How Underground Groups Use Stolen Identities and Deepfakes
trendmicro.com
trendmicro.com
About a decade ago, there were a number of raids by Immigration on meat packing plants across the Midwestern US. What kicked the raids off was when one Hispanic woman who worked at Immigration was being dinged by the IRS for not paying some $160k in delinquent taxes. Upon investigation, it turned out that her name & SSN were being used simultaneously by more than 50 different workers in the meatpacking industry.
Several newspapers in the Denver metro area reported on the raids. Some of the raids happened in Greeley [0]. I remember one of the papers reporting that the only signs in English in the entire plant were the emergency Exit signs over doors. Also mentioned in the papers were that a valid name & SSN combination was worth about $50 if the name was Hispanic, and about $5 otherwise. Some of the name & SSN combinations were used simultaneously more than 100 times, with some repeats being at the same employer simultaneously. Several of the companies raided by Immigration knew that the workers were in the country illegally but didn't care as long as the name & SSN combo made it through some verification process [1].
Notes: 0 - Greeley is about 60 miles north of Denver. When the wind is "right", one can smell the feedlots. Normally, when you drive out of the mountains, you can see a huge brown cloud floating over the Denver metro area. When the wind is "right", you can see a sharp termination of that cloud. The chemicals in the cloud (mostly nitrates and nitrites from exhaust) react with the chemicals from the feedlots (mostly ammonia from cow urine & feces) to form ammonium nitrate (frequently used in fertilizer & explosives) to precipitate out of the air (leaving clear sky).
1 - This clip from Hogan's Heroes displays the willful ignorance. https://www.youtube.com/watch?v=HblPucwN-m0
Back in 2008 I was working at a Wendy's where the majority of the staff would routinely "resubmit" their applications. I don't know the intricacies of the process, but the way it was explained to me was roughly something like this:
1) Illegal fills out application using a fake SSN
2) (Physical) Paperwork gets reviewed by manager, to make sure everything is filled out. Wait on sending it until they are bugged by corporate to submit the "new" employee applications
3) Send it to corporate
4) Corporate goes through a stack of however many "new" employee applications they have received across the region. Let's assume it's 10,000+
5) After corporate reviews the "new" employee applications, they gather up the names and SSNs, which are sent off to some sort of verification system
6) An error is thrown out and sent back to corporate saying that the name and address doesn't match the SSN provided. Corporate waits to send this information for a few days/weeks, depending on how many they are processing at a given time
7) The store receives a rejection notification sometime later
8) Wait about 1 week or so until corporate starts complaining, return to step 1
Some of the guys I was working with had gone through this process for - no joke - at least 2 to 3 years. Since they were continually seen as "new" employees, there was no sort of issue with firing previous employees or anything like that. It also didn't hurt that different information was being provided each time. After all, corporate had no way of claiming that Jose Guzman at 123 fake street, with SSN 123-45-6789 was the same Jose Guzman at 123 fake street, with SSN 987-65-4321, since they didn't want to be accused of racism.
It wasn't so much a problem to be resolved, as it is a "discrepancy" to be "corrected". The only correction needed was to have the "new" employee resubmit their application.
On a side-note, I'm not exactly sure how any of this worked, but it also led to the "new" employees making about $3 per hour. I accidentally left a paycheck out at one point, and one of the Spanish guys saw it and flipped out, yelled to the other guys, and they all started flipping out too. I guess they were under the impression that minimum wage was whatever the managers told them it was? I felt bad for them, in a way, since they were working extremely long days, but they were also not paying any taxes, sleeping on the job, and would flee the country once their home was built back in their home country. Basically, they were treated poorly, but they were also standing to save up about a full decades worth of money by stealing from the country they broke into illegally. I don't really hold any hostility over them doing that, I just don't hold much sympathy either.
Surely the employer is deducting for income tax, SS tax, and medicare tax from their paychecks, and they will not see an income tax "refund" next April nor will they ever collect SS nor Medicare benefits.
And if the employer is not making these deductions then who is doing the "stealing" exactly?
Interestingly, that seems to trigger the taxman to start looking, which is when folks get busted. It’s in some mentioned anecdotes and articles here.
Even more interesting? If they instead just abandon the withheld taxes, no one seems interested in actually fixing the problem.
It would be trivial to mandate employers do realtime submissions of the employment eligibility paperwork for instance, but it’s actually illegal to send it to anyone, or attempt to do anything more with that information (like have a service somewhere that tracks these things and notifies employers of obviously invalid cases like a SSN being used across 5 states for 50 different job applications at different employers at once).
