On Being Paranoid or How To Steal From Your Next Corporation
A new member of the corporation turned up in our corporation communication channel recently, one neither of the two directors currently on-line had met before. Or, indeed, had even heard about. A quick poking with a stick met with no response and we jointly agreed to kick the unfamiliar face back out of the corporation. It was perhaps the shortest stay of any new member, as well as the fastest re-recruitment time. It turns out that the capsuleer was a secondary character of a current but still relatively new member of the corporation and had applied and been accepted by another director.
There is no problem with directors making decisions, it’s what each of us is meant to do. But I feel our process is lacking some oversight and scrutiny, and perhaps some discipline. I notice that we get applications that are empty, with no introductory or explanatory text about who the character is, why they want to join, or what procedures they have already been through and with whom. This makes it rather difficult to assess the application beyond ignoring it and hoping to find out more later. I am hoping to change this, and have already rejected a blank application with the explicit reason that we shouldn’t accept such uninformative requests.
We already ask for access to the capsuleer’s limited API key—and rejected someone who curiously argued against giving this standard nugget of information—which at least helps us see if the actual skill set matches that claimed, but it doesn’t offer much about the character. For this, we ask the capsuleer to join our recruitment channel and stick around for a chat. This lets us gauge interest and attitude, ask pertinent questions, and see tolerance to inane banter—as long as we’re not in the middle of hunting in w-space when our concentration may be elsewhere. A potential recruit should therefore be able to give details of this conversation, who he talked to, and his API key in the body of the application, as a minimum. At least we have details that can be verified and we have another measure of the trustworthiness of the recruit.
Troubles with recruiting go deeper. I am not entirely sure how to accept secondary characters in to the corporation. Bear in mind that for a w-space corporation who lives entirely out of shared hangars the possibility of theft is a real and very expensive risk, one that we have already suffered. The ability to segregate the availability of resources is difficult and inconvenient at best. Personally, if I wanted to steal from a w-space corporation a secondary character would make a lot of sense. But I would reverse the roles.
[caption id="attachment_926" align="alignleft" width="150" caption="I'm just a high-sec trading alt..."]
[/caption]
I would apply to the corporation with my secondary character first, my limited and innocuous skills making me seem harmless. Training in science and industry and not being able to fly anything bigger than a battlecruiser would help shape perceptions. I join the corporation and loiter for a while, being helpful and raking in some iskies. Then I log out and log in with a different character, joining the recruitment channel and asking if my ‘trading alt’ can join the corporation. Surely there can be no harm in this. A high-sec trading character, who is confirmed by the other character to be controlled by the same person, poses no threat to operations.
Except that this ‘alt’ is actually my main character, years old and able to pilot many big and expensive ships, probably even able to pilot an Orca stuffed to the hull with loot and other ships. In a quiet period, my secondary character contracts the bookmarks for the current route between the w-space tower and empire space to my main, and I bring my main to the tower to steal all I can pilot and park it in a personal hangar in an empire station. To avoid the corporation paper trail maybe I liquidate my secondary character’s assets, give it all to my main, then biomass the character to start a new mule.
Maybe I’m just being paranoid. But trust in recruitment is difficult enough without having gaping backdoors that bypass the procedures meant to protect the corporation and its members from harm. I am starting to ask for more stringent measures for every step of the recruitment process and not to assume anything, whether it’s that the alt really is an alt, or that the applicant actually has spoken to a director and not just filed a blank application in ignorance. It’s difficult to learn someone’s character when the system allows it to be masked so easily. The best we can do is follow good practice to keep our exposure to risk at a minimum. There must be a better way but it may take a while, and some failures, before I find it.
