Hacker News Reader

Comment by jackconsidine | Hacker News Reader

I hired a contractor on Upwork once and he worked alongside us in our Slack workspace. He did great work for a few weeks and then I suspected him of outsourcing his persona to someone else. The smoking gun was that the presumed guy behind the scenes sent a PayPal invoice via his Slack account and immediately deleted it. I have regretted not having fast enough fingers since then and wish I had this.

I did end up catching him- the app he was working on enabled geolocation and he went from Chatanooga, Tennessee to Romania in an hour. I'm surprised he accepted geolocation! I also later confirmed IP addresses via Firebase deployments in the same region.

EDIT: since a lot of people are commenting saying that this is fine by IRS laws of subcontracting etc I should clarify:

1. This wasn't a legal matter, but a business matter. I needed to federate access to sensitive infrastructure for this project, and this person failed to disclose (or denied) any additional involvement.

2. The work was not up to spec which is why there was a problem.

3. The reason for using a 1099 as opposed to a w2 in this case had nothing to do with trying to flout benefit obligations. I don't think saying you need to know who's touching your codebase and hiring someone on a contract basis is trying to have your cake and eat it too. This type of contract is much more expensive for us than a full-time employee.

View on HN

"The general rule is that an individual is an independent contractor if the payer has the right to control or direct only the result of the work and not what will be done and how it will be done."

independent contractors are free to sub out work. this is the law. they also probably should not be on your slack unless you're considering the whole thing a consulting arrangement.

i understand where you're coming from, especially in trying to make use of upwork in some actually useful way for your business. but you should also be aware of the law.

https://www.irs.gov/businesses/small-businesses-self-employe...

Yeah I get this and it doesn't apply here. The payer in this case did not have the right to control only the result of the work which is the crux of the situation.

The law, nor the linked resource, stipulates that any 1099 relationship can be subcontracted out by anyone, let alone without disclosure. If that were the case the explicit option to hire onshore vs offshore on sites like Upwork would be meaningless, or a matter of arbitrage.

Not having the right to control only the result makes them an employee which in turn makes them eligible for benefits and so on. This is the specific difference between a contractor and an employee.

The problem is that you can't just have what are effectively employees but on a contract basis under law. It opens you up to liabilities, as Uber has been experiencing.

The closest I think you could get is actually contracting a PEO that takes the individual under employee status and assigns them specifically to your company under contract. Being an employee of the PEO means that they can in fact control these aspects of the job, and you aren't contracting them, you are contracting the PEO who subs out to them.

It seems intuitively like you can't just ghost in someone who didnt even sign the copyright assignment stuff with the right party, ndas, or undergo a possible background check.

there's a whole industry that does this. they're called agencies. taking responsibility for quality and ensuring no subs or staff do anything sketchy is expensive and hard, as such they typically add a 100% cut to what gets billed out to the client.

They don't secretly ghost them in, and they do get them to sign over copyrights etc.

> Not having the right to control only the result makes them an employee which in turn makes them eligible for benefits and so on. This is the specific difference between a contractor and an employee.

This isn't actually even the root issue.

The contractor almost certainly violated their contract by sharing NDA-covered materials with an unauthorized third party.

The contractor also shared access credentials to the company's systems with someone else and then facilitated fraudulent interactions wherein one person claimed to be someone else.

Being a contractor doesn't give someone carte blanche authority to do whatever they want with the company's materials (codebase, design documents) and secured systems.

> independent contractors are free to sub out work. this is the law.

I’ve never seen a contracting agreement that didn’t specifically prohibit subcontracting without the explicit written consent of the client. It’s not that it wouldn’t be federally legal, it’s that it would violate the specific contract with the client.

You can put anything you want in a contract, the question is, is it enforceable?

There isn’t a jurisdiction on the planet that would reject a contract clause that the person hired to do a job cannot covertly outsource the work by providing their credentials to a third party. That’d likely be breaking multiple clauses of any sane contracting agreement.

here's upwork's suggested contract:

3. RESPONSIBILITY FOR EMPLOYEES AND SUBCONTRACTORS, INCLUDING AGENCY MEMBERS If a User subcontracts with or employs third parties to perform Freelancer Services on behalf of the User for any Engagement, the User represents and warrants that it does so as a legally recognized entity or person and in compliance with all applicable laws and regulations. Further, at all times a User that agreed to perform services under a Services Contract remains responsible for the quality of the services and represents and warrants that User has entered into agreements with any such employees and subcontractors on confidentiality and intellectual property at least as strong as those in these Optional Service Terms.

it's a business to business agreement. a contractor is free to sub.

https://www.upwork.com/legal#optional-service-contract-terms

You're not countering the parent's point. Of course you can agree to allow it if you choose.

