “ownership” is not a real thing.

dragonwriter7• 6 years ago

None of the things mentioned here are crimes, as far as I can tell

The fake “Channel Partners” addressed in the article are paragraph 4 of the indictment. The article addresses some of the mechanisms by which they were used to evade legal process for the purpose of concealment, the indictment deals with the fact that they were used for that purpose. It seems preposterous to view those as unrelated.

pdm55• 6 years ago

In support of your comment:

"As Micfo amassed VPN clients using the illegitimately-obtained IP addresses, a lot of traffic — some being criminal — filed through its network without a trace, according to government subpoenas directed at Micfo and reviewed by The Wall Street Journal.

Golestan and Micfo are not charged with being part of or even aware of illegal activity transmitted via VPNs across Micfo’s servers. The DOJ charged him and the company with “defrauding the internet registry to obtain the IP addresses over a period of several years.”

Prosecutors said Golestan’s alleged scheme was valued at $14 million, which was based on the government’s estimated value of between $13 and $19 for each address in the secondary market, according to the court complaint.

Born in Iran, Golestan, 36, started Micfo in 1999 in the bedroom of his childhood home in Dubai before emigrating to the U.S." https://www.pymnts.com/innovation/2020/secure-smart-cities-c...

dragonwriter7• 6 years ago

May be I missed it but can someone tell me what was the crime the company was committing ?

From the description in the article, obstruction of justice, at a minimum, possibly also with the intent of furthering other crimes and civil wrongs by the firm or it's customers.

Almost any company will have defensive strategies such as stalling LEOs and Warrants in whatever way they can.

Many companies will do anything within the law to do this, which is, of course, not a crime. But “whatever way they can” is a crime.

A lot of this is not really "crime" as in kidnapping people or shooting people dead in some alley.

Yes, obstruction of justice is a different crime than murder or kidnapping. It's just as real of a crime.

Is having shell companies a crime ?

No, but using them fraudulently can be a crime and/or a civil wrong, and which has been involved in both civil liability already established against the firm and CEO in question and which is seems to be a key part of the mechanism of the fraud involved in the 20-count federal criminal indictment against them. [0]

[0] https://www.wsj.com/articles/fraud-case-in-charleston-s-c-sh...

Spooky232• 6 years ago

Fraud.

You didn’t miss it. Everything after that first question were excuses for why it’s ok to break the law.

Karishma1234fff• 6 years ago

Which law is being broken? Also (in my personal opinion) criminality should be obvious to a general person, some kind of complex technical illegality may not make the whole company a "criminal organization". A lot of reputed companies like Google get fined on regular basis world over does not make them criminal organizations.

A lot of companies would also willingly break the law depending on the risk tolerance they have, many of those laws result into civil penalties and not jail time for CEO so that also matters.

I was genuinely hoping OP worked from some underground enterprise that provided hitmans to rich people or something. La John Wick style. But thats just the romantic in me.

rblatz• 6 years ago

I read a few other posts on the authors blog and I think overthinking is a common issue for them.

The strangest one was they flew in for an interview the night before, got settled in at 11pm and decided not to sleep because they had to check out at 9am.

normalnorm3• 6 years ago

Am I the only one getting depressed with all the excuses and rationalizations in this thread? It's the same with "adtech" and the like... "Hey, I'm not killing anyone, what's the harm?"

Technology has the potential to raise humanity above its current conditions and limitations. But we can't have it, because we are selfish and short-sighted monkeys. Take a big dump on all the ideals if this delivers the paycheck. "Business" justifies everything. Fuck humans.

A global instantaneous network of information exchange? Let's turn it into a dystopic market of bullshit covered in distasteful advertising, Idiocracy-style. AI breakthroughs? Will help make the Skinner box much more effective! A search engine capable of finding any public piece of information in human record? Replace the entire thing with ads in disguise! Still, autocratic regimes want to censor some of the ads? Can do, they are a huge market!

