My friend Ben: solid employee, DPRK agent

The talk is a radio-style story in three acts. It begins with how contractor layering, overlapping jobs and slow performance management during and after the pandemic made remote roles easier to fill with people who were not who they claimed to be.

The middle follows a composite case built around a remote engineer whose name came from a stolen identity. Warning signs included long video sessions, a camera kept off, a work history that did not match records, and a laptop shipped to an address tied to a laptop farm. The team used VPN and remote-access tool detections, KVM-over-IP devices, impossible travel and local network peers to build a picture, then located the device with property records and Wi-Fi-based geolocation, noting privacy limits. Response, the speaker says, is a business and risk decision involving HR, legal and privacy teams.

The closing argument is that the fix is mostly process rather than technology. Suggested steps include strong in-person identity checks, scrutiny of contractor hiring and address changes for shipped laptops, hardware security keys for high-risk offshore contractors, and early watch for remote-access tools in a new hire's first weeks. Document verification services alone are not enough, since forged identities can be bought cheaply.