Hiring verified one person and employing another
The background check passed. The interview was convincing. The laptop was shipped to a real address. Every control operated correctly, and none of them was designed to answer the question of who sits in front of the machine on any given Tuesday.
How does the North Korean IT worker scheme defeat normal hiring controls?
It separates the identity that was verified from the person doing the work. A US-based facilitator hosts the corporate laptop at a real residential address and installs remote access, so geolocation, device posture and working hours all look correct while an overseas operative works the keyboard.
- Onboarding identity verification is a one-time event, and the employment relationship that follows is continuous.
- Remote access infrastructure deliberately decouples the person from the device, which is what makes a facilitator arrangement work.
- Periodic re-verification bound to the enrolled human, and required on sensitive actions, closes the gap without surveillance.
Part of Remote workforce identity
The structure of the arrangement
The scheme depends on separating four things that hiring assumes are the same person.
| Element | Who it actually is |
|---|---|
| The identity on the application | A real person, whose documents were obtained or fabricated |
| The person in the interview | Sometimes the operative, sometimes a proxy, sometimes synthetic |
| The address receiving the laptop | A facilitator, paid to host it |
| The person doing the work | The operative, connecting remotely to that laptop |
Hiring processes verify the first and observe the second. The third and fourth are outside every control.
Why the laptop matters so much
Shipping a managed device to a residential address is a control: it establishes a physical location, it ensures the endpoint is managed, and it makes the employment feel concrete.
A facilitator defeats all of that by receiving the device, connecting it to their network, and installing remote access. From the employer's telemetry the device is exactly where it should be, on a residential connection, in the expected time zone.
The remote session is invisible, because remote access to a desktop is a normal thing that the security tooling has no reason to flag.
Why the usual signals do not fire
- Geolocation shows the facilitator's address, which matches the record
- Device posture is compliant, because the device is genuinely managed
- Working hours match, because the operative works the target time zone
- Network telemetry shows a residential connection
- Performance is normal, because the work is genuinely being done
The last point is worth dwelling on. These are often competent engineers delivering acceptable work, which removes the performance signal that would prompt closer attention.
What actually distinguishes the cases
Not behaviour. Possession of a credential that the enrolled human holds physically.
# Enrolment, at onboarding, in person or via a supervised session:
# the verified individual enrols a credential on a device
# they physically hold, with user verification required
# Thereafter, periodically and on sensitive actions:
challenge = issue_challenge(context)
assertion = await_signature(challenge)
verify(assertion, credential_for(employee))
require(assertion.user_verified) # biometric or PIN, now
require(fresh(assertion, max_age=120))
# An operative connecting remotely to a facilitator's laptop
# cannot produce this. The credential is not on that machine,
# and the user-verification gesture requires the enrolled human.The critical property is that the credential lives on a device the employee holds, not on the corporate laptop. If it is on the laptop, the remote operative has it too.
Where to require it
| Trigger | Rationale |
|---|---|
| Periodic, on a schedule | Establishes continuity of the employment relationship |
| Production access or deployment | The actions with the largest consequence |
| Access to sensitive data sets | Where exfiltration risk concentrates |
| Payroll and banking detail changes | The financial dimension of the scheme |
| After a period of inactivity | A natural point for a handover to occur |
A periodic check every few weeks is unobtrusive, takes seconds, and is the single most effective element. It is also the one that most clearly distinguishes this from surveillance: it asks the employee to confirm presence, not to be monitored.
The privacy framing matters
Approaches to this problem often reach for monitoring: keystroke analysis, screen capture, camera checks. These are invasive, legally fraught in many jurisdictions, and defeated by a competent operative.
A signature request is the opposite. It collects nothing, transmits no biometric, and produces a binary result. The employee performs a gesture on their own device and the biometric never leaves it.
That distinction is what makes the control deployable in jurisdictions with strict employee monitoring and biometric privacy law, where the surveillance approaches are not.
What this does not address
A willing employee who hands their device and passcode to someone else. No remote mechanism addresses collusion, and that is a different problem requiring different responses.
It also does not address the initial identity verification, which remains the foundation. If the credential is enrolled to a fabricated identity, everything built on it inherits the flaw. Enrolment is where investment belongs, and periodic re-verification is what makes that one-time investment continue to mean something.