A cynical person would say it’s because as long as the people who need to be paid are getting paid, unskilled labor is cheap and easy to scare/boss around, illegal immigration is not actually a problem, but an opportunity for them.
>You lost me at "stealing from the country they broke into illegally."
Sorry about that, I'll clarify: Illegals do not pay state or federal taxes in exchange for the services they benefit from. The validity of taxes themselves is an issue itself that can be debated, but the refusal to pay taxes at all is a form of theft. There's a general attitude of something roughly like, "The more money I save now, the quicker I can get back home." This means not paying for things, stealing food, etc. You learn to lock your car up and not leave your cellphone laying around real quick.
> I see people working hard to try to improve their and their families' lives.
Irrelevant.
Again, sorry if this sounds snippy, but it's true. We could presume that about literally anyone. It does not justify a cop taking a bribe, or a CEO lying to customers to get ahead. There is no justification for breaking into a country illegally. A good deed after committing a crime makes a criminal both naive and poorer for the effort.
More to the point, in the situation that I was speaking of their actions, in my understanding, nothing to do with "their families' lives". The purpose was to save money, in order to build houses so that they themselves would not need to work for a number of years. The men that I worked with were not married, did not have children, and never mentioned their extended families over the course of the years that I worked with them. You can assume that they may have been sending money to relatives, but there is nothing to support that assertion. Honestly, I strongly doubt that assumption in the way that it's written, based on the behavior that I witnessed on a routine basis.
Consider this, in the image of illegals that you have in your mind: do you see them beating homosexuals in the back because they felt like it? Do you see them driving to work drunk? These are the sorts of things I saw regularly. I did not see anything approaching some valiant hero, "just tryin' to provide for the lil' ones back home". I saw drunk, paranoid, irrationally violent men who were going to do whatever they wanted to while they could get away with it. I had little reason to believe that the men I worked with weren't complete sociopaths, let alone believe that they had any sort of duty to provide for some distant relative.
Are there some that do send money back? Maybe the stupid ones. But if they do, they're going to be "stuck" in America longer than they would otherwise. The illegals that I worked with had zero intention of staying in America for any extended length of time. It was just a way to make money and get out. The "I'm gonna get mine, hope you get yours" type mindset.
>Surely the employer is deducting for income tax, SS tax, and medicare tax from their paychecks, and they will not see an income tax "refund" next April nor will they ever collect SS nor Medicare benefits.
I wasn't privy to reading the details of each of their paychecks, but I would assume that they were paying income tax, SS tax, and medicare. If you're attempting to assert that by paying into those things that they were automatically paying for, that it somehow justified or lessened their crimes, you are mistaken. I pay into medicare. I pay into SSN. I have no expectation of ever receiving access to either service being available by the time I would be eligible to use them. I do not, however, then assume that I am somehow being "stolen" from, or "donating" that money. I pay it because I have no choice in the matter. I have already come to terms with that. I have accepted that neither service could possibly be sustainable for the next several decades. That fact however, does not mean that I have some right or choice to not pay into it.
>And if the employer is not making these deductions then who is doing the "stealing" exactly?
Given the points covered above, again, it is the illegals that are stealing. The company, without question, absolutely knew what was going on. They were complicit, a form of accomplice, sure. But the active process of stealing? That was on the part of the illegals - the company simply capitalized on the "great opportunity" and stood to benefit by working with thieves; birds of a feather and all of that.
Again, I don't really have any hatred for these people. They do it because they can get away with it, and there is very little incentive to stop them from doing it. I simply don't feel much in the way of sympathy when the people taking advantage of the country, are in turn, being taken advantage of by scummy corporations that exist within that country. When criminals work with criminals, should it come as a surprise when one rips off another? No one is going to call the cops over receiving a bad batch of heroin, it's simply the cost of doing business with that sort of person.
How the fark does the IRS not notice when a single SSN gets W-2s from 50 different employers, each with a different payee name?
All this stuff is completely computerized. Unlike tax returns, it is no longer possible to file W-2s on paper. You must file them electronically.
> each with a different payee name?
Everyone was using the same name. There's no rule that says you can't be on 50 different payrolls.
When corporate lobbyists want the IRS to crack down on illegal immigrant workers, then there will be an effective crackdown. Until then, it will be possible to (cheaply) use stolen identities to get jobs past online verification.
Equifax - one of the huge credit reporting agencies - is trying to squeeze in to this space.
Until then, Form I-9 gets filed on paper and that paper is kept in the employer's office. After 3 years, they can discard it.