Space programs? Canceled. We now have a Rube-Goldberg machine made of human suffering that can deliver whatever trinket you want the next day to your door, nicely package in a cardboard box with a corporate grin printed on it. But don't worry, some guy who sells cars is taking us to Mars or something.

Fuck all this.

TeMPOraL11• 6 years ago

You're not the only one. And don't even get me started on adtech. I share your sentiment 100%. See [0].

[0] http://jacek.zlydach.pl/blog/2019-07-31-ads-as-cancer.html.

polymatter• 6 years ago

fwiw I also agree entirely.

Ragnarork• 6 years ago

No you're not the only one.

I find especially baffling the rationalization over the type of crime. You don't need to physically harm someone to be committing a crime, and there's a lot of different crimes that happen in paper and/or bytes that don't (directly) physically harm people.

That doesn't make them right or okay by any means.

Shacklz• 6 years ago

Thanks so much for calling this out, including the coarse language used, because in my opinion, it's really warranted.

We could do so many good things with technology, instead we use it more and more for bullshit to maximize profits instead of maximizing social value. It really is depressing really.

amelius• 6 years ago

Imo, the basis of the problem is that we look at the GDP as a major health indicator of the economy, while this works against the idea that we should be consuming less, not more. From this follows adtech, and indirectly people being rewarded for doing stupid stuff.

nkrisc2• 6 years ago

The issue is when people try to stack-rank the "badness" of crimes. "Is bankrupting a thousand people through fraud worse than killing someone?" The answer is: it doesn't matter which is worse. Both destroy lives in different ways.

Fraud and spam are crimes that ruin lives in their own ways.

ikeboy21• 6 years ago

To be clear, my comments were pointing out that what's described was not criminal. I didn't take a position on what's ethical or not.

That said, I think helping VPNs is a good thing ethically. If he'd been arrested for running a Tor node that was used to download child pornography (which has happened), I suspect most people here would defend him.

Helping spammers is bad, but, at least as described by OP, not illegal.

Koremat66663• 6 years ago

Let's turn it into a dystopic market of bullshit covered in distasteful advertising,

I mean absolutely no disrespect to you and I understand your feelings are probably coming straight out your heart. However I would like to point out that when you say that the world does not meet your expectation and that somehow is a problem with the world and not your own self is very arrogant.

But we can't have it, because we are selfish and short-sighted monkeys.

These distasteful comments about fellow humans are nothing but the same arrogant thought process that has caused havoc around the world through ideologies like communism and colonialism. It reeks of Rudyard Kipling's disgusting poem "White man's burden". Without knowing you are claiming that you have the power to know what is good for world and you only need power to fix it. In this process you actually get depressed. You are describing the world as "Fuck all this."

TeMPOraL11• 6 years ago

I know a ton of bay area "startups" than engage in these sort of tricks to maximize the brand damage. (...) Half the companies with "explosive" growth were using mass mailing techniques than involved spamming. Many used foreign companies to skirt US law related to spamming.

Yes, I think we all know some. And it's true, skirting the law and abusing the commons gives one a competitive advantage. But that doesn't make it OK. The market isn't the arbiter of ethics. It only means that not enough is done to stop that behavior, that the border between legal and illegal is too low, or too misaligned with what's actually happening. That people still underestimate the extent to which money trumps ethics in everyday decision making.

speedplane6• 6 years ago

skirting the law and abusing the commons gives one a competitive advantage. But that doesn't make it OK. The market isn't the arbiter of ethics.

Sadly, this is a bit naive, market have become the arbiters of ethics, namely: if it successful, it's good.

This isn't a traditional moral code from, e.g., Kant, Bentham, or Locke. Rather, it's an ethics based on capitalism.

Sure, wonky economics professors justify capitalism by saying it's the most efficient or provides the most utility, arguably grounded in traditional Bentham morality.

