Transcript
I've knocked on a lot of doors in my career. Some belong to hackers, some to whistleblowers, some to spies, many to victims, people who didn't even know they'd been pulled into the story until I showed up. But for all I know, the person behind this next door could be any of the above. My producer and I are driving to the home of a young woman we believe is hosting laptops for North Koreans. Does she know who she's working for? I have no idea. That's what we're here to find out. Okay, so we are driving through Cincinnati on our way to the home of Lexi who's hosting laptops for these fake North Korean IT workers. And it's freezing cold. There's snow on the ground. And it appears that she lives at her grandfather's house. We're hoping that they'll answer the door and talk to us. But we have low expectations here. Oh, and his car's here. All right, we're gonna go try our best here. Hope for the best. What a wild scenario we're in. Hello? I'm Nicole Perlroth, and this is To Catch a Thief. It was actually the North Koreans who led us to Lexi. She was one of a handful of Americans who surfaced in their backchannel communications on Discord. Remember, Nisus deliberately hired a North Korean operative as an AI developer. They shipped him a laptop, laced it with spyware, flipped on the camera, and found themselves sitting in the back of a closet, surrounded by other laptops. It's what the FBI calls a laptop farm. And those who track this for a living estimate that there could be anywhere from 75 to 200 laptop farms operating across the country, run by Americans who, knowingly or unknowingly, are hosting laptops for North Korea. And yet, we know almost nothing about them. Here's Nisus's Ryan LaSalle. I think if we go back to what's the big thing that people need to take away here, the first takeaway is there are thousands of people who are trying to rob U.S. companies of payroll. And the second thing is there are hundreds of Americans who are happy to help them. They call them natives. My native, like going back to the colonialism, that's how they refer to the Americans who have the laptop farms. Who are these people? And what brings them to the point where they're happy to host multiple companies' property in their house and defraud those companies and our country and circumvent sanctions? The only way to answer these questions was to meet one of these Americans face to face. But finding someone who wasn't going to pull a gun out on me presented something of a challenge. Yeah, so we've got one in Texas, one in Florida, one in Nebraska, one in Ohio. So Nebraska is the closest to you, but I don't know that any of those are a place I would go without some sort of protection. Yeah. And what do we know about this facilitator? Not much, actually. That's one of the individuals who was arrested. I know that for sure. For? Breaking and entering and theft. Okay. And the guy in Florida has also been arrested for theft. The person in Cincinnati is a woman. So you might have a lower chance of maybe by just our own internal bias, you may have a higher chance. This was the process of elimination that brought us to Lexi's doorstep. The North Koreans repeatedly mentioned Lexi in their chats. They called her their Ohio native and confirmed they'd paid her to host at least a couple laptops. And then incredibly, they dropped her name and address, which is where we're headed now. For someone at the center of a transnational cyber fraud operation, Lexi barely exists online. From what we can gather, she lives in a duplex with her grandfather, Ken. So we haven't been able to find a ton about her on social media. She has a LinkedIn profile with no picture on it. It looks like she did have a Facebook profile, and she's young. She's 21. So I'll be curious to know how they found her. She's not someone who seems that online. It's worth noting, this is happening at a particularly tense moment in America. We're only a week out from ICE agents killing Alex Preddy, an American ICU nurse in Minneapolis. I will say that this door knock and talk couldn't be happening at a worse time. Societally. Yeah. People are not really down to let strangers into their house right now. People are on edge, which makes what we're about to do fraught. Hence the security detail. Are you, are you armed, Dennis? It's my swat gun. We're pulling down the street, and it's pretty much like you would picture any street in Cincinnati. We're looking at row after row of squat brick houses, some more rundown than others. We find the right house number and make our way through ankle deep snow, up the steps to the door where, ironically, given the circumstances, we're met with a God bless America sign. So here we go. It does look like someone's home. I see the walker. I just noticed the doormat. Go away. All right. Finally, someone answers. Hi, sorry to interrupt. This is Rebecca and Nicole. We are doing some research on laptop firms. I'm sorry. It's a bad time. Okay. Are we in the right spot? We're looking for the... They're upstairs. Just yell. Oh, okay. We knock and knock, but no one answers. It's freezing cold. So we return to the car and try the phone numbers we've tracked down for Lexi and her family. Your call has been forwarded to voicemail. At the tone, please record your message. Hi, Ken. This is Nicole Perlroth. We stopped by your house today. We are hoping to talk to Lexi or Alexis. Eventually, I decide to leave an old-fashioned note. And just