What enforcement has established
United States law enforcement has raided roughly 29 laptop farms across 16 states in a coordinated action that also involved three indictments, an arrest, the seizure of 29 financial accounts and the shutdown of 21 websites. FBI officials have said the farms allowed North Korean workers to be employed at more than 100 US companies, including Fortune 500 corporations, a national television network, an aerospace manufacturer, a car maker and a luxury retailer.
Individual prosecutions give the shape of a single cell. One multi-year scheme used the stolen identities of at least 80 US persons and generated more than $5 million for the DPRK. Facilitators have received custodial sentences, including one of 108 months. The exposure for an employer is not only fraud loss: it is sanctions liability, and potentially export-control and data-protection exposure depending on what the worker could reach.
| Signal | What it shows | Why it passes |
|---|---|---|
| Geolocation | The facilitator's US address | That address is real and on file |
| Device posture | Compliant managed laptop | The device genuinely is managed |
| Working hours | Target time zone | The operative works those hours |
| Network telemetry | Residential connection | It is a residential connection |
| Work output | Acceptable | The work is genuinely being done |
Objections and honest limits
“Our background checks are thorough.” They verify an identity once, and the identity is usually a real stolen one that passes. Nothing in a background check binds that identity to whoever sits at the keyboard next March.
“We would notice the performance.” Frequently there is nothing to notice. These are often competent engineers delivering acceptable work, which is precisely what removes the signal that would prompt a closer look.
What periodic re-verification does not address: a willing employee who hands over their device and passcode. That is collusion and needs a different response. It also depends entirely on enrolment being sound — a credential bound to a fabricated identity inherits the flaw.
Binding the hire to the worker
- Enrol on a device the person holds. Not the corporate laptop. If the credential lives on the laptop, the remote operative has it too.
- Enrol under supervision. In person, or in a session where identity proofing and enrolment happen together and are linked.
- Re-verify on a schedule. Every few weeks, seconds to complete. This single step is the most effective element and the least intrusive.
- Require it on sensitive actions. Production access, bulk data access, and any change to payroll or banking details.
- Disable device redirection. USB and smart card redirection in remote sessions defeats the whole control. Check it, do not assume it.
Terms used here
- Laptop farm
- A residence or facility where corporate laptops issued to remote hires are hosted and connected, so telemetry shows the expected location while the work is performed elsewhere.
- Facilitator
- A person, usually domestic, paid to receive equipment, host it and pass on wages. Several have been prosecuted and received custodial sentences.
- Continuity
- The property that the identity verified at hire remains attached to the person working. Identity proofing is a moment; employment is a duration.
Frequently asked questions
Why don't geolocation and device posture catch this? The laptop genuinely is at the address on record, genuinely managed, on a residential connection. The remote session into it is ordinary and unflagged.
Where must the credential live? On a device the employee physically holds — not the corporate laptop. If it is on the laptop, a remote operative has it too.
Is this employee surveillance? No. It collects nothing and transmits no biometric. The gesture happens on the employee's own device and produces a binary result.
What does it not address? Willing collusion, where an employee hands over their device and passcode. And it depends on enrolment being sound — a credential enrolled to a fabricated identity inherits that flaw.
How many companies have been affected? FBI officials have said laptop farms allowed North Korean workers to be employed at more than 100 US companies, including Fortune 500 firms, an aerospace manufacturer and a national TV network.
How much revenue does a single cell generate? One prosecuted multi-year scheme used at least 80 stolen US identities and generated more than $5 million for the DPRK. Facilitators have been sentenced to terms including 108 months.
Is this a fraud problem or a sanctions problem? Both. Paying a sanctioned party creates exposure independent of any data loss, and depending on what the worker could reach there may be export-control and data-protection consequences too.
Where this fits in Manav
Manav binds the verified human to a credential on a device they physically hold, then re-establishes presence on a schedule and on sensitive actions. The check collects nothing and transmits no biometric — an operative connecting to a hosted laptop simply cannot produce the signature.
Sources and further reading
- U.S. Department of Justice — press releases
- U.S. Department of Justice — indictments in the fraudulent remote IT worker scheme
- The Record — DOJ raids 29 laptop farms in the North Korean IT worker crackdown
- NIST SP 800-63A — Enrollment and identity proofing
- U.S. Treasury OFAC — North Korea sanctions programs