5 ms·

Fisker EVs Hired an IT Spy Who Funneled Millions to N. Korea's Missile Program

134 points by rmason 2y ago

perihelions 2y ago
This appears to be the indictment: https://www.justice.gov/usao-dc/media/1352191/dl https://www.justice.gov/usao-dc/media/1352191/dl (pdf) Some related coverage: https://arstechnica.com/security/2024/05/arizona-woman-accused-of-helping-north-koreans-get-remote-it-jobs-at-300-companies/ https://arstechnica.com/security/2024/05/arizona-woman-accus... ("Arizona woman accused of helping North Koreans get remote IT jobs at 300 companies")
- blackeyeblitzar 2y ago
  > “The charges in this case should be a wakeup call for American companies and government agencies that employ remote IT workers,” Nicole Argentieri, head of the Justice Department's Criminal Division, said. I really hope this doesn’t become ammunition for companies who force unjust and unnecessary return to office policies.
  - kspacewalk2 2y ago
    Unnecessary - perhaps. Ill-advised, since a lot of talent greatly prefers remote work - perhaps. But unjust? Aren't you taking it a bit far? You don't have the right to remote work.
    - kevingadd 2y ago
      If the outcome of the policies is an unjust outcome I don't think the term is inaccurate, even if the common use of it refers to one's legal rights.
    - ceejayoz 2y ago
      I'd consider it unjust if I was hired for a remote role and they changed that deal later.
      - lotsofpulp 2y ago
        It’s just business. Everything is subject to change all the time. Unfair, rude, etc, but unjust is a bridge too far. Unjust might be society not offering a sufficient safety net to ride out income volatility.
        bill_joy_fanboy 2y ago
        "Unjust" is really just a matter of personal taste. Your claim that it's just has no more validity than a claim that it's unjust. Saying "it's just business" is just a canned phrase for minimizing a general dismissive attitude toward the welfare of workers.
        lotsofpulp 2y ago
        >Saying "it's just business" is just a canned phrase for minimizing a general dismissive attitude toward the welfare of workers. reply I don't think I am dismissive toward the welfare of workers. I strongly advocate for government helping workers by at least increasing/streamlining the process of receiving unemployment benefits and/or taxpayer funded efforts to re-train in the event of loss of income or even relocation assistance.
        rangerelf 2y ago
        It's "just business" to the company, it's very personal to anyone affected by it. I find "it's just business" and "it's not personal" to be some of the most insulting and gaslighting phrases in the English language, by how they dehumanize the person at the receiving end of them.
        lotsofpulp 2y ago
        If I stop shopping at a specific vendor, I am doing the same thing. The person operating the farmer's market stand or a food truck or whatever is a human too, but it's perfectly fine to say that you will no longer patronize that business. People are affected by loss of income, and it is tragic. I don't think a buyer ceasing to buy from a seller is injustice, regardless if the relationship is employer/employee or customer/business. It is society that should be providing the stability necessary for business to just be business. If a business makes a mistake, it is not unjust for the business to correct course which could involve changing its terms with its vendors (including employees).
    - deleted 2y ago
      [deleted]
    - weard_beard 2y ago
      RTO mandates for remote hired workers aught to be considered defacto constructive dismissal and grounds for a civil suit for lost wages. The fact that companies can pull this kind of bait and switch is A.B.S.O.L.U.T.E.L.Y. a miscarriage of justice that is harming families and ruining lives.
    - bill_joy_fanboy 2y ago
      > You don't have the right to remote work. What I have a "right" to is ultimately a matter of personal judgment. Isn't it?
      - airstrike 2y ago
        I'm all for WFH but a right implies someone else has an obligation
        8200_unit 2y ago
        I disagree. How does someone else have an obligation to my freedom of speech?
        ricardobeat 2y ago
        There is nothing to disagree here, it’s the philosophical definition of a right. It only exists if there is an obligation on the other side, in this case, to allow you to speak freely and without interference (applies both to individuals and the state).
        bulatb 2y ago
        Only for positive rights, and not always for those either.
        JumpCrisscross 2y ago
        No. You have an obligation not to violate my negative rights, too, e.g. we prohibit murder but don’t guarantee a right to life at any cost.
        deleted 2y ago
        [deleted]
        bulatb 2y ago