as I'm taping it to the door, the neighbor from before pops his head out. Oh, hi. Nicole, they're telling me you're out here. Oh, you can call it? I talked to Kenny. Oh, good. One note, and he said come down. Thank you. Hey, Kenny, I'm standing here with her now. Would you like to walk in the hall until you come down? The lady? Hi, Ken. I'm so sorry to bother you. We're looking for Alexis. We have some information about some laptops that she was sent and some questions about the sender. Ken agrees to come down. Shuffling behind him is our North Korean facilitator, Lexi, or as her grandfather calls her, Alexis. Hi, Alexis. Hi, Alexis. I'm Nicole. This is Rebecca. I'm so sorry to make you come down. So, hi. We're trying to reach you. I don't know what's going on. Yeah, sure. So we try to ring the doorbell. Sorry. It's not. Okay. I'm sorry to barge into your house. I don't want to make you uncomfortable. Do you want to just sit down here? Describing what exactly we're doing here is a bit of a and we had been researching these laptop farms and laptops that are getting sent to Americans' homes, they're coming from North Korea. So we wanted to call and find out if you had any information about where these laptops had come from. We were able to track some of their internal communications, show that they were sending them to you. We're now standing in a stairwell with Lexi and Ken. Maybe it's her Hello Kitty shirt, pajama shorts, and bare feet, but Lexi looks a lot younger than 21. She's a kid. It could be the fact we've just woken her up from a nap, but I got to say she doesn't sound nearly as shocked as you'd expect someone to be, especially when they learn they're part of a North Korean labor fraud scheme. From what we've gathered so far, North Koreans are finding their facilitators on Reddit, especially subreddits of people looking for gig work or quick cash. But according to NISOs, they're also recruiting them off gamer platforms, even the occasional porn site. We did see one mention that they were using Chatterbait as one of the channels to find people. I'm not sure how you approach someone who might want to be in IT there, but maybe there's a big crossover in that demographic, I don't know. These North Koreans do have an ideal candidate. Based on what NISOs gleaned from their Discord chatter, they look for young American men, college graduates, and young professionals looking for a side hustle, a way to pay off their student debt, or just a foothold into a career in tech. But plenty of the Americans North Korea is recruiting for this work are just people who, for whatever reason, can't get work, maybe because they have a criminal background, or they just don't have the right skills or experience. What all these facilitators have in common is that they're desperate for cash. Here's NISOs' Ben Reisenberg. So these individuals were on Reddit saying that they need money, that they're really poor, and they've been trying to get people to loan them money. So the operator got in contact with the person and said, you know, I might have an idea for you of a job, but we need to take this conversation off Reddit into Discord to have a further conversation on what we can do together and how it will work. So in our network, there was four individuals all across the U.S. that were facilitators already. We've also seen them have conversations, would you mind housing laptops, and then people freaking out and saying, this sounds illegal, this is not something I want to do, and I don't need money that bad. We've seen ones that said, nah, this sounds a little fishy, but you know what, I need money really bad, so I'm okay with it. So far, Lexi's story lines up beat for beat. She was young, introverted, online, in desperate need of cash, and from what we can tell, not someone who's going to ask too many questions. Where did they claim to be from? I think they said overseas. At any point, did you figure out who are these people or? No. It was just, I was looking online for help to get money, and that's how they got me. So they reached out to you, and then what was the ask? They said, it was like, I need help with programming, and I want to send the laptop to your house, and I just want to pay for your Wi-Fi, basically, that's what they said. How many laptops have they asked you to host? Like, two at first, and then they wanted more and more and more. How many do you, do you have to like, set it up for them, or? You have to like, put on a, it's like this application that lets them control it from their laptop. Oh, okay, like a remote desktop. Yeah, but you have to download that. Yeah. Are they, are they inside your laptop? No, no, not mine. Just these laptops. Like, a corporation will send you a laptop, and you'll just plug it in for them, and do they ask you to connect it to a VPN, or do they do everything on the back end? They do everything on the back end, I think. Did they speak English well? They spoke it pretty well, yeah. We're only getting bits and pieces, but Ken's interjections start to paint a clearer picture. She's a writer, she writes. What do you write? Uh, just fantasy stories. I've raised them, I've been raising them. Yeah. I have her, she, believe it or not, she could, when she's at the hospital and she's born, I can put her in both my hands. That's, that's how long I've had her, you know. Yeah. If you want her help, she'll help you. Yeah. I don't have my granddaughter. Like I said, she could