{
"slug": "dprk-it-worker-laptop-farm-prevention-guide",
"topic_id": "TOPIC-082",
"cluster": "Remote Workforce & Insider Threat",
"tier": "Tier A",
"title": "Hiring verified one person and employing another",
"summary": "Identity is verified once, at onboarding. Everything after that is a session on a corporate laptop, and nothing re-establishes who is at the keyboard.",
"lede": "The background check passed. The interview was convincing. The laptop was shipped to a real address. Every control operated correctly, and none of them was designed to answer the question of who sits in front of the machine on any given Tuesday.",
"date": "2026-02-17",
"category": "Future of Work",
"author_id": "whit-calloway",
"tags": [
"insider threat",
"remote hiring",
"identity verification",
"sanctions",
"workforce",
"DPRK"
],
"image_title": "Hired One Employed Another",
"schema": "Article",
"key_takeaways": [
"Onboarding identity verification is a one-time event, and the employment relationship that follows is continuous.",
"Remote access infrastructure deliberately decouples the person from the device, which is what makes a facilitator arrangement work.",
"Periodic re-verification bound to the enrolled human, and required on sensitive actions, closes the gap without surveillance."
],
"body": [
{
"type": "h2",
"text": "The structure of the arrangement"
},
{
"type": "diagram",
"kind": "chain",
"alt": "A stolen identity is hired, the laptop ships to a facilitator, and an overseas operative connects remotely",
"caption": "Four things hiring assumes are one person. Only the first two are ever checked.",
"nodes": [
{
"label": "Identity on the application",
"sub": "real person",
"note": "verified"
},
{
"label": "Person in the interview",
"sub": "proxy or synthetic",
"note": "observed"
},
{
"label": "Address for the laptop",
"sub": "facilitator",
"note": "unchecked",
"bad": true
},
{
"label": "Person at the keyboard",
"sub": "operative",
"note": "never checked",
"bad": true
}
]
},
{
"type": "p",
"html": "The scheme depends on separating four things that hiring assumes are the same person."
},
{
"type": "table",
"head": [
"Element",
"Who it actually is"
],
"rows": [
[
"The identity on the application",
"A real person, whose documents were obtained or fabricated"
],
[
"The person in the interview",
"Sometimes the operative, sometimes a proxy, sometimes synthetic"
],
[
"The address receiving the laptop",
"A facilitator, paid to host it"
],
[
"The person doing the work",
"The operative, connecting remotely to that laptop"
]
]
},
{
"type": "p",
"html": "Hiring processes verify the first and observe the second. The third and fourth are outside every control."
},
{
"type": "h2",
"text": "Why the laptop matters so much"
},
{
"type": "p",
"html": "Shipping a managed device to a residential address is a control: it establishes a physical location, it ensures the endpoint is managed, and it makes the employment feel concrete."
},
{
"type": "p",
"html": "A facilitator defeats all of that by receiving the device, connecting it to their network, and installing remote access. From the employer's telemetry the device is exactly where it should be, on a residential connection, in the expected time zone."
},
{
"type": "p",
"html": "The remote session is invisible, because remote access to a desktop is a normal thing that the security tooling has no reason to flag."
},
{
"type": "h2",
"text": "Why the usual signals do not fire"
},
{
"type": "ul",
"items": [
"Geolocation shows the facilitator's address, which matches the record",
"Device posture is compliant, because the device is genuinely managed",
"Working hours match, because the operative works the target time zone",
"Network telemetry shows a residential connection",
"Performance is normal, because the work is genuinely being done"
]
},
{
"type": "p",
"html": "The last point is worth dwelling on. These are often competent engineers delivering acceptable work, which removes the performance signal that would prompt closer attention."
},
{
"type": "h2",
"text": "What actually distinguishes the cases"
},
{
"type": "p",
"html": "Not behaviour. Possession of a credential that the enrolled human holds physically."
},
{
"type": "code",
"text": "# Enrolment, at onboarding, in person or via a supervised session:\n# the verified individual enrols a credential on a device\n# they physically hold, with user verification required\n\n# Thereafter, periodically and on sensitive actions:\nchallenge = issue_challenge(context)\nassertion = await_signature(challenge)\nverify(assertion, credential_for(employee))\nrequire(assertion.user_verified) # biometric or PIN, now\nrequire(fresh(assertion, max_age=120))\n\n# An operative connecting remotely to a facilitator's laptop\n# cannot produce this. The credential is not on that machine,\n# and the user-verification gesture requires the enrolled human."
},
{
"type": "p",
"html": "The critical property is that the credential lives on a device the employee holds, not on the corporate laptop. If it is on the laptop, the remote operative has it too."
