News for hackers. Stuff that matters.
Re:Update on IT Security Incident at UCSF by rkho on Saturday June 27, 2020 @01:23AM (#23659710)
As a reminder, in 2017 UCSF offshored all of its IT staff to HCL Technologies and forced their then-employees to train their replacements before laying them off.

They brought the replacements into the Bay Area on H1B temporarily while they were trained by their soon-to-be-laid-off counterparts and then sent back overseas to continue their roles once training was complete.

https://sanfrancisco.cbslocal.com/2017/02/28/ucsf-tech-worke...

Re:Update on IT Security Incident at UCSF by ahi on Saturday June 27, 2020 @01:43AM (#23659782)
How the heck did they qualify for H1Bs when they were replacing already employed Americans? Not only did the H1Bs unemploy citizens, we didn't even get the long term benefits of trained workers living and paying taxes in the States.
Re:Update on IT Security Incident at UCSF by phonon on Saturday June 27, 2020 @02:00AM (#23659829)
Because HCL employed them, not UCSF.

A large percentage of H1Bs go to "bodyshops", which import workers from abroad to temporarily work at companies that are offshoring their employees. Yes, it's perverse; they are in effect being used to replace American workers, but not explicitly.

Re:Update on IT Security Incident at UCSF by trhway on Saturday June 27, 2020 @01:59AM (#23659822)
using H1B for 4 months stint is very strange. It is too valuable a visa slot (significantly oversubscribed lottery usually, at least in the recent years) to be wasted that way. Usually it is done using something like B1 for such a short trips, especially if it is training, etc. I wonder whether the journalists and others did mistake one visa for another, especially given that they naturally wouldn't be privy to such internal details of a 3rd party company like the HCL in this case.
Re:Update on IT Security Incident at UCSF by rkho on Saturday June 27, 2020 @02:04AM (#23659838)
I looked a little more and found this subsequent article talking about it:

https://www.latimes.com/business/hiltzik/la-fi-hiltzik-uc-vi...

Re:Update on IT Security Incident at UCSF by lyrrad on Saturday June 27, 2020 @02:07AM (#23659851)
My understanding is that H1-B's for some educational institutions (and certain affiliated non-profits) are cap exempt.
Re:Update on IT Security Incident at UCSF by seesawtron on Saturday June 27, 2020 @02:00AM (#23659823)
but they did get the benefit of cheaper IT workforce? What they did to their existing employees was certainly morally wrong but is outsourcing your IT support to cheaper third party seen as morally wrong too? Isn't that the idea of free captial market? Sure the state didn't get taxes from those employees but state owned university saved costs.
Re:Update on IT Security Incident at UCSF by AnthonyMouse on Saturday June 27, 2020 @02:38AM (#23659959)
The H-1B program is not intended to give employers access to cheaper foreign labor. Its stated purpose is to allow people to immigrate when they can do jobs that US workers can't. When there are already US workers doing those jobs, that's clearly not the case. But that sort of abuse has been all too common.

The recent H-1B suspension probably goes too far the other way -- the program needs more safeguards against abuse rather than to be discontinued -- which requires a legislative solution (auctioning off the slots seems promising). But the legislators are apparently too busy flinging their own scat at each other right now because it's an election year. In the meantime it might not be such a bad thing to fail closed rather than fail open, given the effect of the lockdowns on the unemployment rate.

Re:Update on IT Security Incident at UCSF by malux85 on Saturday June 27, 2020 @02:23AM (#23659905)
They did benefit from the cheaper workforce, in fact they saved 1.14 million dollars!

Wait

Oh no...