probably show you everything she's got. I mean, she, she'll do it. Yeah. Are they, do they call you on the phone, or is it on WhatsApp? It's a bit hard to catch Ken there, but he said, if it's for our country, she'll do it. At this point, the absurdity of our situation starts to set in. We're standing in a stairwell explaining a North Korean employment fraud scam to a 21-year-old girl in a Hello Kitty t-shirt, while her stunned and clearly patriotic grandfather tries to take it all in. My producer and I exchange glances. We decide to give them some time to digest all of this and call it for the night, and then ask if it'd be okay if we come back for a proper sit-down tomorrow. ask if it'd be okay if we come back for a proper sit down tomorrow. They agree. But They agree. that night we agonized over whether there'd even be a second interview. There was a good chance Lexi would Google North Korean laptops, read the headlines, and disappear before we ever spoke again. Because there was one name she was almost certain to find. Christina Chapman. A Valley woman is accused of helping the North Korean government avoid sanctions and bringing millions for the country's weapons program. According to the Department of Justice, Christina Chapman operated a laptop farm from her home. Between October 2020 and 2023, Chapman is said to have helped North Korean IT workers secure stolen identities of US citizens and those to get them remote jobs with US companies. Whatever ignorance or confusion Christina Chapman claimed, it didn't spare her from what happened next. The indictment was unsealed this week, alleging that 49-year-old Christina Chapman helped North Korea plant people at prominent companies across the country. Chapman is charged with nine counts, including conspiracy to defraud the US government. A Christina Chapman of Arizona was sentenced to 102 months of imprisonment for conspiring with North Koreans to infiltrate US companies, including Fortune 500 companies, with the goal of creating revenue to send to North Korea for their munitions development. A federal judge has sentenced Christina Chapman to eight and a half years in prison for her role in a fraudulent scheme that assisted North Korea and generated income for their nuclear weapons program. Last year, Christina Chapman pled guilty to conspiracy, identity theft and money laundering. And while she's the most public case, she's hardly an anomaly. Without these American facilitators, North Korea's IT worker scheme doesn't work because they're not here. They need Americans to host their corporate laptops and more. In the beginning, North Koreans would spin up their own LinkedIn accounts. But once companies grew wise to their ways, the North Koreans switched tack. They started compromising real Americans' LinkedIn accounts, even pulling their social security numbers off the dark web and using their identities to apply for jobs. But these days, they're approaching Americans to loan out their LinkedIn accounts, even asking them to cash their paychecks, set up bank accounts. In some cases, they've asked them to show up for in-person job interviews, even take drug tests, all in exchange for a small fee. My name is Chris Wong. I was with the FBI for 10 years, most of that time working against North Korea. Okay, I want to start with Americans' role in all of this. Talk to me about the range of people that are getting caught up in this. By and large, when people are working remotely these days, you're going to have a company laptop. And the company might have certain controls in place so that they can make sure that you are where you say you are. They're not going to ship the laptop to China or to North Korea or to Russia if you've told them you're in Georgia. That's just not going to happen, right? And then there's going to be payment processes that the North Korean needs to set up. And all of this needs to look, at least to the company that's hiring them, as somewhat legitimate. Like, oh, you have a bank account at this small community bank. You have asked for your laptop to be shipped to this certain location. And all of that fits within their HR profile. But the North Korean is not there, so he has to find ways to make this happen, which is where you start running into like a 21-year-old who's looking to earn an extra $200 a month or an extra $50 a month because maybe I'm in college. This is an easy job because all I do is leave that thing there and it's like passive income. And by the way, a 21-year-old is probably not expecting to be contacted by North Korean IT workers to do that. Which brings us back to our 21-year-old facilitator, Lexi. After a sleepless night in Cincinnati, we wake up and grab coffee. Snow has blanketed everything overnight. We meet up with our security detail and head out for our scheduled sit down with Lexi and Ken. But we're pretty convinced there's no way they're going to let us back in. To our surprise, Lexi opens the door and waves us inside. We follow her up the stairs and pass through her living room where her grandmother's watching TV, smoking cigarettes on the couch. I'm a little taken aback when they tell me she's very ill. They guide us toward the dining room. And as we sit down at a worn wooden dining table, I realize we're surrounded by Americana, American flags, bald eagles. There's patriotic knickknacks everywhere. Ken takes a minute to get settled in his chair. And can I ask how you lost your leg? They said