8 ms·

I Worked for a Criminal Organization

264 points by bsdpunk 7y ago

htfu 7y ago
Interesting read! Sounds like however it turns out... they had it coming. How common are setups like this, anyone know?
fxtentacle 7y ago
You have an interesting writing style, describing your experience as if you're watching the weather drift by.
- theawesomekhan 7y ago
  True, he writes blissfully
ikeboy 7y ago
> They insisted I never talk to any LEO Nothing wrong with this ... >PTR records, Enabling Spam Doesn't say why that's illegal. At best it says they had customers that broke the law. >Often both the CEO and Vice President would talk openly about how one of our clients was violating the TOS of several companies. Not criminal even for the client, at least assuming the HiQ v Linkedin case is upheld. And not illegal for the company. Maybe civil liability under tortious interference? Pretty high bar there, though. And that's all assuming there's an actual ToS - the one example given is of Google search results. Manipulating your own website in the hopes Google treats it favorably can't be seen as violating any agreed ToS. The stuff Micfo was accused of in court, and the stuff OP is claiming are criminal acts, are disjoint.
- ghostbrainalpha 7y ago
  >At best it says they had customers that broke the law. Did you see the part at the top where the CEO admitted to being all of those "customers"? They were playing a shell game, and while this guy didn't do the criminal activities he definitely was working for the "legitimate front end" of a larger criminal organization.
  - ikeboy 7y ago
    I read the entire post. Can you please quote the part you're referring to?
    - ghostbrainalpha 7y ago
      "Within a week I was convinced Micfo encompassed more than just Micfo, but a handful of shell companies: This was later proved to be true when the CEO(Amir), admitted in the ARIN(American Registry for Internet Numbers) trial, he was really behind these entities."
      - ikeboy 7y ago
        As far as I can tell, those shell companies were to get additional IP addresses out of ARIN. It's not been alleged that they were customers of Micfo running spamming etc services, by anyone except you.
        ajross 7y ago
        And the author. But your claim was that this was unrelated to the trial. The response was that, no, it actually corroborated the core allegation in the Micfo case. It's true that it alleges other stuff. That doesn't make the IP fraud point somehow not corroboration.
        ikeboy 7y ago
        The author does not allege that. >But your claim was that this was unrelated to the trial. The response was that, no, it actually corroborated the core allegation in the Micfo case. Now you're misreading both OP and the response to my comment. ghostbrainalpha claimed that the OP says the CEO was the same as the customers that were allegedly committing crimes like spamming. The OP does not say this. >That doesn't make the IP fraud point somehow not corroboration. OP never mentions this as one of the crimes he's listing. He lists: 1. Mishandling of warrants 2. Child endangerment 3. Enabling spamming 4. Enabling ToS violations None of the things OP says are crimes are actually illegal, and none of them were at issue during the trial. That's what I pointed out.
- blincoln 7y ago
  >> They insisted I never talk to any LEO > Nothing wrong with this ... Depending on where they're located, failure to report certain types of crime to law enforcement may itself be a crime.
  - hrktb 7y ago
    Reporting the issues to the legal department, which then deals with it could be a ways around this. For blatant issues (i.e. there's a dead body) you'd still be expected to act on your own, but on any greyer area you'd be covered.
  - dannyw 7y ago
    In many, if not most companies, taking legal matters into your own hands without involving your company’s legal team will surely get you reprimanded if not fired. Just like how you would get fired if you sent out a legal demand letter to another company without legal being in the loop. Law enforcement is no different: they are not your friend.
    - n0rbwah 7y ago
      Your employer isn't your friend either and most of them will gladly throw you under the law enforcement bus if it comes to that.
      - kbenson 7y ago
        You employer isn't your friend, but there are aligned incentives when it comes to the business continuity and your continued employment as affected by general business health (even if not necessarily aligned when it comes to your benefits and salary). Law enforcement doesn't even have that aligned incentive. You might say you are aligned in that you want the law to be followed, but their incentive is more along the lines of making sure they bring in and prosecute cases. If the only way to make the case work is to throw the company that reported it (and by extension, its employees) into the grinder because that's all they think they can successfully do, then that's likely what they'll do.
