Transcription performed by LeahTranscribes[START OF RECORDING]
JACK: I remember this one time I really botched a job interview. I was young, in my early twenties, and I applied to do surveillance at a casino. You know, the eye in the sky; watch twenty monitor screens at once and try to find someone cheating or stealing things in the casino and then call the security guards on them? Well, I got an interview with the head of casino security, and things were going well. We hit it off and he liked my resume, but then he asked me one last question. [MUSIC] If you saw me stealing in the casino, would you turn me in? Now, I was dumbfounded by this question. What is this, some kind of ethics test? I mean, he’s the head of security. If I saw him stealing, who would I even report it to? I was baffled on how to answer this. But I wanted this job bad, and so, I did a whole bunch of mental gymnastics to try to read his face and see what answer he wanted. I mean, the first thing that popped into my mind was that quote from the Godfather. Here, listen. MICHAEL: You’re my older brother and I love you, but don’t ever take sides with anyone against the family again.
JACK: Don’t take sides against the family. Who do you think started the whole casino business? It was mobsters. So, what did this head of security cherish more, family or the law? It’s an impossible thing to answer. I felt as if I was on the poker table going head-to-head with him, trying to read what cards he was holding, and my job was what was on the line. Well, I blurted out, of course I wouldn’t turn you in; you’re my boss. With that, he stood up and said, thanks for coming in, but we’re looking for someone else. Good luck. And he reached out to shake my hand. I quickly realized my mistake. Taking the family’s side was the wrong answer. It’s the definition of corruption. Even if he wanted me to always protect the family, this was just too soon of a test to ask me something like that. I wasn’t part of the family yet. Siding with him was taking sides against the casino itself, and if he was actually corrupt, he wouldn’t show his cards like that so early in the first interview with someone. So, I reversed my position. I shouted, no, no, no, I would definitely turn you in; the casino is who I work for, not you. He smiled and shook his head and walked me to the door, and said, better luck next time, kid.
(INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS]
JACK: So, let’s start out with who you are. What do you do?
CONNOR: Yeah, so, I’m Connor Tumbleson. I’m a engineer here in Tampa. Really gone up the steps over the years. I think I’m – I’m our Director of Engineering now, so I do a lot of tech stuff.
JACK: The main thing to know about Connor is he spent years in the tech industry. He’s a great programmer, which has led him to become a director of engineering, and he’s content in his current role. He’s definitely not job-seeking. However, his resume is pretty nice and he’s got a whole list of skills under his belt, and he has a great GitHub. GitHub is a place where people go to share programming code they made, and Connor has wrote a lot of code, so Connor has published a lot of this code to GitHub for other people to see. If you go there, you can see what code he’s been writing since 2011. In fact, he’s posted new code 51,000 times over the last twelve years. What’s interesting about GitHub is you can go back through those years and see every line of code that he shared and what date he shared it. Okay, September 14, 2022, you get an e-mail.
CONNOR: Yeah, it’s crazy. I’m sitting at lunch and – your phone goes off, and I get one of those weird subject titles that I think is just an easily deletable one. I think it word-for-word was something like, Connor, your identity is stolen.
JACK: [MUSIC] It does have a spammy taste to it, doesn’t it? I think I’ve probably gotten spam like this before. You know, click here to see if my identity is stolen.
CONNOR: I was like, yeah, this is probably spam because it came from an address I didn’t recognize. It looked like a bunch of foreign characters I didn’t recognize and I was like, alright, this is a delete. But then, before I deleted it, I saw it had an attachment. I was like, okay, I’m on my phone; this is a – I think probably an easy preview, especially since it was a suspect e-mail. But thankfully I could just preview it and I previewed it, and it was my resume, but it wasn’t. I was like, this is really odd.
JACK: The e-mail was from a guy named Andrew, and Andrew was also a programmer, but he’s just starting out in college and has only posted a little bit to GitHub. Andrew said someone found him and messaged him on GitHub and offered him a job, but when Andrew asked more questions about the job, he was told he had to act like Connor to get the job.