        My battery ran out before I could delete. I had another sentence there at first about "unless you call respecting rights an obligation," but I took it out because I didn't want to make a mess. To me an obligation in this context means the thing which is created by a positive right. (IME when someone uses "obligation" for negative rights, it's often for a bad-faith argument relying on the vagueness of "rights" to score a rhetorical point.) The analogous but different thing that some would say arises from a negative right, to me, is properly described another way. My right to life[0] can still exist without you being obligated not to murder me. It means that I am always justified in self-defense, so if you try to kill me, I'm allowed to kill you back. Except not always. But basically always. Except for the exceptions we can frame a million different ways. In practice, neither of our rights to life are absolute...and so on, down the rabbit hole. [0] But wait: My natural right? My legal right? In terms of enforcement? Or in some vague sense that I "have" a right and those are words I get to say, and, uh, if you don't like it then I'll say them again? In practice, no one cares. People just say "rights" to mean "I'm right." Talking about rights is fraught and frustrating and mostly pointless, and my comment wasn't worth writing, but there's nothing I can do about it now.
  - deleted 2y ago
    [deleted]
  - acdha 2y ago
    I don’t like it either but it is a real concern. We can’t ignore it but we can try to frame the conversation correctly: we should be able to say this isn’t happening because we have good security policies and monitoring, etc.
deleted 2y ago
[deleted]
ceejayoz 2y ago
Reminds me of https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-t... - I seem to remember it coming up here at the time.
jonhohle 2y ago
I’m sure all the money the US government put into Fisker was already gone by then. A decade later and even more reminders of what a terrible “investment” that was.
- karpatic 2y ago
  Fisker continues to widen my eyes. Unfortunately.
- azinman2 2y ago
  What was all the money? It's so far worked out for Tesla, and at least of the major auto companies in the US they're still alive when they could have gone under previously. Supporting new private industry is good policy, if done with balance. China has been employing this very successfully industry after industry.
  - starik36 2y ago
    US govt. invested in Tesla? That's news to me.
    - mikeyouse 2y ago
      DOE gave them a $465 million loan to build out their Fremont factory during the height of the GFC: https://www.energy.gov/lpo/tesla#:~:text=In%20January%202010%2C%20the%20Department,for%20powering%20specially%20designed%20all%2D https://www.energy.gov/lpo/tesla#:~:text=In%20January%202010...
      - ccheney 2y ago
        adding context to the above comment: > Tesla repaid its $465 million loan from the US Department of Energy (DoE) nine years early in 2013
        azinman2 2y ago
        Don't forget that a massive part of their income that allowed them to survive was selling carbon credits to the tune of billions of dollars, and that their cars have been massively discounted due to federal subsidies on EV cars (depending on your income level.... which btw doesn't apply to just them but makes a big difference).
bearjaws 2y ago
Imagine losing your job and then hearing that a NK spy stole millions, resulting in your job loss. Hiring in IT is a joke, there is an obsession with gamifying everything resulting in only people willing to play the game actually getting hired.
- xanthor 2y ago
  It doesn't say millions were stolen. The indictment says North Koreans were paid millions for their work. I wonder what the quality of work was like
Maarten88 2y ago
With all the anger over illegal immigrants taking US jobs, as a European it surprises me that nobody in the US seems to even mention the idea of punishing the employer for employing illegal workers. If I want to hire someone (local or remote) as an employer here, I better make sure the worker has a valid working permit. Fines for non-compliance towards the employer are huge, even for a single day of work. All paperwork has to be complete before any work is done. Even when hiring through intermediary companies who guarantee it's all legal, liability and fines remain in place for the ultimate employer if it turns out to be not so.
- alephnerd 2y ago
  > punishing the employer for employing an illegal worker It's already the law. This is why employers mandate I-9 forms as part of employment. This is part of the larger indictment against Christine Chapman by the DoJ, who found she was falsifying employment verification documents and giving access to North Koreans in return for a portion of the embezzled sums. Stories like this are also why there has been a major push for RTO.
