Terry Gerton You are raising a topic that I have to be honest, really stretched my imagination around remote worker fraud and it’s not just hypothetical. I mean, when I think of maybe remote worker fraught, I’m thinking about somebody taking a long lunch or maybe working two jobs, but your article points to something much more serious. What are you finding that employers are actually discovering?

Jennifer Jackman So the working two jobs is definitely something that we’re seeing, but there’s some more nefarious types of things that aren’t just kind of productivity or paycheck fraud is kind of what we look at. These are more of who has access to your systems and it could be foreign actors that could be triggering all sorts of compliance related issues, particularly for government contractors.

Terry Gerton And you’re saying that companies may not actually know who’s really performing their work. How does that even happen in practice?

Jennifer Jackman So it’s frequent when it happens a lot of times in the IT workspace where there’s a more, they’re hiring for a lot of jobs at one time. And they’re going through a lot of the times the same processes that they would, that might be virtual. So they’re interviewing someone, but there could be AI assisting in the interview so that they are coming across more skilled than they actually are. It could be stolen credentials. So who you think you’re talking to is an actually you’re talking to. Or the one person might be the one that you’ve interviewed, but later on it’s someone entirely different that’s doing the work.

Terry Gerton Are we talking about isolated cases here, or is this something that organizations are seeing much more often?

Jennifer Jackman It’s definitely not isolated. In the situation with paycheck fraud, that’s becoming more and more frequent with the situation with potentially foreign actors or insider threats, I wouldn’t call it frequent, but it does exist. The Department of Justice recently prosecuted multiple cases involving a North Korean remote worker scheme involving laptop farms where employers believed that the employee was in, let’s say, Virginia, and that’s where the laptop was actually being housed. But through different software that had been installed, people in North Korea and actors were getting, the bad actors were access to that information and actually doing the work from North Korea.

Terry Gerton That just seems impossible to imagine, but obviously it’s happening. For government contractors, it seems to go well beyond a personnel issue. At what point then, as you’re describing this challenge, does a hiring problem become a cybersecurity problem or even an export control problem?

Jennifer Jackman Well, in terms of export control issues, you’ve got an issue when you, if you don’t know the person is in a different area, it’s not just exporting products is what we usually think of, but it can be just the data itself triggers export control compliance issues. Cybersecurity, absolutely, because obviously who who’s got access? That’s really the question it becomes. It stops from being a workplace productivity issue to more of who’s gotten access to your data. And once the wrong person has access to your data, you’re dealing with potential data breach issues. Another issue that you didn’t mention has to do with even False Claims Act liability because if you’ve told and represented to the government that a specific person is doing the work or that the people are located in the United States and you later find out that they’re actually not, that there was a breach, now you may have some reporting requirements there. And the question at that point becomes not just the discovery of it, but what you do in response. If you then figure that out and continue paying it or don’t disclose it and continue getting paid by the government, now you may have triggered some of the liability there as well.

Terry Gerton Jen Jackman is the D.C. managing partner with Ice Miller. Let’s go through then what a contractor or agency might need to do if they notice that something here isn’t right. What’s the first step that they should take in diagnosing and responding to the problem?

Jennifer Jackman Yeah, I mean, there are several red flags and we could talk for an hour about what those are, but once those red flags are identified, you don’t want to just make the assumption that there’s fraud, but you want to start having a coordinated response and that’s where you want have IT, legal and HR all involved. You also want to make sure your managers who are your first line of defense are adequately trained to be on the lookout for these things, but you don’t want them going vigilante and doing the investigation themselves because there’s a legal risk that could arise just from doing that. So you want to have a process in place that reacts so that you’re not reacting at that time that is coordinated between IT, legal, and HR. You could be doing audits as well, audits of where people are located, whether there’s any software irregularities on computers that IT has not approved, requiring cameras on. I know employees don’t really like that, but there actually is a real legitimate reason for requiring those on.

Terry Gerton Does this kind of problem originate in the hiring process or does it tend to, that process is fine. We actually know who we’re talking to, but it’s later on that folks get mired in this, in this fraudulent positioning of the workforce?

Jennifer Jackman It can be both. You can certainly tighten your hiring practices, but sometimes you think you’re hiring the right person. You’ve done all of the controls you’re used to having, but the more remote the process is, especially as employers themselves are using AI technology to actually conduct interviews, the risk heightens. Along the way though, they may have done everything right and have actually hired the right people, but I’ve had an example of a client actually who had, they hired the person, but didn’t realize the person was subcontracting the work out to others. And so they were still working with the person, that person was the employee, but he who they thought was a subject matter expert was actually not performing the work. He was paying others to do it and still profiting from that. So in that situation, you have an access control issue, cybersecurity potential data breach, because you don’t know who actually has that access to your information.

Terry Gerton Well, you mentioned AI and a lot of organizations have invested heavily in remote work tools and security controls. Has technology made the problem easier to detect or has technology made the problem easier to hide? Or is it a little bit of both?

Jennifer Jackman I think it’s a little bit of both. One thing you don’t want to be doing is just monitoring every keystroke, right? Because that could give rise to assumptions of fraud that aren’t there. But there is technology in place and kind of those audits that we discussed that you want to utilize that can help detect it. But AI has certainly also helped allow more fraud because of the ability to have real time notes going when someone’s, for example, in an interview. So you may think they have the skillset that you are hiring for. But they’re actually getting everything from AI in real time. So AI is an assistance and it is also an impediment to this issue.

Terry Gerton Well, if you’re an employer, either a government employer or a contractor, and you’re reviewing hiring and security practices, where should you focus first? Is it on verifying identity or verifying location or verifying access to sensitive information?

Jennifer Jackman So it’s going to be, it’s actually not a one size fits all because your level of monitoring is gonna depend on the employee. You know, if it’s a lower level employee or even like a marketing person who isn’t having access to your really sensitive data, what you’re going to be doing isn’t going to be as regimented as someone who actually is the IT person or who has access to that data. And so when you ask, are you gonna verify where they are as part of the hiring process? You certainly want to verify where they are. And then you can, through these audits, you can make sure that when you’re seeing their tracking location, it’s adding up to where they said they were going to be. Verifying identity, absolutely. But when you are virtual, you know, and that’s kind of why you want to have cameras on when you have meetings, other types of login validation. So there’s a lot of technology that you can use to access that. But on the hiring front, it really is important just in the very beginning to make sure there’s that person to person. I mean, the best way to get across this, I guess this battle is in-person interviews, but that’s not practical for really larger employers.

Terry Gerton We’re talking about technology as principally the way to diagnose and fix this problem, but are there performance clues that a manager might see that might also raise a red flag here? What should they be looking out for?

Jennifer Jackman Absolutely. If you have an employee who is supposed to be really working from 9 to 5 and is never available or blocks off large parts of time so that it looks like they’re not available, or they’re working at really random hours, or the work product is just very inconsistent. On one day they might be delivering a really great work product and the next day it’s just terrible and they’re not following instructions. Someone who’s not attending mandatory meetings and again the camera not being on, those are all red flags. One red flag alone is not gonna, you know, necessitate a huge investigation. But if you have that inconsistent work, the refusal to put on a camera, the odd hours, this should be triggering things. And that’s why when we talked earlier about having a coordinated response team in place, that’s when that manager should then say to them, okay, I’ve had some red flags. I think someone else needs to start looking into this.