Is your new co-worker secretly North Korean?

Host PJ Vogt introduces the episode by connecting the difficulty of finding work in the United States to a less visible problem: North Korean workers are being placed in American jobs, often without employers knowing. The North Korean government, despite international sanctions, has developed a way to earn hundreds of millions of dollars by sending technically skilled workers into remote positions at American and other Western companies. Some workers may spy, hack, or steal, but many are primarily there to collect wages that are sent back to the regime. Guest Sam Kessler, a Wall Street Journal data and investigative reporter, says the operation relies on a small group of educated, computer-skilled North Koreans trusted by the regime. Because remote work became normal after COVID, a worker can appear to be based in the United States while never meeting colleagues in person. Kessler argues that employers face two risks: their money supports a government widely accused of severe abuses, and the workers have powerful reasons to prioritize North Korea over the company employing them. In one case, a company discovered that roughly half its staff appeared to be North Korean; one suspicious worker claimed to be in Japan, missed work because of a nonexistent earthquake, and later returned with a different accent.

Kessler first encountered the scheme roughly two years earlier through a tip about a cryptocurrency project allegedly being run by North Korea. He contacted a source named Zaki, who confirmed that the project had hired several North Koreans and had received a strange FBI email. That lead eventually allowed Kessler to identify more than a dozen crypto companies that had hired North Korean workers. When the crypto boom faded, the workers and the people organizing them moved into a much wider range of industries. Kessler and Wall Street Journal colleagues Emma Scott and Robert McMillan found applications going to banks, financial institutions, technology companies, and insurance providers. The workers had adapted their methods to stricter hiring systems and were applying almost everywhere remote work was available. The team traced multiple computers to a North Korean cell led by someone using the username “Eagle Vision.” From the computers they examined, the cell obtained at least nine jobs, including a contract role at Amazon through a third-party recruiting agency. Kessler says some workers are capable engineers, particularly those who came through the earlier crypto ecosystem, while newer recruits—including students pressured or deputized to apply for jobs—make the operation more of a volume-based “shotgun approach.”

The Wall Street Journal team obtained data from computers used by North Korean workers, including screen recordings of job interviews. The recordings showed a worker appearing in a Google Meet interview while using ChatGPT in another window. The system had been prompted to help with a software-engineering interview; the worker copied interview questions or live captions into ChatGPT, waited for an answer, and read the generated response aloud. One answer described using software for background tasks, workflows, API requests, and cost efficiency. Interviewers sometimes tested candidates by asking where they were located or what the weather was like. In one recording, a candidate claimed to be in a particular place, became visibly flustered when asked about the local weather, and had someone controlling the computer quickly search Google for the temperature. Some employers have also tried asking candidates to say something insulting about Kim Jong-un. Kessler says suspected North Koreans often freeze or hang up rather than criticize the leader, likely because fear extends to their families in North Korea. The workers were not uniformly competent. One Florida company fired a worker because he seemed slow and did not understand the work. In another recording, a manager reprimanded a worker for calling in sick late and for lacking communication skills, while acknowledging that he appeared to have technical expertise.

Kessler explains that the workers are often based outside North Korea, especially in China and sometimes Russia, where they may live in dormitory-style housing under supervision. Reports from governments and defectors indicate that monitors ensure workers follow instructions. Most of the money goes back to the North Korean regime, and Kessler’s reporting found links between money from the scheme and companies that governments have associated with missile development and North Korea’s weapons program. A recent government estimate put the income from North Korean IT workers at $800 million per year, but Kessler calls that a lower-bound estimate because investigators can count only what they uncover. He says the work is a new, industrial-scale version of the regime’s efforts to earn money despite sanctions. The host asks why workers who see the wealth and freedom available elsewhere do not defect. Kessler says experts repeatedly point to North Korea’s system of family punishment: a worker may fear that an escape or perceived disobedience would harm relatives who remain in the country. The operation also depends on local facilitators. These people receive company laptops at American addresses, install software or hardware that lets North Koreans control the machines, cache checks, and sometimes attend interviews or perform the visible parts of a job. Without those facilitators, the workers would have difficulty appearing to be located in the United States.

The reporters interviewed Derek Goon, an Ohio man who became a facilitator after meeting contacts through online forums. Goon received corporate laptops at his address and let North Korean workers control them remotely. He attended job interviews, and in at least one case used his first and middle names to hold a job for more than a year while someone else performed the coding. He described the arrangement as passive income that allowed him to attend school full time. One job paid $75,000 a year, with Goon keeping 50 percent while the North Koreans received the rest. Because Goon understood cryptocurrency, he could convert money and send it to the people handling the operation. He initially suspected the workers might be in Brazil or China, but did not believe he was doing anything unethical or illegal. He told Kessler, “If I’m arrested, what would I be arrested for?” and said he was only handling a job in his own name. Goon became angry when Kessler suggested the workers might be North Korean, but later accepted that the arrangement was “shady.” A major turning point came when he received a 1099 tax form showing approximately $100,000 in income he did not recognize. He concluded that Eagle Vision had used his identity to work additional jobs without permission. The arrangement therefore exposed facilitators not only to legal risks but also to identity theft and tax problems.

The episode then follows Michael Brown, an Atlanta-area man whose identity was stolen by North Korean IT workers. The reporters found his name and Social Security number advertised on Telegram, where the group they tracked appeared to buy and sell identities. Brown discovered something was wrong when he contacted the Department of Labor about unemployment and an employee noticed that he supposedly held several jobs in different states at the same time. With the reporters’ help, Brown learned that nine companies had records of employing him, although he had never worked for them. The team could confirm that North Korean workers used his identity for at least two jobs, including a contract job at Amazon. Brown received none of the wages, but the records made it appear that he had earned a large income. As a result, he had trouble opening bank accounts, renting property, finding work, and obtaining a college loan for his daughter. He said that until the records were resolved, his life could not return to normal. Companies sometimes could not even discuss the underlying employment with Brown because they were unsure whether he was the real person. Kessler says the victims face an especially difficult process: they are told to make calls and fix the problem, while also being treated as though they might have committed the identity theft themselves. The FBI told the reporters that arresting facilitators alone cannot solve the problem; law enforcement must be combined with stronger corporate hiring and identity-verification practices.

Kessler says the operation continues to change. In some cases, a North Korean worker gets a job and then posts the work on Upwork, subcontracting the actual labor to someone else and acting as a middleman. The workers are also using AI to send large numbers of applications, tailor resumes, and conduct interviews. Face-swapping tools can change their appearance, while accent-swapping and deepfake technology make it increasingly difficult to determine whether an applicant is using a real face and voice. The host concludes that this may not be a problem with a permanent technical solution, but a continuing condition of remote employment that companies will have to manage. Kessler says new companies are building systems to detect applicants who misrepresent themselves, apply to hundreds of companies with inconsistent resumes, or resemble known fraudulent profiles. The approach resembles credit-card fraud detection: employers pool data and look for patterns that would not be visible from a single application. Kessler’s current reporting focuses on how the operation evolves and whether employers can detect it. He and his colleagues’ documentary, “Inside North Korea’s Operation to Conquer the American Job Market,” contains additional details. The episode ends with PJ Vogt announcing the show’s upcoming ask-me-anything episode and inviting listeners to submit questions by email.