  - ceejayoz 2y ago
    > Stories like this are also why there has been a major push for RTO. Citation needed. I find this very unlikely as the root cause.
    - varispeed 2y ago
      It's about investment funds and shareholders owning commercial property who push for RTO out of fear of their portfolio going down in value if people are not using the offices.
      - JumpCrisscross 2y ago
        > investment funds and shareholders owning commercial property Are you in San Francisco? This is a conspiracy theory I hear a lot in San Francisco.
ijustwanttovote 2y ago
If there is an argument for RTO, it would be this. Stu Sjouwerman: We were hiring a fairly specific, hard-to-find software engineer who had background in AI. We have a number of AI initiatives, and so we needed a software engineer to support all those initiatives. Jessica Mendoza: The job was posted on online job forums, and pretty soon, resumes started to flow in from all over the country, and one candidate stood out. He said his name was Kyle. Stu Sjouwerman: "Mr. Kyle" quote, unquote, air quotes, had experience with exactly everything that we needed. It was a very good interview. He was very open. He talked about his strengths and weaknesses, indicated where he felt he needed additional training and indicated a career path. And so, was the perfect interviewee, which made us move to the next step. Jessica Mendoza: After conducting background checks, Stu's company decided to hire Kyle as a remote employee. They sent him a work laptop to an address in Washington State and started the onboarding process. But almost immediately, it became clear that Kyle was not who he said he was. Stu Sjouwerman: At that point in time, our team started seeing very concerning traffic on that laptop. Jessica Mendoza: What kind of concerning traffic? Stu Sjouwerman: Well, Kyle immediately started downloading malware. We immediately saw that a whole bunch of things were happening that should not be. We tried to get in touch with him and asked if he needed any help. I think this was through Slack, and he said, "Yes, I am trying to debug my router and I'm following instructions from a list." And this is where it became very, very iffy, very fast. Jessica Mendoza: The company shut down Kyle's laptop and quickly fired him. And then, they investigated. What exactly was Kyle doing? The answer took them completely by surprise. Stu Sjouwerman: Yes, we have egg on our face because we hired a fake North Korean IT worker, but this is what happened. And if it can happen to us, it can happen to almost anybody. Jessica Mendoza: It's kind of unbelievable that you hired a North Korean spy as one of your IT guys. Stu Sjouwerman: Yes. That is pretty scary. And there are hundreds if not thousands that are actually, as we speak right now, in this same situation and delivering work for United States companies. https://www.wsj.com/podcasts/the-journal/your-new-hire-may-be-a-north-korean-spy/c39039df-e15c-4308-983d-6a0c54e523b4 https://www.wsj.com/podcasts/the-journal/your-new-hire-may-b...
- jimbob45 2y ago
  Did they not meet him face-to-face? It’s a small price to pay for confirmation that you’re talking to a real person. Even if not, you at least have someone’s face and information to report to the authorities.
1oooqooq 2y ago
lol. exactly the same as happened with off shoring in the late 90s. do people not learn? first they hire telemarketing grunts. then HR gets complacent and normalize not doing any work. then they start using the same techniques for IT workers since for HR they're just more expensive telemarketing.
simple10 2y ago
Articles say the guy was an AI developer. But how did he actually steal money from Fisker? He installed malware on his work computer. Was this then used by North Korea to hack Fisker's internal systems and syphon of money somehow? Maybe I missed the details in one of the articles linked below.
- perihelions 2y ago
  - "But how did he actually steal money from Fisker?" AFAICT, he merely worked for them. The only cash flows mentioned in the indictment [0] are simple wages. The title is a bit misleading. "Millions" is the total haul of the North Korean remote workers over some 60-ish (??) companies. Fisker by itself paid no more than $214,596.00 (page 27, as "Company 6"). The article focuses on Fisker because it's an automotive news site. [0] https://www.justice.gov/usao-dc/media/1352191/dl https://www.justice.gov/usao-dc/media/1352191/dl (pdf)
oleg_antonyan 2y ago
A simple IT guy has access to company's finances in such way to move millions. Am I the only one who smells either ridiculous incompetence or plain fraud by the company trying to cover up "something"?
- axus 2y ago
  That was my first reaction, but everything really is computerized these days. I felt the same way about Snowden's access.

