They ran just about everything in-house (including payroll) and because they didn't use a PEO, the government didn't want to deal with them, and they had to get someone in Congress to intervene on their behalf before getting the approval.
[Flashback May 19 23:19: someone did once check out my organs that way! A brain scan I only found out about because I was asked to participate in a class action suit against Aetna for not paying! Thanks for not paying, Aetna! You know I didn't sign on to that suit against you, that's why I didn't! Otherwise it would have been like picking up money off the street, which I have done, and it was easy, but I didn't see it that way because of the immorality of suing you! They were committing malpractice to harm me, spying on me with a brain scan! I sincerely thank you for not covering that claim, only thing that limited my time in the torture ward. I would be in there to this day if you paid and kept paying those fraudulent claims.]
Are there certain things you aren't able to teach when you travel, or is that fairly unrestricted? I had no idea people were doing work like this.
Not to search too far, although that is a more exotic example, recently crypto guy got smacked for providing crypto speech ( classified as technical advice ) to DPRK(1).
(1)https://www.justice.gov/opa/pr/us-citizen-who-conspired-assi...
On another note, would this case be directly related to the 400 million hack north korea did?
• Multiple logins into one account from various IP addresses in a relatively short period of time, especially if the IP addresses are associated with different countries;
• Developers are logging into multiple accounts on the same platform from one IP address;
• Developers are logged into their accounts continuously for one or more days at a time;
• Router port or other technical configurations associated with use of remote desktop sharing software, such as port 3389 in the router used to access the account, particularly if usage of remote desktop sharing software is not standard company practice;
• Developer accounts use a fraudulent client account to increase developer account ratings, but both the client and developer accounts use the same PayPal account to transfer/withdraw money (paying themselves with their own money);
• Frequent use of document templates for things such as bidding documents and project communication methods, especially the same templates being used across different developer accounts;
• Multiple developer accounts receiving high ratings from one client account in a short period, with similar or identical documentation used to establish the developer accounts and/or the client account;
• Extensive bidding on projects, and a low number of accepted project bids compared to the number of projects bids on by a developer; and
• Frequent transfers of money through payment platforms, especially to PRC-based bank accounts, and sometimes routed through one or more companies to disguise the ultimate destination of the funds.
This list is so generic that I'm not sure what the point of it is. I think it would make sense to ban some of these practices from a general security perspective. But these practices would give way too many false positives if you were trying to use them to identify DPRK developers.
I'm honestly really confused about who the target audience is for publications like this. It can't be actual IT professionals due to the lack of actionable information. Is it journalists? Do we publish these things just to remind them that we don't like the DPRK?