Doctor 'used silicone fingers' to sign in for colleagues | Hacker News Reader

Doctor 'used silicone fingers' to sign in for colleagues

bbc.co.uk

76 pointsRobAley31 comments

From the article: "A council spokesman has told BBC Brasil that among those believed to be those "ghost employees" - as Brazilians call informally those who receive regular wages without actually showing up for work - are public workers in the areas of health, education and security."

Yes. Education especially. The fraud is not always so high-tech. In many places in Brazil and elsewhere in Latin America, schoolteachers can be on the taxpayer-subsidized payroll while regularly failing to show up for class on school days. School pupils can't count on teachers being in the building when they show up for school, so sometimes the pupils don't show up for school either. A similar pattern of schoolteacher union takeover of the state education system led to such widespread fraud in Mexico that the president of the schoolteacher union was recently arrested

http://www.latimes.com/news/world/worldnow/la-fg-wn-mexican-...

http://www.globalpost.com/dispatch/news/afp/130227/mexico-te...

as part of a corruption conspiracy investigation.

Unions. Corruption. Surely you jest.

The post speaks for itself - the snark is not required here.

This kind of thing is extremely common here in Brazil. Another very common example is the mandatory classes a citizen has to take in order to get his driving permit, if you fail to show on a class you can easily bribe an attendant of the licensed driving school to change the time on the clock of the biometrics computer so you can register your fingerprint on the correct time.

Unfortunately this kind of issue is a cultural problem here in Brazil. This is what we call 'jeitinho brasileiro' (Brazilian way), the belief that one must always take advantage of others or find ways to bend the rules.

True, I know a guy who just bought his driver license. He paid some cash ( If I remember correctly something around 3000 BRL ), they took his picture and information, made a similar silicone finger from the described in the article and after some time he received the permit. No classes, no tests, no physical and psychological exams, just like that.

I think the most interesting point about this story is the existence of "ghost employees" per se. One has to think of remote Yahoo workers ;).

The fraud involved biometrics, but I think it is a non-issue. Of course you can trick every system, and a finger-print system is arguably harder to trick than punching card systems that might have been used before. You cannot expect to log in with silicon fingers for a long time before someone will notice ...

Would these fingers be considered 'burglars tools' by the courts?

"Would these fingers be considered 'burglars tools' by the courts?"

A boxer's hands may be considered lethal weapons so probably yes.

They should invent something to use in Japan, just in case their social services /pension agencies want to see the 128 year old grandma before sending the next check http://www.bbc.co.uk/news/world-asia-pacific-11258071 :).

The boxers hands bit is not true, they aren't required to be registered nor are they consider weapons. However, a fighter or martial artists background may be pertinent in the case.

I've seen many cases where there was a violent altercation of some kind where the person with training is labeled the responsible party even if they were the victim. I forget where it was, but years ago when I was in martial arts a case made the rounds in our group about a guy who was attacked, I forget why, in front of multiple witnesses at the local mall during a demonstration. In the tussle the attacker fell and hit his head on the nearby fountain, I believed he died. The prosecution focused on the victim's martial arts training implying that he had total control of the situation and that the result was his sole responsibility. It's a sobering thought to think that your local prosecutor might imply your teenage child is a highly trained killer because they participated in Tae Kwon Do.

A boxer's hands are a lot less useful when not attached to a boxer's arms.

On the plus side, you could take one to touch in at work for him.

The term "ghost employee" is a standard English term used by auditors. Any sufficiently large organization must periodically reconcile the payroll system with managers and/or a timecard system. It is usually as simple as just sending a email to managers asking them to certify that a list of employees are working for them. There are often a bunch of edge case that must be worked out, like the people that don't have managers in the HR system, or people on leave where the paperwork didn't get processed correctly.

Unfortunately, audits aren't really designed to uncover fraud with collusion. This is why any fraud that is found should be criminally prosecuted, which the Brazilians are doing correctly here. They need to also prosecute the employees that were receiving benefits without working as well.