The important caveat that is that in many jurisdictions, there’s a significant difference in the tax treatment of contractors vs. employees, and so by producing such a contract (that forbids subcontracting) you are plausibly creating an employment arrangement and are on the hook for tax consequences.

Here in the UK, for example, if you wrote such a contract, it would be enforceable… but you would be considered (by the tax authority) to be trying to evade employment taxes, and hit with something starting in the range of a low 5-figure financial consequence (assuming the contract was a few months at current average rate for tech workers).

All of my contracts explicitly allow subcontracting in order to comply with tax law.

> you are plausibly creating an employment arrangement and are on the hook for tax consequences.

I realize this thread is full of armchair lawyers, but that is definitely not the case in the US.

Most importantly, there are plenty of valid business reasons to prevent subcontracting that don't have to do with "locus of control" issues that would warrant someone being a full-time employee.

There is a difference between "allowing it" and "allowing it secretly without your knowledge". There are issues of confidentiality (and potentially NDAs and therefore IP issues) and possibly issues of export depending what you're working on.

There's also an issue of 'what you bought' - this isn't necessarily a contractual thing. I work for a consultancy, if we sell you a project based on the skills and knowledge of a few of our experts and then when the project starts we actually staff the project with a few grads, you'd be annoyed right? Very carefully our contracts don't name individuals to allow us flexibility (e.g. someone gets ill, goes on leave etc.) so we're fine legally but you'd be understandably upset and might want to end the contract. [this by the way, is exactly what Accenture does quite a lot]

No a contract is a contract and the contract defines what the agreement is. The IRS might have a view of the tax implications of contract law but it doesn't control anything.

At the very least you're probably breaking the NDA.

Yes, it is!

They can also include clauses that the company's code and other materials won't be shared with 3rd parties, aka an NDA. These are standard and well-accepted practice.

The contract will also be very clear that access to the systems is only granted to the person signing the contract. They don't get to grant access to other people just because they have contractor status.

Correct. This is the law in the United States. But would it apply to someone working outside of the United States?

The original commenter didn't say what happened as a result, just that he caught the contractor subbing out work.

If it were me, I would not renew a contract with someone who sub-contracted work out to someone I don't know and didn't approve without informing me. Whether it is or not, it certainly seems shady, and I don't want to work with people who have violated my trust.

When I was a contractor, our clients usually had a number of clauses in the contract that would have allowed them to end the engagement early for pulling something like that.

And, of course, in the end they could always just have said "go to hell, we're not working with you anymore," and it would come down to who wants to go to court the least.

> When I was a contractor, our clients usually had a number of clauses in the contract that would have allowed them to end the engagement early for pulling something like that.

At minimum, any NDA would have been violated by sharing the company's code and/or access with a third party.

Being a contractor doesn't give someone carte blanche authority to pull random people into confidential work. Any reasonable contracting agreement will make it clear that the materials are not to be shared with anyone outside of the contract.

> independent contractors are free to sub out work. this is the law.

Practically speaking, there is no way a software contractor can sub out work without violating a litany of contractual obligations in the contracting agreement. Even minimalistic contracting boilerplate agreements will have clauses that cover these situations.

For example, if you sign an NDA with a company covering the work and then turn around and send the codebase to a contractor in Romania to work on it, you've very clearly violated the terms of the NDA.

So no, the law doesn't automatically allow engineering contractors to do whatever they want with the work.

> For example, if you sign an NDA with a company covering the work and then turn around and send the codebase to a contractor in Romania to work on it, you've very clearly violated the terms of the NDA.

I find that unlikely. What if you were instead handing it to an employee?

(Also, different NDAs are... different, it's pretty tough to talk about them all in general and expect a statement to be true.)

> So no, the law doesn't automatically allow engineering contractors to do whatever they want with the work.

Yes, it does. Just because you might have terms in a contract prohibiting it doesn't mean the law prohibits it.

> I find that unlikely. What if you were instead handing it to an employee?

> (Also, different NDAs are... different, it's pretty tough to talk about them all in general and expect a statement to be true.)

If you sign a contract that says you're not going to share the company's code and then you share the company's code, you've violated the NDA. It's as simple as that.

Being a contractor doesn't grant someone magical immunity to the contracts they've signed. At most, the employee could argue that the contract made them a full-time employee and sue for benefits and such. They can't, however, simply ignore contractual obligations that they've agreed to.

Contractual obligations that go against the law are void. And it means that indeed, you are supposed to just ignore them.

Are you claiming that this specific contractual obligation is against the law?

The legality of it does not really matter here. If I'm paying top dollar to someone in the US I expect them to actually do the work themselves.

In construction, parts of projects are routinely subcontracted out. The primary contractor is on the hook for ensuring quality.

I don't see why software projects can't be the same.

Construction has standards, licensure, bonding...

Startups are supposedly fast and agile enough that perhaps they can evaluate contractor work week over week.

If the work is good, I'd be fine with the above arrangement so long as I wasn't working in an industry that required regulation (PCI compliance, etc.)

The United States has employment laws. Hiring someone as a contractor and then treating them like an employee also likely violates US law.

I feel like there has to be a legal difference between treating someone like an employee and requiring, say, your contractor Bob to be the one signing in with their credentials bob01 and not his subcontractor Bill.

Why would it matter who is signing in as long as whoever does the work follows the same agreement standards? Sounds an awful lot like controlling what will be done and how it will be done, which is the definition of an employee.

I guess I can't imagine a situation where Bill is contracted at a temp agency, turns around and hires Bob, and when Bob shows up with Bill's badge and is refused entry, and Bill somehow wins a lawsuit on the theory that Bill must be allowed to subcontract and anyone he subcontracts to must be allowed on-site to perform the work, no matter what.

Like, not giving out your password (or badge, or key, or whatever) to someone else is a pretty core job responsibility!

If they are contracted at a temp agency, then they are taking on the risks Bill would be an employee of the temp agency... Employee misclassification is frequently abused so don't get me wrong, I think it happens a lot, but in many cases people are misclassified.

The employee / contractor thing may be a violation of IRS regulations (depends on a lot of factors). Lying to obtain a contract, and lying about who is doing the work and who has access to any sensitive materials related to the work is straight up fraud, so I wouldn’t want to get into a legal pissing match over it.

> lying about who is doing the work and who has access to any sensitive materials related to the work is straight up fraud

Fraud would require a contract saying X is doing the work, which is controlling what will be done and how it will be done which means they would be classified as an employee.

The person or entity who hired the prime contractor is also on the hook. If you are in that position, it is better to detect and stop a contractor doing things behind your back than it is to explain that you didn’t know that a contractor subcontracted the work to the person who installed the backdoor.

They can be, provided that disclosure is handled up-front and the contract is structured for it. Dropping that on someone who had every reasonable expectation - and possibly even contractual language - about you doing the work yourself is quite a different matter.

They certainly can be the same. In this case the contract I had with this person stipulated that they would be doing the work and this person denied having another person involved ahead of time. Moreover, there were security clearances associated with this person and expanding the footprint was a relevant consideration for the project.

You hired a contractor from Upwork for a project requiring clearance?

Sure. Not state-level clearance with capital letters, but access to sensitive infrastructure etc

> In construction, parts of projects are routinely subcontracted out. The primary contractor is on the hook for ensuring quality.

> I don't see why software projects can't be the same.

Contractors can't automatically give subcontractors access to the plans, the construction site, and so on. The contracting agreement will have provisions about who can access the site, how they get approved, on what terms, and so on. Becoming a construction contractor doesn't give someone carte blanche to invite other people to a site without regard to the terms of the contract.

Likewise, a software contractor can't just decide to share your codebase and design documents with a subcontractor because it almost certainly violates many of the contractual clauses they agreed to.

> The contracting agreement will have provisions about who can access the site, how they get approved, on what terms, and so on.

I would definitely expect all of that to be handled by the primary contractor (i.e. the person who specializes in construction sites). No?

The terms are negotiated between the company and the contractors.

Being a contractor doesn't automatically grant someone the right to delegate access to sites and such.

I think a lot of people in this thread have misunderstand what the law is actually saying. The law doesn't say that if you're given contractor status you can do whatever you want. The law says that if the job is misclassified as a contracting position when it should be a full-time position, then the employee is owed benefits and such.

If you sign a contract with a company that says you will not share the code, design docs, system access credentials, physical building access, or other common stipulations, you can't automatically ignore those because you're a contractor.

I mean, yes, that’s right. The primary contractor runs the job site, manages who’s allowed to be on the site, and will absolutely complain if the known subcontractors smuggle in random unauthorized people to run cabling. It’s not like they’re being obnoxious just to make money; in construction, as in software, there are many regulatory and compliance related reasons that who does the work matters.

