Homework: Turing, Investigations Analyst
Where fraud and insider risk sit in an AI data vendor with a global contractor network, the typologies that follow, and a working case desk that takes a case from signal to written report.
Turing sells confidential work done by remote people. Both halves carry the risk: who the person really is, and where the client's data goes.
On a human-data contract, fraud includes the data itself. Machine output passed off as human work is a case, and a quality problem for the lab that paid for it. Section ★.
A case desk on synthetic data: alert queue, cross-source timeline, entity graph, hashed evidence with custody log, generated case report, detection benchmark. Try it ↗
Turing in context
Two businesses, one workforce. Each creates a different insider-risk profile.
| Layer | Fact | What it means for investigations |
|---|---|---|
| Frontier lab side | Coding and STEM datasets, RL environments and benchmarks for frontier labs. Largest data provider in software engineering | Lab instructions, eval sets and prompts are the crown jewels. Exfiltration and leakage cases start here |
| Enterprise side | Agentic AI systems built into Fortune 500 workflows across financial services, life sciences, healthcare, retail, auto and CPG | Engineers hold access to client production data. Access misuse and privilege cases start here |
| Workforce | ~4M developers in the talent cloud. Vetting runs as survey, quiz, coding challenge and AI matching | The funnel is the attack surface for proxy candidates, synthetic identities and the DPRK IT-worker scheme |
| Scale and money | Series E USD 111M, March 2025, led by Khazanah Nasional, USD 2.2B valuation, ~USD 300M run rate and profitable | Large payout volume to a global contractor base. Duplicate payees and payout diversion are live fraud paths |
| Security org | Director of Security Investigations, Director of Information Security and two Investigations Analysts, all open September 2026 | A function being stood up. Playbooks, case templates and detection feedback loops get written by the first hires |
The threat map
Four public events from the last 16 months set what labs now ask of a data vendor.
| Event | What happened | The investigation lesson |
|---|---|---|
| Scale AI, June 2025 | 85+ Google Docs left public, exposing Meta, Google and xAI project material plus contractor records, some editable | Public-link creation on client docs is a detection, with an owner and a time-to-revoke |
| Scale v Mercor, Sept 2025 | Trade-secret suit alleging a departing lead moved 100+ customer strategy docs to a personal Drive | Resignation date plus bulk download plus personal destination is the classic departing-insider pattern. Watch the 30 days before notice |
| Mercor, March 2026 | Poisoned LiteLLM release on PyPI, live about 40 minutes, stole credentials. 40k+ contractors' IDs, interview videos and lab methodology taken. Class action filed 1 April 2026 | Credential theft turns an outsider into an insider. Investigations need a clean line to D&R for session and token review |
| DPRK IT workers, 2025 to 2026 | July 2026 State and FBI advisory with 10 allied nations. Laptop farms, KVM devices, deepfaked interviews, facilitators sentenced to 9 years and 200 months combined | Identity, device and payout evidence have to be read together. Paying one is also a sanctions exposure, so Legal is in from the start |
Typologies for an AI data vendor
Each row is planted in the case desk alongside a benign twin. The twin is the reason a single signal never closes a case.
| Typology | Signals, across sources | Benign twin | First move |
|---|---|---|---|
| Laptop farm / DPRK-style worker | KVM USB id on EDR, remote-access tool, residential proxy ASN against declared country, payout account shared with other workers, face match drop since vetting | Developer with a KVM for two machines and a VPN for travel | Preserve, Legal first, D&R contains access |
| Proxy interviewee | Vetting face and voice differ from delivery calls, typing cadence changes after onboarding, output quality drops | Poor webcam, new headset | Compare vetting media with recent calls |
| Account sharing or resale | Overlapping sessions from two countries, throughput doubles, new device fingerprints | Travel with a laptop and phone both signed in | Session overlap by minute |
| Client data exfiltration | Bulk download of client instructions, public link created, push to a personal Git remote, resignation within 30 days | Lead exporting docs for an approved handover | Revoke link, legal hold, check the ticket |
| Timesheet inflation | Logged hours far above active time, input at fixed intervals, no task output in the window | Reading-heavy review tasks | Output per logged hour against peers |
| Machine output on human-data tasks | Paste ratio near 1, detector score high, throughput spike, identical phrasing across tasks | Fast senior engineer drafting offline | Sample with the client QA rubric |
| Duplicate payee | Several contractor accounts paying into one bank fingerprint, bank country unrelated to each profile | Family members sharing a joint account, disclosed | Hold payouts, verify identity |
| Staff privilege misuse | Admin grants self access to another client's workspace with no ticket, outside hours | On-call fix with a late ticket | Match to change record, interview via HR |
JD duties, my method
Each duty in the posting, the method I would bring, and where it shows on this page or in the desk.
