Government contractors have traditionally approached personnel security through background investigations, access controls, employment screening, and security-clearance procedures.
A new FBI advisory demonstrates why those measures must increasingly address a more fundamental question: is the individual performing the work actually the person the contractor hired?
On October 13, 2026, the FBI issued an updated warning concerning North Korean remote information-technology workers who infiltrate U.S. companies using stolen identities, fraudulent employment arrangements, and domestic facilitators.
That same day, the Department of Justice announced coordinated enforcement actions involving more than 70 affected American companies, including an indictment, arrests, and the seizure of approximately 187 computers associated with suspected North Korean IT-worker operations.
According to DOJ, one investigated network generated approximately $3 million in revenue through fraudulent remote employment arrangements.
The scheme is more sophisticated than submitting a false résumé.
North Korean operatives allegedly use stolen or borrowed identities to obtain remote IT positions. Domestic facilitators receive employer-issued laptops at U.S. addresses and maintain them on internet connections while individuals elsewhere remotely operate the devices.
These arrangements—often described as laptop farms—can make a foreign-based worker appear to be performing services from within the United States.
The FBI reports that facilitators may also participate in interviews, provide identification credentials, maintain professional networking accounts, and complete activities designed to satisfy employment-verification procedures.
Some arrangements now involve additional foreign subcontractors performing the underlying technical work.
For federal contractors, the implications extend beyond ordinary employment fraud.
A person who obtains unauthorized access through a false employment identity may gain access to proprietary technology, Government information, source code, customer systems, or sensitive personnel data. Depending on the circumstances, the incident could implicate contractual cybersecurity obligations, incident reporting, export controls, sanctions, or facility-security procedures.
For cleared contractors, the stakes may be particularly significant because the consequences of inappropriate access can extend to national security.
Importantly, the public enforcement announcements do not establish that the affected companies were all cleared contractors or that these workers successfully obtained security clearances. The threat is broader, but the potential implications for the defense industrial base are clear.
The FBI recommends an approach it calls identity in depth.
Instead of relying upon a single interview, identification document, employment-verification tool, or device location, companies should combine identity assurance with continuing technical and behavioral monitoring.
That could include enhanced verification of remote applicants, controls over employer-issued equipment, monitoring for unauthorized remote-access tools, review of unusual account and device activity, confirmation that approved personnel are performing assigned work, and coordination among human resources, cybersecurity, security, legal, and management functions.
Subcontractor and contingent-workforce arrangements deserve similar attention.
A prime contractor may carefully vet its employees while relying on subcontractors or staffing providers whose remote-hiring and access practices are less transparent. The same risk may therefore enter through a supplier relationship rather than direct employment.
Contractors must also avoid indiscriminate screening or decisions based on nationality or ethnicity. The FBI specifically warns that individual indicators can overlap with legitimate remote work and recommends layered, evidence-based review to reduce false positives.
The lesson is not that remote work is inherently insecure.
It is that identity verification cannot end when the employment paperwork is completed.
As hostile actors develop more sophisticated methods for impersonating legitimate employees, contractor security must connect the identity of the person hired with the identity of the person actually accessing systems and performing the work.
Recommended FedContractPros Product: Ethics & Compliance Builder
The Ethics & Compliance Builder can help contractors establish risk-based onboarding procedures, insider-threat controls, reporting responsibilities, investigation protocols, subcontractor oversight, training, and corrective-action processes across compliance, cybersecurity, and personnel-security functions.
Disclaimer:
This article is provided for general informational and educational purposes only and does not constitute legal, employment, cybersecurity, sanctions, personnel-security, or government-contracting advice. Allegations in criminal indictments are not findings of guilt. Contractors should evaluate applicable labor and nondiscrimination laws, contractual security requirements, personnel-clearance procedures, incident-reporting provisions, and specific threat information before implementing additional controls.