Meet your new North Korean colleagues

Sascha: [00:00:02] Welcome to The Dive, the podcast that asks Who said business news needs to be all business? I'm your host, Sascha Kelly. Turns out large Western companies accidentally hired thousands of North Koreans. Now, that is a headline that caught our interest. Seems like a big accident, so we had to dig in. It's Wednesday, the 1st of November. And today I want to know how did thousands of North Koreans trick their way into jobs with some of the largest companies in the West? To talk about this today, I'm joined by the co-founder and my colleague here at Equity Mates. It's Alec Renehan. Alec, welcome to the dive. 

Alec: [00:00:43] Sascha, good to be here. 

Sascha: [00:00:44] All right, Alec, the FBI reported that thousands of North Koreans got remote jobs over the past couple of years. How on earth has this happened? 

Alec: [00:00:54] Yeah, it's a wild story. So American authorities say that thousands of people dispatched by North Korea were sent to work for U.S. companies in an effort to feed millions of dollars into North Korea's missile program. It's a pretty extreme scheme. Now, officials didn't name the companies that unknowingly hired North Korean workers. They also didn't say when the practice began or elaborate on how investigators became aware of it. So there's a lot that we don't know at this stage. 

Sascha: [00:01:25] Pretty vague on the details there.

Alec: [00:01:27] Yeah. I imagine they're still investigating the extent of it. What we do know is that federal authorities in the U.S. have been aware of this scheme for some time. We know that it involves thousands of people and that we know that those thousands of people got paid millions of dollars in salaries that was sent back to North Korea. Wow. Now, court documents allege that the government of North Korea sent these North Korean people to live primarily in China and Russia. So they weren't working from North Korea, but they were sent this specifically with the goal to deceive businesses from America and elsewhere in the West into hiring them as freelance remote employees. Now, the scale of this scheme is still being unravelled, but so far federal authorities have seized one and a half million dollars in cash and 17 domain names as part of their investigation. 

Sascha: [00:02:25] Well, you've said that this is ongoing and there's not a whole lot of detail at this stage. But do we have any indication of how widespread this was? 

Alec: [00:02:35] We have some indications. So Jay Greenberg, who's an FBI official in Saint Louis, said that any company that hired freelance I.T. work is, quote.

Audio Clip: [00:02:46] More likely than not. You have some of these North Korean I.T. workers on your contractor payroll.

Alec: [00:02:52] Which surprised me. I don't I can't get my head around how that could be true. But that's what the FBI is saying. 

Sascha: [00:02:59] I've got to say, if you're an H.R. worker and one of those big tech companies at the moment, like there's got to be chills running down your spine reading that kind of thing.

Alec: [00:03:07] Yeah, Yeah, of course. 

Sascha: [00:03:09] So Alec, what are the reasons that the authorities have given for why North Korea wanted people to work for these foreign companies? 

Alec: [00:03:18] Yeah. So the thing that you have to understand about North Korea is they are desperate for foreign currency because unfortunately for them, no overseas seller is accepting North Korean ones. So if they're trying to import, you know, essential supplies, food and medicine, but also if they're trying to buy parts for their missile program and for their military, they need foreign currency to buy it. And that is such a challenge for North Korea.

Audio Clip: [00:03:50] In per capita income terms. North Koreans are now eight times poorer than Chinese and over 20 times as poor as South Koreans. Rather than reform, the government sought to fill a shortfall in hard currency by trafficking illegal goods abroad. According to numerous reports, this illegal business is run by an agency known as Office 39.

Audio Clip: [00:04:12] It's an office that's organised principally to raise US dollars for the ruling Kim party. 

Alec: [00:04:18] And they've tried everything to get foreign currency into the country. And when I say everything, I mean everything, including having their people disguise themselves as I.T. workers from other countries and get jobs at U.S. companies. There are some instances and some allegations that North Korean workers infiltrated computer networks and stole information from the companies that hired them. That certainly was an added benefit for North Korea. But this story is about getting foreign currency into the country and using that currency to fund their ballistic missile program. 

Sascha: [00:04:55] Well, Alec, let's take a break there. And then when we get back, I want to actually unpack how they got these jobs in the first place. 

Audio Clip: [00:05:06] The global headquarters of Bayer Crop Science in St Louis Getting credit from the FBI tonight for tipping them off to an international scheme. Bayer became suspicious of some data movement and as it turned out, they had stumbled onto an illegal funnel of US money to the North Koreans weapons programs. 

Sascha: [00:05:26] Welcome back to the Dive. Today we're talking about the fact that the FBI have reported that thousands of North Koreans have managed to get remote jobs in Western countries over the past couple of years. Well, U.S. companies, I should be specific. Alec, how on earth did they get this? I mean, we've hired people at equity rates. Surely you just do screening them during the interview process. 