CONNOR: I kinda just quickly ate my lunch and ran back to my computer and jumped on to view it in Gmail. At that point, when I expanded it for real, I saw it was way more than my resume. It was an introduction of me from a – it was really rough reading it from the very first inspection ‘cause it was someone trying to pretend they were me. ‘Cause not only was the e-mail just clearly wrong, but the address was a address that was for sale on Zillow kind of right around where I live. Then it was my resume, then it was information about a company, and then it was information of a fake cover letter I wrote. [MUSIC] At this point, I’m thinking holy cow, what is going on here? ‘Cause now I think this is actually legitimate, because there’s someone that has put a great deal of effort into taking a lot of my true, earned achievements –whatever; school, everything – but then mixed it with a bunch of things that are lies, which I think, funny enough, boosted my resume in a way. But yeah, they weren’t true. It was just a mixture of lies and truth in a huge document.
JACK: Okay, wow. They took Connor’s real resume but changed just a few things like the e-mail address, physical address, and few other accomplishments. But all this sounds really spooky. I mean, to get an e-mail from someone explaining all this? The person sending the e-mail could be trying to help or they could be trying to scam Connor into paying them to scrub this information off of some website or something. What was the real intention of this Andrew guy who e-mailed him?
CONNOR: Yeah, so, it was weird; he was telling me that there was this guy, Maris, and this – a guy that was hiring him to be an engineer. I was like, okay, what does that have to do with me? Then he says in the next sentence in the e-mail – he’s like, it turns out I was supposed to pretend to be you and I didn’t feel comfortable with it, and sent me the doc. So, I read that, I read the doc, and I’m still thinking this is weird because as you just mentioned, I’m getting suspicious that the guy just wants me to sign into something, buy something. So, I just send a quick response and I said, so, to get this right, you were hired at a company and then paid to pretend to be me for an interview. He responds and goes, yeah, I’m about to go to class, but here’s a few log snippets of a Slack channel.
JACK: It seems like this guy Andrew is responding to questions Connor has, but is equally as confused as Connor is about this. I mean, imagine someone messages you on GitHub, offers you some paid work, and when you say, yeah, that sounds great, then they ask you to pretend to be someone else. So, Andrew was sending more information over to Connor; screenshots of Slack chat that he had with this Maris person.
CONNOR: At this point, I’m actually getting attached to this because in the screenshot he sends me, he’s talking about the interview – that’s supposed to be in a few hour’s time that I’m looking at – of me that he is no longer attending. This is crazy because I’m also talking to a co-worker next to me at this point; like, should I join this interview? What is going on? I feel like someone is pretending to be me in an interview later today. That is kinda crazy to think about.
JACK: Oh, right, this is an online video interview and it’s all set up where the company is expecting Connor to join and be interviewed, and it was in a few hours. This just gets wilder and wilder. Connor starts wondering if he should join the interview and – just to see what’s going on. At the least, he can inform this other company that they shouldn’t hire him, because he’s not actually applying for the job. That’s gonna be awkward to explain to them, for sure. All the while, Connor is trying to figure out why they took his resume to copy. What was it about Connor that made his resume special?
CONNOR: Yeah, and I think that’s what really sketched me out or made me feel a bit uneasy, ‘cause at the end of the day, I thought, why not just make some AI-generated random document if you’re trying to go out there and get jobs?
JACK: [MUSIC] Connor still feels like he needs more details from Andrew. Something just isn’t adding up, still.
CONNOR: I’m trying to actually e-mail him a lot. I’m saying, hey, I need more info here. I dug deeper into this and it’s more creepy than I thought. I was like, hey, what more can you give me? Can you give me all your e-mail communications? Can you tell me more? He was like, sorry, I’m going to class. I was like, oh. So, the person that’s helping me through this is no longer available.
JACK: How did Andrew get involved in this?