preinheimer 7y ago
So Micfo was one of our suppliers, they remain the only one to have mailed us chocolate at Christmas. The chocolate wasn't great, but it's more than any of our other providers have mailed us :).
dang 7y ago
This is related to https://news.ycombinator.com/item?id=22354357 https://news.ycombinator.com/item?id=22354357.
hackermailman 7y ago
Not uncommon in some cities in Canada to find out you're working for a criminal outfit if writing point of sale/restaurant software where they want you to produce one receipt for the customer and a different one for the restaurant or salon or shady car mechanic that then pockets the unreported tax aka a 'zapper'. Profitek was busted once, InfoSpec Systems, zappers are in high demand
- frandroid 7y ago
  No wonder the Québec government swooped in and mandated a government POS terminal for the food service industry. :)
  - deleted 7y ago
    [deleted]
  - stef25 7y ago
    They did that here in Belgium too. Didn't take very long for one of the few official manufacturers of said terminals to jailed after presumably installing a few custom features.
  - cat199 7y ago
    > government POS terminal for the food service industry. :) and how did procurement for that contract go?
- nitrogen 7y ago
  Are these used to inflate records of customer bills for laundering, or to deflate customer bills for tax fraud?
  - didericis 7y ago
    > pockets the unreported tax I’d assume tax fraud is much more common than money laundering. Maybe drug dealers and the like create enough of a market for “reverse zappers” to exist; not sure.
Koremat6666 7y ago
May be I missed it but can someone tell me what was the crime the company was committing ? Almost any company will have defensive strategies such as stalling LEOs and Warrants in whatever way they can. A lot of this is not really "crime" as in kidnapping people or shooting people dead in some alley. Is having shell companies a crime ? I know a ton of bay area "startups" than engage in these sort of tricks to maximize the brand damage. Ask.com and other toolbar companies are great examples where they will just rebrand the same toolbar as X and sell it to 10 companies which were owned by same entity. Half the companies with "explosive" growth were using mass mailing techniques than involved spamming. Many used foreign companies to skirt US law related to spamming. I think author is overthinking.
- Spooky23 7y ago
  Fraud. You didn’t miss it. Everything after that first question were excuses for why it’s ok to break the law.
  - Karishma1234fff 7y ago
    Which law is being broken? Also (in my personal opinion) criminality should be obvious to a general person, some kind of complex technical illegality may not make the whole company a "criminal organization". A lot of reputed companies like Google get fined on regular basis world over does not make them criminal organizations. A lot of companies would also willingly break the law depending on the risk tolerance they have, many of those laws result into civil penalties and not jail time for CEO so that also matters. I was genuinely hoping OP worked from some underground enterprise that provided hitmans to rich people or something. La John Wick style. But thats just the romantic in me.
    - Spooky23 7y ago
      Misrepresentation when money or other tangible things are at stake is fraud. There are civil frauds and criminal frauds. Say you needed to have a room added to your home. You approach a contractor, who talks about his past experience, and offers up several customer and trade references to corroborate this experience. You sign a contract, pay the 50% deposit, and the person disappears and doesn’t respond to your inquiries, nor those of the police. You later find out that the customers were family members of the contractor, the trade reference was a Delaware corporation owned by the same Nevada corporation that cashed your check. In other words, the entire enterprise was a criminal enterprise constructed to defraud customers, not deliver. That contrived example is an obvious series of frauds that is obviously a criminal enterprise. It’s easy to understand because the money was stolen. A case like this is a little different because the fraud was basically a scheme to get a constrained resource by lying about material facts to commit the fraud. IANAL, but my guess is the deliberate construction of these legal entities with no meaningful purpose elevated the matter.
walrus01 7y ago
