Latest / The Morning Edition / Nick McKenzie on how North Korean spies are infiltrating Australian companies

Transcript

Nick McKenzie on how North Korean spies are infiltrating Australian companies · The Morning Edition

0:03
S1: Investigative reporter Nick McKenzie logged on to the Zoom meeting
0:07
S1: to meet the man who said he was Aaron Pearson. McKenzie, too,
0:12
S1: was hiding his real identity, pretending to be a recruiter
0:15
S1: for an Australian tech company. The whole thing was a setup,
0:19
S1: a trap for someone McKenzie suspected to be a spy
0:22
S1: for North Korea. I'm Samantha Cylinder Morris, and you're listening
0:27
S1: to Morning Edition from the Age and The Sydney Morning
0:30
S1: Herald today. Nick McKenzie on the new way that spies
0:34
S1: are targeting Australian businesses. And what happened in that Zoom call.
0:44
S1: So ASIO has told you that North Korean spies have
0:47
S1: infiltrated companies in Australia, using what you've described as an
0:50
S1: ingenious method. Tell us about this.
0:54
S2: Well, just how ingenious it is is perhaps open to debate,
0:58
S2: but it's certainly malicious and it's certainly at vast scale.
1:02
S2: So what's happening? The North Koreans need money. Kim Jong
1:05
S2: un has a, as we know, uh, illicit weapons program,
1:08
S2: nuclear ballistic and other. It needs to fund that. North
1:13
S2: Korea is also on a mission to steal sensitive commercial
1:16
S2: IP defense IP from Western nations across the world. And
1:20
S2: ultimately it wants leverage points, not just weapons, but if
1:23
S2: it can go and sabotage companies involved in vital infrastructure.
1:27
S2: These are all things the North Koreans want. Now, what
1:29
S2: North Korea has done is deploy an army of agents
1:32
S2: who are pretending to be non-north Koreans. So American, Western European,
1:39
S2: South Asian, Southeast Asian, remote IT workers offering themselves out
1:44
S2: as job applicants at major companies and small companies and saying,
1:48
S2: we can work for your Australian company. Well, one little thing,
1:50
S2: we'll have to work offshore. Just think of it as
1:52
S2: a stay at home workout. We'll work in your IT
1:54
S2: department or as an IT contractor, or through an IT
1:57
S2: contractor third party, and you'll be none the wiser that
2:00
S2: we are, in fact a North Korean agent. The money
2:02
S2: you pay us goes straight back to the regime of
2:04
S2: Kim Jong un. And once we're in your systems, once
2:08
S2: we're in your networks, we can steal your secrets. And
2:13
S2: worst case scenario, engage in acts of sabotage if and
2:16
S2: when the need arises. Now, no less than the Director-General
2:20
S2: of security, the head of ASIO, Mike Burgess, has sounded
2:23
S2: the alarm that Australian companies have been infiltrated. His investigators
2:26
S2: have found this going on in Australia. It's a real,
2:30
S2: clear and present danger.
2:33
S1: Okay, well, this is what I wanted to ask you,
2:35
S1: because you said that it's actually rare to get an
2:37
S1: invite into the ASIO building. This, of course, is our
2:40
S1: leading spy agency. But not only did ASIO boss Mike
2:43
S1: Burgess invite you in, but he invited the whole 60
2:46
S1: minutes video crew into the building to film your interview.
2:50
S1: So is this an indication of how damaging you know,
2:52
S1: these North Korean spies are potentially to Australians? And what
2:55
S1: exactly is at stake here? Like, what threat do they
2:58
S1: pose to anyone who's listening?
3:00
S2: Well, I think the reason that they're normally very secretive
3:04
S2: ASIO and it is extremely rare to get access to
3:07
S2: ASIO and its Director-General. Open the doors on this occasion
3:10
S2: is because the spy agency by itself, with its partners,
3:14
S2: the AFP and others, can only do so much for
3:16
S2: Australia to actually properly combat these malicious actors. We've got
3:20
S2: to get on the front foot. And that's not the
3:22
S2: job of the spies, the spooks and the cops. It's
3:25
S2: the job of the companies and the communities. How dangerous
3:28
S2: is it? Well, the world is a more hostile and
3:31
S2: more complex place arguably than ever before. We know North
3:34
S2: Korea wishes to do the West harm. We know North
3:37
S2: Korea is building stockpiles of terribly destructive weapons. We know
3:41
S2: North Korea already has very active cyber operations across the world,
3:46
S2: seeking to infiltrate Western companies, Western governments to steal secrets
3:51
S2: most significantly, once. And this is the danger of the
3:55
S2: cyber digital economy world in which we now all live.