The one edge case I typically run into with IT systems is when the chairman of the board, who is not the CEO, wishes to have an office at the company. Where do you put him on the Org Chart? Every other person I can assign a manager that ultimately flows up to the CEO - but the politics of hierarchy between the CEO (who answers to the board) - and the chairman (who most certainly does not answer to the CEO) are tricky.

While having "ghost employees" is troubling and lowers work ethics for other people, it could have been worse. The doctor could have been using the "silicone fingers" to sign drugs out of the drug cabinet. If biometrics were the only protection there, the patsy doctors would have very little recourse to defend themselves.

Fooling fingerprint readers isn't really that hard. YouTube is full of videos explaining how to do it with nothing more than a bottle cap, super glue, some duct tape, and a regular laser printer.

It's quite easy to fool most high-end fingerprint scanners, at least older ones. If you're persistent, you can do so with a bit of gelatin and a laser printer.

http://vast.uccs.edu/~tboult/tmp/fingerprint-boult-koaa-medi...

There are some scanners that try and look for eg. the motion of the blood pulsing through the veins with infrared, but I'm not familiar with them.

This issue is called "spoofing / liveness detection," if you want to go learn more. It's quite a popular topic at conferences like ICB, IJCB, and BTAS.

This is not very surprising. Brazilians have a very fluid concept of time, such that being a few hours late or not showing at all is considered normal behavior. However, you do not keep someone more important than you waiting. That's just rude.

yet, they still want to be paid for that time they don't care about.

Yes, because this new "checking in" system goes against their established cultures and norms.

That's not normal behavior around here..

Our culture may not be very crazy about punctuality, true, in that if you set something up and you or the other arrive 10 or 15 minutes late it's not an outrage, but if you don't show up or is hours late it's still fucking rude/may get your ass fired or start bittering a then-friendly relationship, for sure... there's a tolerance time(at least for business that is, social is another story )

a long time ago there existed the "carioca time" if I'm not mistaken(can't find where I read about this), when people were reaally loose about times, like going out for lunch and only getting back 2, 2.5, 3 hours later but this stopped as industrialization required more professional etiquette

Also, it depends on what region you're talking about, they vary a lot around here, in São Paulo they're probably really tight about this, it's the economic center and they're considered to only care about working, Cariocas maybe a bit less, Gaúchos(South) culture is so different that basically they do everything differently from the rest and on..

Also important to note that since bureaucracy and public services here are generally bad here.. if someone needs to go the bank by bus, for example, you can't know how much it will take, so you gotta see it through this lenses too

> public services here are generally bad here..

Traffic is also pretty insane/random, at least here in São Paulo. There are routes that are notoriously unpredictable.

The lesson here is that fingerprint biometrics are not generally reliable, i.e., they assume the user will not volunteer their credentials to others. The same is true of passwords.

Cost notwithstanding, would retina biometrics be more reliable? Is there a cheap and reliable solution?

Current fingerprint readers have "live finger" detection, this won't work on newer equipment.

It should be possible to fool a retina scanner with a designer's contact lens, but it's quite easy to simple break it (ie. force a nonmatch) with a regular contact lens.

What will be really interesting is when someone commits a crime with a fake fingerprint.

Haha, who said no-show jobs were only in construction?

This is very Gattica... Kind of find it amusing that we have finally caught up with the movies...

That's GATTACA, it's made of the letters used to describe DNA bases: G, C, A, T.

Vincent: They think I killed the mission director.

Jerome: What makes you think that?

Vincent: They found my eye lash.

Jerome: Where?

Vincent: In the corridor.

Jerome: Ah well it could be worse. They could have found it in your eye.

http://www.imdb.com/title/tt0119177/

It would be a lot more scary if the person committing the fraud were not also a doctor.

You could go back even before Gattaca. In the beginning of one of Heinlein's earliest works (and one of my all time favourites), "Double Star" [http://en.wikipedia.org/wiki/Double_Star], he discusses using latex fake fingerprints to frame someone.

Book was written, I believe, in the early '50s.

Reply on news.ycombinator.com