DOJ charges 14 in North Korean IT worker scheme

U.S. investigative authorities have launched a massive crackdown targeting North Korean IT workers who were working undercover for U.S. companies.

Editor's note: this story was translated from the original VOA Korean article.

A federal grand jury in Ohio has indicted two Americans, 10 Chinese nationals and two defendants whose identities remain under seal for helping North Korean IT workers obtain remote jobs at U.S. companies using stolen or fabricated identities, the Justice Department said Tuesday.

The two Americans, residents of Pennsylvania and Texas, were arrested. The other defendants, many of them from Dandong, a Chinese city on the border with North Korea, remain at large. They face charges of wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft, and aggravated identity theft.

The Justice Department said more than 70 U.S. companies were affected and that about $3 million in revenue is believed to have been sent to sanctioned entities controlled by North Korea. The victim companies were not named.

“North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the United States or its allies,” said Assistant Attorney General for National Security John A. Eisenberg.

At the center of the schemes are so-called laptop farms, where work laptops issued by victim companies are kept at the homes of U.S.-based facilitators. North Korean workers connect to the devices remotely from abroad, appearing to work from inside the United States.

From September 21 to 25, under “Operation Lonestar Roundup,” the FBI searched more than 40 homes in Texas known or suspected to be laptop farms and seized about 187 laptops and KVM devices, which allow a computer to be controlled remotely. The Justice Department did not say whether anyone was arrested or charged in that operation. The 14 charges come from a separate Ohio case.

“Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security,” said U.S. Attorney Ryan Raybould for the Northern District of Texas.

The 58-page Ohio indictment offers a detailed look at the scheme. According to the indictment, overseas co-conspirators directed a U.S.-based facilitator in Ohio to hire an actor to sit for an in-person job interview and to pay for advertisements recruiting actors with a stolen credit card. One fake employee submitted a form purportedly signed by a “psychologist” to avoid using a video camera.

In a public service announcement issued the same day, the FBI said North Korean IT workers pay Americans who are facing financial hardship to sit for video job interviews and to complete urinalysis tests and fingerprint submissions on their behalf. In some cases, after being fired, the North Korean workers made death threats against former managers and their families to demand money, the FBI said.

The FBI estimates that the North Korean government receives about 85% to 90% of the revenue these workers generate and said the largest operator of such workers is likely the Workers’ Party of Korea’s Munitions Industry Department.

The Justice Department said the actions are the latest in a series of efforts to disrupt North Korea’s illicit revenue generation and its U.S.-based enablers.