> What's the difference between a foreigner with an accent in your onsite team VS a foreigner that's remote in US timezones (LatAm)?

If I give someone in the US access to my code, systems, and, inevitably, customer data then I have a lot of legal recourse against that person if they do something bad. They have a lot of incentive to be careful and follow the rules. Their desire to maintain their reputation and avoid legal liability aligns our interests.

If I hire someone in the US and they hand everything over to a random person in a foreign country who doesn't care in the slightest about US laws, then they don't care about anything other than keeping those paychecks coming for a while. They don't care about anything, especially once those paychecks stop coming. It's even more complicated because the company isn't the one sending the paychecks, it's the person you hired. If that person has a falling out with their outsourced counterpart and the outsourced counterpart decides to take revenge on the company as leverage over their front-person, it gets bad.

> Security? It applies if you're working on defense software, but other than that...?

Are you suggesting that security only matters to defense software? You've never worked on a project that involves customer data? You've never worked on proprietary software that your competitors would love to have?

Do you not get annoyed when companies leak your personal data?

Run a background check, sign confidentiality and DP agreements and hire someone who sells you trust. Again, something you would do in any given modality of work.

this sounds good on paper but how effective - really - are background checks outside the developed world? Even inside the developed world, language becomes a big stumbling block.

If you are so worried don’t hire remote. You get what you pay for.

You rarely get more than you pay for.

But it’s quite common to get less than you paid for.

> they don't care about anything other than keeping those paychecks coming for a while

Don't forget this is all employment really is. Any employee-employer relationship boils down to this regardless of what you have deluded yourself into believing.

That is ... wrong, or at least very reductionist.

Yes, I do my work for money, and would not do it if they don't pay me, but it's definitely not just money. I like my team, have personal friends among them, and find pleasure and realization in doing a good job.

But not enough that if they stopped paying you you would keep working, presumably

Everything beyond the core financial relationship is just mythology and propaganda employers have beaten into you since birth to make you a good serf

Similarly those "friends" will throw you to the wayside when their own employment is threatened. Been there, done that.

Employers pretend their employees aren't replaceable cogs, but that's exactly how they see them.

Hi. Question: I'm an engineer living outside the US. If I were to establish a consultancy company in the US and offer my services through it, would that fulfill the legal and security concerns?

> and, inevitably, customer data

That's not inevitable (for programmers, at least). Post-GDPR European developers generally keep well away from customer data, and it isn't a big impediment.

If you can imagine the difference between hiring one single developer to work on your application vs. hiring dozens of different developers each to handle some small part of it...and it's still worse than that.

Typically the person "hired" is the senior and the person doing the work is _extremely_ green.

Oh yeah, if you're talking about dev shops, don't hire dev shops (the "hired" VS extremely green person phenomenon you're talking about happens in these kinds of companies because their incentive is to sell hours/men, instead of actual value).

Do your diligence, and your technical/communication/leadership interviews to make sure you're hiring the right person.

And if it doesn't work out after 2-3 months, fire the person. It happens in all formats of work whether it's remote, hybrid, or onsite.

> It happens in all formats of work whether it's remote, hybrid, or onsite.

You're not wrong, but it's missing the point.

It's so much harder and riskier to do this onsite that it's not very common.

With remote, a group of people can defraud multiple companies at the same time this way. They can do it all remotely, which means they can do it without stepping into the legal jurisdiction of the company.

Remote opens the doors to so much more fraud. There is almost no comparison between someone doing this on-site and someone from a foreign country scamming companies as their job.

Your objection is valid, and I'm sure someone at these international payroll companies would be able to answer it much better than I can. Regardless, the benefits are much larger.

The happy path between local vs foreign often looks the same. That's not the problem for anybody.

The edge cases are common and often legally ambiguous. When things go wrong, it can be extremely hard for a company to resolve the situation when it crosses boarders. Heck, even just operating in a different state can open a company up to legal issues.

Once you start opening up to different legal jurisdictions, you basically have to run company policy in a way that accounts for the worst situations across all jurisdictions.

Some things that I'm aware of:

* Import/Export law for software. It may seem mundane, but having any encryption can cause significant scrutiny.

* Import/Export law for hardware (like getting a company laptop to an employee)

* Ability to track/down or recover lost/stolen hardware

* Variations in labor laws.

* Variations in copyright/IP protection laws.

* Variations in digital hacking/data integrity laws.

* Government level data monitoring/tracking

* Local data protection laws that you might not be subject to without a local employee.

* Scrutiny from your customers about foreign workers.

* Accidental sanctions violations.

* Potential for customer data to leave legal boundaries via a foreign employee.

* etc

You do not want the Treasury Department knocking on your door to ask you why you're sending money to a North Korean front company in exchange for slave labor.

Don't work with sanctioned countries. It's common sense.

Turns out you're not the first person to think of this, and as a result they operate out of other countries (ie China or Indonesia). https://www.bleepingcomputer.com/news/security/north-korean-...

curious, so if you see some devs from those countries applying for your jobs, are you relating them to the news and automatically rejects them based on those countires?

Work with one of the 20 countries that the USA has a FTA with. From what I understand (I'm not a lawyer), these agreements have a chapter dedicated to cross border trade in services which includes dispute resolution.

Some more roadblocks:

- IP protection - some countries make it super hard if someone breaks the NDA and steals their employer's IP. At least in the US, the employer can go after the IP thieves as a last recourse.

- Secure devices - lot of companies give laptops which come with all sorts of tracking software (eg. to force security updates). It is hard to ship laptops all over the world due to customs requirements.