3:58
S2: Once a hostile actor, a North Korean agent is in
4:01
S2: your systems. They can do untold damage. We've seen what
4:05
S2: happens when large organizations are hacked. We've seen systems go down.
4:09
S2: We've seen hospitals and places providing acute services, much needed
4:14
S2: services held to ransom. These are all massive sabotage like dangers.
4:19
S2: And that's bad enough. It's not just that you're funding
4:21
S2: the North Korean regime when you employ these North Korean
4:24
S2: agents unwittingly. But the risk is you're also giving up
4:28
S2: your commercial secrets. It could be secrets that are sensitive
4:31
S2: to national security, but also you could be compromising. If
4:34
S2: you say a company working in critical infrastructure, you could
4:38
S2: be compromising national security that way because of the risk
4:41
S2: that these same remote IT secret agents can work as
4:46
S2: saboteurs down the track.
4:48
S1: Okay. And ASIO actually has examples of Australian companies that
4:52
S1: have been infiltrated by these North Korean spies. So tell
4:55
S1: us about that.
4:57
S2: Well, the director general of ASIO didn't say a great
5:00
S2: deal about that Other than his investigators have found these
5:04
S2: threat actors. They found them operating in Australia because we're
5:07
S2: talking about essentially criminal acts. It's one for the AFP.
5:11
S2: So these matters have been referred to the federal police.
5:14
S2: We have detects a cyber company that's leading the charge
5:17
S2: here in this nation, protecting the private sector. Also referring
5:20
S2: matters to the AFP. We know there are live AFP
5:23
S2: assessments and or investigations into these threat actors here operating
5:27
S2: in Australia, either from a remote location or in some cases,
5:31
S2: onshore in Australia. The most prominent case that we uncovered
5:37
S2: involved the National Australia Bank, the NAB, one of the
5:41
S2: big four banks. It found one of these North Korean
5:43
S2: agents had infiltrated its workforce, posing as a remote IT worker,
5:47
S2: albeit through a third party contractor identified the threat it
5:50
S2: got rid of the actor. But the point to be
5:52
S2: made is if a very sophisticated beast like the NAB,
5:57
S2: with all its cyber and security controls, can be so
6:00
S2: easily infiltrated. Think how the rest of our tech, commercial,
6:04
S2: financial services, defense sectors are exposed, and even more so
6:08
S2: when there are players without those controls that the NAB
6:11
S2: and other big players naturally have.
6:16
S1: Okay, well, let's get into how these North Korean spies
6:19
S1: have actually infiltrated companies in Australia and elsewhere. Perhaps you
6:23
S1: can just tell us about how you actually caught one
6:25
S1: of these operatives in the act. What happened?
6:28
S2: Well, we know there are thousands of North Korean agents
6:31
S2: posing as these remote IT workers. They're using networks of
6:35
S2: intermediaries who play certain roles in this scheme. There are
6:39
S2: managers of the scheme. Think of them as, I guess,
6:41
S2: as more senior agents or more senior spies calling the shots.
6:45
S2: There's a system that's been put into place and developed,
6:48
S2: and it's developing in time. So, for instance, one of
6:50
S2: the more recent developments is the North Koreans are using AI.
6:53
S2: The AI programs create resumes. They scoured the internet looking
6:57
S2: for remote IT job opportunities. The AI programs initially sometimes
7:03
S2: interact with recruiters as if they're a real person once
7:06
S2: they get through the door. Then the North Korean agent,
7:09
S2: who's a well trained operative who speaks pretty good English
7:13
S2: and is trained to say, I'm actually stationed right now.