CONNOR: He mentioned that he just got cold e-mailed. Like, just a random e-mail presumably from his GitHub where someone reached out and said they were looking for a partner to join him and needed a bit of development experience. This was a guy that was a fresh developer right out of school that was looking for a place to work, and it seemed like a great chance. So, I think he continued moving forward with this employment as they said they needed a good English-speaking engineer, and he fit all those boxes. Andrew ends up joining this company. They get invited to a Slack channel, and the same day he joins the Slack channel, roughly a few hours later, he ends up getting a bunch of messages.
JACK: Now, when Andrew joined the Slack chat, he was greeted by someone just named PND.
CONNOR: This PND person is a acronym. Ends up posting to Andrew and says, hey, you’re gonna pretend to be this person, and it’s a lient that he ends up linking or sharing to me. That’s when Andrew realizes, I don’t really want to be part of this because Connor looks like an English-speaking engineer. Why am I pretending to be him? Maris or the PND, we don’t really know who this person is, says, yeah, Connor is one of our engineers. Is that gonna be a problem for you? He says, yeah, that violates his ethical behavior, and Andrew just ends up leaving and taking a bunch of information with him. So, I’m thinking to Andrew, this guy’s amazing. He just leaked a bunch of information to me from this whole thing and I guess lost a job in the process. Probably not the best job, but for someone looking for work, I guess a job was a job.
JACK: Hm, I wonder how big of a decision this was for Andrew, a college kid looking for work, finding a job that pays, but having to turn it down because it violates his ethics. I bet there are quite a lot of college kids that would be up for it, you know? I wonder if this is a tactic, that this Maris person or PND person targets college kids because they need the experience and work and are more willing to take non-ethical jobs. I don’t know. [MUSIC] Anyway, for Connor to get an e-mail like this, it absolutely derailed his ability to concentrate on anything at work that day. I mean, he had to go to an interview that he did not set up, and how do you even prepare for something like that? Actually, it doesn’t matter, since there just wasn’t much time to prepare for it, anyway.
CONNOR: Yep, exactly. So, I think I opened it around noon and the interview was at 4:00, 4:30. So, it was a pretty quick turnaround on all of this.
JACK: Andrew sent Connor all the information to join the interview.
CONNOR: It, of course, had the Zoom link and the time and the company and the meeting. I was like, oh, this is crazy. Well, I’m gonna use this for sure. So, then I join it, but I actually join the interview about five minutes before it starts, and I’m just kinda sitting in a Zoom channel. It’s the Zoom waiting room. I can’t really talk to anyone yet. I’m stuck there. My fear is I’m sitting in this meeting and someone is gonna join before me, like another person, and then I’m stuck in a debate. But thankfully, the interviewer, he shows up early and adds me. We both jump on video, sitting in the same spot I am now, and I say, hey, before we jump into the interviews, you’re not gonna believe anything I’m gonna tell you, so I’m gonna go really quick. I just proceed to tell this guy – and I think I just spew it out as quick I can, of saying I didn’t apply for this job, but I am indeed the person that you have all the documentation for. He starts getting really confused here trying to not – follow what’s going on. I think at first he thinks I’m pranking him. I’m trying to explain, no, this is legitimate. I’m the real Connor, but I did not apply for this job. He starts joking with me; well, your resume’s really good. We were hoping this was a real interview. While we’re talking, I’m trying to explain what happened from my perspective, that I got an e-mail.
I’m asking him, can you share from your perspective who applied for the job? While we’re talking about this – because he lets me know that it was on Upwork that my fake self applied for the job. Then he tells me that there’s another Connor Tumbleson in the waiting room. At this point, I’m freaking out a bit because now another fake Connor has decided to join the call, and he’s trapped in the meeting room. This interview guy, he goes, hey, why don’t you change your name, turn off your camera, and just sit in this call? I was like, holy cow, that is amazing. It was your idea; I love it. I want to sit here and figure out what’s going on. So, I change my name, I turn off my Zoom camera, and I’m sitting in the call when he admits another Connor Tumbleson. This is where the story goes even crazier, is I then sit in a call and listen to a guy with this accent that I can’t place. I think I can safely say it’s probably not American, but I don’t know where. This guy then proceeds to say that he’s Connor Tumbleson. Not only that; he starts reading off all my accomplishes, even says his GitHub address, which is odd because I haven’t changed my alias on my – alias in like, twenty years, so iBotPeaches everywhere is me. So, to hear someone say that, it was just extremely upsetting. I’m just sitting in this call, listening to this guy proceed to just list things. I can tell he’s reading the sheet word-for-word that I’m looking at.
