Remote Work Is Convenient for Employees…and North Korean Scammers - WSJ Tech News Briefing

Summary

WSJ Tech News Briefing: Remote Work Is Convenient for Employees…and North Korean Scammers

Episode Release Date: May 30, 2025
Host: Victoria Craig
Reporter: Bob McMillan
Publication: The Wall Street Journal

Introduction

In this episode of WSJ Tech News Briefing, host Victoria Craig explores the darker side of the remote work revolution. While remote employment offers significant benefits for American workers, it has inadvertently created opportunities for sophisticated scams orchestrated by North Korean operatives. This detailed analysis delves into how these scams operate, their impact on both individuals and corporations, and the broader implications for the tech industry.

The Emergence of Laptop Farms

Victoria Craig introduces the concept of "laptop farms," a new form of gig economy job that has surfaced post-COVID-19 alongside the surge in remote work. These operations are not advertised publicly but are typically recruited through platforms like LinkedIn or gig work websites.

Key Insights:

Laptop Farmers: Individuals who receive laptops to ship to fake workers posing as employees of legitimate U.S. companies. These devices are then remotely controlled by North Korean workers to perform various tech tasks such as Python development.
Bob McMillan explains, “This is a new gig economy job...you get a request maybe via LinkedIn or some kind of gig work site that asks if you want to help a foreign company with U.S. representation.” (02:14)

Case Study: Christina Chapman

Christina Chapman exemplifies the human element within these scams. Initially living in dire circumstances—a trailer in Minnesota without heat and relying on gym showers—Chapman was lured into the scheme through a deceptive job offer on LinkedIn.

Notable Quotes:

Chapman’s life was significantly improved by the job, yet it was entirely illegal. As Bob notes, “[...] she was desperate and it really did turn her life around. The problem is it’s completely illegal.” (04:18)
Post-discovery, Chapman faced severe repercussions, ending up in a homeless shelter despite her initial financial relief from the scam.

Modus Operandi: Infiltrating Corporate America

Bob McMillan details the sophisticated methods North Korean scammers use to infiltrate reputable U.S. companies:

Building Legitimate Profiles: Creating believable LinkedIn profiles, maintaining GitHub repositories, and establishing fake companies as references.
Overwhelming Job Requests: Bombarding companies with applications to bypass standard hiring diligence.
Circumventing Verification Processes: Initially using AI-driven avatars for virtual interviews until companies tightened their verification methods, leading scammers to employ genuinely skilled tech workers to pass interviews.

Quote: “They build this sort of simulation of a legitimate, usually a tech worker profile...” (07:15)

Objectives of the Scammers

North Korean operatives engage in these scams primarily for three reasons:

Financial Gain: Generating hundreds of millions of dollars annually to fund the heavily sanctioned regime, including military programs.
Data Exfiltration: Stealing corporate secrets, source code, and sensitive information to sell or use for extortion.
Espionage: Targeting aerospace and other sensitive industries to gather intelligence and technological advancements.

Bob McMillan summarizes, “First and foremost, they want money... they want more money... and the FBI suspects that they are also conducting espionage.” (08:31)

Scale and Impact

The FBI estimates thousands of such remote workers are involved in these scams, affecting a wide range of industries. Initially prevalent in the cryptocurrency sector, the reach of these scams has expanded significantly, posing a threat to any organization relying on remote employees.

Quote: “It feels like anybody who is hiring a remote worker has to worry about this.” (09:38)

Corporate Response and Mitigation

Companies are grappling with how to address this pervasive issue. Despite awareness among top executives—such as Amazon's Chief Security Officer—solutions remain limited. The suggestion to mitigate risks includes requiring employees to work on-site five days a week, thereby reducing reliance on remote work that facilitates such scams.

Victoria Craig highlights the ongoing debate: “Since the story published, there's been a lot of debate over this.” (10:02)

The Downfall of Christina Chapman

Christina Chapman's involvement in the scam led to severe personal consequences:

Legal Repercussions: In October 2023, the FBI raided her home. Chapman pled guilty and faced potential sentencing of over nine years in prison.
Financial Ruin: Despite initially improving her financial situation, Chapman ended up homeless after her involvement was exposed. Attempts to recover through GoFundMe, selling products on Amazon, and even gig work like DoorDash yielded minimal income.

Quote: “She struck a plea deal...she could be facing just a little bit more than nine years in prison for this.” (10:27)
Further Impact: “She struggled when this gig went away, and she eventually lost her home.” (10:57)

Conclusion

The episode underscores a critical vulnerability in the remote work ecosystem, where the flexibility and reach of digital employment can be exploited by international actors like North Korea. As remote work continues to be a staple in modern employment, the need for robust verification and security measures becomes increasingly paramount to prevent such sophisticated scams.

Produced by: Julie Chang
Theme Music: Jessica Fenton and Michael Lavalle
Supervising Producer: Melanie Roy
Development Producer: Aisha Al Muslim
Deputy Editors: Scott Salloway and Chris Sinsley
Head of News Audio: Falana Patterson

Note: Advertisements and non-content sections have been excluded to focus solely on the episode's core discussions and insights.

Transcript

Mark (0:00)

Marketers. You know that feeling when your content just works. When you crush a viral trend before 10am that's contentful, dynamic content made blissfully simple. Contentful helps you create and launch personalized experiences instantly across any digital channel. No limits, no stress, only possibilities. Come get the feels@contentful.com hey TNB listeners.

Victoria Craig (0:26)

Before we get started, heads up. We're going to be asking you a question at the top of each show for the next few weeks. Our goal here at Tech News Briefing is to keep you updated with the latest headlines and trends on all things tech. Now we want to know more about you, what you like about the show, and what more you'd like to hear from us. So our question this week is how often do you want new episodes and how long do you want them to be? Do you want shorter shows more often or longer shows less frequently? If you're listening on Spotify, look for our poll under the episode description. Or you can send us an email to tnbsj.com now on to the show. Welcome to Tech News briefing. It's Friday, May 30th. I'm Victoria Craig for the Wall Street Journal. Remote jobs have become common for workers in industries across America. They make the work life balance easier for employees, but they've also allowed countries like North Korea to infiltrate US Companies with the help of everyday Americans. Today, we're taking a deep dive into an intricate scam involving illegal paychecks and stolen data. A scam that the FBI says involves thousands of North Korean workers has brought hundreds of millions of dollars a year into the country. It's a place where international sanctions have frozen the flow of funds. So the country has gotten creative in its quest for cash and it's capitalized on some of America's remote work opportunities. Despite start laptop farms in states across the U.S. bob McMillan covers computer security, hackers, and privacy for the Wall Street Journal. Bob, I'm going to guess that the phrase laptop farm is not a familiar one for most of our listeners. So what is it and what kind of person typically runs one?

Bob McMillan (2:14)

Yeah, it's a new gig economy job that's popped up since the COVID epidemic and the advent of massive remote work. This is not something you'll find advertised, but basically you get a request maybe via LinkedIn or some kind of gig work site that asks if you want to help a foreign company with U.S. representation. And the next thing you know you're getting laptops shipped to your house and you're turning them on and you're operating them. But they're shipped to fake workers who have got jobs at these companies and who need a US address to pretend to be working out of. So laptop farmer receives the computers for the fake workers workers, turns them on, connects them, and then adds remote software so these people offshore can connect to these laptops and then doing things like tech jobs, you know, Python development and stuff like that. Here's the kicker, though. The remote workers are actually North Koreans and they're trying to, in a very illegal way, make money for the heavily sanctioned regime there.