Stephane's tumbling tumblr

Adventures in oDesking

I have been away from blogging for a long time, but I finally have a pretty good story to tell the world.

For a couple of years now, I have been using the oDesk.com site to get various pieces of work done by external contractors all over the world. In short, oDesk is a worldwide marketplace where people can put their skills up for sale, and match them with employers who need a specific job done. There are other sites, like Freelancer.com, that are pretty similar in concept.

Employers come up with a job description, then prospective contractors all over the world can apply. Not very different from your typical job application process in practice, but since this is all done over the Internet, if you don’t need the person to be physically present you are usually able to get the job done for much cheaper overseas.

This fits particularly well for most tech jobs these days. My experience with the site has been entirely as an employer, though I know of people who can make a decent living working full time on contracts through the site. Jobs can be paid on an hourly basis or as a fixed-price job. Skills have value, and really good skills have really good value. Plus you get to be your own boss and deal directly with clients. Overall, a win-win arrangement for a lot of folks, especially those in less affluent countries.

Over the past couple of years, I have had a variety of jobs done for a relative bargain: logo design for my company, various short-term translation jobs, etc. I especially found a very talented graphic artist from the Philippines who designed most of the art in my popular Trainer HD apps for iOS. I hired a Chinese dude for a few weeks to do some marketing on our behalf in China. With few exceptions, I have had a mostly positive experience with the site and continue to get back to it whenever I need something done that I have neither the skills nor the time to do myself.

A few months ago I decided it was about time to have a real website at www.catloafsoft.com, instead of the very bare-bones logo-and-text page I have had there since inception. The main reason I didn’t bother to take care of this earlier was that the heart of the business was happening on the App Store directly (so the focus has always been to send customers to the app pages there), and the rest through my old mobiletutor.org site for older apps. I am a coder by trade, but I am terrible at front-end Web programming - I haven’t done much HTML since the early days of the Web, and CSS is mostly new to me. And I know I’m not a good designer either - I get too easily distracted by the technical aspects.

But as business for the LLC has been picking up, it was time to improve the public-facing image of the company and get a real site done. After exploring various avenues, oDesk seemed like it would be one of the best places to go to to find somebody to get the job done. My first attempt with just a vague description of the project was met with a huge response the first time I posted the job publicly - literally dozens and dozens of applicants flooded my inbox with their mostly boilerplate pitches. The vast majority were from your stereotypical countries when it comes to IT needs: India, Pakistan, Bangladesh, etc. Countries where English is a common second language and labor costs are much cheaper than stateside.

This first attempt was rather overwhelming and I let it go without hiring anybody for a while. This was really the first time I was hiring for a real coding job after all - getting a very different and obviously more crowded field of applicants. When I was ready to try again, I made sure I was better prepared: I wrote a more comprehensive document that would give a pretty good idea of the project to my coder, including a raw layout of pages and what their content would be. I also included a special keyword in my oDesk job ad, with explicit instructions for applicants to mention it in their cover letters. This would allow me to easily weed out mass applicants that didn’t even deign to read the jobs they apply to - i.e. people I most definitely would not want to do business with.

I had no particular preference with the country of origin of the contractors. While it would be nicer to get somebody closer to the US west coast, the vast majority of applicants were still from Asia. Many of the applicants were also through agencies, meaning that the hire would actually be a team instead of just an individual. In my case, it didn’t matter whether the designer and the coder were the same person or not.

Still, a very significant chunk of the applicants were denied on the spot when they didn’t mention my keyword, which helped a lot. I have to admit it was kinda fun having to explain to that one guy who tried to get me to reconsider my decision this was a basic test I couldn’t allow them to fail.

I am a firm believer in the principle that you tend to get what you pay for, and I was ready to pay a decent hourly wage (around $20/hour or so) to secure somebody competent at their job I could forge a long-term business relationship with. Many of the applicants also had very poor English in their cover letters, which while not necessarily a deal-breaker, definitely reflects poorly on their application.

