Agreed. Unless there is a crime or a safety issue, mind your own business.

(Edit - one interpretation of your post is this person is compromising your corporate security in some way. If this is the case, you should probably, and without trying to be clever about it, discuss your concern with the person and if not satisfied with whoever is responsible for security in your company)

I've considered this, however: -it's a contractual violation -the work is shoddy -it's immoral -this presents security issues -it would make a good hacker news story

If the work is shoddy, fire him — regardless of why it’s shoddy. If you don’t have the power to fire him, convince the people who do. If you can’t do that — on the basis of shoddy work — then it’s time to recalibrate your definition of shoddy.

actually, I just realized that there are some countries whose work laws do not allow firing on the basis of "shoddy work". but would totally allow firing for outsourcing your own job, on the basis of trust violation, trade secrets access from unauthorized people, and stuff like that.

Out of curiosity, list some of those countries.

Good advice.

that last part invalidates all the previous parts.

It's just wrong to say you are doing something and giving it to someone else. At the very least they are lying and that is not professional.