Hacker News Reader

Comment by tablespoon | Hacker News Reader

> While some of the deepfake recordings used are convincing enough, others can be easily detected due to various sync mismatches, mainly spoofing the applicants' voices.

> "Complaints report the use of voice spoofing, or potentially voice deepfakes, during online interviews of the potential applicants," the US federal law enforcement agency added.

Something about this doesn't smell right:

1) Don't video deepfakes require lots of high-quality input video (which is why they were often made of Obama)? Where would an attacker get this for some rando?

2) Why would voice deep-fakes even be necessary, given the interviewee is very unlikely to be known by the interviewer? I suppose it could be used to fake accents, but I don't think that would be an issue for a "remote tech job" -- just steal an identity that could plausibly have your accent.

View on HN

Regarding 1, you setup a fake company and interview the candidate in multiple rounds. Record the interviews and then use them as input for deep fake.

Edit: you could also approach them as a love interest and get the video through chats.

I'd also be curious to see if there's an overlapping former employer between the candidates. If you found an archive of some employers zoom meetings you have all you need.

Okay I'm gonna stop before I get paranoid.

In the second year of COVID I was hiring for a dev position and got a really good candidate who came across as a very bright, outgoing young woman, who got "hire" decisions from 4 of 4 interviewers. She worked with us for about 6 months remotely, but never turned her camera on after the interview loop, and in retrospect she seemed like a totally different person than who we interviewed. The conspiracy theorist in me says she used a double to do the interviews. No need to deep fake anyone.

Interviews as a service. Interesting idea and thanks for sharing.

One of my previous leads suspects a contractor did something like this for an in-person role. We only did one or two phone interviews for such roles, and the guy did well enough to get brought on for a 3 month contract or something. The guy who showed up didn't seem to know as much as the interviewee, and was always on the phone. My lead suspected he was getting help from "somewhere else." In retrospect, he suspects the guy who showed up may have had a different foreign-country X regional accent than the person who interviewed, but it's impossible to know for sure.

He speculated that some unscrupulous but relatively knowledgeable guy was sitting in for the interviews, and then coaching the incompetent applicants day to day for a cut of their pay.

In the end he just let the contract lapse. Not a whole lot you can do since it would be really hard to prove any kind of malfeasance, and to make the accusation would just make you look crazy and paranoid.

I'd rather look crazy and paranoid in that scenario than do nothing.

There was a place that hired a consultant for a project a friend worked on, and she was... I don't think she could write code at all. Like, had trouble manually inserting fragments into an XML file despite fragments with the same structure already being in the file.

Her productivity skyrocketed at night however, and she generally had working code in the morning, which lead to rumors that her husband or someone in her home country was doing the work (would have been daytime over there). Nobody really complained. She wore a hijab and the company had just hired it’s first “diversity officer” so maybe that’s why. Thankfully they stopped using that vendor not long after. It's a story a friend told me a long time ago. I didn’t and couldn’t fact-check it.

The husband’s theory came from the fact she apparently mentioned her husband was also a software consultant.

That's fine if people helped her after work, it means she is struggling a bit technically and she has to work after-hours to learn. It's ok. It means she is dedicated to her job but lacks some skills and is trying to learn. The result is also the most important.

> That's fine if people helped her after work

Depending on the industry, it's definitely not fine.

I work in healthcare. If one of our employees was giving a foreign national access to our internal systems, that would be a Very Big Deal.

I don't think any company would be even slightly 'fine' with unvetted random people having access to any of their systems, and it's almost certainly a breach of contract by the employee to give anyone else that access, whether that involves letting them login and poke around or having them look over your shoulder.

Your experience may vary but for many it's an open secret in IT that developers and sysadmin help each other (at any level).

In practice, when you are a developer you get to know lot of infrastructure and even sometimes customer secrets from Facebook, Apple, Google, PayPal, etc.

This is because the tech people actually speak together, ask feedback and share information.

When a doctor doesn't know, he asks the other doctors for opinion.

There are even websites for that (StackOverflow, GitHub, etc).

It's fine. I trust my employees to use their best judgement when making such choices.

It doesn't mean these 3rd-party guys will get access to your systems.

Even the NSA asks for help, you can see them in the reverse-engineering forums, in MediaWiki conferences, etc.

Experienced developers are not teenagers and act rationally, they don't do 10 years of career to suddenly risk losing all their trust/friends and reputation, all that for 5-minute fame on Twitter for a leak that is likely non-strategic to the outsiders.

Atari loved that Steve Jobs worked at night because they suspected Woz who was a better engineer would help him.

As long as the work gets done...

>Not a whole lot you can do since it would be really hard to prove any kind of malfeasance, and to make the accusation would just make you look crazy and paranoid.

No no, it's trivial to prove. You just ask them to work from a supervised location for a short period of time and that they can't have their phone at their desk. You just have to care.

> No no, it's trivial to prove. You just ask them to work from a supervised location for a short period of time and that they can't have their phone at their desk. You just have to care.