134 points by rmason 2y ago

This appears to be the indictment: https://www.justice.gov/usao-dc/media/1352191/dl https://www.justice.gov/usao-dc/media/1352191/dl (pdf) Some related coverage: https://arstechnica.com/security/2024/05/arizona-woman-accused-of-helping-north-koreans-get-remote-it-jobs-at-300-companies/ https://arstechnica.com/security/2024/05/arizona-woman-accus... ("Arizona woman accused of helping North Koreans get remote IT jobs at 300 companies")

blackeyeblitzar 2y ago
> “The charges in this case should be a wakeup call for American companies and government agencies that employ remote IT workers,” Nicole Argentieri, head of the Justice Department's Criminal Division, said. I really hope this doesn’t become ammunition for companies who force unjust and unnecessary return to office policies.
- kspacewalk2 2y ago
  Unnecessary - perhaps. Ill-advised, since a lot of talent greatly prefers remote work - perhaps. But unjust? Aren't you taking it a bit far? You don't have the right to remote work.
  - kevingadd 2y ago
    If the outcome of the policies is an unjust outcome I don't think the term is inaccurate, even if the common use of it refers to one's legal rights.
  - ceejayoz 2y ago
    I'd consider it unjust if I was hired for a remote role and they changed that deal later.
    - lotsofpulp 2y ago
      It’s just business. Everything is subject to change all the time. Unfair, rude, etc, but unjust is a bridge too far. Unjust might be society not offering a sufficient safety net to ride out income volatility.
      - bill_joy_fanboy 2y ago
        "Unjust" is really just a matter of personal taste. Your claim that it's just has no more validity than a claim that it's unjust. Saying "it's just business" is just a canned phrase for minimizing a general dismissive attitude toward the welfare of workers.
        lotsofpulp 2y ago
        >Saying "it's just business" is just a canned phrase for minimizing a general dismissive attitude toward the welfare of workers. reply I don't think I am dismissive toward the welfare of workers. I strongly advocate for government helping workers by at least increasing/streamlining the process of receiving unemployment benefits and/or taxpayer funded efforts to re-train in the event of loss of income or even relocation assistance.
      - rangerelf 2y ago
        It's "just business" to the company, it's very personal to anyone affected by it. I find "it's just business" and "it's not personal" to be some of the most insulting and gaslighting phrases in the English language, by how they dehumanize the person at the receiving end of them.
        lotsofpulp 2y ago
        If I stop shopping at a specific vendor, I am doing the same thing. The person operating the farmer's market stand or a food truck or whatever is a human too, but it's perfectly fine to say that you will no longer patronize that business. People are affected by loss of income, and it is tragic. I don't think a buyer ceasing to buy from a seller is injustice, regardless if the relationship is employer/employee or customer/business. It is society that should be providing the stability necessary for business to just be business. If a business makes a mistake, it is not unjust for the business to correct course which could involve changing its terms with its vendors (including employees).
  - deleted 2y ago
    [deleted]
  - weard_beard 2y ago
    RTO mandates for remote hired workers aught to be considered defacto constructive dismissal and grounds for a civil suit for lost wages. The fact that companies can pull this kind of bait and switch is A.B.S.O.L.U.T.E.L.Y. a miscarriage of justice that is harming families and ruining lives.
  - bill_joy_fanboy 2y ago
    > You don't have the right to remote work. What I have a "right" to is ultimately a matter of personal judgment. Isn't it?
    - airstrike 2y ago
      I'm all for WFH but a right implies someone else has an obligation
      - 8200_unit 2y ago
        I disagree. How does someone else have an obligation to my freedom of speech?
        ricardobeat 2y ago
        There is nothing to disagree here, it’s the philosophical definition of a right. It only exists if there is an obligation on the other side, in this case, to allow you to speak freely and without interference (applies both to individuals and the state).
      - bulatb 2y ago
        Only for positive rights, and not always for those either.
        JumpCrisscross 2y ago
        No. You have an obligation not to violate my negative rights, too, e.g. we prohibit murder but don’t guarantee a right to life at any cost.
        deleted 2y ago
        [deleted]
        bulatb 2y ago
        My battery ran out before I could delete. I had another sentence there at first about "unless you call respecting rights an obligation," but I took it out because I didn't want to make a mess. To me an obligation in this context means the thing which is created by a positive right. (IME when someone uses "obligation" for negative rights, it's often for a bad-faith argument relying on the vagueness of "rights" to score a rhetorical point.) The analogous but different thing that some would say arises from a negative right, to me, is properly described another way. My right to life[0] can still exist without you being obligated not to murder me. It means that I am always justified in self-defense, so if you try to kill me, I'm allowed to kill you back. Except not always. But basically always. Except for the exceptions we can frame a million different ways. In practice, neither of our rights to life are absolute...and so on, down the rabbit hole. [0] But wait: My natural right? My legal right? In terms of enforcement? Or in some vague sense that I "have" a right and those are words I get to say, and, uh, if you don't like it then I'll say them again? In practice, no one cares. People just say "rights" to mean "I'm right." Talking about rights is fraught and frustrating and mostly pointless, and my comment wasn't worth writing, but there's nothing I can do about it now.
- deleted 2y ago
  [deleted]
- acdha 2y ago
  I don’t like it either but it is a real concern. We can’t ignore it but we can try to frame the conversation correctly: we should be able to say this isn’t happening because we have good security policies and monitoring, etc.