7:16
S2: In the case of the operative that I encountered in
7:19
S2: San Jose, California. Then the operative steps in and conducts
7:22
S2: the job interview and hopefully lands the job. So knowing
7:25
S2: all that, we actually set up a trap. We knew
7:28
S2: the sorts of jobs the North Koreans were after. We
7:32
S2: advertised one of those jobs using a friendly recruiter, in fact,
7:36
S2: working for us. And we were partnered. We did this
7:39
S2: with Dtex, the cyber company that's leading the charge, fighting
7:42
S2: these malicious actors. Put the job out there. Sure enough,
7:46
S2: AI interacts with what looks like AI interacts with us
7:49
S2: saying yes, love to go for this role. I'm a
7:52
S2: Californian based IT professional. This is my resume and keen.
7:56
S2: Let's do the interview. There were some things about that
7:59
S2: identity used. We knew that was an identity that had
8:02
S2: been used previously in North Korean operations, so we had
8:05
S2: a very good sense. This was likely to be a
8:07
S2: North Korean operation, but we didn't know until that interviewee
8:12
S2: appears the job applicant appears. So I take the place
8:15
S2: as the recruiter I'm being secretly filmed. I say, hello, welcome.
8:18
S2: I'm a recruiter and who are you and who pops
8:20
S2: up on the screen? Well, the person had gone for
8:23
S2: the job. His name is Aaron Pearson or his alias
8:26
S2: is Aaron Pearson. And the photo I had of Aaron
8:28
S2: Pearson was of a Black American. That was the person
8:31
S2: we thought would be popping up on screen, because that
8:33
S2: person had been involved in other job applications that were
8:36
S2: of suspicion. In fact, what pops up or the person
8:39
S2: that pops up is someone who looks Asian. Hello? Is
8:42
S2: that Aaron?
8:43
S3: Yeah. Hey. Sorry for being late. Yeah, that's okay to me. So, yeah.
8:49
S2: They don't look like an Aaron Pearson. They certainly don't
8:51
S2: look like Aaron Pearson, the black American on the resume.
8:54
S2: I had already knew likely it was to be an operative,
8:57
S2: so I had to test that theory. He went through
9:00
S2: his technical expertise, but I then asked him, okay, are
9:02
S2: you saying you were living in San Jose, California? Have
9:06
S2: you been to Santa Cruz? That local surf break of yours?
9:10
S2: He doesn't like sharks, he tells me. What about Big Sur,
9:12
S2: that very famous landmark that. Think of the big Californian redwoods.
9:16
S2: He wasn't overly okay with those, either. New York. He'd
9:20
S2: lived there for three years. He could not name the
9:24
S2: area in New York. Think about those famous New York areas. Manhattan, Brooklyn,
9:29
S2: the Bronx. He could not name where he lived. All
9:32
S2: he could say was on the west. Where are you living?
9:35
S2: What's that? What suburb?
9:37
S3: Uh. I'm sorry.
9:39
S2: Where in New York did you live?
9:42
S3: I'm in west coast of the New York. I mean,
9:44
S3: west part of the New York area.
9:47
S2: The more I drilled, the more stilted he became. Finally
9:51
S2: I said to him, well, you don't look like the
9:53
S2: Aaron Pearson, who I believe is the real Aaron Pearson.
9:57
S2: And he began to panic and push back. We know
9:59
S2: that when North Korean Asians are challenged about the regime
10:02
S2: for who they operate. If you say to them, tell
10:04
S2: me about the North Korean regime, they cannot ever speak
10:07
S2: ill of their dear leader, Kim Jong un or the
10:10
S2: regime itself. So I put it to him pretty frankly.
10:13
S2: I said, we're worried about North Korean operatives. What do
10:16
S2: you think about the North Korean regime? And that's when
10:18
S2: he very quickly wrapped up the interview we have in
10:21
S2: Australia sanctions. It means we cannot deal with anyone from
10:24
S2: North Korea. Are you comfortable with that?
10:25
S3: Hey, I'm being asked at this interview.
10:29
S2: Um, can I can I tell you, Aaron, because I
10:31
S2: have a photo of Aaron Pearson. It's a different you look,
10:34
S2: the photo I have is of a of a, of
10:36
S2: a black American.
10:37
S3: I'm not interested in any more. By.
10:39
S2: By then we had enough data points to know that
10:42
S2: he was a North Korean agent. We'd caught him out
10:44
S2: in the act and we. For the first time, I
10:46
S2: think really ever of any Western media company caught out
10:50
S2: a North Korean operative actually doing what's of such great
10:53
S2: concern to our intelligence agencies across the world.
