--:-- [Theme music fades out]
--:-- Noel King: One of the big challenges of hiring remote workers is you don't really know who you're hiring. Recently, the FBI warned that many companies really don't know who they're hiring. Big American companies like Google and SentinelOne have been tricked by compelling resumes and LinkedIn profiles into hiring North Koreans.
--:-- Noel King: Now to the story of spies in the break room. The US, the UK, and South Korea have jointly accused North Korea of using a cyber espionage group to steal sensitive and classified data.
--:-- Noel King: Ahead on Today Explained, we talked to a reporter about what it's like to sit in on a job interview with a North Korean operative.
--:-- Noel King: We tried to keep it as sort of simple as possible. So I was just introduced as someone who was sitting on the call. We didn't want to alert them to, obviously, the fact that I was a journalist, because we didn't want to scare them away. We wanted to see what they had to say.
--:-- Noel King: Support for Today Explained comes from Saks Fifth Avenue. Fall is here. Might be time to find some nice new pieces you can wear again and again. With Saks Fifth Avenue, it can be a breeze to shop for your personal style, like maybe a relaxed Prada blazer or Gucci loafers that are great for both work and the weekend.
--:-- Noel King: This is very Sean. This is very Sean-coated. Gucci loafers. Saks says Saks makes shopping feel totally customized to you, whether that's from an in-store stylist or a visit to Saks.com, where they can show you just what you want to see.
--:-- Noel King: They say they'll even let you know when arrivals from your favorite designers are in or when something you've been eyeing is back in stock. You can find inspiration for your personal style every day at Saks Fifth Avenue.
--:-- Noel King: Support for this show comes from Strawberry.me. Be honest. Are you happy with your job? Or are you stuck in one you've outgrown? Or never wanted in the first place?
--:-- Noel King: Sure, you can probably list the reasons for staying. But are they actually just excuses for not leaving? Let a career coach from strawberry.me help you get unstuck. Discover the benefits of having a dedicated career coach in your corner. Go to strawberry.me slash unstuck to claim a special offer.
--:-- Noel King: It's Today Explained. I'm Noelle King. The life of a freelance investigative reporter is not an easy one. A lot of time is spent figuring out what story is going to justify your time and talents.
--:-- Noel King: Such was the problem for reporter Bobby Johnson, who's based in the Bay Area. Late last year, Bobby had been hearing about people using AI to run scams, and he decided to see if there was anything there.
--:-- Noel King: And so one evening, I bumped into this young entrepreneur called Simon Weikmans at an event in San Francisco. And I shared with him what I'd heard about and asked if he'd heard about anything.
--:-- Noel King: And he said, well, you'll never guess what happened to me recently. And it turned out that Simon runs a web security company, and he'd been interviewing people for a software engineering job, a remote software engineering job, so people not based near HQ.
--:-- Noel King: And in interviewing, he'd seen a bunch of deeply suspicious activity. You know, he was worried that people were trying to fraudulently get jobs or something.
--:-- Noel King: And it turned out to be far more complicated and weirder than we expected. So what Simon spotted in the first place was that the job was bombarded with candidates right so there were hundreds of applications way more than was typical.
--:-- Noel King: Then he started getting on video interviews with people and strange things kept coming up lots of the applicants had resumes that didn't really match what he saw on screen.
--:-- Noel King: You know, maybe they had Anglo names but were ethnically Asian. A lot of them said they were born and raised in America in Tennessee or in Brooklyn but they had really, really thick foreign accents.
--:-- Noel King: They all aced their coding test in almost exactly the same ways. But when he was talking with them, they often gave stilted answers and asked questions just about salary, but nothing else.
--:-- Noel King: And there were other things too. So they all used similar default video background images, they had laggy internet connections. And in the background, he could hear noise.
--:-- Noel King: So it sounded like they're in a busy room, not a call like a call center, maybe not what you would normally do a job interview in.
--:-- Noel King: So these things, you know, individually, he didn't see any of these as a major red flag, because you can imagine why somebody's name doesn't fit their face in your conception, right?
--:-- Noel King: Or why they have an accent or why they use a default background on their video call. But as he spotted candidate after candidate, following the same pattern, he started to get really suspicious of them.
--:-- Noel King: And, and then the clincher really was that he saw one of the candidates was wearing glasses and as the candidate was answering questions Simon could see in the lenses of the glasses a reflection of an AI bot on the candidate's screen.
