FBI Catches North Korean Remote IT Workers Who Infiltrated Federal Agencies Under False Identities

Hemmen confirmed that the FBI had caught North Korean remote IT workers working for the federal government last week.

This officially confirmed that North Korean IT workers are operating within US federal government agencies.

However, he added that while the private-sector share is far higher, the government is also affected to some degree.

This suggests that North Korea's attempts to place IT workers under false identities are widespread and pose a potential threat even to critical US infrastructure.

Experts therefore believe the North Korean IT workers are most likely working as remote contractors for government agencies. This is interpreted as an infiltration strategy that bypasses strict hiring procedures.

The false-identity infiltration of federal agencies by North Korean workers may go beyond simple foreign-currency earnings. It could enable information theft from US federal agencies, and analysts say North Korean authorities likely directly oversaw the process.

As a result, US authorities are expected to respond with measures such as sanctions. This can be read as a strong US warning about North Korea's cyber threats.

There have been past cases of helping North Korean IT workers infiltrate the public sector. A man living in Maryland was sentenced to 15 months in prison for bringing a North Korean national in China into a Federal Aviation Administration (FAA) software development contract.

This case clearly shows that American accomplices who get involved in North Korean IT workers' false-identity employment can be punished.

On the 31st of last month, the US, together with 10 countries including South Korea, Japan, the UK, and Australia, issued an advisory on North Korea's use of IT workers. The advisory states that North Korea is using IT workers to fund its nuclear and missile programs.

This reflects the shared international recognition that North Korea's illegal foreign-currency activities pose a serious threat to international security.

North Korean IT workers are known to mainly stay in China and use brokers in the US to obtain jobs at American companies. The brokers help with the false employment by using laptops provided by those companies so that North Korean IT workers in China appear to be working remotely from the US.

Because such methods can carry out crimes remotely across physical borders, they pose difficulties for enforcement.

Rep. Young Kim, chair of the East Asia and Pacific Subcommittee of the US House Foreign Affairs Committee, recently introduced a bill with Rep. Ami Bera, the Democratic ranking member, to block remote false-identity employment by North Korean IT workers. This is a move to establish institutional safeguards against North Korea's illegal activities.

At the same time, the US Department of Justice has continued to investigate organized false-identity employment attempts by North Korean nationals. This shows the government's strong determination to respond at the government level.

According to the US Department of Justice, eight American citizens have been charged this year alone with helping North Korean IT workers obtain false employment, and have been sentenced to prison. This shows that penalties for Americans who assist North Korean IT workers' illegal activities are being strengthened.

The US government regards such assistance as a serious crime and plans to respond firmly going forward.

Such accomplices serve as key links enabling North Korean IT workers' activities in the US, and they are currently major targets of US government enforcement.

The accomplices found in the US so far are mainly American citizens motivated by simple financial gain. However, there are concerns that if such assistance were organized beyond the individual level, it would become much harder to detect.

Furthermore, if such an organization were linked not to private or criminal groups but to government bodies, the problem could become far more serious. This is noted as a potential direct threat to national security.

A former organization director of the KCTU was sentenced to more than nine years in prison on espionage charges, and evidence was found that he had received North Korean instructions over a long period.

It is also known that the individual's father had himself been sentenced to prison on espionage charges, so the family as a whole reportedly has such a record. Such cases were cited as grounds for concern that some South Korean organizations may be linked to North Korea.

It is pointed out that there are indications the KCTU itself may be contaminated by spies. Under such circumstances, it is argued that if the KCTU were to act as an accomplice helping North Koreans obtain false employment, the result would be disastrous.

This is an argument raising the potential risk of North Korean IT workers' false-identity employment based on the nature and past conduct of a specific organization.

The US maintains a high level of wariness toward groups carrying out anti-US activities within its borders.

Two months after the New York anti-US rally, there was a raid on the Hyundai-LG battery plant in Georgia. Several agencies including the FBI and HSI jointly carried out a large-scale immigration crackdown, and of more than 400 people detained, 300 were South Korean.

According to testimony from Yoo Jin-chul, a candidate for the US House, immigration agents were comparing the faces of those detained at the Georgia plant against photos of South Korean union members who had taken part in the New York anti-US rally. This is interpreted as suggesting the US government is closely monitoring the activities of South Korean groups including the KCTU.

It is mentioned that the US government already has information on the KCTU, including its organizational structure, officers, names, and faces. This means the US government holds a considerable level of information on a specific South Korean group.

Large South Korean conglomerates are investing heavily and expanding into the US, and most of these companies have unions, many of which are linked to the KCTU. When these companies send employees on assignment to the US, they apply for visas, and the US then needs to determine whether those employees are helping espionage. This raises concern that it could negatively affect visa issuance for workers dispatched from South Korean companies.

In particular, a bill introduced by Rep. Young Kim includes provisions expanding the Secretary of State's authority to exert pressure abroad.

This is an attempt to create a legal basis for the US to actively intervene and impose sanctions on forces abroad that help North Korean IT workers obtain false employment, not just activities within the US.

This has raised concern that it could lead to sanctions against the South Korean government or South Koreans.

Passage of such a bill could cause considerable repercussions across South Korean society and is emerging as an important issue that could also affect South Korea-US relations.