JACK: Man, I can’t even imagine being in this scenario, listening in on an interview with someone else pretending to be you trying to get this job. What? All the time fake Connor is speaking, the real Connor is muted, listening. How does he respond to all this? How would you respond to this situation? If I were him, I’d be freaking out, wondering if I’m being pranked and wanting to know who this guy is that’s pretending to be me, and who put him up to this.
CONNOR: Yep, definitely that. I’m talking to some co-workers at the same time during this, ‘cause we’re all sitting around, ‘cause they’re all – at this point – involved in the story. I couldn’t stay on mute any longer. It was just really, really rough. I thought I could sit there and just listen to information, but I turned my camera on and kinda just started talking. I said hey, I’m the real Connor Tumbleson, so who are you? I didn’t get, I think, more than five, ten words out of my mouth, and he just dropped the call, which was pretty sad ‘cause I really wanted to figure out if we could have just a candid conversation of why this was happening, but he left the call immediately.
JACK: What was going through your mind after that interview?
CONNOR: Just the fact that another Connor joined the call, a fake me. I was so confused because I was under the impression initially that this guy I was talking to, Andrew, had ended up joining the call and going forward with this. I was like, why would he do that? He just leaked it all to me. I couldn’t really figure out in my head how there was actually someone joining the call.
JACK: So, this PND person set up this interview and asked Andrew to join it and pretend to be Connor. Andrew said no for ethical reasons, but then someone else pretending to be Connor did join the call. Who was that person?
CONNOR: Yeah, exactly. So, at that point, I’m talking to the interviewer again ‘cause the other Connor has left the call. I was like, hey, do you mind just sending me everything you have? I was asking for who applied, how did he apply, et cetera. This guy goes, yeah, sure. Can I have your e-mail address? I was like, hey, just take the e-mail they gave you and take the 2 off the end of it, ‘cause it was such an embarrassingly copied e-mail. It was just my e-mail with a number 2 at the end. So, sure enough, this company, they then e-mail me and it’s just screenshots of Upwork. This is where I got way more creeped out, [MUSIC] is it was a fake Upwork of me. Once again, it was a highly-detailed resume’s accomplishment. They even had a random Laravel certification I got from a few years ago. I didn’t even put that anywhere except in a tweet. So, I was like, this is a crazy amount of detail that someone went to to make a real, truthful – but also exaggerated in a lot of regards – Upwork account of me.
JACK: Stay with us. There’s more after the break. Okay, so, let’s recap. Someone made an Upwork profile using Connor’s resume and information, and they were using that fake profile to apply for real jobs, then getting someone else to act like Connor for the job. Then that person would sit in an interview and pretend to be Connor. Yeah, so, Upwork is a place that freelancers can go to look for jobs, anything from design to IT or legal professionals. Freelancers will make an account saying what skills they have and that they’re available to work on these projects. Either someone messages the freelancer about a job or a job gets posted on Upwork and freelancers can apply for it. Someone made an Upwork account using Connor’s details, some real, some fake, and applied for jobs, saying look how great my profile is; I want to come work for you.
CONNOR: Yeah, and I think – I honestly had never really used Upwork or only slightly heard of it myself at the time, so I was also googling what is this thing, and, yeah, just as you described, it seemed like it was just an adhoc applying to a job as an individual using my fake information. So, at this point, now that I have screenshots of my fake Upwork account, including my real photo that was a recent work photo, I was like, okay, this is getting really crazy now. I thanked the interviewer for letting me sit on the call. I said, thanks for this info, and took all that info and then wrote another large e-mail to Andrew where I honestly asked him, was that you on the call? ‘Cause I really had no idea what was going on at this point, ‘cause I couldn’t really figure out how a third Connor joined the call. Andrew, after he gets back from class, actually responds and he gives me a ton of information. [MUSIC] He not only sends me every e-mail that he went back and forth with this Maris person to establish this fake employment, but he also sends me screenshots of all these Slack channels where he only joined that day as part of joining this kind of paid work. So, now I basically have Upwork screenshots, Slack screenshots, and e-mail screenshots.