10:58
S1: After the break.
11:00
S2: The system or the operation put in place by North
11:03
S2: Korea relies on companies taking shortcuts. And the terrifying thing is,
11:07
S2: too many big Aussie corporates are taking those shortcuts. Why?
11:10
S2: To save money.
11:16
S4: And you've said that this is.
11:17
S1: A relatively new problem for Australia. But we know that
11:20
S1: it's not new in the US. Right. There was a
11:22
S1: significant case there involving a woman who became one of
11:25
S1: these so-called laptop farmers, these intermediaries. So tell us about that.
11:31
S2: We know this North Korean operation has been operating at
11:35
S2: scale for a decade. The US has been a great
11:38
S2: hunting ground for the North Koreans. It's a massive economy.
11:41
S2: Covid meant there was a huge reliance on stay at
11:44
S2: home or remote workers, especially IT workers, contract workers. This
11:49
S2: was a great time for North Korea to be operating
11:52
S2: and people all over the world. You find people desperate
11:56
S2: for money and happy to take money to look the
11:58
S2: other way. And the North Koreans found a woman called
12:01
S2: Christina Chapman. She was in Arizona on a run of
12:06
S2: the mill, pretty poor, working class person who was desperate
12:11
S2: for a job in the North Korean sense that they
12:14
S2: gave her a job as what's known as a laptop farmer.
12:16
S2: And her job was this whenever a North Korean agent
12:19
S2: working undercover wins a job, gets a job at be
12:22
S2: it a company like Nike or Boeing or any of
12:24
S2: the other American companies that were ultimately compromised, these remote workers,
12:28
S2: these undercover operatives, need a laptop to do their job.
12:31
S2: And so the US company needs to send them a laptop.
12:34
S2: She agreed to use her home address in Arizona to
12:38
S2: receive those laptops. When the FBI finally raided, her, 90
12:42
S2: laptops had been sent to her. It's estimated she helped
12:45
S2: these North Korean agents infiltrate 300 US companies, including some
12:50
S2: big names like Nike. And I think the remarkable thing
12:54
S2: about her operation was not just how many companies were
12:57
S2: infiltrated and how many agents were involved, but really the
13:01
S2: unremarkable nature of her. She was a not too bright,
13:05
S2: not too well spoken, very ordinary American doing some pretty
13:10
S2: extraordinary things. Right now she's sitting in a jail cell,
13:13
S2: serving eight and a half years in prison.
13:15
S1: And in your investigation, she claims that she was unaware
13:19
S1: that she was a so-called laptop farmer, that she was
13:21
S1: an intermediary between these North Korean spies and these American companies.
13:26
S1: Do you think there's any credibility to that? I mean,
13:28
S1: certainly you also interviewed Jeanine Pirro, who is currently the
13:32
S1: United States attorney for the District of Columbia, a very
13:35
S1: high profile in her in her own right. She's prosecuted
13:38
S1: this woman who, again, facilitated these North Korean fraudsters. So
13:43
S1: is there any credibility, any possibility that she just didn't
13:46
S1: know what she'd been contracted to do?
13:48
S2: Well, the prosecutor, Jeanine Pirro, thought not. And I mean,
13:52
S2: I think if any of our listeners, uh, consider that
13:56
S2: their home would receive 90 laptops and they'd be asked
13:59
S2: to plug in dozens and dozens of Asian IT workers
14:03
S2: to US companies in such a bizarre fashion, you'd think
14:06
S2: you'd have your hackles up. You think you'd be a
14:08
S2: little bit suspicious? The idea that Chapman was an unwitting agent,
14:14
S2: a dupe is pretty ridiculous, and I think we can
14:17
S2: see that in her ultimate sentence of eight and a
14:20
S2: half years for breaching, for harming US national security. But
14:24
S2: I think what her case really tells Australia is we
14:27
S2: know there's people out there that want to make a
14:29
S2: buck and who'll do the wrong thing to do so. Uh,
14:31
S2: they can do so in a way where they can
14:33
S2: pretend to some extent that they're simply operating. Helping fill
14:37
S2: an IT gap for some bizarre company overseas and not
14:39
S2: really ask themselves, what am I truly up to? There
14:42
S2: are those sorts of people we suspect in Australia today.