I had a rare disease called Charco. And I don't know if it's the bone, it dissolves your bones in your foot. That's how it started. I had four broken bones in my foot and didn't even know it. And they just collapsed. Do you have any idea how you broke them? No, no. I just, I was weed eating in the front yard and I just collapsed on the ground. And that's the only thing I can remember. It all started from there. How I lost my kidneys is another story. That's from the antibiotics I believe they gave me for my leg that destroyed my kidneys. And they were giving me some strong antibiotics to the IV and everything. I don't even want to talk, that was a nightmare in the hospital. I ask about the American flags and eagle figurines. Ken tells us he collects them. He's a proud American. He tells us everything he knows about North Korea came from his father. He passed away, but he told me a lot about Korea because he was in Korea. Was he in the Korean War? Yeah, he was a Marine. Yeah. In any other room, in any other context, this might have been an ordinary family detail, but given why we're all here, it lands differently. The Lexi from the stairwell last night was guarded, nervous, almost monosyllabic. But sitting across from me now, she sounds different. Like she spent the night thinking about what she would say, maybe even rehearsing it. She immediately dives into her explanation, not as some willing accomplice to North Korea, but as a broke, isolated kid who got pulled into something she didn't fully understand. I'm really trying to get a job. It's hard because I have really, really bad social anxiety. And I freeze up when I try to talk to people. That's my problem. It was just, I'm looking for some jobs to get some money to help around my family because, like I said last night, we struggle badly, especially near the end of the month. It could be rationalization or self-preservation, or maybe she is exactly the type of person these operations are designed to prey upon. It's really hard for us, especially with my grandpa. He lost his leg, his kidneys, and he's the only one that drives. And my grandma lost her hearing, and it's just me and my little sister, you know? And I have a lot of problems in the head because my mom, she left me when I was really young, and it messed me up. But I was trying to get some money because I can draw, I can write, and I wanted to use that talent. And they messaged me off of that. It really sucks. I just took advantage of that. As Lexi talks, it's easy to forget that hosting a laptop isn't some harmless side hustle. And it's not just a crime. It's helping fund a foreign adversary's nuclear program. But we also made the decision to bleep Lexi's last name, because despite some very questionable choices here, she appears to be a victim too, drawn into an identity scam she never fully understood. I asked Lexi to tell us how the North Koreans got to her in the first place. So maybe it makes sense to back up. Why don't we just start with Reddit? Yeah, Reddit. Do you spend a lot of time on Reddit? Not really. It's not really my place. I just really went there to try and get some like, little work to do. That's where they approached me. Is there like a name of the Reddit channel? I think one of them was like, Get Money Now. Okay. Yeah, like that, or Pocket Money Online, like that. But your post was, I can do drawing or art or... Or just anything really. So I guess that's why they said, because the anything part. Lexi had posted that she would do anything online for quick cash. And she mentioned she draws. She gets out her phone and pulls up one of the drawings she sold on Reddit for 20 bucks. It's a really sweet anime character. Yeah, she's like, she's one of my first. Um, hold on. She tells us she dreams of publishing a book about her anime creations. When she was in school, they used to tell her, tell me how she, they used to call her, nickname her The Writer, because she was always writing. I always got in trouble for it in school. Just imagine getting in trouble for writing. Her Reddit posts attract a guy Lexi calls, The Recruiter. He asks if they can take their Discord. And for a while, they chat about everything but laptops. It's clear he was trying to build a rapport. Uh, we were just, he would just like, ask about my day and like, you know, all that stuff. Like, ask me questions. Like, he seemed like really interested in what I had to say, really. So almost like an internet buddy or... Yeah. Yeah. And what kind of things would he ask you about? Like, um, I have screenshots right here. When I was talking about my dream as being a writer when I was a child, he said, then that would be a long dream for you. I wanted to be a designer when I was a child. I'm doing programming now, but I love it. Did he share anything else about himself in those early conversations? Not, I think he shared his birthday with me. How old was the year? He, I think he said he was like around my age. This recruiter claimed to be Japanese. He sent her emojis, a lot of emojis. She called him darling. She confided about her family and their money troubles. And once he'd earned her trust, he made the ask. Lexi was too shy to read their exchanges aloud. So you'll hear me reading them here. So it says, um, all right, so now you understood what I want, right? Yes, darling. Excellent. So in short, I would like you to rent me your internet connection and home address to start our collaboration. I will