Video-off/voice-consistency flag
A dev identity & insider risk factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor records whether the protocol team has declined video-on participation in public interviews or recorded calls, or whether voice patterns and stated timezone are inconsistent across public appearances. Measurement is manual curator observation: the curator reviews any recorded public appearances by team members (podcasts, AMAs, conference talks, Twitter Spaces) and flags video-off behavior, accent or language inconsistencies relative to stated geography, or reluctance to appear on camera across multiple occasions. Category 7 context: video-off behavior is an explicit behavioral indicator in DPRK developer-implant detection playbooks.
**Why it matters** US, EU, and crypto-ecosystem investigators have documented video-off behavior as one of several consistent traits of DPRK IT workers posing as remote developers. FBI and DOJ guidance on DPRK freelancer risk specifically calls out consistent video-off behavior, accent inconsistencies, and avoidance of in-person or synchronous video contact as warning signs. The Drift Protocol incident ($285M, April 2026) involved UNC4736 building credibility through in-person conference attendance — a deviation from the video-off pattern, underscoring that sophisticated actors adapt tactics and this signal should not be treated as definitive.
**Green / Yellow / Red** Green is scored when core team members have multiple public recorded video appearances with face-on camera, voices consistent with stated geography, and no documented reluctance to appear synchronously. Yellow applies when some team members have appeared on video but others consistently decline or when only audio appearances are available. Red is scored when all core team members have consistently declined video participation across multiple public appearances despite operating a high-TVL protocol with active community expectations.
**Common gray cases** Gray is assigned when the protocol has no public interview history (too new or low-profile to have generated AMAs), making this signal inapplicable, or when the entire team is explicitly pseudonymous and video-off is the stated policy rather than an anomaly.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Record whether the team has declined video in public interviews, or exhibits voice/timezone inconsistencies suggesting false identity.