Nova Law Review article with some background of my original post: https://nsuworks.nova.edu/nlr/vol32/iss2/6/
Department of Labor is upset that one of the consent decrees with Walmart gives them 15 day notice before any investigation of wages: https://www.oig.dol.gov/public/reports/oa/2006/04-06-001-04-...
I can't find the consent decree where Walmart gets advance notice of Immigration investigations. All of the primary links are dead. 30 or 60 day advance notice - this will prevent SWAT-style raids like those at the Swift meatpacking plants. Like the above one, if Walmart is "in compliance" when Immigration is allowed in the door, then they are exempt from fines & penalties. Walmart paid $11M in penalties for this one. Several of the blog posts reporting on the consent decree imply that the no-jail plus advance notice were a result of large campaign contributions to one political party along with political appointees interfering with enforcement actions.
> Not a RICO case, but illustrates ICE efforts to hold companies responsible for their subcontractor’s violations.
https://www.mondaq.com/unitedstates/work-visas/50104/immigra...
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3345232
> At the time of the raids, the government said they had wiretaps showing that Wal-Mart executives knew the company was using illegal workers. However, as part of the settlement the company will not admit any wrongdoing or liability.
https://money.cnn.com/2005/03/18/news/fortune500/wal_mart_se...
There are no jobs that Americans don't want to do. There are only jobs that Americans don't want to do at exploitative wages.
And I agree with you about the exploitative wages mostly, but I don't know what to do about it.
So we pay real wages to migrant farm workers -- Even if we double subsidies for corn and whatnot, beef now costs 3X at the supermarket.
In Texas, 1 in 5 children are hungry every day[1]. How do you do it so that more children aren't made less food safe and you don't cause riots/social unrest from exploding inflation?
Sigh.... I wish we could at least all work on the problems instead of all the sloganeering always going on. Not to say you're doing that, it just feels like we can never have any kind of real conversation about what to do anymore -- Maybe it's just that no one is driving the bus anymore.
Have a good day!
Kind of like 2FA is currently "solved" by requiring mobile numbers instead of something like Ubikey, even though SMS is insecure and awful for privacy.
Alex Jones used the same reasoning to declare the Sandy Hook shooting a false flag intended to move the conversation about gun control. I encourage you to watch the coverage of the ongoing hearing where the very real people who lost their very real loved ones are testifying.
You can't have a discord or signal account without a valid phone number. Think about that for a second.
But yeah, not being able to use proper 2FA devices annoys the bejeesus out of me
I see dozens of problematic uses of the tech everywhere in the news. But, other than "it's cool that we can do this" demos, I have not yet seen 1 application of this that I'd actually want.
If you need to access the walled garden but would prefer to keep your identity from them, thispersondoesntexist + deepfakes could be one way to do it.
De-aging actors such as Luke Skywalker in the Book of Boba Fett.
https://www.breitbart.com/entertainment/2022/08/12/lionsgate...
Still feels like a gimmick. Particularly because most of the value you get out of processing the audio, not the video. And video is the part of deepfakes that I feel never should have been developed (but was inevitable, someone was eventually going to make it happen).
I don't endorse the idea, but it with the correct implementation it could be a legitimate use.
They couldn't quite him on set on time for a particular scene, so at some point some guy on set said "Hey, this guy is roughly the same build as the JdG, why not have him put the costume for this scene and stand here, and deepfake the JdG's face later?". It's still a bit visible in the video though.
You could still get a movie shipped without using the tech tho. Feels slightly gimmicky, but legitimate indeed. Cheers!
Hiding your real appearance on video calls (like that famous cat filter, but a normal-looking human instead of a cat)? I think the usual reasons I hear are either people with stalkers or people who have issues with their appearance.
Blackhatworld is the only one I know of, any others?
There used to be raidforums as a big one before being seized by LE but it's not hard to imagine that another forum sprung up to fill the void that RF left behind.
Krebsonsecurity blogs about transactions on some of these (often in Russian language) forums although I don't know if he mentions them by name.
Don't expect HN-level discourse though, it's a mess.
Typically, there are different tiers and the higher your reputation, the more content and channels you have access to.
I think the lack of action with FaceBook & Cambridge Analytica shows exactly where this is going in the future.
So far it isn’t common enough to be a scandal.
> Someone is pretending to be me https://news.ycombinator.com/item?id=32996953
It would be trivial to create a deepfake model to represent the author in interviews and meetings. If your picture is available online, anyone could pretend to be you. Pretty scary.
Because I am too ugly.