JACK: And as Connor looked through the information Andrew sent over, he realized that some of the people communicating to Andrew also seemed to be impersonators. Like, Maris, for instance, was a real person with a nice GitHub and stuff, but it was probably not the real Maris who was messaging Andrew.
CONNOR: It’s like a neverending circle of bouncing between fake e-mails, and that’s where it gets crazy as I’m trying to follow this weirdness of – I can’t trust anything. Everyone’s fake. The person Andrew is talking to is not even Maris, because Maris is just another impersonated individual. So, I’m really losing track of who’s real or not.
JACK: A lot of these trails seem to come back to the person in the Slack chat app calling themselves PND. PND is who told Andrew to impersonate Connor for the job, and he’s also telling everybody what to do in this chat room. PND might also be Maris. I don’t know, but it seems that PND has a website called PND Design, which offers coding and web design services, and this gives Connor a new thread to pull on.
CONNOR: [MUSIC] PND – I find their website because they just explained it in their Slack channel, PND Design. I just start doing basic things, trying to figure out other websites PND Design built. I’m just trying to figure out who owns PND Design. I end up finding the person who owns it. I call them once or twice; no one ever picks up. I e-mail them; no one ever responds. I don’t know what to do. I just wanted to talk to someone who was associated with PND Design, and they just never respond to any of my – reaching out. I don’t remember if I put it in the blog post, but I called a lot of the numbers that were in the document that Andrew got from PND, and those numbers were these American embassies in foreign countries. I was like, this is crazy. I was like, I didn’t even mean to call these numbers, and here I am thinking it’s some official number for a business, and I’m calling embassies. It was just – it was strange.
JACK: Giving a fake phone number; I love it. It reminds me of this scene from the classic movie, The Blues Brothers.
JAKE: [BACKGROUND MUSIC] Those cops took your license away. They got your name, your address…
ELWOOD: No, they don’t got my address. I falsified my renewal. Put down 1060 West Addison.
JAKE: 1060 West Addison? That’s Wrigley Field.
JACK: A good criminal will always throw people off with what looks like real information but is actually something bogus.
CONNOR: Yeah, and I think at the same time, I’m trying to look at the websites that PND Design built, and they had this weird obsession about disabling right-click. It seems like such an old technique, to stop your right-click. I’m just finding all these sites, and I think they’re in the hundreds, of just all these sites – disable right-click, they had the same Google Analytics ID, and they have this weird footer where it’s like, hey, we created it, PND Design, but guess what? Our CEO’s by SEO Crunches, and our IT is by ITech Fixes, and the design was via Visible Dev, and all these companies are PND, basically.
JACK: [MUSIC] That’s hilarious, a web design company boasting about how they can create great-looking websites, but they didn’t even create their own website. The footer says it was made by someone else. Connor wasn’t sure what was happening, but thought that maybe companies were hiring an individual to build their sites who then would turn the project over to PND Design to do the actual work. But he doesn’t know. It was just so frustrating to have all these puzzle pieces and have no idea what the finished picture looks like. But Connor does the only thing he can, by just start e-mailing companies who PND claimed to have worked with. He would write e-mails saying…
CONNOR: Hey, this is gonna sound extremely strange, but I feel like I’m getting my identity – something impersonate – I don’t know how to explain it, but can you answer a simple question? Did a company, PND Design, build your website? I thought it was a pretty simple ask. Unfortunately, some people told me some very rough things, like to just mind my own business, ignored me, or refused to help me, except for one guy that I think after I talked – a few e-mails back and forth, understood I was a real person and then finally told me, yes, we had never worked with this company before. So, at this point I’m realizing that I don’t think I can trust a single thing that is going on in this Slack channel and this e-mail chain, and the story just continues to grow in these weird angles.