Re:Update on IT Security Incident at UCSF by _mog1 on Saturday June 27, 2020 @06:32AM (#23660885)
You say that as though 1.14 million dollars is a lot.
Re:Update on IT Security Incident at UCSF by malux85 on Wednesday July 01, 2020 @09:08AM (#23700901)
swing and a miss
Re:Update on IT Security Incident at UCSF by SomeoneFromCA on Saturday June 27, 2020 @09:25AM (#23661723)
Lots of people are brought from overseas on B1, J1, L1 whataver cheap visas and employed illegally. All these HCL-Wipro-Mahindra rent out whole apartment complexes in the areas where they have large customers; there these B1s are allowed/forced to live on cheap.
Re:Update on IT Security Incident at UCSF by ed25519FUUU on Saturday June 27, 2020 @02:20AM (#23659899)
The H1B system is totally out of wack. One of the many things that we need to tear down and rebuild from scratch in 2020.
Re:Update on IT Security Incident at UCSF by mc32 on Saturday June 27, 2020 @01:30AM (#23659734)
What kind of monster of an employer makes their employees train the replacements they're getting fired for?

If that were me, I'd organize and have everyone quit; let them figure things out. Screw the pittance of a severance.

Re:Update on IT Security Incident at UCSF by PeterStuer on Saturday June 27, 2020 @02:24AM (#23659914)
From what i have seen over the years this is an industry standard practice. Don't assume the employees about to be sacked are in the know.

Sometimes this is hidden under the guise of big IT modernization projects. The company transitions or consolidates towards ERP platform X. It is a huge operation that touches almost every part of the business. Armies of analysts are brought in to map the AS-IS business operations, the system is developed, once stable enough, the other shoe drops and the whole IT department is now moved off- or near shore to the company that transitioned the system while other 'non-strategic' parts of the business are 'streamlined' into managed service contracts with other parties in the project consortium.

Re:Update on IT Security Incident at UCSF by voodoochicken on Saturday June 27, 2020 @01:39AM (#23659770)
Re:Update on IT Security Incident at UCSF by throwaway87634 on Saturday June 27, 2020 @10:41AM (#23662114)
Heard firsthand from employees in the pharma industry that were forced to train their replacements that would do the work in India (quality control of medical devices). If they didn't comply they would get fired immediately and not get a special severance package... most of them did comply and trained their replacements because the job market was bad.
Re:Update on IT Security Incident at UCSF by WrtCdEvrydy on Saturday June 27, 2020 @03:59AM (#23660242)
> I'd organize and have everyone quit; let them figure things out.

Be careful here... due to "freedom to choose" legislation targeting unions, it may be illegal for you to "organize labor" in your state...

Re:Update on IT Security Incident at UCSF by Ghjklov on Saturday June 27, 2020 @01:34AM (#23659747)
Their severance pay was probably on the line...too sad
Re:Update on IT Security Incident at UCSF by milofeynman on Saturday June 27, 2020 @01:41AM (#23659778)
Someone, somewhere, is calculating whether the ransomware line item was worth the offshoring and laying off local employees line item.
Re:Update on IT Security Incident at UCSF by what_ever on Saturday June 27, 2020 @02:00AM (#23659827)
While what they did was may not be right, is there any direct link about this to work done by HCL? Have all of such previous attacks been linked to work done by H1Bs?
Re:Update on IT Security Incident at UCSF by castratikron on Saturday June 27, 2020 @01:44AM (#23659785)
What would it mean if it was?
Re:Update on IT Security Incident at UCSF by scottwb on Saturday June 27, 2020 @02:23AM (#23659908)
It wasn’t all IT, not even half.
Re:Update on IT Security Incident at UCSF by techie128 on Saturday June 27, 2020 @03:19PM (#23663965)
H1B for outsourcing companies has created massive arbitrage opportunities for American companies (primary non-tech). They find it cheaper to off shore their IT operations. H1B has a lot of "loop holes" that benefit employers. They're as follows:

1. H1B ties employees to a specific employer. This bonded labor prevents free labor movement. This allows the employer to exert tremendous control over the employee. Free labor movement is important to discourage employers from depressing wages for American workers.

2. H1B is allowed to participate in the EVC model. This would be fine if the H1B was not tied to the employer and instead it belonged to the employee. In absence of this, it explicitly allows exploitation of H1B workers hurting American employees.

