North Korea sent him abroad to be a secret IT worker | Hacker News Reader

North Korea sent him abroad to be a secret IT worker

bbc.com

112 pointstellarin67 comments

> Jin-su spent most of his time trying to secure fraudulent identities which he could use to apply for jobs. He would first pose as Chinese, and contact people in Hungary, Turkey and other countries to ask them to use their identity in exchange for a percentage of his earnings, he told the BBC.
"If you put an 'Asian face' on that profile, you'll never get a job." He would then use those borrowed identities to approach people in Western Europe for their identities, which he'd use to apply for jobs in the US and Europe. Jin-su often found success targeting UK citizens.

"With a little bit of chat, people in the UK passed on their identities so easily," he said.

Interesting. I was under the impression that most large employers perform basic background checks on new employees?

> basic background checks on new employees?

yes background check is done on UK person's identity and then Jin-su shows up to the job.

This is a happening a lot for regular tech jobs. Person who interviews and person who shows up for job are completely different ppl. we had to start taking screenshots of faces in interview so we can compare. This is happening big time.

And, at least as far as I've heard, those people often target small-ish companies, something like 20-100 employees. Large enough where you can stay unnoticed, small enough that you don't have strict policies and background checks.

Ok makes sense. So only once you see his face in the interview you realize it’s not the UK person?

We've had people interview remarkably well, get hired, and when they showed up on the team - they did not know the stories/experiences they mentioned in the interview. Realized the person we screened was not the same that showed up to work. Back when we were doing a lot of hiring, this sort of scam worked.

Over the past years I was approached multiple times with innocent sounding emails that clearly had the goal to use my identity in the way described here.

I‘ve always simply ignored these.

Is there a better way?

Germany: I don't know of anything a normal company could do as a "background check". Some sectors can ask for a criminal record which the future employee has to provide. Of 3 companies I was at, 0 required (or were allowed to require) this.

Military/government jobs with secret data have their own, through clearance checks of course, but a random IT company would never have this.

On the other hand, you have to submit so many tax, social security, insurance-related IDs which are cross-checked, I don't think it's feasible to impersonate someone here. It's also a reason why over-employment is not possible.

Odd that he was sent abroad to do it, I always assumed they just did it from NK instead of abroad.

Also only having to give 85% to the regime seems pretty weird to me, it’d seem more logical to give 100% to the regime and have them provide the workers with a very cheap bed and food

They probably hoped that the remaining 15% was just enough to keep the workers from defecting. That combined with the threat to brutally torture and kill their family that remained in North Korea were probably pretty effective motivators to stay loyal to the regime.

No. They don't need to worry about defections. Unless the guy really wants condemn his whole extended family and next 7 generations into labor camps.

some NK do choose that option

Its quite presumptuous to assume that

1. Every citizen will have ties or family to -think of- 2. The current regime (which is now on its third generation) will last 7 generations more. 3. You have any descendants at all

In Romania during the 70s and 80s the only people who would go to specialization/training in the West had spouse and kids that stayed behind. The punishment for defecting was that the defector would not see their wife/husband/kids ever again (well, it seemed to be for ever. Nobody expected the regime to crumble). AFAIK there were no labor camps in Romania.

With this in mind-I am quite sure NK is selecting the people win a similar fashion. I would not be surprised if the punishment for defection is more sinuster than just not seeing their spouse/kids ever again.

I admit this is a presumption, but I doubt they send people out without leverage of some sort.

dictatorships are the worst. but true, even professional athlete's when travelling defect etc

It's a threat. It doesn't have to be perfect. If the citizen does have a family or descendants, it will have a significant effective rate.

They can also select which citizens to send based on their ties. Much as a bank might size up collateral for a loan.

Every regime needs some way to encourage people other than "we'll kill you if you don't". Letting them keep 15% makes the work more attractive.

In the UK they let us keep 50%

Maybe it's not so bad in North Korea? :)

It’s bad but not as bad as we’re made to believe, people still have lives worth living. They live, they laugh, they love. They do fun normal stuff, they have free thoughts, they have family.

People will see kids laughing and playing in a war zone and think “it can’t be that bad, if it was that bad they’d be cowering in fear 24/7” - but people always find a way to live and find snippets of joy in even the worst situations

And 30 years later people get nostalgic for the simple days...