| JD duty | Method | Shown in | Status |
|---|---|---|---|
| Investigate fraud and insider threat cases, reconstruct events | One timeline per subject across all sources, coloured by source, so gaps and overlaps are visible before any conclusion | §04 | built |
| Triage alerts and reports, escalate appropriately | Severity sets the path. Sanctions or active exfiltration go to D&R and Legal at once. Behavioural alerts are worked in score order with a stated SLA | §05 | built |
| Analyse logs, transactions and behavioural signals | Join on stable keys: device id, payout fingerprint, ASN, vetting id. Shared keys between people are the strongest lead | §04 | built |
| Document objectively, keep chain of custody | Evidence hashed at collection with collector and UTC time. Report separates fact from inference and states confidence with a reason | §05 | built |
| Partner with D&R, Legal and HR | Legal before any contact with a subject or any OSINT. HR owns the interview. D&R owns containment. The analyst owns the file | §05 | designed |
| Contribute to playbooks, feed new detections | Every closed case ends with a detection note: what would have caught it earlier, and what it would have cost in false positives | §04 | built |
| Nice to have: SIEM, DLP, UEBA, SQL, Python | SQL and Python daily. SIEM query languages (SPL, KQL) are syntax over the same joins | resume | partial |
The case desk
Built for this application on a synthetic workforce: 400 contractors, 60 staff, 30 days, about 30,750 events, 22 rules. At the default threshold it catches 11 of 11 planted subjects with no alerts on the 9 benign twins. No Turing systems or data. Open the desk ↗
Alerts with severity, source and SLA age. Dismissal needs a reason. Escalation names the partner team.
Unified timeline, the signals that fired and why, and a graph of shared devices, IPs and payout accounts.
Filter the raw logs directly, with saved hunts for each typology.
Pinning a row hashes it (SHA-256) and appends a custody entry. Re-verify at any time.
Generated write-up: scope, sources, timeline, findings with evidence ids, benign hypotheses tested, confidence, actions.
Rules run over labelled subjects with a threshold slider, so each change shows what it catches and what it costs.
Working a case
The same seven steps on every case. Cheap, reversible steps first.
alert or report
snapshot, hash
write it, test it
two independent sources
Legal, D&R, HR
facts, inference, confidence
detection note
| Evidence rule | Practice |
|---|---|
| Hash at collection | SHA-256 of the canonical export, recorded with collector, source system and UTC time |
| Work on copies | Originals stay in the evidence store. Analysis runs on a copy with its own hash |
| Log every transfer | Each hand-off to Legal, HR or an outside party is a custody entry |
| Legal hold early | Mailbox, Drive and Git retention frozen before the subject can know |
| Need to know | Case access limited to named people. No case detail in shared channels |
| Proportionate collection | Only what the allegation needs, on a documented basis. Stricter where GDPR applies |
First 90 days
- Learn every source: fields, retention, join keys
- Shadow senior investigators on live cases
- Read closed cases, list what each one needed and lacked
- Work cases end to end with review
- Draft a case report template and evidence checklist
- Saved queries for the top three typologies
- Independent caseload
- Two detection proposals from closed cases, each priced in false positives
- Playbook drafts for workforce identity fraud and data exfiltration
Method & sources
Public job posting (2026), public reporting and court records. The case desk uses synthetic data only.
| Claim | Source |
|---|---|
| Series E USD 111M led by Khazanah, USD 2.2B, ~USD 300M run rate | SiliconANGLE, TechCrunch via Yahoo |
| ~4M developers in the network | Fortune |
| Automated vetting funnel | Tecla review |
| Director of Security Investigations opening | job listing |
| Scale AI public Google Docs, June 2025 | TechRepublic |
| Scale v Mercor trade-secret suit | Axios |
| Mercor breach via LiteLLM, March 2026 | TechCrunch, BankInfoSecurity, Hausfeld |
| DPRK IT-worker advisory, laptop farms, sentences | Skadden, Holland & Knight, DOJ, The Hacker News |
Independent work by Edward Tay for a job application. Not affiliated with Turing. The case desk is a prototype built for this application and is not Turing software.