Something like that would have taken extra time and effort, and the problem took care of itself. He had more important things to focus on.

And I think it would have been more difficult to catch than you think. We don't do pair programming, and it's kind of reasonable to ask for time to figure something out. I think the best he could have determined was the guy wasn't good, not any of the suspicions about the scam of cheating on the interview and getting outside help.

>the problem took care of itself

Yeah and how many other employees took themselves out the door because they had to compensate for the nonperformer? I've been in teams with these sandbags and it's infuriating.

> Yeah and how many other employees took themselves out the door because they had to compensate for the nonperformer?

None.

> I've been in teams with these sandbags and it's infuriating.

The guy was on something like a three month contract, and a good chunk of that time was on-boarding then slowly getting suspicious. When we bring on contractors we expect some of them to be duds, the only thing interesting about this guy was his weird behavior.

>The guy was on something like a three month contract, and a good chunk of that time was on-boarding then slowly getting suspicious.

My perception after reading a lot of this thread is that there's so much bloat and checked-outness in the tech sector that it's probably very feasible as an employment strategy to bullshit your way into multiple 3-month contracts, sandbag your way through the onboardings then fail to be renewed (without having done a day's productive work) then rinse and repeat indefinitely.

I don't know how much longer that will persist now that the free money tap has been turned off, though.

It's another world from the startup sector I know where you could tell within a week that a guy wasn't any good and you'd instantly show them the door because you couldn't afford the dead weight for literally another day. shrug

If you're willing to front load the effort you can also just work hard for a year or two and then coast. There are plenty of holes like this.

Sure; if you can do the work. If you can't do the work...

I think any one with average intelligence can probably do software development, it's just a matter of putting in the effort.

>probably do software development

Could they get hired at a tech company and put in level-appropriate work for two years? Without domain-specific knowledge and experience? You're saying 'work hard for two years' presumably by that you mean produce level-appropriate or above-level-appropriate work?

You're basically saying that you think just anybody off the street with a 100+ IQ can 'just get hired' at a tech firm and do dev work, for two years, and then coast?

Studying to get the job is also part of the effort you put in.

Winner!

How did she get away with never turning on her camera?

Well, apparently "she" didn't. She was fired. The thing is, you could potentially make 40-80k(OR MORE!!!) after taxes faking it for six months. I've been thinking about this scam a lot lately. In fact, there's nothing illegal about being a shitty employee for six months which complicates things.

There's definitely an opportunity here to make a bunch of money at least pretending to fix this problem. Or maybe capital just decides to bring everyone back into the office.

Couldn't there be a case for fraud?

I don’t know. I’m not a lawyer. But also what is stopping just any old person from doing this once or twice a year? Is being fireable fraud? I doubt it but again, I’m not a lawyer.

In the UK it's 'obtaining a pecuniary gain by deception' the same as lying on your CV. If you're routinely outsourcing parts of your job (because you can't do it yourself) then you've met the standard for prosecution.

> If you're routinely outsourcing parts of your job (because you can't do it yourself) then you've met the standard for prosecution.

I imagine it would be a problem in the US too, just for other reasons probably. You are essentially giving confidential work info to a third party that has no relationship with your employer.

Not a lawyer, but I don't see a deception charge for "under-performing and getting fired for it (while having 2 jobs)" faring well in courts.

Think about it: if you were performing your work well, despite having 2 jobs, what would the deception be? You promised to deliver work on your own, you deliver it on your own. The other job has no intersection with your other one, they are entirely independent. The only difference between that situation and the same situation but poor performance is literally just your performance. Poor performance doesn't automatically turn that situation into deception.

The deception is implicit, when you take on a full time role it's commonly understood that you're declaring that you're dedicating yourself to that role on a full time basis, i.e. that you don't have another full time job.

The law is interpreted by human beings, you know, it's not a 'code is law' situation. Remember that a jury would make the final decision. I can see a good lawyer using an argument along the lines of 'well, you said agreed to work FULL time. If a bucket is already FULL would a reasonable person expect the bucket to be able to carry any more load?' and winning.

>there's nothing illegal about being a shitty employee for six months

If there is fraudulent intent it is illegal. The intent is what matters here.

Assume it is illegal, will your average employer care enough to pursue damages for six months of lost wages?

How do you prove the employee wasn’t simply incompetent?

I can't imagine a circumstance where I would compel someone to share a video of themselves when they're apparently not comfortable with it. If she went six months without creating a pull request that would be a different story.

>I can't imagine a circumstance where I would compel someone to share a video of themselves when they're apparently not comfortable with it.

Wow. I can't imagine contracting work from people (and giving them access to commercial-in-confidence data) and yet not knowing with 100% certainty 100% of the time that the people I'm talking to are the people I'm contracting with, you know, the ones I background-checked, the ones I can hold accountable in court.

You know what happened with remote schooling? Teachers didn't demand that pupils turned on their cameras because of the same 'it'll make them uncomfortable' excuse. Result? Kids turned their computers on, their cameras off and played minecraft all day for 18 months.