Man, screwing with ARIN seems like a really dumb idea. They're located in northern VA and their leadership team has direct contacts at places like the US district attorney's office, and FBI. Some of the internet grey beards who know the ARIN leadership are well connected in the parts of the US government responsible for "cybersecurity". People at ARIN also have 20+ years of experience identifying shell games.
nyolfen 7y ago
wsj writeup: https://www.wsj.com/articles/fraud-case-in-charleston-s-c-shines-light-on-webs-dark-corners-11581944400 https://www.wsj.com/articles/fraud-case-in-charleston-s-c-sh...
Causality1 7y ago
The only substantial difference between this company and, say, Facebook, is that Facebook generally knows how to budget properly. Facebook and other large successful companies try to only commit crimes when they know the profit from doing so exceeds the risk of being caught and punished.
- goatinaboat 7y ago
  Facebook and other large successful companies try to only commit crimes when they know the profit from doing so exceeds the risk of being caught and punished. Indeed; when I clicked the story I expected it to be about working for a FAANG.
- speedplane 7y ago
  > Facebook and other large successful companies try to only commit crimes when they know the profit from doing so exceeds the risk of being caught and punished. While this statement is often true (big companies make these cost-benefit decisions), I don't think it really captures what is happening to Facebook. Doing a cost-benefit analysis like this requires having data on potential costs and benefits. In most cases, Facebook didn't have this data. When an individual, company, or institution is faced with a decision, but lacks data to properly evaluate it, they fallback on other decision making tools, including instinct and principles. Facebook almost certainly didn't know the consequences of the many decisions they made, they didn't know the potential costs or benefits. But they did have some underlying principles, namely: maximizing platform engagement, convincing people to share more personal data on their platform, and exploiting user data for better advertising. With these foundational principles, you can end up making some really bad decisions even without a proper cost-benefit analysis.
- heisenbit 7y ago
  Well FB - lets you sign a waiver that you are willing to receive spam - ensures that you sign with your real name, not a shell - are not a helpless child that can be endangered This together guarantees that neither a crime is committed nor enabled.
CKN23-ARIN 7y ago
Court documents from the ARIN case: https://www.courtlistener.com/docket/15619663/oppobox-llc-v-american-registry-for-internet-numbers-ltd/ https://www.courtlistener.com/docket/15619663/oppobox-llc-v-... From the criminal wire fraud case: https://www.courtlistener.com/docket/15619660/united-states-v-golestan/ https://www.courtlistener.com/docket/15619660/united-states-...
blackrock 7y ago
Geez. I wonder if working for a porn hosting company is better. I’d rather not work for either, but if you’re not in a hot tech area, then your choices are limited.
- toyg 7y ago
  Sometimes I find myself thinking that working in porn could actually be pretty interesting - what with massive caching needs, video encoding etc etc... Unfortunately the few job ads I’ve seen were for super-boring stacks like PHP or Perl, which I’d rather avoid.
  - Cthulhu_ 7y ago
    Definitely, I'm convinced that a lot of people that made youtube and other video hosting sites work in the early days actually came from the online porn industry.
- wappayment 7y ago
  A few years back i used to work for a porn company and they are not. There is an old protocol still creeping around smartphones known as WAP Payment (yes that WAP) which was/is used to buy stuff on the mobile web and the purchase shows up on your phone bill. They buy all type of mobile ads (banner, text, popup, modal, etc.) and when you open the ad you get billed 4€, 5€, 6€ per week or month, without any confirmation whatsoever. Some phone carriers ask for user input (mostly the user has to click a button "I agree") but that's where click-jacking, CSRF and other kind of exploit comes in, very few ask for a confirmation code. The sad thing is that they know, the carriers know but they don't care, until enough people complain about it then they shutdown the service to that website for a few days (in some cases they shut it down permanently) but they always come back online. P.S. this is a throwaway account
alexcnwy 7y ago
Epic
apache99 7y ago
I also love Canadian Hip Hop. Especially from Torronto. Casper TNG is really cool
KptMarchewa 7y ago
> The playing field will always be non-level, you gotta deal with it. What a shitty boomer attitude.
Izmaki 7y ago
Honestly I expected worse. But then again if it was, writing about it would probably be a felony on its own.