guide you by end to end. What I'm going to be doing from now is I will be contacting you over here within one to two week, even before Christmas, and we'll brought a new laptop to your home. Then you set up the laptop and allow me to access it remotely via any desk. If things go well, you will be having a monthly income. It's currently estimated to 100 to 200 per month. As soon as the recruiter bridged the laptop, his affect completely shifted. And that's all he would talk about. He told her she just need to sign for it, plug it in, download a free remote desktop tool, and in exchange, get a hundred bucks in crypto paid to her PayPal account every month. Did you ever get on the phone with these people? No, I avoided it. Okay. Did they ask to get on? Yes. They, they asked a lot and I just said, I can't talk. Okay. And did they say, we'd like to send you more than one laptop? Yes. They said that a lot. And would they have offered more payment for that? Yes. Like I said, a hundred per laptop. And why wouldn't you do that? I, I just, I don't know. It's, I just felt like something was fishy about it. Really. How many were they trying to get you to take? Uh, I don't know. They sent me two efforts and then the first one broke and they wanted to send more. When they would ask you if they could send you more laptops, how did you phrase your reply? Uh, I said, I honestly said, I don't mind. That's literally what I said, but they just never sent them. I'm glad they didn't. Honestly. And did you have any concerns over what this was? Not really. I mean, I was a little concerned, but you know, I really wanted the, you know, the money, the family issues and all that stuff. And so you plug in these laptops, do they give you any instructions? Like you have to keep them open? Uh, keep it. Yeah. Keep it on and plugged in. They were able to control it when it was closed, which I didn't understand. Okay. And since you didn't know these people were kind of worried when you were setting it up, maybe there was someone watching you through the camera. camera? Yeah. So did you put tape on the webcam or anything like that? Yeah. Do you Yeah. remember seeing anything on the home screen when you first turned the computer on? I said Dustin Lee that's the name I said Dustin Lee. Dustin Lee. Lexi showed us a picture of the login screen with Dustin Lee's name and we found what we believe is his LinkedIn page. We reached out and never heard back so we can't be sure but as far as DPRK IT worker profiles go it tracks. Despite a long work history his LinkedIn profile was only set up a couple months ago. He claimed to have had a three-year stint at Accenture but Accenture confirmed it has no record of a Dustin Lee ever working there. His account linked off to a personal website featuring what's clearly an AI generated headshot, a VOIP number, and a long bio that was pretty clearly written by AI. It's textbook. As Lexi's unspooling this bit by painful bit I look over at Ken. It's clear he had zero idea what she's been up to. I ask her what she used the money for. She said it helped pay for the Wi-Fi bill, the occasional takeout, and gifts. She says she likes to buy her little sister small gifts. She likes to decorate her room that's her favorite thing and I love to buy her that stuff makes her happy. She likes lights that's what her favorite thing is lights. After Lexi sets up the laptop the recruiter sticks around for the next few weeks then hands her off to a man he calls Jacob but Lexi has an alternate name for Jacob. She calls him the mastermind and this guy's a far cry from her sweet Japanese internet friend. Again you'll hear me reading his messages here. So he says okay then let me chat I don't care what you were doing with him for now you're my business partner you have the laptop he sent you and honestly I've been using it for two months and I've been in charge of the payment for you smiley face so what your responsibility is keep the current laptop available on the internet and receive and keep the laptop available for the internet and what was your last correspondence with the original person like where are you yeah I just I said are you all right and nothing back nothing back her anime loving Japanese friend ghosted her everything that came next came from the mastermind Jacob and what do we know about Jacob or how did he present um he said he was from Texas that's what he told me and you said you got it that feeling that this was a little fishy yeah what point did that start to feel that way um I guess a little like after cuz like I was like why would you need to use the internet when you're in America right and I didn't like the way he talked he was like creepy a little bit yeah what kind of creepy like you know I'm a like like a young girl and it's just like that kind of stuff you know yeah it's like the flirty stuff yeah do you mind reading us any of those messages I don't know if I have any of the 40 ones I kind of avoided them okay I don't know if Lexi deleted these flirty messages or she just doesn't want to read them in front of her grandfather but kind of avoided is a bit of an understatement reading through Lexi's whatsapp history shows Jacob calls her repeatedly not only does she never pick up she tells him she's nonverbal okay hmm you said I just can't use my voice I assume you were trying to not get on the phone yeah okay you said you know what a mute is you just told him like I can't talk okay this doesn't