Oh my God, you are so naive. Normal stuff in NK is watching your kids wasting away because of lack of calories (average North Korean is 10 inches shorter than average South Korean-even though 70nyears ago they were the same people genetically). Is living with a radio in your home that does not stop singing praise to the regime - neighbors will report you if they think you turned off the radio. If they have free thoughts they do not share these out of their family (and most likely hide them from their kids because kids talk unsupervised). I could go on for a page or so but I hope you get the idea.

You're just feeding into western propaganda. Yes North Korean people are poor and there's tons of inequality but they are still real people. They are not in a constant war being bombed and tortured endlessly. They tend to farms, chat with friends, make jokes, feel pain and joy, they do what they can. I know that sounds like literal hell to a tech obsessed population that has to filter everything through the lens of social media, but for many people this is just life.

A lot of North Koreans probably don't even think about the government, it just has always existed and always will exist to them, they don't think about things being anther way because it won't be, so they just get on with it. It's like the people who believe propaganda that America has turned into a hell hole now under Trump where people have no rights or opportunity and have to live in fear of mass shootings or being kidnapped by ICE everyday. For the vast majority of American's that just not accurate at all. Touch grass.

  They are not in a constant war

North Korean soldiers have been fighting and dying in Ukraine this year to support Russia.

https://en.wikipedia.org/wiki/North_Korean_involvement_in_th...

The only bad things in the daily NK life you mentioned are poverty and inequality (more about that below [0]). You did not mention famine, physical oppression, lack of healthcare, censorship-all of which are well documented. I am afraid it is not me who is pushing some type of propaganda…

[0] about inequality in communist countries- these countries had much less inequality than western countries. Almost everyone was equally poor. In my home country of Romania the top 100 level apparatchiks (people who rworked directly with Nicolas Ceausescu) had the life style of a surgeon or wealthy dentist in the west: they had a “villa” with 3-4 bedrooms in the Primaverii neighbourdhood and a cottage somewhere. They still had to drive their own Romanian Dacia car. They had good heating and the electrical blackouts did not happen in their neighborhood. They had access to special stores to buy food( they did not wear western clothing). The rest 99.99% of Romanian people were all equally poor: they lined up at the same food queues, lived in the same cold apartments, lacked electricity and medicines equally, drank the same yellow/ brown tap water, listened to the same 2 or 3 western radio stations broadcasting in Romania, etc…

Stalin and the members of his governments also did not live lavishly: Stalin always wore a military coat and all through the 80s the Kremlin looked as drab as ever. His dacha had 4 bedrooms and two floors.

Compare this inequality vs what has been going on in the west. Wealthy people in the west own islands: both Google guys, JP Morgan, the Bush family. They own not just 1 yacht, but another one to follow along with their help on the summer Mediterranean milk-run. They own not just one mansion, but multiple mansions.

I want to conclude this long post by saying that under communism I was personally aware of this difference between the inequality in the west and the equality in communist Romania. And that once Romania overthrew their dictator and inequality exploded I personally felt much better. Sure, 2 or 3 of my classmates started driving to high school in their BMWs-and I spent all of high school in the same patched up jacket. The rich boys had their group physically close and yet separated from us. They were sure to tell girls how much their latest gizmo costed or how big the disco bill from previous night was. Of course they did that in front of poor guys like myself(labagii) All of which is not nice at all. But at least now I had food, heat and electricity-and a chance to leave for better places. I would take this trade-off today just as eagerly as I took it in Dec 89.

>> about inequality in communist countries- these countries had much less inequality than western countries.

Maybe some, while others had much higher inequality. E.g. Tito lived like a king. Not only did he amass huge private fortune, he also used state owned means for his private pleasure. I think it was very similar for Ceausescu and other dictators.

So you have no proof, and are just repeating propaganda, with a bonus anti communist rant. NK isn’t Eastern Europe.

Every single person which was raised up in the USSR-occupied country, who lived through the collapse of the Soviet Union and then in their independent countries, can repeat this story.

Mine's basically verbatim.

There are books about it, you know.

The facts are mentioned are well documented and available on Wikipedia. You can google them yourself. My “rant” was actually an explanation of how communist countries had low levels of inequality.