JACK: Things are just so weird at this point. Was the PND person in the Slack channel actually affiliated with PND Design or were they just impersonating that company, too? So many layers of fakeness going on here and impersonations that it’s just really hard to know what’s real and who to trust here.
CONNOR: So, at this point, I felt like I had done a good deal of research. I had tracked down who I thought was involved, what was going on, all thanks to Andrew leaking this information to me. I think, holy cow, I have a lot of information to finish my blog post and make a presentation.
JACK: Connor has tried to reach out to so many people involved, but then realized hey, wait, why not reach out to Connor? Not the real Connor, but the fake Connor, the one who was impersonating him? So, he writes to it, why are you impersonating me?
CONNOR: [MUSIC] I’m e-mailing myself, my fake e-mail. Sure enough, the e-mail account of my fake self responds and just tells me – I don’t remember exactly, but I think they said I look cute or something, which I think is the strangest thing, ‘cause I’m fuming at this point of why someone’s using my real name and everything, and they’re just joking around. Of course I add that screenshot to the blog post, and I think that’s what a lot of folks on Reddit and Twitter all liked the most, is just that random screenshot of me e-mailing myself.
JACK: The full response he got back from the fake Connor was, sorry, but you have a great GitHub and you look cute. Of course, Connor’s first reaction is anger, but perhaps there’s a bit of information in there that’s helpful.
CONNOR: Because then I finished that blog post, and I think that’s where the story gets even stranger, because that blog post just skyrockets to the top of Hacker News within I think an hour of me posting it, and my poor little Linode server falls over ‘cause it’s never had more than a thousand hits, and it’s getting twenty thousand at it. What I didn’t really recognize with getting to the top of Hacker News is how many people just offered to join your investigation and search. Then I had people everywhere just DMing me, messaging me, of other similar e-mails and similar Slacks and messages, but different names. I was like, this is a huge story because people are giving me personal examples where they were an interviewer.
Someone was like, I jumped on a call with someone ‘cause they wanted to talk through it, and this one guy at a random company was like, we were talking to an interviewee who didn’t know anything of why he was on the call or who he was talking to. He was asking us questions of why he was there. I was thinking, that’s crazy, because that kinda rings a bell. If you don’t know anything of why you’re joining a call except given a document a couple minutes before you’re supposed to be there, I could see that happening. Then people are telling me, oh, I live kind of by where PND Design is, their headquarters. They’re like, we’ll go visit the office for you. I was like, well, thanks. [MUSIC] It starts piecing together some things.
JACK: So, Connor starts learning all kinds of new things about this mystery from the help of people on the internet. It turns out there’s a story that Brian Krebs wrote a while ago which talks about faked LinkedIn profiles.
CONNOR: I then get a link to Brian Krebs, of all of his investigative research. Someone links me to one of his articles where he was investigating all these fake LinkedIn profiles, of the upwards of 100,000, 200,000 of them. I’m thinking, this is insane. There’s people – all these fake profiles on LinkedIn. I know they’re on Upwork. I was like, this story is huge. I just unfortunately was one person that’s a bit more connected than, I think, of others that may have no idea they – their information was harvested to make a real-looking profile to then use to get a job from.
JACK: So, this article is interesting. LinkedIn is where people go to look for jobs and network and do hiring, but there’s a huge amount of fake profiles being created every day, and these profiles are real tricky though, because they’re half-AI-generated and half-real, and they take some real information from certain LinkedIn accounts, but then change a few things on it. These fake accounts start creating connections and joining groups, and then the fake accounts start applying for jobs, real jobs, and it’s a real pain in the neck for LinkedIn to try to figure out who’s real and who’s fake on here. The comments on this article are filled with people saying how they’ve had a bunch of fake people apply for jobs at where they work, and recruiters have to do this extra step verifying people’s actual identity, which makes me think, how exactly can someone actually get a job using someone else’s name? In the US, you have to fill out tax documents and stuff that if you work there, you can’t forge this stuff. Where are the paychecks gonna be sent to?