This is so unethical and sadly not rare. I have had people reach out to me (twice, recently) on LinkedIn to interview for them (using names and credentials of people who have work authorization for USA) and the offer is usually a fixed rate + commission per job per month for the lifetime of the job. They hire skilled engineers to secure the jobs for them while outsourcing the actual work. So the scam can go further than just outsourcing the work to people with potentially far lower skills.

I've been working remote for almost a decade, and most of the companies I've worked for have pulled me into the office at some point. All expenses paid of course. No, it does not stop an employee from outsourcing work, however a decent contract will.

Employers should also not frown upon those that have this type of behavior unless they specifically call this out in a contract or the employee handbook.

Note that I've never attempted to outsource my work since I like writing code and I get paid an awesome enough salary as it is, but I don't blame those that do unless they are breaking the rules.

I actually got laid off from a job because the lead programmer on my team was doing this. He had 3 folks working in India full time. He told me about it prior to the layoffs over beers. 3 folks on my team were let go. Note that we all found jobs within a month. The last time I spoke with him, he was still doing it. The only time he does any work is when the company has meetings he is asked to attend.

I have concerns about a similar situation. We live in a weird world.

Is this against Upwork rules? What's the problem, assuming the work was done according to spec?

All sorts of information being shared with a completely unknown and unvetted person somewhere in an unknown part of the world?

Depends on the contract. Part of being a contractor by IRS standards is being able to subcontract.

> Personal performance of services: An independent contractor should have the freedom to hire assistants or subcontract work to other workers or firms at his or her expense (this is where profit or loss could enter the picture). If you require the worker to perform the work personally, that's a sign of control and therefore indicative of employee status.

Legally, maybe. In practice, when I was freelancing, I don’t think any of my clients would have been okay with me subcontracting the work. Amongst other reasons, I think most clients wouldn’t be happy with the idea that they could have paid someone else less to do the same work. (And yes, I understand that there’s a management aspect to subcontracting that may justify the difference, but most clients wouldn’t see it that way if they were expecting you to do the work by yourself.)

I don’t feel sympathy for that, because to me the very aspect of contracting is that you should be able to subcontract out the work. If they wanted me specifically to do the work, then they should have taken the time and effort and paid the taxes to hire me as a W2 employee. You can’t have it both ways.

You could absolutely have it both ways if both parties agree to those terms though. If the agreement is for the work to be performed by a specific person, either in word or intent, then it could be breach of contract.

Absolutely! My point is that if you are making an agreement for a specific person to perform the work instead of worrying about the outcome itself, perhaps you are really seeking employment instead of a contractual agreement.

Bingo.

This whole thread got super litigious around my comment that there is a defendable reality where people subcontract what you contracted them to do. It all depends on the contract wording.

Good counter example to me defending be able to subcontract would be performance agreements (e.g. I pay Foo Fighters $1m for a concert they can't send Weird Al in their place).

You misunderstand: someone is an employee when they fall under many of those categories, not just one. They aren't some kind of requirements/'standards' contractors must completely (or even mostly) adhere to.

Someone would be an employee rather than a contractor if they couldn't subcontract AND they had set hours AND they had to use your tools AND you set the work on a day to day basis. Many of those things need to be true, not just one to push someone from contractor to employee.

Sure.

Or consider the ABC test:

A. The worker is free from the employer's control or direction in performing the work.

B. The work takes place outside the usual course of the business of the company and off the site of the business.

C. Customarily, the worker is engaged in an independent trade, occupation, profession, or business.

In this case, again, depending on the contract signed, A would cover subcontracting unless it was explicitly prohibited by the contract. And maybe it was. But I have signed plenty of contracts with my personal name not my fictitious or LLC name that would not have been violated by having someone else perform the work.

> Part of being a contractor by IRS standards is being able to subcontract.

Yes, but the contractor must still respect the other contractual obligations.

For example, they almost certainly signed a contract that they wouldn't share the codebase (NDA) or share access to the company's systems. The contractor would have clearly violated this by giving the code to someone else to work on and giving that person access to the company's Slack under someone else's name.

If he would have subcontracted an isolated task involving no trade secrets, no confidential information, and no access to the company's systems he would have been fine.

But you can't just hire someone in Romania and have them pretend to be you and log in with your credentials and have access to the company's proprietary materials. Being a contractor isn't an automatic license to ignore all of the things you've agreed to.

I think it is unfair you quoted the second half without acknowledging I explicitly said:

> Depends on the contract.

And you immediately jump to conclusions:

> they almost certainly signed a contract that they wouldn't share the codebase

We don't know what they signed.