I started interviewing a little over a dozen prospective applicants over email. The task of going through their portfolios was daunting and time-consuming. I eventually narrowed it down to people who had experience designing sites using the Twitter Bootstrap framework, as I really liked the look, lightness and flexibility of many of the sites I had seen using it. Shifting gears, I started to actually invite contractors to apply who listed this framework as part of their skill set - a much narrower subset of the contractors.

In retrospect, I think actively pursuing contractors instead of letting them come to you might be the best way to make hires on oDesk. Making a public posting creates such a huge amount of initial applications from all over the world that it can be really just counter-productive to spend time weeding through them. If you really know what you are looking for, then it is probably easier to do a search in oDesk’s database and initiate contact with only the people who look qualified.

As my needs were being more clearly defined, this restricted the pool of prospective hires some more. One of them especially seemed to fit the bill very well. She was a French national named Jessica Michael currently living in Canada (yay, fellow frenchie!), a coder with experience using Twitter Bootstrap to design websites and a decent portfolio. At about $17/hour, she was also in my price range - and the proximity on the same continent (though on the East Coast, Toronto) was a big plus as it would help with communication.

She was an independent contractor, although she seemed to be in charge of a Web design business in Canada. We had a quick chat and I was pretty much won over. Her French was surprisingly rusty but I assumed it was from living in a mostly English-speaking area for a long time. In any case, it was not a requirement for the job. The contract started, I sent her the document explaining the project, gave a few clarifications and waited for work to start.

Contractors on oDesk who are paid by the hour have to run a piece of software on their computer that takes screenshots every 10 minutes and posts them to my account. This allows the employer to see the progress of the contractor and make sure that they’re not wasting money on the contractor spending hours playing FarmVille.

Additionally, billed time can be disputed before the credit card on file is charged, so there are always opportunities to fix a wrong. I started looking through Jessica’s work log and everything seemed normal. She was using Dreamweaver CS3 on a Windows PC, and everything was going fine as far as I could tell. This wasn’t a full-time job and I knew she was working on other contracts simultaneously, so I was only expecting a few hours of work per week.

The first drafts of the design were produced. I liked the proposed layouts and approved further coding to go through. Soon the designed pages turned into a demo website we were able to play with. There were a number of things to change (a bunch of typos here and there, for instance) but these were to be expected in the early stages of any project. I let her work further and gave her instructions on how to approach the pages for the Trainer HD pages, a very important piece of the whole project.

At that point I started contemplating further collaboration with myself (as I would need to make content changes) and deployment on our own web server. It was clear that some kind of source control would be useful, as it is with pretty much any software project worth its salt. I ended up deciding to create a Git repository on bitbucket.org (which is a lot like the popular github.com, except they allow you to create private repositories for free). There is a multitude of software clients and documentation on Git available online, as its usage has boomed in recent years. I figured it shouldn’t be a big hurdle for Jessica to download and install the software and start using it as a way to collaborate more closely with me. 

I would expect any graduate with a computer science degree to be at least somewhat familiar with version control systems. They are just one of the tools of the trade. I can understand not being familiar with a relatively new one like Git, but it is imperative for any programmer to at least have used some of them. From the old RCS to CVS, Perforce, Subversion, Git, Mercurial, etc. There’s plenty and it shouldn’t be a major challenge for any seasoned developer to get it setup on their computer, especially after following the many step-by-step guides available online. When I was a student at my engineering school back in France, I certainly had classes on using these - and I would expect the same would be true at any other school in the country, and certainly at the one Jessica claimed she attended.

After I laid out my plan to use Git and BitBucket to Jessica, I told her to get set up on her side. I gave her pointers to the documentation and the necessary Windows software she would have to use. After all, the most she would have to do at this point would be to check out the repository for the site and merge her new files in it. We could then carry on with collaboration without stepping on each other’s toes. I didn’t hear back from her for several days after this.

I eventually managed to get a hold of her on Skype chat late one day, as I wanted to give her some more pointers to get her started with Git on Windows. Up till now we had been communicating pretty much exclusively between oDesk’s e-mail system and Skype chats. The Skype account she was using was simply named after her company, WebWithUs, a relatively professional way to handle this.

