Comment by jstarfish | Hacker News Reader

Comment by jstarfish | Hacker News Reader

The article is about Equifax, but based on the histories and subsequent employment of other suspect individuals they are far from the only target. Any FI or related should be concerned.

The common goal seems to be to get their foot in the door within a subset of 3-5 American financial verticals (the "b-b-but I just work in marketing!" excuse as an obscenely common insider position that doesn't attract any scrutiny at all, unlike someone working in engineering or R&D. Seriously-- you want to find the spies in your company? Start with marketing), exfiltrate everything they can access and retreat to China for a cushy job and enjoyment of immunity against extradition. By the time the target catches on and law enforcement gets spun up, they've already finished their tour of duty with two to three other companies and are on a plane halfway across the Pacific.

It's hard to do anything about it without either implementing literal racist policies or comprehensively overhauling an entire industry's security posture, but it is what it is.

Heh, even racist policies would not stop this.

You could just offer non-Chinese Americans a hefty reward + a Chinese passport as a reward for their espionage. Given the number of Gen-Z or Millennials straddled with debt, in an era with little company/employee loyalty (both ways), it seems like the recruitment pool would be quite big. Pick someone "All American" looking and be done with it.

Both the Soviets and the Chinese have done similar things to steal military secrets.

I've normally heard it that they pay current insiders rather than try to get outsiders to join. Though I'd appreciate links to well documented cases to the contrary.

Also, really, none of this matters for 99.99% of the companies out there. The weak point is far from hiring practices. The weak point is almost always cybersec or social engineering.

Not an hour ago, I talked to a client who thought an employees email was hacked because they got this email:

From: employee name (sjfjro@garbage.io) Subject: direct deposit

Boss, I have a new account, please change my direct deposit info.

Yours, Employee name

They changed the direct deposit info. Need a wetware version update.

I'm being thick. If they thought it was a hack why did they change the deposit info?

Also, I'm really into cryptocurrencies now. Please pay me in bitcoin.

These days, the Chinese and Russians can get whatever they want from companies like Equifax without leaving the comfort of their own homes or dealing with messy human interactions. Either one of them can, and most likely did, hack Equifax at will.

I would be surprised if a large company with very good security practices could resist them indefinitely, Equifax wasn't going to hold them off.

The difference between state actors and regular thieves is the state actors don't want anyone to know about it. Sony got wrecked by North Korea because they wanted them to feel the pain. That could happen at almost any company, just the state actors want a long-term strategic advantage not a short-term one.

The ubiquity of technology in all aspects of our society makes us extremely vulnerable to losing a digital war. We have so much more to lose, and so much more surface area vulnerable to attack. Seriously, North Korea was able to assert their will on us just to (successfully) keep a movie from being released to theaters.

Special treatment against specific nations isn’t necessarily racist (depends on motives). I don’t think treating Chinese immigrants differently wrt private business information is racist, as long as the same rules don't apply to ethnically Chinese US citizens

What about ethnically Chinese Canadian citizens in its Toronto office? It sounds a lot like the rules did apply to US citizens.

Practically, how do you see this working? I get it that very senior management could work with HR on information/promotion discrimination. But do you expect the rest of the company to have discretion in executing information security when so much information flows freely inside divisions? By seeing who has the thickest accents? Or perhaps people could wear bands on their shoulders? Why stop there--maybe we can mandate it in the public sphere too. I don't mean to be sarcastic or insensitive, but motives and intentions can be blurry.

> do you expect the rest of the company to have discretion in executing information security when so much information flows freely inside divisions?

Finance and law are decently adept at erecting information barriers. Roping off certain information to non-Chinese nationals would be annoying but with plenty of precedent.

I am not for or against this practice, but this is how it works in places like EA (minus the racist parts) where security is a concern. Different classes of employees have different colored door badges which is visually obvious.

Unfortunately given the trends, being ethnically Chinese will now be another vector for potential job discrimination.

It's like that in defense as well.

It isn't practical or sensible to discriminate based on nationality. Like, it won't work, and in retrospect it will look as stupid as Japanese internment camps.

I think you would need to look at ITAR as an example. In that context, you need to restrict things to US nationals and there are complications for dual nationals.

My guess would be that .gov will create some sort of regulatory regime around critical infrastructure.

A nit, i believe ITAR is open to US Persons which would include greencards & permanant residence beyond those born in somoa or from overseas us citizens.

I was interested in seeing if that is the case, it turns out that is actually discrimination:

https://www.eeoc.gov/laws/types/nationalorigin.cfm

"The law prohibits employers from hiring only U.S. citizens or lawful permanent residents unless required to do so by law, regulation or government contract."

Based on that, as long as someone in the US is legally allowed to work, you cannot turn them down because they are a Chinese National.

This doesn’t stop Washington DC from discriminating against Chinese and Russian job seekers.

Yes, you could hire Japanese citizens and not Chinese and comply with that.

In which cases does the US government ("Washington DC"?) discriminate against Chinese and Russian applicants more than other noncitizens for defense roles?

So there could be a law or regulation in place for specific industries is what it says. Not to mention any large government contract could specify it. So based on that, as long as someone in the U.S is legally allowed to work, there might be any number of areas in which they are not allowed to work.

I am not sure why this comment with such blatant discrimination against nationality is not immediately down-voted or flagged.

This is the same line of argument as the Muslim ban.

Not quite. The so-called Muslim ban involved countries may have little ability to discern who's who in their own country. Most Muslim nations did not fit this criterion.

But others actively try to place spies in other countries. It's not wise to treat them as we treat allies, especially given the way they treat their own minorities and political dissidents and neighbors and debtors.

Speaking purely anecdotally, it could be because some people have trouble discerning between the culture, the broad ethnic groups considered to be 'Chinese' no matter where in the world they are, the headline-generating government of the P. R. of China, and Chinese nationality of people who were geographically there when they entered the world. This leads to all sorts of arguments of "the Chinese are horrible people and can't be trusted because their government does terrible things."

By that logic, we can't conclude that anti-Semites are racist until we've resolved the scholarly debate as to whether the Jews constitute a "race" of their own.

I'm not saying that Jews shouldn't be regarded as a race. I'm saying that your moral reactions shouldn't be contingent on morally irrelevant descriptive features such as whether the group being discriminated against constitute a race or nation or ethnicity.

It's even possible for people to discriminate against people from a state or city. Should we wait for a special word like "statist" and "citist" to be coined before suddenly discovering that this is wrong?

And don't tell me: "but the reason we want to treat these people differently is because of their moral characteristics, it's not that we are biased against them". Go read Mein Kampt and tell me this isn't exactly the rationale for anti-Semitism stated in it.

Reply on news.ycombinator.com