01 / EXECUTIVE SUMMARY
DOJ announced sentences for two facilitators of a scheme in which North Korean IT workers posed as U.S. residents, used at least 80 stolen identities and obtained work at more than 100 U.S. companies.
02 / WHAT HAPPENED
DOJ announced sentences for two facilitators of a scheme in which North Korean IT workers posed as U.S. residents, used at least 80 stolen identities and obtained work at more than 100 U.S. companies.
The chain distinguishes what appeared valid, what was physically true, which authority followed and what consequence the source documents.
Applicants used stolen identities, employment profiles and U.S.-located company laptops to claim they were legitimate domestic workers.
The operators were overseas North Korean IT workers connected through laptop farms run by U.S.-based facilitators.
Companies hired the workers, placed them on payroll and granted access to corporate systems and sensitive data.
DOJ reported more than $5 million in illicit revenue, access to sensitive data and sentences of 108 and 92 months for the facilitators.
Persistent verification binding the interviewed person, physical operator, assigned device and live work session.
ECR separates a documented monetary floor from a modeled social and economic consequence envelope. It is not an accounting loss figure.
The range combines documented facts with calibrated consequence and response-cost assumptions; it is not an accounting loss figure.
Identity counts, company counts, revenue and sentences are DOJ facts. The Presence formulation is 4SI analysis.
Remote identity controls can validate a digital worker while the accountable human and operating location remain absent.
4SI does not claim to have independently verified the underlying event. Scores, boundary analysis and economic ranges interpret published evidence; they are not probabilities, compliance findings, valuations or loss forecasts.
Related cases are editorially connected by domain, authority pattern or missing physical trust boundary.