},
{
"type": "h2",
"text": "Where to require it"
},
{
"type": "table",
"head": [
"Trigger",
"Rationale"
],
"rows": [
[
"Periodic, on a schedule",
"Establishes continuity of the employment relationship"
],
[
"Production access or deployment",
"The actions with the largest consequence"
],
[
"Access to sensitive data sets",
"Where exfiltration risk concentrates"
],
[
"Payroll and banking detail changes",
"The financial dimension of the scheme"
],
[
"After a period of inactivity",
"A natural point for a handover to occur"
]
]
},
{
"type": "p",
"html": "A periodic check every few weeks is unobtrusive, takes seconds, and is the single most effective element. It is also the one that most clearly distinguishes this from surveillance: it asks the employee to confirm presence, not to be monitored."
},
{
"type": "h2",
"text": "The privacy framing matters"
},
{
"type": "p",
"html": "Approaches to this problem often reach for monitoring: keystroke analysis, screen capture, camera checks. These are invasive, legally fraught in many jurisdictions, and defeated by a competent operative."
},
{
"type": "p",
"html": "A signature request is the opposite. It collects nothing, transmits no biometric, and produces a binary result. The employee performs a gesture on their own device and the biometric never leaves it."
},
{
"type": "p",
"html": "That distinction is what makes the control deployable in jurisdictions with strict employee monitoring and biometric privacy law, where the surveillance approaches are not."
},
{
"type": "h2",
"text": "What this does not address"
},
{
"type": "p",
"html": "A willing employee who hands their device and passcode to someone else. No remote mechanism addresses collusion, and that is a different problem requiring different responses."
},
{
"type": "p",
"html": "It also does not address the initial identity verification, which remains the foundation. If the credential is enrolled to a fabricated identity, everything built on it inherits the flaw. Enrolment is where investment belongs, and periodic re-verification is what makes that one-time investment continue to mean something."
},
{
"type": "h2",
"text": "What enforcement has established"
},
{
"type": "p",
"html": "United States law enforcement has raided roughly 29 laptop farms across 16 states in a coordinated action that also involved three indictments, an arrest, the seizure of 29 financial accounts and the shutdown of 21 websites. FBI officials have said the farms allowed North Korean workers to be employed at more than 100 US companies, including Fortune 500 corporations, a national television network, an aerospace manufacturer, a car maker and a luxury retailer."
},
{
"type": "p",
"html": "Individual prosecutions give the shape of a single cell. One multi-year scheme used the stolen identities of at least 80 US persons and generated more than $5 million for the DPRK. Facilitators have received custodial sentences, including one of 108 months. The exposure for an employer is not only fraud loss: it is sanctions liability, and potentially export-control and data-protection exposure depending on what the worker could reach."
},
{
"type": "table",
"caption": "What each control sees during a facilitator arrangement",
"head": [
"Signal",
"What it shows",
"Why it passes"
],
"rows": [
[
"Geolocation",
"The facilitator's US address",
"That address is real and on file"
],
[
"Device posture",
"Compliant managed laptop",
"The device genuinely is managed"
],
[
"Working hours",
"Target time zone",
"The operative works those hours"
],
[
"Network telemetry",
"Residential connection",
"It is a residential connection"
],
[
"Work output",
"Acceptable",
"The work is genuinely being done"
]
]
},
{
"type": "h2",
"text": "Objections and honest limits"
},
{
"type": "p",
"html": "“Our background checks are thorough.” They verify an identity once, and the identity is usually a real stolen one that passes. Nothing in a background check binds that identity to whoever sits at the keyboard next March."
},
{
"type": "p",
"html": "“We would notice the performance.” Frequently there is nothing to notice. These are often competent engineers delivering acceptable work, which is precisely what removes the signal that would prompt a closer look."
},
{
"type": "p",
"html": "What periodic re-verification does not address: a willing employee who hands over their device and passcode. That is collusion and needs a different response. It also depends entirely on enrolment being sound — a credential bound to a fabricated identity inherits the flaw."
}
],
"faq": [
{
"q": "Why don't geolocation and device posture catch this?",
"a": "The laptop genuinely is at the address on record, genuinely managed, on a residential connection. The remote session into it is ordinary and unflagged."
},
{
"q": "Where must the credential live?",
"a": "On a device the employee physically holds — not the corporate laptop. If it is on the laptop, a remote operative has it too."
},
{
"q": "Is this employee surveillance?",
"a": "No. It collects nothing and transmits no biometric. The gesture happens on the employee's own device and produces a binary result."
},
{
"q": "What does it not address?",
"a": "Willing collusion, where an employee hands over their device and passcode. And it depends on enrolment being sound — a credential enrolled to a fabricated identity inherits that flaw."
},
{
"q": "How many companies have been affected?",
"a": "FBI officials have said laptop farms allowed North Korean workers to be employed at more than 100 US companies, including Fortune 500 firms, an aerospace manufacturer and a national TV network."