This time was odd though. Shortly after I got a response from her, the name associated with the Skype account changed to a new one: Zubair Arif. Red lights immediately went off in my head. Instinctively, I asked what the reason for that sudden change was and didn’t get an answer for a few hours. In the meantime, my investigation was under way. Who was I really talking to? Jessica or Zubair?

With the recent acquisition of Skype by Microsoft, I was aware of what could trigger such a sudden exposition. Microsoft has been working to integrate its Live Messenger service with Skype, and quite possibly “Jessica” went through the upgrade and the user identity was merged from the other account. There was also the possibility that a Facebook account had been connected to Skype, another recent new feature. I have gone through these steps myself but didn’t notice anything our of the ordinary, probably because I have nothing to hide and my identity is consistent across these services.

The first instinct was to search on Google for a Zubair Arif, especially one with connections to the WebWithUs company and the Toronto area. It seems to be a fairly common name in Pakistan, and there was still the possibility that this Zubair would just be another employee of the company. After all, Canada also has a large population of tech immigrants.

A few interesting tidbits quickly surfaced, particularly Facebook and LinkedIn profiles, both with juicy public information. Facebook was especially interesting because of its integration with Skype, making this find more likely to be the right person.

Note that it seems that in an effort to cover his tracks, he has since edited his profiles and restricted access. However, I had the foresight of taking a series of screenshots when I first uncovered him.

The Zubair Arif on Facebook mentioned that he was the “Director” at the WebWithUs company in Canada, which pretty much guaranteed it was the right profile. Director would obviously imply a position of leadership. The other public information on the profile included past education at a college in Lahore, Pakistan, as well as a current living location of Kuala Lumpur, Malaysia.

Drilling down some more on the public information from our friend, I went through his public list of friends. He only had 39 connections in total, so it was a quick look. What was very informative though was comparing that list of friends with glimpses I got from his Skype contacts in the screenshots from Jessica’s work log on oDesk.

Immediately, several connections were visible. This meant that this was obviously the same person - at least the person logged in on Skype. This revelation pushed me to get a closer look at the work log from the past weeks, i.e. the screenshots every 10 minutes that were part of the permanent record in return for payment.

Each of these oDesk screenshots have their own timestamps, conveniently visible in either my own time zone or the time zone of the contractor. The clock of the system was visible in the corner of the screen for every one of the shots. And guess what? It didn’t match either California or Toronto. But it matched East Asia - particularly Malaysia. This discrepancy was plainly visible in every single shot from the work log - I had just never bothered to pay attention to it.

The above screenshot of a candid conversation with one of his pals clearly shows that they were definitely local and planning to get together a couple of hours later in local time - and not EST.

There were even other screenshots where my Skype conversations with “Jessica” were plainly visible. Actual evidence that this person in this very foreign time zone was talking to me posing as a French woman. There was no longer any doubt that I was not talking to a Jessica at all, and probably never was. A lot of things about her started to make a lot more sense. I wondered if that Jessica even ever existed at all; no doubt the person in the pictures existed. She probably just wasn’t the Jessica Michael working for Web With Us in Toronto, Canada. She might not even have been French at all!

A search for matching images on Google Image Search didn’t turn up anything.  A wider search in Google turned out almost no results besides contracting gigs on oDesk and similar sites. Her whole identity just seemed cleverly fake. “Jessica Michael” are both very common names, making it very hard to find relevant results in Google. No doubt this was a valuable trait for a fake profile. The same could have been said about the company name, “Web with us” is a pretty common combination of words.

Looking more into the company, I looked at the whois records for webwithus.ca, the domain they used. It seems that Canadian domains do not always report the full registrant information so there was no way to determine if the person who registered it was based in the country. Certainly this must have been one of the factors that determined the choice of Canada. One insightful tidbit from whois was the domain creation date, however :

Domain name:           webwithus.ca

Domain status:         registered

Creation date:         2011/07/02

Expiry date:           2014/07/02

Updated date:          2012/12/18

This shows that the domain was only registered recently, so at least this Canadian presence has been less than 2 years in the making, contrary to some of the claims implied by the “company” itself.