3. H1B is dual-intent non-immigrant visa and is the first step to permanent residence. The employer dangles this carrot and exerts further control over employees. The long wait times (on the order of a decade or longer) due to the greencard backlog for certain countries (primarily India, China, etc.) make it worse. More importantly, the employer can rescind the application throughout this process and completely destroy the employee's professional and personal life.

4. Outsourcing companies will not start the greencard process for H1B employees until they're in the 5th year of H1B. Combine this with the 10+ years wait for certain employees, ties the employee to the employer for at least 15 years.

5. Until recently, employers could've rescinded the H1B any time and the employee had to exit the country immediately (no grace period). It was only recently that the US government gave a 60 day grace period for H1B visa holders. Imagine how a human being would feel if they have lived in the country for a decade, making their lives here, having to wind up and leave within a few days or even 60 days. Its simply inhuman. However, this is where we are right now.

This issue is more nuanced than it looks like but the underlying problem is due to the fact that the H1B visas and permanent residence process is tied to employers. If we look at visa programs in pretty much any other country, visas belong to employees, their PR process is between the government and the individual applying for the PR. The employer has very little control over the employees. This is why such large scale exploitation doesn't exist in other parts of the world.

There have been attempts over the years to fix this issue. The infamous Neufeld memo tried to eliminate the EVC model. Unfortunately, that did not fly and was eventually rescinded. Honestly, a tiny percentage of H1Bs are used by tech companies that genuinely treat their employees well. If you eliminate the bottom 80% of the H1B employees, EVC companies will shut shop and you'll also hurt foreign new grads.

Re:Update on IT Security Incident at UCSF by redditmigrant on Saturday June 27, 2020 @02:06AM (#23659848)
It's tiring to keep hearing these stories and tieing them to H1B. Satya Nadella also started on an H1B, Sundar Pichai did too and so did Andrew Ng. Just those 3 combined have created more jobs than were lost here. So please, stop spreading partial info that creates hate against a whole swathe of people who have come here legally, have contributed extremely productively to this nation in the form of taxes and labor, and would like to be treated with atleast the same level of dignity as any European low skilled person who just got off a boat at Ellis Island.
Re:Update on IT Security Incident at UCSF by charlchi on Saturday June 27, 2020 @02:29AM (#23659928)
This is a labour issue, not an issue of xenophobia. Though I'm sure these companies would love us to believe it's about xenophobia. The breakdown of western labour protections and the march towards near chinese levels of exploitation will likely be overseen by people who claim that western labour protections are racist.
Re:Update on IT Security Incident at UCSF by redditmigrant on Saturday June 27, 2020 @03:06AM (#23660043)
"They are taking our jobs" is also overtly about labor but the jump to xenophobia happens pretty quickly.
Re:Update on IT Security Incident at UCSF by basilgohar on Saturday June 27, 2020 @02:18AM (#23659889)
I think most of the sentiments here are regarding the abuses of the H1-B program by the American companies and not targeted towards the recipients of the visas themselves. I don't think it's reasonable for people to draw the conclusion that the normal people that were awarded the visas should be to blame.
Re:Update on IT Security Incident at UCSF by redditmigrant on Saturday June 27, 2020 @03:11AM (#23660059)
I do believe that you perhaps aren't tieing the program to the recipients. But I don't think the distinction between the program and the beneficiaries is clear to the average voter who likely hasn't ever met a person on an H1B. When they read these stories their instinctive reaction is jobs going to "other people" and then they vote for people who are against immigration, who are tacitly for xenophobia. You could have called me pessimistic, but we have clear examples now of how xenophobia can resonate and can be built on labor issues.
Re:Update on IT Security Incident at UCSF by rkho on Saturday June 27, 2020 @02:19AM (#23659894)
I find it difficult to believe that we read the same article.

Based on the specifics of my comment and the context of the article at hand, I don't understand how your point ties to my comment and do not appreciate the insinuation it brings.