deleted 2y ago

[deleted]

ceejayoz 2y ago

Reminds me of https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-t... - I seem to remember it coming up here at the time.

jonhohle 2y ago

I’m sure all the money the US government put into Fisker was already gone by then. A decade later and even more reminders of what a terrible “investment” that was.

karpatic 2y ago
Fisker continues to widen my eyes. Unfortunately.
azinman2 2y ago
What was all the money? It's so far worked out for Tesla, and at least of the major auto companies in the US they're still alive when they could have gone under previously. Supporting new private industry is good policy, if done with balance. China has been employing this very successfully industry after industry.
- starik36 2y ago
  US govt. invested in Tesla? That's news to me.
  - mikeyouse 2y ago
    DOE gave them a $465 million loan to build out their Fremont factory during the height of the GFC: https://www.energy.gov/lpo/tesla#:~:text=In%20January%202010%2C%20the%20Department,for%20powering%20specially%20designed%20all%2D https://www.energy.gov/lpo/tesla#:~:text=In%20January%202010...
    - ccheney 2y ago
      adding context to the above comment: > Tesla repaid its $465 million loan from the US Department of Energy (DoE) nine years early in 2013
      - azinman2 2y ago
        Don't forget that a massive part of their income that allowed them to survive was selling carbon credits to the tune of billions of dollars, and that their cars have been massively discounted due to federal subsidies on EV cars (depending on your income level.... which btw doesn't apply to just them but makes a big difference).

bearjaws 2y ago

Imagine losing your job and then hearing that a NK spy stole millions, resulting in your job loss. Hiring in IT is a joke, there is an obsession with gamifying everything resulting in only people willing to play the game actually getting hired.

xanthor 2y ago
It doesn't say millions were stolen. The indictment says North Koreans were paid millions for their work. I wonder what the quality of work was like

Maarten88 2y ago

With all the anger over illegal immigrants taking US jobs, as a European it surprises me that nobody in the US seems to even mention the idea of punishing the employer for employing illegal workers. If I want to hire someone (local or remote) as an employer here, I better make sure the worker has a valid working permit. Fines for non-compliance towards the employer are huge, even for a single day of work. All paperwork has to be complete before any work is done. Even when hiring through intermediary companies who guarantee it's all legal, liability and fines remain in place for the ultimate employer if it turns out to be not so.

alephnerd 2y ago
> punishing the employer for employing an illegal worker It's already the law. This is why employers mandate I-9 forms as part of employment. This is part of the larger indictment against Christine Chapman by the DoJ, who found she was falsifying employment verification documents and giving access to North Koreans in return for a portion of the embezzled sums. Stories like this are also why there has been a major push for RTO.
- ceejayoz 2y ago
  > Stories like this are also why there has been a major push for RTO. Citation needed. I find this very unlikely as the root cause.
  - varispeed 2y ago
    It's about investment funds and shareholders owning commercial property who push for RTO out of fear of their portfolio going down in value if people are not using the offices.
    - JumpCrisscross 2y ago
      > investment funds and shareholders owning commercial property Are you in San Francisco? This is a conspiracy theory I hear a lot in San Francisco.