264 points by bsdpunk 7y ago

htfu 7y ago

Interesting read! Sounds like however it turns out... they had it coming. How common are setups like this, anyone know?

fxtentacle 7y ago

You have an interesting writing style, describing your experience as if you're watching the weather drift by.

theawesomekhan 7y ago
True, he writes blissfully

ikeboy 7y ago

> They insisted I never talk to any LEO Nothing wrong with this ... >PTR records, Enabling Spam Doesn't say why that's illegal. At best it says they had customers that broke the law. >Often both the CEO and Vice President would talk openly about how one of our clients was violating the TOS of several companies. Not criminal even for the client, at least assuming the HiQ v Linkedin case is upheld. And not illegal for the company. Maybe civil liability under tortious interference? Pretty high bar there, though. And that's all assuming there's an actual ToS - the one example given is of Google search results. Manipulating your own website in the hopes Google treats it favorably can't be seen as violating any agreed ToS. The stuff Micfo was accused of in court, and the stuff OP is claiming are criminal acts, are disjoint.

ghostbrainalpha 7y ago
>At best it says they had customers that broke the law. Did you see the part at the top where the CEO admitted to being all of those "customers"? They were playing a shell game, and while this guy didn't do the criminal activities he definitely was working for the "legitimate front end" of a larger criminal organization.
- ikeboy 7y ago
  I read the entire post. Can you please quote the part you're referring to?
  - ghostbrainalpha 7y ago
    "Within a week I was convinced Micfo encompassed more than just Micfo, but a handful of shell companies: This was later proved to be true when the CEO(Amir), admitted in the ARIN(American Registry for Internet Numbers) trial, he was really behind these entities."
    - ikeboy 7y ago
      As far as I can tell, those shell companies were to get additional IP addresses out of ARIN. It's not been alleged that they were customers of Micfo running spamming etc services, by anyone except you.
      - ajross 7y ago
        And the author. But your claim was that this was unrelated to the trial. The response was that, no, it actually corroborated the core allegation in the Micfo case. It's true that it alleges other stuff. That doesn't make the IP fraud point somehow not corroboration.
        ikeboy 7y ago
        The author does not allege that. >But your claim was that this was unrelated to the trial. The response was that, no, it actually corroborated the core allegation in the Micfo case. Now you're misreading both OP and the response to my comment. ghostbrainalpha claimed that the OP says the CEO was the same as the customers that were allegedly committing crimes like spamming. The OP does not say this. >That doesn't make the IP fraud point somehow not corroboration. OP never mentions this as one of the crimes he's listing. He lists: 1. Mishandling of warrants 2. Child endangerment 3. Enabling spamming 4. Enabling ToS violations None of the things OP says are crimes are actually illegal, and none of them were at issue during the trial. That's what I pointed out.
blincoln 7y ago
>> They insisted I never talk to any LEO > Nothing wrong with this ... Depending on where they're located, failure to report certain types of crime to law enforcement may itself be a crime.
- hrktb 7y ago
  Reporting the issues to the legal department, which then deals with it could be a ways around this. For blatant issues (i.e. there's a dead body) you'd still be expected to act on your own, but on any greyer area you'd be covered.
- dannyw 7y ago
  In many, if not most companies, taking legal matters into your own hands without involving your company’s legal team will surely get you reprimanded if not fired. Just like how you would get fired if you sent out a legal demand letter to another company without legal being in the loop. Law enforcement is no different: they are not your friend.
  - n0rbwah 7y ago
    Your employer isn't your friend either and most of them will gladly throw you under the law enforcement bus if it comes to that.
    - kbenson 7y ago
      You employer isn't your friend, but there are aligned incentives when it comes to the business continuity and your continued employment as affected by general business health (even if not necessarily aligned when it comes to your benefits and salary). Law enforcement doesn't even have that aligned incentive. You might say you are aligned in that you want the law to be followed, but their incentive is more along the lines of making sure they bring in and prosecute cases. If the only way to make the case work is to throw the company that reported it (and by extension, its employees) into the grinder because that's all they think they can successfully do, then that's likely what they'll do.