},
{
"q": "How much revenue does a single cell generate?",
"a": "One prosecuted multi-year scheme used at least 80 stolen US identities and generated more than $5 million for the DPRK. Facilitators have been sentenced to terms including 108 months."
},
{
"q": "Is this a fraud problem or a sanctions problem?",
"a": "Both. Paying a sanctioned party creates exposure independent of any data loss, and depending on what the worker could reach there may be export-control and data-protection consequences too."
}
],
"sources": [
{
"t": "U.S. Department of Justice — press releases",
"u": "https://www.justice.gov/news"
},
{
"t": "U.S. Department of Justice — indictments in the fraudulent remote IT worker scheme",
"u": "https://www.justice.gov/opa/pr/two-north-korean-nationals-and-three-facilitators-indicted-multi-year-fraudulent-remote"
},
{
"t": "The Record — DOJ raids 29 laptop farms in the North Korean IT worker crackdown",
"u": "https://therecord.media/doj-raids-laptop-farms-crackdown"
},
{
"t": "NIST SP 800-63A — Enrollment and identity proofing",
"u": "https://pages.nist.gov/800-63-4/sp800-63a.html"
},
{
"t": "U.S. Treasury OFAC — North Korea sanctions programs",
"u": "https://ofac.treasury.gov/sanctions-programs-and-country-information/north-korea-sanctions"
}
],
"related": [
{
"slug": "bait-switch-hire-deepfake-video-interviews-infiltrating",
"title": "Deepfake video interviews",
"category": "Future of Work"
},
{
"slug": "keystroke-dynamics-behavioral-biometrics-fail-against-remote",
"title": "Why behavioural biometrics fail",
"category": "Future of Work"
},
{
"slug": "zero-biometric-workforce-assurance-model-verifying-identity",
"title": "Workforce assurance without biometric collection",
"category": "Future of Work"
},
{
"slug": "remote-desktop-protocol-rdp-anydesk-forwarding-hardware-keys",
"title": "Why a hardware key will not work down a remote desktop tunnel",
"category": "Future of Work"
}
],
"image": "https://cdn.twc.sh/images/igcache/Hired%20One%20Employed%20Another/1500_900/blog.jpg",
"wordcount": 1231,
"url": "/blog/dprk-it-worker-laptop-farm-prevention-guide.html",
"reading_time": "5 min read",
"hub": {
"slug": "topics/remote-workforce-identity",
"title": "Remote workforce identity"
},
"answer": "It separates the identity that was verified from the person doing the work. A US-based facilitator hosts the corporate laptop at a real residential address and installs remote access, so geolocation, device posture and working hours all look correct while an overseas operative works the keyboard.",
"answer_q": "How does the North Korean IT worker scheme defeat normal hiring controls?",
"entities": [
{
"name": "United States Department of Justice",
"type": "GovernmentOrganization",
"url": "https://www.justice.gov/",
"primary": true
},
{
"name": "Democratic People's Republic of Korea",
"type": "Country",
"url": "https://ofac.treasury.gov/sanctions-programs-and-country-information/north-korea-sanctions"
}
],
"glossary": [
{
"term": "Laptop farm",
"def": "A residence or facility where corporate laptops issued to remote hires are hosted and connected, so telemetry shows the expected location while the work is performed elsewhere."
},
{
"term": "Facilitator",
"def": "A person, usually domestic, paid to receive equipment, host it and pass on wages. Several have been prosecuted and received custodial sentences."
},
{
"term": "Continuity",
"def": "The property that the identity verified at hire remains attached to the person working. Identity proofing is a moment; employment is a duration."
}
],
"checklist": {
"title": "Binding the hire to the worker",
"id": "binding",
"desc": "Five steps that keep the verified identity attached to the person doing the work.",
"steps": [
{
"name": "Enrol on a device the person holds.",
"text": "Not the corporate laptop. If the credential lives on the laptop, the remote operative has it too."
},
{
"name": "Enrol under supervision.",
"text": "In person, or in a session where identity proofing and enrolment happen together and are linked."
},
{
"name": "Re-verify on a schedule.",
"text": "Every few weeks, seconds to complete. This single step is the most effective element and the least intrusive."
},
{
"name": "Require it on sensitive actions.",
"text": "Production access, bulk data access, and any change to payroll or banking details."
},
{
"name": "Disable device redirection.",
"text": "USB and smart card redirection in remote sessions defeats the whole control. Check it, do not assume it."
}
]
},
"cta": {
"title": "Where this fits in Manav",
"html": "Manav binds the verified human to a credential on a device they physically hold, then re-establishes presence on a schedule and on sensitive actions. The check collects nothing and transmits no biometric — an operative connecting to a hosted laptop simply cannot produce the signature.",
"href": "../docs.html",
"label": "See workforce re-verification"
}
}