Investigators probed the developer's computer for malware and other clues, but instead turned up hundreds of pdf invoices from a Chinese consulting firm.
From, there, investigators quickly pieced together what happened.
"As it turns out, Bob had simply outsourced his own job to a Chinese consulting firm. Bob spent less that one fifth of his six-figure salary for a Chinese firm to do his job for him," Valentine said.
He had FedExd his RSA token to the Chinese firm so that the company could log in and work using his credentials. Meanwhile "Bob" was typically in his office at the company from 9 a.m. to 4:30 p.m. watching cat videos, reading stories on Reddit and spending time on eBay, Facebook and LinkedIn, the blog post said.
At 4:30 p.m. most days, he would send an end of day update to his managers.
"Evidence even suggested he had the same scam going across multiple companies in the area. All told, it looked like he earned several hundred thousand dollars a year, and only had to pay the Chinese consulting firm about fifty grand annually," the blog post said.
Bob's superior's had rated his work as excellent quarter after quarter.
"His code was clean, well written, and submitted in a timely fashion. Quarter after quarter, his performance review noted him as the best developer in the building," Valentine wrote in his blog.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at 
@jaivijayan, or subscribe to Jaikumar's RSS feed 
. His e-mail address is jvijayan@computerworld.com.
Read more about Security in Computerworld's Security Topic Center.
Free Insider GuideCopyright © 1994 - 2013 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc.