--:-- Noel King: So what he could see was that this was pumping out a script of some kind for the applicant to read in order to answer Simon's questions and he could see this happening in real time.
--:-- Noel King: So at this point he figured you know his paranoia was well justified. What emerged as we got deeper and deeper in were not just that these were people who were, you know, trying to fraudulently get jobs or people who were maybe running several different jobs at the same time, which we've seen a lot since the pandemic.
--:-- Noel King: But in fact, we were able to connect them back and see that they were actually operatives who are working for the North Korean regime to try and get jobs and send money back to North Korea, which is, it turns out this kind of pretty widespread scam that's being perpetrated against American companies particularly, but all around the world.
--:-- Noel King: So by the time you met Simon at that event, he had clearly copped on that something was up here. Had Simon actually hired anyone in North Korea? No. So he'd realized that something strange was going on and hadn't hired anybody.
--:-- Noel King: But there are lots of companies around the country who have been hiring North Koreans unwittingly. And this is actually, it turns out, it's a pretty widespread operation and well known in the cybersecurity industry and in parts of law enforcement.
--:-- Noel King: But it's really not something that's broken through into the public consciousness. Most people don't actually know about it.
--:-- Noel King: So when we started to put the pieces together and understand what was really going on, that's when the breadth and depth of this thing became apparent.
--:-- Noel King: How does this work? And to what degree is this going on? The scam it kind of basic in some ways but wild in others.
--:-- Noel King: First of all, on the simplest level, you have teams of North Korean agents who are recruited out of college and they get sent to work in other kind of friendly countries typically China or Russia.
--:-- Noel King: They cross over the border and they go work in these teams. They steal people's identities, and they use those identities to apply for jobs.
--:-- Noel King: So they steal American identities and use them to apply for jobs in the US. And they use all manner of AI enhancements to get the job, you know, like they use the AI coding tools to ace the test, they use the chatbots to script their answers so that they sound more competent.
--:-- Noel King: They use deepfake technologies to cheat ID verification and some of the tests that you have to go through in order to get a job.
--:-- Noel King: So if they're lucky enough to get through the interviews, the surprising thing I think is they actually generally do the job that they've been employed to do.
--:-- Noel King: This is usually building websites or apps for a company, completing different tasks, you know, IT related stuff. And often they share those tasks around their team.
--:-- Noel King: So there might be 10 or 15 people working in a team doing multiple jobs. And they basically are doing the minimum to stay employed.
--:-- Noel King: But because they share the tasks around the team, they're often very efficient and seem to be doing their job pretty well. So they stay under the radar.
--:-- Noel King: And all of this gives them time to earn cash that they then send back to North Korea.
--:-- Noel King: Now, software engineers can be pretty well compensated. So that's be a substantial amount of money.
--:-- Noel King: But they also use that access that they have as a developer to go and steal information, money, cryptocurrency, and even in some cases, plant malicious software on the victim's computer systems.
--:-- Noel King: In many cases, they don't get through to being hired. You know, they're just trying, they're testing the system.
--:-- Noel King: But when they do get through, sometimes they only last a few days until they do something clear that they're not who they say they are.
--:-- Noel King: But sometimes they stick around. I mean, I spoke to some victims who have unwittingly employed people for up to a year, you know, they've been working in a company and getting away with it.
--:-- Noel King: But the real trick, I think, and the key weakness in this scam is that they need to use a middleman in the US.
--:-- Noel King: So, you know, the company will send forms to fill out. They'll send the computer for the developer to use. They'll they need a place to send paychecks.
--:-- Noel King: You know, all of these require somebody on the ground. And if you're in a North Korean team in China or Russia, you don't have that person.
--:-- Noel King: So they work with an accomplice who manages the physical stuff. So they're based in the US and they will install software that lets the North Koreans dial into their computer from overseas and still look like they're in New Jersey or California or wherever they say they're based.
--:-- Noel King: So this means you have these middlemen who have houses full of laptops that all connect up to all the different jobs that they're working.
--:-- Noel King: And it's, you know, law enforcement calls that a laptop farm. And the accomplice gets up every morning, switches the computers on, make sure they're all running properly, lets the North Koreans dial in to those computers from overseas, and then carry on the job and carry on the subterfuge.
--:-- Noel King: And in some cases, the facilitators who have been caught, you know, have been found with like 50 or 60 laptops running simultaneously in their house.
--:-- Noel King: And that's the place where law enforcement is actually able to catch these gangs understand what's going on and try to stop it.
--:-- Noel King: So there's one case particularly that um I dug into which is of a middleman or middle woman in this case called Christina Chapman who recently pled guilty to a range of different crimes related to this.
--:-- Noel King: She was based in Minnesota and Arizona and over the space of a couple of years she worked with a North Korean team and helped them target at least 300 different companies in the U.S. including some pretty substantial ones.
--:-- Noel King: Howdy people. So today I think is day seven and I did not make my own breakfast this morning. my clients are going crazy so I just some of them were mom and pop shops but some were big corporations you know and Chapman ran this scam she would help the teams do their IT work she would host a laptop farm with maybe 60 computers at the same time and she would help them dial into meetings or keep up to date with stuff she would receive money that she would then pass along to a bank in China and take a cut along the way.
--:-- Noel King: New at 10, an Arizona woman has been indicted in a series of complex identity theft cases that have been generating money for the North Korean government. Christina Chapman was working out of her house in Litchfield Park.
--:-- Noel King: Someone approached her on LinkedIn, asking her to be the U.S. face of their company. What that meant was... She got drawn into this, as far as we can tell, by the fact that there was a promise of some money and it was an easy way to earn some cash.
--:-- Noel King: And when I spoke to security experts about this, they said it's really typical for somebody to get drawn in, you know, and that's why they choose folks who are able to stay under the radar, right? People who have no significant profile, people who can just look ordinary and behave in pretty ordinary ways.
--:-- Noel King: The woman who lives around the corner from you or the guy who lives in the apartment block or whatever, just ordinary folks who can help perpetrate this scam without raising too many suspicions.
--:-- Noel King: Bobby Johnson, he's a freelance investigative reporter. He ended up writing this story for Wired. Coming up, Bobby goes to the flip side. Who are the North Koreans?
--:-- Noel King: Support for Today Explained comes from Built Rewards. These days, it seems like everybody has a rewards program. You swipe your card and you get one cent on the hundred dollars. But with your rent, frequently, you just pay month after month. You never get anything from it other than that roof over your head.
--:-- Noel King: Not anymore, says Built Rewards. Built Rewards says it lets you earn points on your rent by paying rent through Built. They say you can earn flexible points that can be redeemed toward hundreds of hotels and airlines, perhaps a future rent payment, your next Lyft ride, and so much more.
--:-- Noel King: Your home isn't just where you sleep, it's your community. And Bilt wants you to go out and do things in the community. You can eat at your favorite local restaurants, then earn more points. You can get VIP treatment at certain fitness studios. You can enjoy exclusive experiences just for Bilt members every month.
--:-- Noel King: When you're ready to travel, they say Bilt points can be converted to miles or hotel points all around the world. You can earn points on rent and around your neighborhood wherever you call home by joining built.com slash explained.
--:-- Noel King: That's J-O-I-N-B-I-L-T dot com slash explained. Running a business comes with a lot of what-ifs. But luckily, there's a simple answer to them. Shopify. It's the commerce platform behind millions of businesses, including Thrive Cosmetics and Momofuku.
--:-- Noel King: And it'll help you with everything you need. From website design and marketing to boosting sales and expanding operations, Shopify can get the job done and make your dream a reality.
--:-- Noel King: Turn those what-ifs into... Sign up for your $1 per month trial at shopify.com slash special offer.
--:-- Noel King: Support for Today Explained comes from Upwork. If you run a business, you know that scaling your business requires the right expertise at the right time.
--:-- Noel King: I sometimes wonder how many of you are running businesses out there. I would love to know. Please email me noelle at king.com.
--:-- Noel King: With Upwork, you can find specialized freelancers in IT, web development, AI, design, admin support, marketing, and more experts who they say are ready to help you take your business to the next level.
--:-- Noel King: With more than two decades of experience, Upwork has a simple and ambitious goal to pioneer a better way of working. Companies at every stage turn to Upwork to get things done and find more flexibility in the way they staff key projects and initiatives by accessing a global marketplace full of top talent.
--:-- Noel King: Plus, Upwork makes posting your job easy with no cost to join. You can register, browse, freelance, or profiles, get help drafting a job post, or even book a consultation.
--:-- Noel King: You can visit Upwork.com right now and post your job for free. That is Upwork.com to post your job for free and connect with top talents ready to help your business grow.
--:-- Noel King: That's U-P-W-O-R-K.com, Upwork.com. This is Today Explained. We're back with Bobby Johnson, who wrote about North Korean operatives getting hired by American companies for Wired.
--:-- Bobby Johnson: The companies don't like to talk about what is happening. Neither does North Korea. So Bobby relied on defectors who understand how the scam works from North Korea's end.
--:-- Bobby Johnson: So typically these guys, and they really are guys, like you say, young, you know, pretty much straight out of college. They are recruited to work in these teams of 10 or 15 people and they basically operate like a criminal gang in a sort of digital sweatshop.
--:-- Bobby Johnson: So they are typically sent overseas, I don't think they get many choices, you know, they're sent overseas to live in a nondescript apartment and it's pretty much a 24-7 existence, they work there, they eat there, they sleep there, they are only allowed to leave in small groups to make sure that nobody runs away.
--:-- Bobby Johnson: And they get paid by the government and sometimes pretty well, but the regime also makes it clear that you know your family back in South Korea is under extra surveillance to try and dissuade people from trying to escape.
--:-- Bobby Johnson: But these these teams are typically relatively low-level North Korea does also run sort of very high-level hacking teams and this kind of work is maybe a stepping stone towards that, but it's kind of where folks are paying their dues.
--:-- Bobby Johnson: Kim Jong-un is a very strange guy. He has interesting priorities. And this now, based on everything you've told us, really does appear to be one of them.
--:-- Bobby Johnson: How has he made this kind of cyber training a priority in North Korea? What could you find out about that?
--:-- Bobby Johnson: Yeah, so Kim Jong-un is a really interesting and strange leader. I mean, we all know kind of how he's behaved when he appears in public and the kind of things that North Korea has been doing with its weapons program and threats against other countries.
--:-- Bobby Johnson: North Korea's leader Kim Jong-un has ordered his country's military to be ready to use nuclear weapons at any time. North Korea threatening to test still more weapons of mass destruction after a beaming Kim Jong-un watched the latest missile launch.
--:-- Bobby Johnson: But unlike his father, who was very kind of anti-technology and pretty old school, Kim Jong-un was actually educated in Switzerland under a pseudonym.
--:-- Bobby Johnson: He was kind of sent to school there and he had access to Western culture and Western technology. And when he took over in the 2010s as supreme leader, he really switched things around.
--:-- Bobby Johnson: So North Korea went from a country that basically had like one pipeline to connect to the internet for years and years and years to a country that saw that maybe its only options or some of its options involved getting really good at technology.
--:-- Bobby Johnson: So he has encouraged and put more money and effort into funding computer science programs and technology literacy in North Korean schools and that's bubbled up through various universities and colleges that sort of develop people's skills and teach them things you know they don't just teach them coding or how to use computers they teach them how to hack and how to cover their tracks and all of this stuff.
--:-- Bobby Johnson: And so you get these young men particularly coming out of college in North Korea who have been trained for the last few years to really be operatives you know to be make it possible for them to do this stuff.
--:-- Bobby Johnson: And it's paying dividends for North Korea, you know, for such a small country and one that doesn't have like a big technology industry. They are they punch way above their weight in terms of this stuff.
--:-- Bobby Johnson: And so there's a lot of cryptocurrency theft going on earlier this year. A couple of months ago, a crypto exchange in Dubai got hacked and one point five billion dollars got stolen. And that was by North Korean hackers.
--:-- Bobby Johnson: So these guys have realized that this is a very lucrative way, with very low cost to them. You know, really, it's just, you know, a computer and some training to get out there and cause havoc and fund the country that has no other way of making money.
--:-- Bobby Johnson: Do we know how much money this is making? You know typically a team of pretenders might earn you know several million dollars a year through the different jobs that they running.
--:-- Bobby Johnson: And I seen lots of estimates wild all over the place, but the minimum is kind of around $3 million a year.
--:-- Bobby Johnson: Now, this is like, that's a lot of money, but it's not, you know, it's not a huge amount. But yeah, obviously, the way North Korea operates, they're taking nearly all of that as profit, right and uh and it's going straight back into military programs it's going straight back into kim jong-un's slush fund you know it's going back into the country.
--:-- Bobby Johnson: And they're running you know there are many of these groups running um different scams and scale-wise you know there's been a lot of activity in the u.s but folks I spoke to are saying that they're seeing a real expansion of activity in Europe, in Japan and elsewhere.
--:-- Bobby Johnson: So this has now become a very lucrative scheme across the board for the North Koreans.
--:-- Bobby Johnson: I'm trying to put myself in the shoes of the American who ends up talking to one of these people in North Korea and figures it out and is like, uh-oh, this person is definitely not in Knoxville.
--:-- Bobby Johnson: And I wonder what you do about it. Like, you can't call the police and say somebody fraudulently applied for a job at my company, But also, this isn't right. It doesn't seem legal.
--:-- Bobby Johnson: What can law enforcement and what does law enforcement actually do here?
--:-- Bobby Johnson: Yeah, this is really the tough thing in these cases, because if you're smart enough to spot it before it happens to you, kind of no crime has been really enacted upon you or something that's not going to lead to a prosecution.
--:-- Bobby Johnson: But in any case, it's really hard to prosecute these cases because for the most part the worst offenders are based in a country that the American courts can't extradite from so you know we're not gonna pull someone out of china or russia um so that means the cases generally focus on the stolen identities and the accomplices.
--:-- Bobby Johnson: The real problem underneath all of this is that the political or economic solutions that you think would be possible just aren't really effective right you can't enact sanctions against North Korea for this because the sanctions already enacted against North Korea are so punitive, right?
--:-- Bobby Johnson: One of the reasons that these guys are doing this in the first place is because legal trade is basically zero because the country is being punished rightly for its rogue nuclear weapons program.
--:-- Bobby Johnson: So for now, from the industry and law enforcement folks I spoke to, your best remedy is to try and be aware of it and prevent it happening to you.
--:-- Bobby Johnson: And that's tough. And it's a big leap to go from saying, you know, there's something fishy going on with this applicant to, I believe this applicant may be working for the North Korean government.
--:-- Bobby Johnson: That's like, that's a wild jump to make. But at least if you're looking for things, looking for those red flags or kind of looking for that circumstantial evidence, then you can protect yourself from being a victim.
--:-- Bobby Johnson: There is something about all of this, Bobby, that is just not particularly clever. It's working, but you don't have to have a beautiful mind to think up a scam like this one.
--:-- Bobby Johnson: I wonder, though, as you were reporting out this story, where your mind went when you thought about what are the perils in the future that we're facing? What doors are opened by this little scam that five years from now or 10 years from now might be even harder to combat?
--:-- Bobby Johnson: There are sort of two threads that I would pull here. One is that once they can get access, they're stepping stones, right? You know, they're just trying to do a job and earn money.
--:-- Bobby Johnson: But what if somebody else can use the same techniques and be more aggressive in their attacks? You know, if if you get hired, let's say you get hired inside a government defense contractor, you know, can you access intellectual property or state secrets or something like that?
--:-- Bobby Johnson: The espionage potential is high and the kind of aggressive attacks on companies could could get a lot worse.
--:-- Bobby Johnson: And then I think, you know, the second thread is just that it dramatically undermines trust in everything.
--:-- Bobby Johnson: Right. You know, we've we already see deep fakes we already see misinformation we already see all kinds of ways of of making you not believe the things that you see and if you if you can't even believe uh sorry my computer screen just disappeared i think it went on screen saver i'm gonna pick that one up it's north korea okay yeah that's i do get paranoid about these things sometimes now um yeah i think this there is this fundamental problem of eroding trust that you can't believe what your eyes are seeing you know we see deep fakes happening all the time we see misinformation we see all these systems working to kind of separate you from reality and try and get you to second guess everything that you see and that's important you know you don't want to fall for tricks but the more prevalent they become the more difficult it is to know what's real and what's not.
--:-- Bobby Johnson: And so if you are stuck in a position where you can't be 100% sure that the person on your company team phone call or Zoom call who doesn't like to put their camera on and doesn't talk very often, but they do the job, if you start to believe that that person could be an operative of a foreign country, then, you know, you're getting really into some wild places in your thought process.
--:-- Bobby Johnson: And I think that undermining of reality is kind of the biggest existential problem here.
--:-- Bobby Johnson: And it's one, I don't know that there's a way to solve it, but we can all see that how dangerous it can be to separate you from the truth.
--:-- Noel King: Bobby Johnson, investigative reporter.
--:-- Noel King: Gabrielle Burbay produced today's show. Amina El-Sadi edited. Patrick Boyd is our engineer. And Laura Bullard checks the facts.
--:-- Noel King: I'm Noelle King. It's Today Explained. Thank you.