CONNOR: Yeah, it has to get crazy, because at that point you’re thinking – let’s say that it goes successfully and you end up hiring a fake me. We can tell from the Slack conversations that had Andrew successfully done this interview, he doesn’t need any technical experience at this point because they say all technical requirements should just be gathered and given back to this Slack channel, where presumably a lot of engineers are waiting to do whatever task is requested. So, then I’m thinking at this point, you are basically becoming maybe a project owner, manager, or someone to manage engineers behind you, but you’re just the front-facing, English-speaking person. I think that’s a motto in business design that happens and works everywhere. So, I’m thinking, why is this happening at a more malicious intent way of hiding that? I’m thinking, maybe this is some Upwork thing where it’s easier to hire an individual that’s maybe masquerading as a company behind it, and I’m getting confused ‘cause I’m thinking, how are you getting paid? What is the legal, what social numbers – social security numbers are getting used? This is just employment at the end of the day. I don’t think you can hide it or pay by Bitcoin forever. There has to be something or some real names come out. Then when I’m – this blog post is out there and more and more people are reporting this, I’m thinking, this must be working because so many people are telling me that they’re finding cold e-mails to them to be part of it, or it’s happened to them or they’ve interviewed people they suggest – guessed it happened to.
JACK: [MUSIC] There was a time where I was trying to find someone on one of these freelance websites to make a video game for me, and they claimed to be American with great coding skills. But then when I asked for a phone call, the story quickly changed to be a person from India, and it was also not a single person but a whole team of people ready to work on my project. So, what Connor said may be what’s going on here; get Andrew to be the token American English-speaker, and then they can advertise themselves as American-based to ask for a higher rate.
CONNOR: Sometimes people are hesitant to join with another company or work with them versus doing a quick contract job with a single individual. But what if you’re working with a single individual who’s hiding behind a company without your knowledge? I think that is maybe what’s an attraction on Upwork, is you get these individuals, even fake me profiles, that come in at really low offers of working and say, I’m a single individual. I can do all these tasks with a really great resume. But little do you know, if you hire that individual, that you might have an entire dev team behind you that you just never meet, know, or interact with. I think that’s my current running theory.
JACK: Okay, but back to the e-mail the fake Connor sent the real Connor. It said, you have a great GitHub and you look cute. Okay, let’s put aside that ‘look cute’ part. The ‘great GitHub’ is the curious point for me. Like I said, Connor has contributed code 51,000 times to GitHub in the last twelve years. That, I think, is what is great about it, that alone. What I mean is, you can’t go back in time on GitHub and post code. That is, you can’t create an account that looks like the person has been there for twelve years and has all this coding experience unless you’re spending twelve years posting code on GitHub. So, the fact that Connor has been posting code there for twelve years does, in fact, make him look like a well-established veteran coder who knows his stuff, and that goes a long way with job recruiters.
CONNOR: [MUSIC] I think, probably, on GitHub, it’s probably definitely harder to make fake ones ‘cause you can just look back, I think, on my profile, and see a couple of ten, fifteen years of commit history. I think definitely copying and pasting those, even if you took all the repos, you’re gonna have a pretty empty historic graph. Maybe that’s exactly why people just – it’s easier just to claim one as yours and talk about it.
JACK: Yes, I think so, too. That’s something you can’t fake easily. A long-standing reputation of pushing code to GitHub is attractive to employers. So, that is exactly why I think Connor got his identity stolen. Someone, I don’t know, PND, Maris, saw Connor’s GitHub and liked it, and that’s why they took his identity. After Connor posted this blog post, he gave a talk at a conference in Tampa, and someone who read his blog post came up to him after the talk and told him another crazy story. He said…
CONNOR: To be honest, I’ve had two jobs and I’m working two remotely, and the other companies don’t know. He had invested in all these switchers to jiggle a mouse and use two computers. [MUSIC] This guy’s saying, I don’t think I’m doing anything wrong. I’m just working two jobs at once, and neither of the companies know. I think, holy cow, this guy’s just dumping knowledge out to me. I was thinking, is this – this whole employment remote is crazy.
