DOJ Exposes Terrifying Infiltration of America

The Department of Justice (DOJ) just exposed North Korean operatives’ infiltration of more than 70 American companies by posing as remote IT workers using stolen identities. The FBI raided over 40 suspected “laptop farms” across Texas, and U.S. Attorney Ryan Raybould warned of “a hostile foreign regime infiltrating American companies” to fund its weapons programs.

According to an official statement from the Department of Justice’s Office of Public Affairs:

“This investigation is about far more than fraud,” said U.S. Attorney Ryan Raybould for the Northern District of Texas. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.” . . .

“Today, the FBI and DOJ announced a series of coordinated actions against this threat, securing charges against 14 individuals, conducting two arrests, seizing nearly 190 devices, and executing operations at more than 40 suspected ‘laptop farms’ across Texas. According to the FBI, this scheme reportedly operated for years, with workers appearing for video interviews, participating in meetings and even completing identity-verification procedures to confirm they were who they claimed to be.

In other words, this wasn’t a traditional hacking operation. These individuals weren't necessarily breaking into computer systems. They were being hired and given legitimate access to them. It sounds like what is sometimes referred to as a “long con.”

And the scary part is, it probably wasn’t that hard to pull off, especially in a post-COVID world. Remote work has become a normal part of doing business, and employers often have little or no face-to-face contact with the people they hire. Even companies that conduct background checks and verify identities can find themselves dealing with sophisticated fraud.

Federal authorities recently announced coordinated efforts to target these North Korean scammers. The FBI reported arrests, indictments, the seizure of nearly 190 electronic devices and operations targeting more than 40 suspected laptop farms in Texas. These facilities allowed computers located here in the U.S. to appear as though they were being operated domestically, even when they were actually being controlled by overseas operatives.

Investigators say the scheme generated significant income for North Korea, helping fund the regime and its weapons programs, including its ballistic missile program. At the same time, access to American companies potentially created opportunities to obtain sensitive information and compromise corporate systems.

FBI officials have since issued guidance to American businesses to help them recognize and mitigate these kinds of threats.

But the real lesson for employers here may be that cybersecurity can’t stop at simply preventing outside attacks. Companies also have to consider who they’re allowing inside those networks in the first place. A person can appear qualified, perform assigned duties and participate in routine meetings while concealing a fraudulent identity and a much larger operation.

That presents a difficult challenge, particularly for smaller businesses that may not have the resources of major corporations to investigate suspicious hiring activity. And it’s not as if they can follow their employees home at night to make sure they’re not secretly spies. But this should still serve as a reminder that threats to national security don’t always look like conventional espionage. Sometimes, they look like an ordinary job application.

The DOJ’s investigation is a wake-up call that our foreign adversaries are finding more creative ways to exploit American businesses. Employers need to remain vigilant, strengthen identity-verification procedures, and take cybersecurity extremely seriously at every stage of the hiring process, especially in regard to remote positions.

Today’s Sekulow broadcast included more analysis of this shocking report out of the Department of Justice regarding North Korean intelligence schemes. We were also joined by Special Presidential Envoy for Special Missions Ric Grenell to discuss a second federal probe that was just opened to investigate Rep. Ilhan Omar. 

Watch the full broadcast below: