Lawfare Daily: Sam Kessler on How North Korean IT Workers Infiltrate U.S. Tech Companies
Oct 24, 2024
auto_awesome
Sam Kessler, Deputy Managing Editor for Tech and Protocols at CoinDesk, dives into the troubling infiltration of U.S. tech firms by North Korean IT workers. He reveals how these workers disguise their identities while attempting to fund their regime's nuclear ambitions. Kessler discusses the ethical challenges of employing these individuals, many of whom are victims themselves. The conversation highlights the vulnerabilities in the cryptocurrency space and the evolving tactics of North Korean cybercriminals, emphasizing the importance of corporate security measures.
North Korean IT workers exploit vulnerabilities in the crypto industry, disguising their identities to financially support the regime's activities.
U.S. agencies are educating tech companies on best practices to avoid hiring these workers, emphasizing the importance of thorough background checks.
Deep dives
North Korean IT Workers' Infiltration Tactics
North Korean IT workers infiltrate international tech companies by applying for jobs through popular platforms like CryptoJobList and Indeed.com, often obscuring their true identities due to global sanctions. These workers conduct interviews and perform job tasks like any other employees, but their earnings are funneled back to the North Korean regime, potentially funding its nuclear program. This phenomenon is particularly pronounced within the crypto industry, where the lure of higher wages attracts these workers, who may represent a significant portion of job applications received by certain companies. The implications of hiring these workers include severe legal ramifications and the potential for serious security risks to the companies involved.
The Financial Impact on North Korea
Estimates suggest that North Korean IT workers generate between $250 million to $600 million annually, with a majority coming from salaries and wages. These workers typically retain only 10% to 30% of their earnings, with the bulk of their income sent back to the regime. The gravity of this issue underscores the duality of these workers as they often act as victims themselves, coerced into supporting a totalitarian regime. This financial pipeline not only supports daily operations within North Korea but directly contributes to its capacities for cybercrime and military advancements.
Response to the North Korean Threat
The U.S. has responded to the threat posed by North Korean IT workers through advisories focused on sanctions violations faced by companies unknowingly employing these workers. Government agencies like the FBI and Treasury have intervened when suspicious transactions are detected, usually offering guidance rather than imposing penalties on unwitting companies. The U.S. also aims to educate companies about recognizing and mitigating potential risks associated with hiring these workers, with resources made available for identifying suspect financial activity. This collaborative approach acknowledges these companies as victims themselves, positioned within a complex global challenge.
Best Practices for Hiring in the Tech Industry
To protect themselves from unintentionally hiring North Korean IT workers, tech companies are advised to implement thorough background checks through professional services. This measure can help uncover fake IDs and prevent the hiring of individuals with hidden agendas. Additionally, companies should remain vigilant about odd behaviors and inconsistencies among employees, which could indicate misrepresentation. The broader aim is to establish a culture of caution and foresight within the industry, ensuring a safer hiring ecosystem in the crypto space and beyond.
Eugenia Lostri, Senior Editor at Lawfare, sits down with Sam Kessler, Deputy Managing Editor for Tech and Protocols at CoinDesk, to talk about his recent investigation into how North Korean IT workers are infiltrating the crypto industry. They talked about the red flags that companies should be looking out for, why the crypto industry is particularly vulnerable, and the connection between these workers and the North Korean hacking arm.