preinheimer 7y ago

So Micfo was one of our suppliers, they remain the only one to have mailed us chocolate at Christmas. The chocolate wasn't great, but it's more than any of our other providers have mailed us :).

dang 7y ago

This is related to https://news.ycombinator.com/item?id=22354357 https://news.ycombinator.com/item?id=22354357.

hackermailman 7y ago

Not uncommon in some cities in Canada to find out you're working for a criminal outfit if writing point of sale/restaurant software where they want you to produce one receipt for the customer and a different one for the restaurant or salon or shady car mechanic that then pockets the unreported tax aka a 'zapper'. Profitek was busted once, InfoSpec Systems, zappers are in high demand

frandroid 7y ago
No wonder the Québec government swooped in and mandated a government POS terminal for the food service industry. :)
- deleted 7y ago
  [deleted]
- stef25 7y ago
  They did that here in Belgium too. Didn't take very long for one of the few official manufacturers of said terminals to jailed after presumably installing a few custom features.
- cat199 7y ago
  > government POS terminal for the food service industry. :) and how did procurement for that contract go?
nitrogen 7y ago
Are these used to inflate records of customer bills for laundering, or to deflate customer bills for tax fraud?
- didericis 7y ago
  > pockets the unreported tax I’d assume tax fraud is much more common than money laundering. Maybe drug dealers and the like create enough of a market for “reverse zappers” to exist; not sure.

Koremat6666 7y ago

May be I missed it but can someone tell me what was the crime the company was committing ? Almost any company will have defensive strategies such as stalling LEOs and Warrants in whatever way they can. A lot of this is not really "crime" as in kidnapping people or shooting people dead in some alley. Is having shell companies a crime ? I know a ton of bay area "startups" than engage in these sort of tricks to maximize the brand damage. Ask.com and other toolbar companies are great examples where they will just rebrand the same toolbar as X and sell it to 10 companies which were owned by same entity. Half the companies with "explosive" growth were using mass mailing techniques than involved spamming. Many used foreign companies to skirt US law related to spamming. I think author is overthinking.

Spooky23 7y ago
Fraud. You didn’t miss it. Everything after that first question were excuses for why it’s ok to break the law.
- Karishma1234fff 7y ago
  Which law is being broken? Also (in my personal opinion) criminality should be obvious to a general person, some kind of complex technical illegality may not make the whole company a "criminal organization". A lot of reputed companies like Google get fined on regular basis world over does not make them criminal organizations. A lot of companies would also willingly break the law depending on the risk tolerance they have, many of those laws result into civil penalties and not jail time for CEO so that also matters. I was genuinely hoping OP worked from some underground enterprise that provided hitmans to rich people or something. La John Wick style. But thats just the romantic in me.
  - Spooky23 7y ago
    Misrepresentation when money or other tangible things are at stake is fraud. There are civil frauds and criminal frauds. Say you needed to have a room added to your home. You approach a contractor, who talks about his past experience, and offers up several customer and trade references to corroborate this experience. You sign a contract, pay the 50% deposit, and the person disappears and doesn’t respond to your inquiries, nor those of the police. You later find out that the customers were family members of the contractor, the trade reference was a Delaware corporation owned by the same Nevada corporation that cashed your check. In other words, the entire enterprise was a criminal enterprise constructed to defraud customers, not deliver. That contrived example is an obvious series of frauds that is obviously a criminal enterprise. It’s easy to understand because the money was stolen. A case like this is a little different because the fraud was basically a scheme to get a constrained resource by lying about material facts to commit the fraud. IANAL, but my guess is the deliberate construction of these legal entities with no meaningful purpose elevated the matter.

walrus01 7y ago

Man, screwing with ARIN seems like a really dumb idea. They're located in northern VA and their leadership team has direct contacts at places like the US district attorney's office, and FBI. Some of the internet grey beards who know the ARIN leadership are well connected in the parts of the US government responsible for "cybersecurity". People at ARIN also have 20+ years of experience identifying shell games.

nyolfen 7y ago

wsj writeup: https://www.wsj.com/articles/fraud-case-in-charleston-s-c-shines-light-on-webs-dark-corners-11581944400 https://www.wsj.com/articles/fraud-case-in-charleston-s-c-sh...