Don't be odd about this. Nothing at all about face to face contact is uncomfortable for adults. That shouldn't be something that's normalised and it's detrimental to society to allow for it. You are literally reading an article that outlines all the negatives about your 'cameras are uncomfortable' mindset and you still haven't twigged?

Keep doing it your way, but don't be surprised when you've had your entire company's data exfiltrated and sold to a competitor by the 'person' you were too uncomfortable to ask to appear on video.

And don't for one microsecond retain people who mysteriously only produce quality work when 'unsupervised' or 'overnight' or when they're 'on the phone all the time.' Fire them! You have no idea who they're talking to or who's really doing the work. They're not an asset to your company, they're a bullshit artist!

Exactly. Turn your damn camera on. It’s rude to not…

Might be true for where you work. But it's not universal true.

Even in the same company I had teams where no one would turn on their camera and some where everybody would.

I think it's rude to expect me to try to do the same things we do in person, just 100% of the time because I can't tell if you're looking at me at any given time..

Two counterpoints:

First, the top performers on my team right now are essentially ghosts. One I just went on a business trip outside the country with, and I hadn't seen his face for a year and I might not see it again ever. Another one is my "lieutenant" and in two years I've seen him face to face twice. No video. He's probably leaving the country soon and I don't care, because he'll be in the same longitude.

The other point, since this is FAANG, how is the conversation going to go with HR if I want to terminate someone because they won't turn on their camera?

>The other point, since this is FAANG, how is the conversation going to go with HR if I want to terminate someone because they won't turn on their camera?

Well, I guess going by what you've said they won't care either. I don't know how you can run a company productively over the long term if nobody cares, though.

This is a really overbearing and insecure take. If you know the voice of the people you work with and actually pay attention to their work, do screenshares, etc. it’s really obvious if they know what is going on and if they are doing the work.

If you think looking at a camera view of someone will prevent them from defrauding you, you are an ideal con artist’s mark because you’re taking your cues from the easier parts to fake.

>If you know the voice of the people you work with and actually pay attention to their work, do screenshares, etc. it’s really obvious if they know what is going on and if they are doing the work.

This is also fine. But look at the reply below yours, when the 'team manager' is littering their comments with 'my top performers are ghosts' and 'I don't care.'

Your strategy involves focus and care applied through one perspective. My strategy involves focus and care applied through another perspective. Yours is arguably better, but I don't think mine is insecure, mine is perhaps a reaction to some of the nonsense I'm seeing in this thread in which managers admit they have staff who they think are outsourcing their work or just can't do the job but are 'uncomfortable' dealing with it. I don't think they're uncomfortable, I just think they don't care. I can't stand don't carers. I've had to work on too many teams managed by don't carers and staffed with don't carers and I just don't get the mentality. It annoys me.

Different companies have different cultures around cameras. At my current company nobody turns on video during any meetings.

> Why would voice deep-fakes even be necessary, given the interviewee is very unlikely to be known by the interviewer? I suppose it could be used to fake accents,

You have it backwards-- the point is accent elimination. You don't need to sound like someone else, but you do need to not sound like someone of your own locale.

Accents can only be changed, not eliminated.

That's a strange dichotomy to make. How is accent elimination different from an accent change from a nonstandard accent to a standard accent?

He's just pointing out that the concept of "accent elimination" is obviously coming from someone who is in a mindset of, "I sometimes have coworkers who have accents, unlike me, who speaks in the default accent"

I believe that "accent" here refers to "phonetics of a foreign language applied by a non-native English speaker". i.e. German speakers who merge /w/ and /v/ because no such distinction exists in German. That's a different kind of accent from an American, British or Kiwi accent, etc, which are produced by divergent populations of native English speakers.

Why do you think that there isn’t any distinction between /w/ and /v/ in German? That’s simply not true …

> You don't need to sound like someone else, but you do need to not sound like someone of your own locale.

That doesn't make any sense though, given how many real tech workers are immigrants with accents.

What you say does make sense for someone trying to do certain kinds of fraud (e.g. an Indian scammer pretending to be an IRS agent demanding iTunes gift cards), but not for applying for a tech job.

Immigrants are people you can hold legally accountable for fraud. Someone who catfishes their way into a remote-work job and is untouchable by domestic law, not so much.

There are some ethnic boundaries across which some employers are not willing to entrust remote work, and the response by the impacted demographic appears to be to double down on the fraud that led to the stereotypes to begin with.

Regarding 1) and following 2) you only need to make realistic-enough video that it passes as a person and is similar enough to the target person. For example, you can have a pretrained model (e.g., using zero targeted data) and search for some configuration that is closest to the target person. You only need to match a few variables (e.g., ethnicity, gender, hair color, age) before the fake is plausible.

> 1) Don't video deepfakes require lots of high-quality input video (which is why they were often made of Obama)? Where would an attacker get this for some rando?

I imagine that at some point, or even now, we can use transfer learning for deep fakes and just train existing models on a limited data set for "good enough" deep fakes.

Reply on news.ycombinator.com