But capitalism has never simply been an economic policy, there has always been an ideological component to it (see for example, Ayn Rand). Maximizing returns on investment isn't just "efficient", it's "right".

walrus01• 6 years ago

Man, screwing with ARIN seems like a really dumb idea. They're located in northern VA and their leadership team has direct contacts at places like the US district attorney's office, and FBI. Some of the internet grey beards who know the ARIN leadership are well connected in the parts of the US government responsible for "cybersecurity".

People at ARIN also have 20+ years of experience identifying shell games.

nyolfen• 6 years ago

wsj writeup: https://www.wsj.com/articles/fraud-case-in-charleston-s-c-sh...

Causality1• 6 years ago

The only substantial difference between this company and, say, Facebook, is that Facebook generally knows how to budget properly. Facebook and other large successful companies try to only commit crimes when they know the profit from doing so exceeds the risk of being caught and punished.

goatinaboat• 6 years ago

Facebook and other large successful companies try to only commit crimes when they know the profit from doing so exceeds the risk of being caught and punished.

Indeed; when I clicked the story I expected it to be about working for a FAANG.

speedplane6• 6 years ago

Facebook and other large successful companies try to only commit crimes when they know the profit from doing so exceeds the risk of being caught and punished.

While this statement is often true (big companies make these cost-benefit decisions), I don't think it really captures what is happening to Facebook. Doing a cost-benefit analysis like this requires having data on potential costs and benefits. In most cases, Facebook didn't have this data.

When an individual, company, or institution is faced with a decision, but lacks data to properly evaluate it, they fallback on other decision making tools, including instinct and principles.

Facebook almost certainly didn't know the consequences of the many decisions they made, they didn't know the potential costs or benefits. But they did have some underlying principles, namely: maximizing platform engagement, convincing people to share more personal data on their platform, and exploiting user data for better advertising.

With these foundational principles, you can end up making some really bad decisions even without a proper cost-benefit analysis.

heisenbit• 6 years ago

Well FB

- lets you sign a waiver that you are willing to receive spam

- ensures that you sign with your real name, not a shell

- are not a helpless child that can be endangered

This together guarantees that neither a crime is committed nor enabled.

CKN23-ARIN• 6 years ago

Court documents from the ARIN case: https://www.courtlistener.com/docket/15619663/oppobox-llc-v-...

From the criminal wire fraud case: https://www.courtlistener.com/docket/15619660/united-states-...

blackrock• 6 years ago

Geez. I wonder if working for a porn hosting company is better.

I’d rather not work for either, but if you’re not in a hot tech area, then your choices are limited.

toyg• 6 years ago

Sometimes I find myself thinking that working in porn could actually be pretty interesting - what with massive caching needs, video encoding etc etc... Unfortunately the few job ads I’ve seen were for super-boring stacks like PHP or Perl, which I’d rather avoid.

Cthulhu_• 6 years ago

Definitely, I'm convinced that a lot of people that made youtube and other video hosting sites work in the early days actually came from the online porn industry.

wappayment• 6 years ago

A few years back i used to work for a porn company and they are not.

There is an old protocol still creeping around smartphones known as WAP Payment (yes that WAP) which was/is used to buy stuff on the mobile web and the purchase shows up on your phone bill.

They buy all type of mobile ads (banner, text, popup, modal, etc.) and when you open the ad you get billed 4€, 5€, 6€ per week or month, without any confirmation whatsoever. Some phone carriers ask for user input (mostly the user has to click a button "I agree") but that's where click-jacking, CSRF and other kind of exploit comes in, very few ask for a confirmation code.

The sad thing is that they know, the carriers know but they don't care, until enough people complain about it then they shutdown the service to that website for a few days (in some cases they shut it down permanently) but they always come back online.

P.S. this is a throwaway account

alexcnwy• 6 years ago

Epic

apache99• 6 years ago

I also love Canadian Hip Hop. Especially from Torronto. Casper TNG is really cool

Izmaki• 6 years ago

Honestly I expected worse. But then again if it was, writing about it would probably be a felony on its own.

I Worked for a Criminal Organization

Related Stories