Hacker News Reader

Comment by pylua | Hacker News Reader

Criminal negligence on the behalf of Boeing sounds like a stretch. If you have to verify the details of the work you outsource then everything would have to be done in house, and there would be no benefit to it. Are you criminally liable if your supplier commits fraud ?

View on HN

> If you have to verify the details of the work you outsource

Yes, they have to verify. Verification is necessary whether or not the component is sourced through a supplier or in-house. Verification happens after the sourcing step. And yes, you are criminally liable in the supplier case if your supplier commits fraud and you knew about it, as is the implication here.

Two things:

Are they legally bound to do the verification themselves ? Seems like it would be more cost efficient to outsource that as well, which would just be prone to fraud.

I did not see it mentioned where they were aware that their suppliers were committing fraud. At these large companies the executives only look at the spreadsheets and take the contracts as fact, regardless if a third party can deliver.

It would only make sense that they would do it. We test materials randomly at one place I went to randomly. It wasn’t every piece or every batch, but we definitely sent off materials to labs to get tested. We weren’t under the eye of anything like the FAA either, we were doing it to just ensure QA that out gearing was made with quality materials and not junk. It’s not cheap but it’s not outrageously expensive either to get metallurgy checked to make sure it’s meeting your requirements as per the mechanical design.

Seems like outsourcing to a lab to verify would have equal chances of fraud as the supplier ?

You are (or should be) if you took no effort to avoid the fraud for something this important. In IT, if you hire a company to handle your SSO, but don’t check that they have the required certifications verified by independent auditors for their own security you may well be on the hook when they expose your customers’ data.

I agree you should be. I don’t think our economic system enforces those checks. In practice auditing and pen testing are just farmed to the lowest cost place that says they will do everything. The system has no proper checks or balances against fraud.

You can’t outsource liability to a random Chinese supplier with no significant presence in US. Small Chinese company will sign whatever agreement you want and promise to do whatever checks you need - and then do absolutely nothing. What are you gonna do if something goes wrong? Sue them in Chinese court? Good luck.

If you want actual compliance, you have to send actual person (that you trust - it’s another big problem as that person can get bribed) in flesh and blood to verify everything and essentially be part of supplier team. That’s the only way.

I don’t believe you can do that outsourcing in good faith. However, assuming they did and were lied to, does that constitute liability I would see them arguing they are the victim.

Reply on news.ycombinator.com