Causality1 7y ago

The only substantial difference between this company and, say, Facebook, is that Facebook generally knows how to budget properly. Facebook and other large successful companies try to only commit crimes when they know the profit from doing so exceeds the risk of being caught and punished.

goatinaboat 7y ago
Facebook and other large successful companies try to only commit crimes when they know the profit from doing so exceeds the risk of being caught and punished. Indeed; when I clicked the story I expected it to be about working for a FAANG.
speedplane 7y ago
> Facebook and other large successful companies try to only commit crimes when they know the profit from doing so exceeds the risk of being caught and punished. While this statement is often true (big companies make these cost-benefit decisions), I don't think it really captures what is happening to Facebook. Doing a cost-benefit analysis like this requires having data on potential costs and benefits. In most cases, Facebook didn't have this data. When an individual, company, or institution is faced with a decision, but lacks data to properly evaluate it, they fallback on other decision making tools, including instinct and principles. Facebook almost certainly didn't know the consequences of the many decisions they made, they didn't know the potential costs or benefits. But they did have some underlying principles, namely: maximizing platform engagement, convincing people to share more personal data on their platform, and exploiting user data for better advertising. With these foundational principles, you can end up making some really bad decisions even without a proper cost-benefit analysis.
heisenbit 7y ago
Well FB - lets you sign a waiver that you are willing to receive spam - ensures that you sign with your real name, not a shell - are not a helpless child that can be endangered This together guarantees that neither a crime is committed nor enabled.

CKN23-ARIN 7y ago

Court documents from the ARIN case: https://www.courtlistener.com/docket/15619663/oppobox-llc-v-american-registry-for-internet-numbers-ltd/ https://www.courtlistener.com/docket/15619663/oppobox-llc-v-... From the criminal wire fraud case: https://www.courtlistener.com/docket/15619660/united-states-v-golestan/ https://www.courtlistener.com/docket/15619660/united-states-...

blackrock 7y ago

Geez. I wonder if working for a porn hosting company is better. I’d rather not work for either, but if you’re not in a hot tech area, then your choices are limited.

toyg 7y ago
Sometimes I find myself thinking that working in porn could actually be pretty interesting - what with massive caching needs, video encoding etc etc... Unfortunately the few job ads I’ve seen were for super-boring stacks like PHP or Perl, which I’d rather avoid.
- Cthulhu_ 7y ago
  Definitely, I'm convinced that a lot of people that made youtube and other video hosting sites work in the early days actually came from the online porn industry.
wappayment 7y ago
A few years back i used to work for a porn company and they are not. There is an old protocol still creeping around smartphones known as WAP Payment (yes that WAP) which was/is used to buy stuff on the mobile web and the purchase shows up on your phone bill. They buy all type of mobile ads (banner, text, popup, modal, etc.) and when you open the ad you get billed 4€, 5€, 6€ per week or month, without any confirmation whatsoever. Some phone carriers ask for user input (mostly the user has to click a button "I agree") but that's where click-jacking, CSRF and other kind of exploit comes in, very few ask for a confirmation code. The sad thing is that they know, the carriers know but they don't care, until enough people complain about it then they shutdown the service to that website for a few days (in some cases they shut it down permanently) but they always come back online. P.S. this is a throwaway account

alexcnwy 7y ago

Epic

apache99 7y ago

I also love Canadian Hip Hop. Especially from Torronto. Casper TNG is really cool

KptMarchewa 7y ago

> The playing field will always be non-level, you gotta deal with it. What a shitty boomer attitude.

Izmaki 7y ago

Honestly I expected worse. But then again if it was, writing about it would probably be a felony on its own.