The xz backdoor thing reminds me of a story

Eh. I suppose 3 points, all minor:

1) Best of luck in an audit explaining that there is almost a 14% chance that your project is free of backdoors given reasonable assumptions. I recommend taking a photo of the auditor's expression and reporting back.

2) There are quibbles to be had about the IID assumption here; dependencies tend aren't selected randomly and attackers aren't targeting them randomly.

3) You don't need a for loop for that, you can calculate directly with `1-(0.99*200)`.

You can create a forged chipped passport, just have the chip not work. Won't work at the border, but would be fine everywhere else you show a passport. I've never had anyone (bars, hotels etc) read a chip.

Doing such a thing is entirely within the purview and capability set of an intelligence agency.

Why would you need to? Passports are not required to hire a person; most americans don’t even have one.

They can forge a real one by providing enough forged identity documents and paying the right bribes. They don't need to suborn the private keys - Just the people who have "use" access to them.

The likely approach would probably be less technical and more covert ops, tricking the target country into issuing a (technically) genuine passport. No need to break encryption/signing this way.

They can and also now you know why they use specific countries like Brazil, etc to forge fake identities (other than the fact it’s easier to mask the accent / cultural things). Also not all passports are chipped - it is not a requirement for us visa, only vwp

Of course they can. Have you not seen any Bond or Mission Impossible Movies?

But seriously, why would they not be able to? They will almost certainly have high-level connections into the State Dept. (or whatever agency issues passports for your country) that allows them to create any passports they need. Same way the Police can get license plates for undercover vehicles from the DMV that don't list "One Police Plaza" if someone (i.e. "other" Police) runs the plates.

Not all countries have chipped passports. But those passports are just as valid as any other.

I suppose I'm doubting that e-verify was ubiquitous 20 years ago, or nearly as likely to catch things.

Using money you owe for something else for as long as you get away with is hardly alien in business in general. It is why most companies (almost every company?) delay payment of invoices for as long as legally possible, no point losing that fraction of whatever in interest (or interest saved on debt). Heck, with regard to cheques it is why banks held on to 3+ clearing periods on those and other payments for as long as they did. Doing the same with outgoings to employees isn't a stretch that would surprise me in the slightest.

Not really. More like, “we could make an extra hundred bucks a week by doing X”. So they do X. If it’s annoying to the employees, that cost is not considered.

At least in Canada, the numbers provided for direct deposit are the same numbers used for direct/pre-authorized debit (i.e. withdrawals). So, while your employer likely wouldn’t abuse that information? People may be wary of giving out those numbers unless absolutely necessary, since someone could indeed drain their bank account. They’re also the same numbers that appear on cheques, so someone could easily forge a cheque in your name with those numbers.

Because you’re trying to plant backdoors you don’t want any paper trail?

Almost everyone does direct deposit. But it’s not a legal requirement for an employee to be paid that way.

In America they can and do also take money out of your account, to correct errors supposedly, but sometimes also in error. I still get paid on paper to this day because to me the terms of the direct deposit agreement are overbroad.

In the US, I'm fairly sure your bank account number (routing and account) can be used to withdraw money.

Apart from the paper trail side of it, some people just really hate banks and don’t have an account.

In the US, if you know someone's routing/bank number, name, and address, you can write cheques in their name.

There's companies that make their money on selling (now, usually older folk) literal books of cheques. One of the ways you can pay is literally for them to write themselves a cheque from "you" that gets processed digitally.

The US is a strange banking system wherein I have had the unpleasant experience of putting my card into the reader at a 7-11 and it just... Not work. Why? Nobody knows. ApplePay sometimes works -- some readers know how to handle it, others lose their shit and crash.

Sorry, what does being Norwegian have to do with it? Going to the physical bank with a physical check seems like too many steps no matter what country you're from.

Maybe I'm a bit to naive since I don't know the US banking system, but at least in the EU you just need to tell someone your IBAN and Name and they can transfer money to your account. Is it that much harder in the US?

That is so weird. What is there to set-up about deposit? Can't they just input your account number and send you your money?

Bingo.

Leaving the checks uncashed means there's less of a paper trail to follow.

People with fake identities because they're working as a spy have real bank accounts. But more importantly, cheque-cashing places give a god-awful return but would still look more legitimate then just not ever cashing anything.

In short: the details of this story make no sense for the implied narrative (spy). They make a lot of sense for "not mentally well person" or "guy who suddenly had to disappear for other reasons". Combined with just "regular software developer things".

For example - I've cloned the entire git repository server of every place I've ever worked at. I have a script which does it for Github and Gitlab, because usually when you're exploring a codebase you wind up needing just "every repo" and it's easier to dump it all in a folder on my work machine ahead of time. I've run "find" on a network share because have you ever tried to figure out where a particular word document might be after looking through 10+ years of random SMB share naming systems and empty folders?

Read the stories of long-term agents from the Cold War - for both sides, but Russians in America is easier to find the stories of. Spies don't act secretive, spies blend by acting normal. They're an unremarkable next door neighbor who never draws any attention and works a respectable job. They're polite to their neighbors but keep to themselves, they do things on time and promptly, they have identities that check out and do normal things like "get paid from a regular job".

Whereas people absolutely can and do simply ghost jobs all the time. Like a simple explanation here for this guy would be "was actually an illegal immigrant and someone told him that going from contractor to full time employee might be too much exposure, got spooked and bailed". Probably was just an actual software developer. And if you here "illegal immigrant" and think "Mexican" you're also wrong - plenty of people overstay or exceed the bounds of their visas in the US.

P.S. "contributed a large number of commits to the project he was assigned to" - you know, as would be expected when you're hired to work on something? What was in those commits? Why is it omitted from the story?