14:46
S2: We do believe there's at least one laptop farm operating
14:48
S2: in Australia, similar to that of Kristina Chapman today. So
14:53
S2: it really shows that ordinary people can get swept up
14:56
S2: in what are very hostile operations by very dangerous Regimes,
15:01
S2: in this case North Korea. They're likely to be here
15:04
S2: already in Australia, and they're likely to be operating with
15:06
S2: some success.
15:07
S1: And Nick, just to wrap up, what can companies and
15:09
S1: businesses do to protect themselves?
15:12
S2: There's some very basic things check out in person who
15:16
S2: you're hiring. Do proper due diligence. Yes, AI and we
15:21
S2: know that China is now backing North Korea in this operation.
15:24
S2: So we've got some pretty high level Chinese AI operating here.
15:27
S2: China's government, uh, led Chinese technology created AI. It can
15:34
S2: be remarkable. It can come up with very good resumes.
15:36
S2: It can alter people's identities and video interviews. You can
15:39
S2: feed answers into people's earpieces. Uh, but still, companies have
15:45
S2: the ability to do thorough due diligence to combat that
15:48
S2: AI and in-person or real person challenge by checking, well,
15:54
S2: you say you did your university here. Tell me about
15:57
S2: what was happening in the year 2002. When you say
15:59
S2: you were stationed at Sydney University, Were you aware of
16:02
S2: that flood event that happened in at Melbourne? When you
16:06
S2: say you're at Melbourne University, there's ways you can test
16:09
S2: these human. Now, the AI might be countering that, but
16:12
S2: there are ways and means. See your employee face to face.
16:15
S2: If they have an important role, ask them to come
16:17
S2: into your satellite office. Present some ID in person knowing
16:22
S2: that ID can be doctored and faked as well. Have
16:25
S2: controls in place to make sure these North Koreans never
16:28
S2: get in the door. The system or the operation put
16:32
S2: in place by North Korea relies on companies taking shortcuts.
16:35
S2: And the terrifying thing is, too many big Aussie corporates
16:38
S2: are taking those shortcuts. Why? To save money that has
16:42
S2: to end. The issue really is these North Korean agents
16:45
S2: are good at their jobs. They are trained in coding,
16:48
S2: they are trained in other IT disciplines. They will be
16:53
S2: able to perform the role. So looking at their work
16:56
S2: won't necessarily raise any concerns. It will be other things.
17:01
S2: It will be there. Unusual flags about their working hours.
17:06
S2: The way they're logging in, uh. The systems they're using
17:10
S2: to log in. Keeping in mind that they're going to
17:13
S2: be trying to counter the counter-attack from the companies. Now,
17:17
S2: this is an evolving fight. Just as companies begin to
17:19
S2: have technology to really detect whether fake IP addresses are
17:23
S2: being used to obscure a remote workers real location. Just
17:27
S2: as that technology is developed and employed, new technology will
17:31
S2: be put in place to defeat it. So we need
17:33
S2: to have a continuous and continuously improving system of countering
17:37
S2: what is a very IT proficient army of North Korean agents,
17:43
S2: ultimately working for one of the most pernicious and dangerous
17:46
S2: regimes in modern human history.
17:49
S4: Well, thank you.
17:49
S1: So much for your time.
17:51
S2: Great to be with you.
18:02
S1: In other news today, politicians will be guarded at public
18:06
S1: events while their homes and offices will undergo security upgrades
18:10
S1: due to the most dangerous security environment in generations, according
18:14
S1: to experts. Sydney and Melbourne house values have fallen for
18:18
S1: a second consecutive month, but values soared in Perth, Brisbane
18:22
S1: and Adelaide and more people are renting electric vehicles ahead
18:27
S1: of Easter amidst surging petrol and diesel prices. To find
18:31
S1: out more, visit the Ajcosta or smh.com.au. Today's episode was
18:38
S1: produced by Kai Wong. Our executive producer is Tammy Mills,
18:42
S1: and our podcasts are overseen by Lisa Muxworthy and Tom McKendrick.
18:47
S1: If you like our show, follow The Morning Edition and
18:49
S1: leave a review for us on Apple or Spotify. Thanks
18:53
S1: for listening.