This against their rules. And I had the same thing happen.

Hired an “American” contractor named Jeff. Had a video meeting with him, everything started off great.

Then when we got him into slack, his English went way down hill.

I tried to get a phone number for him and he resisted and gave excuses why he couldn’t talk right now.

So… because I suspect this is getting to be very common… Get a phone number for your contractor and call them periodically. Insist to speak with them on the phone about something they have done recently.

Even if the work would have been good, I won’t pay a liar like that.

I manage a big dev-related Telegram channel, I was surprised how widespread this practice is (they call it "proxying")

Thanks for that. I feel like having a term for it is an important step to not getting scammed again.

Yep, I had to spend a lot of time talking with people offering proxy services or looking for proxies to understand exactly what it was, and we ended up banning this kind of requests because of how dishonest it is. Turns out it's common practice also for university exams!

University scam like someone takes classes for you?

Exactly, to work around mandatory attendance

Because nobody likes knowing he's getting arbitraged? Also security concerns.

I can practically guarantee (without bothering to check) it's against Upwork's rules, and in many jurisdictions a form of fraud.

1. Legal/compliance/tax problems

2. If Upwork were to allow this, it effectively allows bad actors to reset their reputation whenever they want

3. If you're willing to lie about this, do I really want you working for me?

4. Just because you approve of them and think they're safe doesn't mean I do, and you're sending my confidential company secrets and source code to them

None of these are problems if you're upfront about it, but lying and claiming you're doing the work when you're actually outsourcing it is very bad.

I wonder, would you (or others complaining about subcontracting) be OK with it if the prime contractor was totally above board, disclosing the fact that he is subcontracting and allowing you to "vet" the subs?

In other words, is it the misrepresentation that's the problem, is it your need to scrutinize the subcontractors, or is it simply that the prime contractor isn't personally toiling sufficiently for you?

Personally, I don't see what the big deal is. A client is paying some agreed amount of money for some agreed results in some agreed time period. What difference does it make if the contractor personally types in the code or if he finds 5 Indian guys to do it?

I put in some hours in the world of defense/government contracting, where in many cases, the prime contractor never does any work at all. His only job is to "be the prime contractor" but he subcontracts everything, and I mean everything out to others as soon as the ink is dried.

Yeah I definitely wouldn't care if it was disclosed ahead of time. In my case it was not disclosed and ultimately denied when asked. It represented a security threat to a system where we specifically federated access to specific people.

> In other words, is it the misrepresentation that's the problem, is it your need to scrutinize the subcontractors, or is it simply that the prime contractor isn't personally toiling sufficiently for you?

There seem to be quite a few comments specifically calling out the misrepresentation as the main problem. I guess we could speculate that the motivation is actually that they want the prime contractor to toil for them, but I dunno. Caring who exactly is toiling seems kind of weird and controlling, we should be generous to the community and not ascribe weird motivation to them if they've got some other perfectly reasonable reason to care.

> I wonder, would you (or others complaining about subcontracting) be OK with it if the prime contractor was totally above board, disclosing the fact that he is subcontracting and allowing you to "vet" the subs?

Yes, the misrepresentation is the key part. For example, if I grant you access to a server that doesn't mean that I want a bunch of randos I never meant having access to the same server as you — if nothing else, you'd want them to have had whatever you consider necessary security training and you'd want your ops people to know that a connection from Romania isn't an immediate sign that you've been hacked.

This is especially true when you're crossing country boundaries and things like IP law or similar concerns vary widely. Most contracting agreements cover things like handling corporate IP carefully and I'd expect at least a request to confirm that this is okay.

Now, there are cases where it might be more forgivable: for example, if I'm hiring you to work on a project which involves an open source component and you turn around and hire one of the developers on that project to add a feature we need, that seems entirely reasonable because it's a) not my IP and b) totally above board that J. Random Maintainer made those commits and shipped v1.2.3 which you're using. Similarly, if you found an artist to contribute assets but didn't give them access to my server or a copy of our code, that seems fine, too. None of that seems anything like the situation described, however.

> I put in some hours in the world of defense/government contracting, where in many cases, the prime contractor never does any work at all. His only job is to "be the prime contractor" but he subcontracts everything, and I mean everything out to others as soon as the ink is dried.

Yes but speaking from experience on the .gov side they do that with the full knowledge of the agency and a contractor will be terminated and banned from future work if they violate security policies such as having unauthorized people access a government system or sharing source code without authorization.

In finance this is allowed. It's called arbitrage.

Reply on news.ycombinator.com