inside a federal agency

what happened

Speaking at a Digital Government Institute panel on 28 July 2026, FBI Deputy Assistant Director Todd Hemmen said the Bureau had identified, that same week, a North Korean remote IT worker who was working for the federal government as a contractor.

The agency was not named. Neither the duration of the employment nor the extent of any data exposure was disclosed, and the investigation was described as ongoing.

Chapman's operation had already tried to place workers at two U.S. government agencies, mostly without success. This is the case that shows the ceiling was reached.

how it was caught

By the FBI, through investigation, not by the contracting process that hired the worker.

Federal contractors are subject to more identity scrutiny than almost any private employer applies. The scrutiny is documentary. It confirms that papers are valid. It does not confirm that the person on the video call is the person in the papers.

what it cost

Not disclosed. The relevant number is the one nobody can produce: how long the worker was there, and what they could reach.

For every private company weighing whether this is a real risk, the useful comparison is that an organization with federal-grade identity requirements still hired one.

the tells

signals that were visible, in hindsight, before anyone was hired.

• Contractor placements sourced through staffing intermediaries with thin verification of their own.
• Remote-only roles with privileged system access and no in-person step at any point.
• Sign-in patterns and working hours inconsistent with the stated residence.

what would have stopped it

the checks aperture runs on every session, mapped to this case. nothing here is hindsight-only. each one runs before a hiring team spends an hour on the candidate.

sources

1. [1]
   FBI investigating North Korean remote IT staffer working for a U.S. agency

   Federal News Network · press · August 10, 2026

   FBI Deputy Assistant Director Todd Hemmen disclosed the finding at a Digital Government Institute panel on July 28, 2026.

2. [2]
   Arizona woman sentenced for $17M information technology worker fraud scheme that generated revenue for North Korea

   U.S. Department of Justice · dept. of justice · July 24, 2025

   The primary record for the Christina Chapman laptop farm: 309 U.S. businesses, 68 stolen identities, more than $17 million, 102 months in prison. Fortune reports 311 companies; DOJ's own figure of 309 U.S. plus 2 international is used throughout this site.

3. [3]
   Alert to countries, companies and other entities regarding North Korean IT workers

   U.S. Department of State and ten allied governments · government · July 31, 2026

   Eleven governments warn that workers increasingly use third-party proxies to sit interviews and even in-person meetings, and urge in-person verification.