stop Jacob from pushing Lexi to do more over text do you know some people who meet this requirement male 31 to 35 handy with online work and laptop good network speed work 8 to 5 CST central time at home remotely no sadly not hmm okay no worries have they been more aggressive about sending these around or finding other people or like how do you even find other people I'm not a social person so I was the worst person so I haven't found anyone I think it's safe to say the North Koreans didn't exactly pick the most enterprising laptop farmer with Lexi Christina Chapman was getting paid an average of $4,900 a month to host laptops when the FBI raided her home in 2023 they seized 90 machines and incredibly Chapman documented much of this work on tick-tock another busy morning for me when I started 530 in the that's what time I get up I started 530 go straight to my office which is the next door away from my bedroom I'm gonna start taking care of my clients computer business today is going to be a bit of an out-and-about day because I have a lot of errands to run for clients I got a bundle of fry earrings and I'm trying to wear a different pair each day I think so far these are my favorites compared to Christina Chapman the North Koreans probably saw Lexi as an underperformer she broke the first laptop they sent her and was only making a hundred bucks a month to host a single corporate laptop until we knocked on her door last night so after we left last night tell us what you did um I sat right here for a little bit just contemplating doing research that's what I did first and then I also I I filled out an FBI report because I'm a victim of this and I don't want to be like you know because like I'm I'm so young and I don't I haven't really lived my life and I don't want this money as you just feel like you don't ruin my life what were you thinking when we came in here and said we're looking into North Koreans planting laptops yeah it was it was scary did you known about this North Korean issue no not at all the investigative journalist in me doesn't want to give her the benefit of the doubt or believe that people are just willingly hosting laptops for perfect strangers overseas but her story is not that uncommon if you recall cliff from the last episodes the CISO from one of the large staffing agencies who asked to remain anonymous that we've given him a pseudonym and we're anonymizing his voice well he told us he was actually able to track down one facilitator in Florida who get this was a US military veteran not only did this guy not know he was working on behalf of North Korea he didn't think there was anything wrong with hosting a laptop farm he actually openly advertised his laptop services on his resume I looked at the guy's resume and darn if he didn't have laptop farm on his resume he was touting that that's what he does so fast forward when we talked to him he had no idea he was doing something wrong he was using the laptop in his own laptop farm serving up other laptops so you thought we're all no idea that he was involved in something so sinister as what he was involved in and was probably the most upset person that we've encountered then in a completely separate case cliff tried to recover a laptop from one of the North Koreans his staffing agency had placed he reached out to the candidates LinkedIn account it turns out that account actually belonged to an account to North Korean workers and I think everyone needs to hear this voicemail he left cliff just to be super clear these folks physically presented me an opportunity to use my LinkedIn and he was basically offering me a negotiation so percentages of every project income so every project that he was able to close giving me like 20% of kickback and then I think I had something like $1,000 in addition has like a base pay every month this guy tells cliff that all this talk of North Korea has him a bit stressed and reconsidering this line of work I've also been opening myself maybe it's other kinds of opportunities like maybe the adult entertainment recently I've been discovering adult entertainment and that industry allows you to always be relaxed and fresh and be high-minded hope this message finds you in the warmest spirits and I look forward to your response soon okay here's where I think we need to step back this season was supposed to be about North Korea the remote IT workers but the more I dug in the more I realize it's about us America it really hit me in Cincinnati that the long list of things we've yet to address here at home income inequality and affordable healthcare unemployment this loneliness and isolation many Americans are feeling whether it's from social media or just the long tail of kovat they all converged here in this one smoke-filled house covered in American flags in Cincinnati where a young American can't find work lives off her grandfather's disability checks and is willing to look the other way for an extra hundred bucks a month but once you start pulling on that thread once you consider the u.s. rise in long-term unemployment once you think about the jobs AI will likely erase and the people now competing for work against a flood of perfectly AI North Korean resumes it gets scary because the pool of Americans North Korea is drawing from it's about to get a whole lot bigger and this isn't just limited to Americans oh they are like everywhere here I'll bring in our interview with one of the been tracking