Alec: [00:05:49] Yes. So there was a couple of steps to this scheme. I guess, first of all, as we said earlier, they weren't based in North Korea. They were in Russia and China and other locations. But even still, they were then given false identities. In many cases, they posed as Americans with the fake documentation. The FBI also alleged they used various techniques to make it look like they were working from the US, including paying Americans to use their home Wi-Fi connections. And then they simply relied on the, you know, the pandemic and the work from home disruption and, you know, companies trying to scale quickly in 2020 and 2021 in a remote working environment. Cameras off at meetings and well, a lot of companies never found out.

Sascha: [00:06:38] Yeah, like they just saw the opportunity, I guess, and like, devised the perfect plan. 

Alec: [00:06:43] And Sascha, we were looking on Reddit where there's been some comments. Obviously, these are just comments and and sort of unverified. But there was anecdotes of hiring managers who would screen an initial candidate. And then when the actual interview happened, it was a completely different person there for the actual interview. And so that was how some people were starting to get suspicious. And then there were also people commenting on Reddit that the it seemed like when they were interviewing people, they were looking off camera and getting instructions from someone. So things like that, which, you know, doesn't initially flag that someone's North Korean like it just flags that they're getting coached through their job interview. But yeah, now now that this story has broken, there's sort of anecdotes floating around online of some weird and wonderful stories of hiring and work practices during the pandemic. 

Sascha: [00:07:42] And people putting the pieces together. So i like i guess say i am head of h.r. For big company in the u.s. how on earth do i start, like, avoiding this practice? Continuing? How do i stop north koreans getting a job at my company?

Alec: [00:07:58] Yeah, well, the first recommendation that the us government officials gave is very simple, and it shows perhaps how negligent some of these companies were in their hiring practices. First recommendation was to hold video interviews. 

Sascha: [00:08:13] Oh, wow. Okay. 

Alec: [00:08:14] Yeah. Okay. So two cameras on in meeting? 

Sascha: [00:08:17] Yes. Yeah. Yep. 

Audio Clip: [00:08:18] Mr. Parton, I believe you have a filter turned on in the video settings. And it is. I don't know how to remove it. I brought my assistant here. She's trying to, but I'm prepared to go forward with it, and that's where I live. I know I'm not a cat. 

Alec: [00:08:36] And then, you know, there's obviously other things that companies can do checking references, speaking to previous employees or all of that stuff. But the biggest one was just apparently to video cameras on. 

Sascha: [00:08:51] Oh, that says a lot about the world we've been living in the last few years. I like to close off today. This is actually one example of a broader trend.

Audio Clip: [00:09:01] Hackers attacked in waves, first, crippling Sony's internal systems, then leaking five Sony movies online. 

Audio Clip: [00:09:08] The FBI, and say that they did some technical analysis of the malware that was used to infect the computer systems at Sony. And they found that this was malware that the FBI has previously seen used by the North Korean government. 

Sascha: [00:09:23] There's reports that North Korea has put a premium on IT skills and are finding new ways to make money. You talked earlier about, you know, the fact that foreign currency is really important to them. What are we saying here? 

Alec: [00:09:35] Yeah, that's right. In May 2022, So what a year and a half ago, the State Department, Department of the Treasury and the FBI over in the US issued an advisory which noted that in recent years, the regime of Kim Jong un, quote, has placed increased focus on education and training in I.T. related subjects. And while a lot of countries have big, you know, cyber espionage programs to get information on the adversaries. For North Korea. It's again about this quest to bring more foreign currency into their country. In February this year, the United Nations estimated that North Korean hackers working for the government stole crypto assets, estimated to be between 630 million and 1,000,000,000 USD. So that's been one avenue as they try and get more foreign currency into the country. And then there's also been other cyber attacks, ransomware, where they get into a computer system and hold a hostage until the victim pays a ransom. 

Audio Clip: [00:10:40] North Korea has reportedly made attempts to steal COVID 19 vaccine technology by hacking pharmaceutical giant Pfizer. The Justice Department has charged three North Korean hackers over a wide ranging scheme that included the attempt theft of billions of dollars from multiple companies.

Alec: [00:10:58] Yeah, this is a brave new world for North Korea as they try and keep that country afloat.

Sascha: [00:11:03] Well, fascinating, Alec. I think let's leave it there for today. Thanks for telling me all about that story today. A reminder, if you want to get in touch with us, tell us what you want us to talk about contact@equitymates.com is the best way. And while I have you, please give us a five star review in your podcast player. Alec, thanks for your time today. 

Alec: [00:11:21] Thanks, Sascha. 

Sascha: [00:11:22] I'll be back in your feeds on Friday. Until then.