ijustwanttovote 2y ago

If there is an argument for RTO, it would be this. Stu Sjouwerman: We were hiring a fairly specific, hard-to-find software engineer who had background in AI. We have a number of AI initiatives, and so we needed a software engineer to support all those initiatives. Jessica Mendoza: The job was posted on online job forums, and pretty soon, resumes started to flow in from all over the country, and one candidate stood out. He said his name was Kyle. Stu Sjouwerman: "Mr. Kyle" quote, unquote, air quotes, had experience with exactly everything that we needed. It was a very good interview. He was very open. He talked about his strengths and weaknesses, indicated where he felt he needed additional training and indicated a career path. And so, was the perfect interviewee, which made us move to the next step. Jessica Mendoza: After conducting background checks, Stu's company decided to hire Kyle as a remote employee. They sent him a work laptop to an address in Washington State and started the onboarding process. But almost immediately, it became clear that Kyle was not who he said he was. Stu Sjouwerman: At that point in time, our team started seeing very concerning traffic on that laptop. Jessica Mendoza: What kind of concerning traffic? Stu Sjouwerman: Well, Kyle immediately started downloading malware. We immediately saw that a whole bunch of things were happening that should not be. We tried to get in touch with him and asked if he needed any help. I think this was through Slack, and he said, "Yes, I am trying to debug my router and I'm following instructions from a list." And this is where it became very, very iffy, very fast. Jessica Mendoza: The company shut down Kyle's laptop and quickly fired him. And then, they investigated. What exactly was Kyle doing? The answer took them completely by surprise. Stu Sjouwerman: Yes, we have egg on our face because we hired a fake North Korean IT worker, but this is what happened. And if it can happen to us, it can happen to almost anybody. Jessica Mendoza: It's kind of unbelievable that you hired a North Korean spy as one of your IT guys. Stu Sjouwerman: Yes. That is pretty scary. And there are hundreds if not thousands that are actually, as we speak right now, in this same situation and delivering work for United States companies. https://www.wsj.com/podcasts/the-journal/your-new-hire-may-be-a-north-korean-spy/c39039df-e15c-4308-983d-6a0c54e523b4 https://www.wsj.com/podcasts/the-journal/your-new-hire-may-b...

jimbob45 2y ago
Did they not meet him face-to-face? It’s a small price to pay for confirmation that you’re talking to a real person. Even if not, you at least have someone’s face and information to report to the authorities.

1oooqooq 2y ago

lol. exactly the same as happened with off shoring in the late 90s. do people not learn? first they hire telemarketing grunts. then HR gets complacent and normalize not doing any work. then they start using the same techniques for IT workers since for HR they're just more expensive telemarketing.

simple10 2y ago

Articles say the guy was an AI developer. But how did he actually steal money from Fisker? He installed malware on his work computer. Was this then used by North Korea to hack Fisker's internal systems and syphon of money somehow? Maybe I missed the details in one of the articles linked below.

perihelions 2y ago
- "But how did he actually steal money from Fisker?" AFAICT, he merely worked for them. The only cash flows mentioned in the indictment [0] are simple wages. The title is a bit misleading. "Millions" is the total haul of the North Korean remote workers over some 60-ish (??) companies. Fisker by itself paid no more than $214,596.00 (page 27, as "Company 6"). The article focuses on Fisker because it's an automotive news site. [0] https://www.justice.gov/usao-dc/media/1352191/dl https://www.justice.gov/usao-dc/media/1352191/dl (pdf)

oleg_antonyan 2y ago

A simple IT guy has access to company's finances in such way to move millions. Am I the only one who smells either ridiculous incompetence or plain fraud by the company trying to cover up "something"?

axus 2y ago
That was my first reaction, but everything really is computerized these days. I felt the same way about Snowden's access.