these facilitators around the globe a Poland based researcher who asked to go by his online alias black big swan or BBS for short BBS has tracked down these facilitators all over the globe there is also like extremely a lot Americans but we get like a lot of Ukrainian facilitators Argentina is another growing hub you can make $100 per day or something like this and for a guy from Argentina who's currently unemployed who may be starting his developer journey this sounds pretty good and because he already has a relation with with this North Korean through many different private chats he's kind of a more trustworthy that this will actually be a legitimate job people just like try to take the chances online right and North Koreans are waiting for it have you talked to any of these facilitators one-on-one yeah to some of them and how many of them were not aware that they were operating at the behest of North Korea I say it's 50-50 like half of the people just is basically in need of money and they will take any job and ignore all of the potential repercussions but if they would knew that this is North Korea and that this is a scam in the end like a security threat they wouldn't do it but they just simply don't know and there is the other half which is trying to make a business out of it I don't know if they are telling themselves a story that they are running a legitimate business just like maybe in a gray area of the market or they just don't care the most interesting is the guys who try to make a business out of it because those guys they will tell themselves a story that they are businessmen that this is all fine that they are not doing anything illegal they may even know that North Korea is doing it but they will choose to ignore this fact they will just like assume that nothing bad will happen that it's completely fine I'm just giving them access to my PC okay when you have reached out to these facilitators and you have told them you are doing this on behalf of North Korea and this is where the money goes if the conversation has gotten that far what are the typical responses you've gotten usually denial like a full denial sometimes threatening asking how do we know this how did we obtain this illegal data to quote one of those guys often often it's like just like trying to downplay the whole thing like those people maybe in the next few weeks they will try to delete this whole business because they will get afraid of like you know criminal charges or something but usually their first reaction is to basically ignore this like to say that there's nothing wrong with that I'm just doing business it's a tech business I'm a businessman I pay my taxes I don't think that we had a single case when we convinced one of when we convinced one of those facilitators that what he's doing is wrong. Like at best, what they will do is they will get scared and try to delete it. But that's like the best case scenario. And on this spectrum of total ignorance to witting accomplice, where do you think Christina Chapman landed? I think like the case of Chapman was actually that she wasn't trying to make a business out of it. She was obviously motivated by economical gain, she needed money, but she wouldn't fall into the type of this businessman we are often seeing where they just like basically don't give a hell about what they are doing as long as they are getting paid. And they will continue to do it even if we tell them that this is North Korea. We reached out to Christina Chapman several times, but weren't able to secure an interview with her in prison. But we did speak to the person closest to her case, her attorney. Hi, I'm Alexis Gardner. I am a federal public defender in the Federal Defender's Office for the District of Columbia. When I first received the case, it was a high profile case. And my first thought was, honestly, she's screwed. I mean, she's an unsophisticated woman without really any skills or talent to think of. And really kind of a lonely person who I could see easily being taken advantage of, someone who doesn't have a lot of resources, who's hard up for money, who wants attention. She had a pretty big online following, which honestly surprised me. But like a lot of influencers, Christina was trying to paint a very specific picture of her life. I am sitting in an RV and I am in Long Beach, California. I'm so excited. I am very early to the location of the Rising Japan Music Festival. She would be talking about her like K-pop interests and her different like diet plans and stuff like that. And then talking about kind of her woes of life. And then she did this bootcamp. Christina found an IT bootcamp online, a six-week course to help her find a job in the field. This is how Chapman herself described what happened next in an interview with Bloomberg. Towards the end of the course, I had gotten several different job offers and then we went into COVID. Most of the job offers went away with the exception of one. The job offer came to me through LinkedIn and basically said that they wanted me to be the face for their company. I would be the person in between them and the clients. It was about building websites, maybe doing database work. They've reached out to her on LinkedIn like, hi, we see you're looking for a job. We have the perfect job for you. You could be the U.S. face of our company. And yeah, that's how their relationship started. By the time the red flag started showing up, Chapman was