Speaking about proof-where is yours? Your extraordinary claims require extraordinary evidence…

You have no idea what happens in NK and are trying to pretend you do because you read some western propaganda. Get a clue.

Gone on, tell us, which podcast should we be listening to?

One where they don’t say NK is a marvel villain or that KJU killed various people in the government only for them to be seen weeks later.

If you are ignorant on something you are better off keeping quiet than regurgitating low IQ propaganda.

North Korea must be wonderful: nobody has an unkind word for the leader and hardly anyone leaves /s

Found the NK IT worker :)

lol.

But are they any good? I suppose they must be, as they seem to retain their jobs, but how do they rank overall?

Also, I tend to think that maintaining these interactions going might be a way to let more information into Naughty Korea and might actually have a positive influence in the long run.

The risk is not the quality of the work that the person might do. The risk is that you now have a state-controlled North Korean asset operating inside your security perimeter.

A lot of these are not there to breach your data, they're there to make money and fund the DRPK.

That's why there's no one industry or types of businesses being targeted, it's anywhere they can get hired. If your a high profile target, that's a bonus not the original goal.

NK is a client state of Russia and China. Their handlers are all too happy to pay for sneaking loyal dogs inside the henhouse.

It's 2025, it's all about zero-trust now. Can't be inside the security perimeter when there is no security perimeter.

Hiring mischievous North Koreans is fully in line with your CIO's new priorities, which she heard about at a conference once.

The reason that North Korea targets IT roles in particular is precisely because they're the weak link in zero-trust implementations. Someone, somewhere, has the unfettered rights to access the production database, and they're in the IT department.

If not production, they can usually read all the backups, DR systems, logging telemetry, legal discovery systems etc...

Zero trust doesn't do anything for you when you give the person a legitimate account with access, which presumably you must do for employees else they can't typically do any work

I interviewed one guy who probably was one of them and he was not a genius enough that I could ignore the aura of confusion and sus. I didn't think it was NK until way later but now it makes sense

Probably got lucky otherwise I would have no work myself because I think the client isn't that rich, they would go out of business from ransomware attack

I'm pretty sure I interviewed one of these guys too. He was impressive, until you got far enough off script and started finding red flags. I realized at one point too that he was reading a lot of prepared statements (and doing so with skills a politician would envy)

If you’re picked from the top of a country with 26 mil population you are probably good

They're very good. They get training directly from the regime.

perfect example of why you shouldn’t bother hiring these cheap offshore engineers.

you’re hiring an engineer thousands of miles away in another country for a fraction of the cost of an American engineer and you just assume they can be trusted with access to your most sensitive data and systems? And that they even are who they say they are and not just a frontman for some cabal?

How trustworthy is that American?

You know that the North Korean is untrustworthy, but that's kind of a special case. Is a random American more trustworthy than a random Bangladeshi or Slovakian?

I suppose that you have a bit more ability to do background checks on US citizens. But those background checks aren't so great, either.

A random person in your own country is more trustworthy for two reasons.

1. background checks 2. more ability to meet face to face. 3. ability to go after them for wrongdoing (either civil cases or chances of getting the police to follow up on anything criminal.

And off by one errors.

See? If I had not offshored that comment I would have written three!

They thought they were hiring American engineers, though.

The only way to prevent this is to do in-person only, but that's another can of worms.

I mean at least have some in person and commonly check in with video calls.

Heh, maybe we need to make a 2FA device with biometrics and GPS, where it's setup in person the first time.

my wages fund the american regime

[flagged]

"Eschew flamebait. Avoid generic tangents."

https://news.ycombinator.com/newsguidelines.html

I doubt these North Koreans are getting hired due to wage disparities (these are roles supposed to be in the US where they have a contact person in the US), more like they have perfected the interview process as the most important thing in their life.

I got the impression from the article he was working with people in Turkey and Hungary to use their identities to get jobs in the UK and US. So US company found this amazing Hungarian dev who would work for 1/5 what an American would ask for, but they paid for it either way their privacy (hey wait a minute, sounds familiar...)

there was recently this soham dude on SV/YC doing the rounds a few weeks ago

if all you do everyday is interview, you obviously get great at it

+1 vouching this one, lol. The flaggers, downvoters, and moderation comes from YC bootlickers sucking up to their masters.

Reply on news.ycombinator.com