A lot of other things didn’t gel with the identity of a French, or even Canadian, woman. The very bad conversational French, let alone the often clumsy English. The fact that this French expatriate would not be connected to any other French or even French-sounding names at all. I know that a lot of my contacts are friends and family from back home. She had virtually no online presence at all - save for a Google+ profile that I ran into when I gave her access to the company blog. Very few contacts there too, none of them remotely French either. More pictures that seem to lend legitimacy at first but were probably all swiped from the same album they got her image from.

It just seems inconceivable that a professional Web developer in Canada would have absolutely no online presence. Nothing on LinkedIn or Facebook that is easily findable. It’s like if this person didn’t want to get connected to clients or friends in an increasingly social age. And indeed it seems like it was the plan from the start.

So what did we know at that point? I had absolute certainty that this “Jessica Michael” did not live or work in Canada. I was almost certain that the “webwithus” company did not exist as a legitimate business entity in the Toronto area either.

What we had here was at least one Pakistani web developer, likely based in Kuala Lumpur, who figured that he could raise his chances at getting higher-paying jobs from Americans and other westerners who may have been hesitant to get cheap labor from India.

Some of the oDesk screenshots even showed glimpses of conversations he had with other US employers he had obviously fooled into thinking he was the Canadian Jessica.

I admit I completely understand the reasoning here, and I can see how it probably paid off for him. A clever way to expand his business reach through the time-old practice of lying about your own identity.

However, when it comes to business relationships, as with all other types of relationships, honesty is paramount. For all of the reasons that Zubair had to do what he did, and even though he did a pretty good job with his assignment, I was left with no choice but to immediately terminate his contract.

I gathered all of his latest work and fired him as soon as I verified that the files were in my possession. Trying to confront him on Skype as I did this, he still tried to cover his tracks and deny that he was who he really was. But as can be seen above, the evidence against him was just too strong - I really wish he had the honesty to fess up and admit to his lying. I would have probably given him a second chance if he was willing to make amends.

Trust had been broken and I could no longer have that person with any control of the public face of my business. I immediately revoked all his access and closed the contract, leaving a public rating that should expose him to further employers on the site (although he seems to have since conveniently hidden it).

I have not so far taken any action to try to recover any of the money that was paid, as I still think it was fair pay for the job accomplished. This experience definitely taught me a lesson and while I almost feel angry at myself for letting myself be fooled so easily, there are a few lessons when hiring remote contractors that I think we can all profit from.

1. Do some due diligence. Do not take the online profiles at face value, unless you really don’t care who the person is. Try to find more details about the person and look up their work history on social sites such as LinkedIn. Online contractors need to have an online presence to find work, so they should be easy to find if they know what they are doing. Treat difficulty to locate these contractors as highly suspicious.
2. Consider doing a real live interview as part of the hiring process. Many contractors offer communication with Skype - at least consider doing a video interview with the applicant before hiring them, if only to verify that they are who they say they are. I usually don’t find it practical to have live video chats while the contract is ongoing, especially considering that oDesk already logs the work for me, but it might be useful as a first step.
3. Do not ignore red flags. It is easy to overlook details that may be giving away crucial facts about your contractor, like the fact that he was impersonating somebody else. Details matter!

With this enlightening experience under my belt, I am not deterred from using oDesk in the future. I just know I will have to be more careful in my selection of contractors.

As for the site, we have opted to take the work from Zubair and finish it ourselves, which is something we were somewhat planning on doing in the first place. We just didn’t think we’d have to start doing it before completion, and so abruptly. It doesn’t seem to be worth going through the process again to find somebody else at the moment, and between me and Jenn we can handle the last technical aspects and have the new site up shortly.

This should be self-evident already, but it bears repeating: don’t believe everything your see on the Internet!

Update June 2013: Look what can now be found in the portfolio of a new company called “New Design Malaysia” ? At least now they’re being honest about themselves. That’s as much of a validation of this entire investigation as we’re gonna get. Additionally, oDesk told me that they had closed their contractor profile.