already in too deep. I felt sorry for her in that I realized, she had gotten into more trouble than she, I think, conceptualized. She did think initially everything was above board until she started being asked to do things that weren't in the role that she thought she had taken on, like cash people's checks. I did that with the understanding that the people on the checks were somehow involved with the company. These were people that I trusted, dumbly trusted, but I still trusted them. You know, we're gonna send the checks to you for you to cash. And it's like, oh, well, hold on. That's not what we talked about. Well, don't worry. We'll make it worth your while. We'll give you this much money for, you know, this percentage of each one. And when she was in, she was in. She wasn't just cashing North Koreans' checks. She was picking up their corporate badges. You keep getting more into it and it's like, oh, well, this badge requires someone go pick it up in person. So Denny needs to pick it up. And it's like, well, there is no Denny, so you need to go pick it up. And she's like, oh, there is no Denny? Well, so is that just a made up person entirely or this? And it's like, you know, go pick it up. I mean, sometimes they answered her questions frankly, like, oh yeah, no, that's just made up. She made less than $160,000 off the whole thing. It's in my sensing memo. Of course, they were like $17.5 million. And I was like, this woman didn't even make 60 grand a year off this. Back in Ohio, I specifically asked Lexi if she'd read up on Christina Chapman. Before last night, before we came knocking on your door, did you have questions about the legality of all of this? Yeah. How did that come up? I don't know. It's just, I was asleep when you guys came. So I just woke up and my mind was just all over the place. Like, what is this about? So had you read up on any of this in the news? Did you know any of this? I looked last night, I did. What kind of cases came up in your research? It was really just, it was on Reddit, because that's where a lot of information is, because it was someone asking questions about it and everyone in the comments was like, you're gonna go to jail or you're gonna go to prison. It was scary. It made my anxiety spike, like how people in my position were arrested and stuff. And that's why I filled out the FBI report, because I wanted to show that I was a victim. And did you read up the case of Christina Chapman by any chance? She was in Arizona and she was hosting laptops for a ton of people. She had around 60, I think. Yeah, and so she was arrested. And that was the first time we saw this. At this point, Ken jumps in. 60, 60 laptops? Yeah. Well, she's making banquets. But it doesn't end well. Did y'all work on the FBI report together? I did it on my own. I didn't want to cause him any more stress, you know? And when you were looking on the Reddit threads last night, did you write anything to anybody? No, like I said, I don't like to communicate. When's the last time you talked to Jacob? He actually messaged me today, because last night I turned off all the laptops, so he's probably wondering what's going on. Oh, do you mind reading them? He just said hello. Lexi told us she was through, but Ken worried that the North Koreans might still try to contact her. Now, what do we do if she's, if they keep trying to get in touch with her, then? You gotta decide that for yourself. Yeah. All right. Is there anything that we didn't ask you that you want to say? Not really. Like, I feel like I got out what really, really needed to be said. Good. I'd like to find out where it came from. Me too. Me too. As we shuffled out, it was hard not to think about how small the gap can be between an ordinary life and becoming part of a foreign nuclear funding operation. And harder still not to wonder how many more people are about to fall into that gap. The North Korean IT worker scheme may be one of the most ingenious sanctions evasion operations ever constructed. American companies unknowingly funding the regime's weapons programs. American citizens unknowingly providing the infrastructure. But this ingenuity didn't appear out of nowhere. North Korea has been establishing new playbooks for more than a decade. And had we been paying closer attention, we might've seen this one coming. Instead, that North Korean caricature we cling to clouded our judgment. Which is ironic, because it was a Hollywood caricature of North Korea that put us in Pyongyang's digital crosshairs in the first place. And so for years, we war gamed in this space. What will it look like if a rogue nuclear armed nation decides to attack the United States through cyber means? And we did a lot of different scenarios. We did electrical grid and water grid and attacks against missile systems. And our overall ability to communicate, so telecom. We all got it wrong, right? And no one anticipated that the first time that that would happen would be over a movie about pot smoking journalists with Seth Rogen in it. Returning to the hack that blindsided America and rewrote the playbook. Hello, North Korea! Whoa! That's next on To Catch a Thief. Follow To Catch a Thief to make sure you don't miss the next episode. And if you like what you hear, rate and review the show. To Catch a Thief is co-produced by me, Nicole Perlroth, and Rubrik in partnership with Pod People, with special thanks to Julia Lee. To Catch a Thief is a production of Pod People.