JACK: I stumbled upon this same stuff, too. I recently found this subreddit called r/overemployed, and it’s all about people who are gaming the whole work-from-home thing, having two full-time jobs at the same time. That is, they go to work from 9 to 5, but are working at two different places at the same time, and neither company knows they’re actually spending half the time at some other company. Yeah, there’s articles on this r/overemployed subreddit that tell you things like how to look productive when you’re not at your keyboard and stuff, like having mouse-jigglers move your mouse around for you, or how to automate some of the tasks to look productive. They also have listings of which companies are over-employed-friendly. One of the top posts there is someone saying they now work five jobs, bringing in a total of $1.2 million a year, and here’s how I did it. Ask me anything.
While that’s crazy, this gives me all kinds of business ideas. Like, let’s say I get a job working remotely somewhere, but then outsource my job to someone else who wants to do it for half the pay. Yeah, if I could do that, then why not get another job and outsource that to someone else? Now I’ve got all these jobs that I’m doing work for, but I’m actually not doing the work for; someone else is doing it for me. I mean, that is clearly unethical, but I guarantee with the wave of working-from-home jobs out there that it’s happening. Oh, and let’s not forget what happened to John Wu. I talked with him on Episode 119, and he thinks that someone from North Korea tried applying for a job where he works who could very well have been trying to get a job there just to steal the cryptocurrency from their company.
CONNOR: Yeah, that’s a crazy one, too. I think one person tweeted me that one, of maybe it’s just a state-sponsored unlimited budget; just see how many companies you can join and then extract information.
JACK: So, did you ever get to speak with PND or Maris or whoever and say, dude, what is going on here?
CONNOR: No, unfortunately neither. I had sent many e-mails to Maris, the real Maris e-mail, and never got a response. I just gave up calling leaving voicemails with PND. I sent LinkedIn messages, I sent more. I kind of even worded things as I just want to have a good conversation. But just no response.
JACK: [MUSIC] Is that where we are today?
CONNOR: Yeah. Today, I think where I am now, is I continue to just research things people give me and go through this entirely large list of, I’d say, roughly a hundred websites. I’m continuing to reach out and find contact information for all of them to see if anyone is willing to talk to me on who built their website, how was the interaction, and all the communication between them and the company to figure out if I can find any more information besides what I continue to find. It’s just fake e-mails, generic documents, and any lack of true, real information. ‘Cause I think someone paid someone at some point, and some real, real info.
JACK: What a weird time it’s becoming, isn’t it? This is just the modern world that we’re in now, where working from home is more popular than ever, and it seems to be ushering a whole new set of scams. Or are they even scams? I guess if you’re misrepresenting yourself, then it is a scam, even if you’re not trying to trick someone to give you money for nothing. Just lying to score a contract seems scammy to me. I think if you’re hiring today, you should be very cautious of the people who are applying for your position, because they might not be real. If they are claiming to be someone, maybe double-check with the person that they’re claiming to be by reaching out to them separately. Just be safe out there as our world keeps evolving and becomes more tricky to navigate.
(OUTRO): [OUTRO MUSIC] A big thank-you to the real Connor Tumbleson for coming on the show and telling us his crazy story. You could see what he’s blogging about over at connortumbleson.com. Don’t forget, on the website darknetdiaries.com is a link to all the articles mentioned in these episodes, as well as full transcripts of every episode. This show is made by me, the cyber samurai, Jack Rhysider. This episode was written and produced and edited by the cheerful Tristan Ledger. Sound design was done by Garrett Tiedemann, mixing by Proximity Sound, and our theme music is by the mysterious Breakmaster Cylinder. I was once asked in an interview if I’m any good at Microsoft Office. I told them, I excel at it. The interviewer asked me, was that an Office pun? I said, Word! This is Darknet Diaries.
[END OF RECORDING]