Verify a decision

{"actor":"system:backfill","investigation_id":"54db7c0a-a7cc-4771-9b97-e13d0bb9e073","kind":"publish","page_slug":"michael-james-bostelle","published_at":"2026-10-14T12:09:29.402Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Michael James Bostelle","sections":[{"content":"On October 13, 2026, the Department of Justice announced the arrests of two U.S. citizens, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, in connection with an alleged scheme to place North Korean IT workers in remote jobs at U.S. companies. Both men were charged with wire fraud, money laundering, and identity theft. An indictment was unsealed the same day in the Northern District of Ohio; a U.S. Attorney for the Northern District of Texas also commented on the case, reflecting the multi-state scope of the alleged conduct and related FBI search activity in Texas. These are allegations contained in a criminal indictment; Bostelle has not been reported to have entered a plea or been convicted as of this writing.","heading":"Arrest and Charges","severity":"critical","sources":[{"credibility":1,"name":"DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas (Spokesman-Review)","type":"news_article","url":"https://www.spokesman.com/stories/2026/oct/13/doj-arrests-two-seizes-187-devices-in-north-korean/"},{"credibility":2,"name":"DOJ charges 14 over a sprawling North Korean remote work scheme (CyberScoop)","type":"news_article","url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"},{"credibility":1,"name":"Justice Department press release on coordinated actions against North Korean remote IT worker scheme","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"}]},{"content":"According to CyberScoop's report on the unsealed indictment, Bostelle allegedly \"aided the scheme by providing his name and a fraudulent driver's license,\" which prosecutors say helped North Korean IT workers pass identity checks required by U.S. employers to work remotely. This is consistent with a pattern described in other, separate DOJ actions against North Korean remote-IT-worker schemes, in which U.S.-based facilitators supply or help fabricate identity documents and, in some cases, host company-issued laptops ('laptop farms') so that North Korean workers appear to be working from a U.S. location. The specific allegation against Bostelle has not yet been tested at trial.","heading":"Alleged Method: Providing Identity Documents to Facilitate Placement","severity":"critical","sources":[{"credibility":2,"name":"DOJ charges 14 over a sprawling North Korean remote work scheme (CyberScoop)","type":"news_article","url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"}]},{"content":"Per CyberScoop's reporting, the indictment alleges that North Korean workers, aided by Bostelle, Pena Carrillo, and others, held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities, and filed false employment records in the names of more than 25 identity-theft victims. The Spokesman-Review similarly reported the scheme impacted more than 70 U.S. companies and generated at least $3 million in revenue for the overseas IT workers; CyberScoop described the goal as funneling roughly $3 million from 70 U.S. employers 'back to Pyongyang.' Ten additional defendants, described in reporting as based in China, were charged alongside Bostelle and Pena Carrillo; reported names include Sun Sheng Ming, Pei Li Guang, Weng Shou Cheng, Han Guo Bin, Wang Jian Jun, Sheng Zhang Kun, Zhang Wei Ping, Zhang Li Ping, Yu Yang, and Jin Long. A third individual, reported by CyberScoop as Trey Michael Nolte, was named in the indictment as having allegedly moved more than $320,000 through accounts opened under false names, though it is unclear from available reporting whether he faces separate charges.","heading":"Scale of the Alleged Scheme","severity":"high","sources":[{"credibility":2,"name":"DOJ charges 14 over a sprawling North Korean remote work scheme (CyberScoop)","type":"news_article","url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"},{"credibility":1,"name":"DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas (Spokesman-Review)","type":"news_article","url":"https://www.spokesman.com/stories/2026/oct/13/doj-arrests-two-seizes-187-devices-in-north-korean/"}]},{"content":"The Spokesman-Review reported that the FBI conducted searches between September 21 and September 25, 2026, at more than 40 residences in Texas as part of the investigation, seizing 187 devices. It is not stated in available reporting whether any of the searched residences were directly connected to Bostelle, who is reported to reside in Pennsylvania, or whether the device seizures related primarily to Pena Carrillo's alleged Texas-based role or to other, uncharged facilitators.","heading":"FBI Search Operation in Texas","severity":"medium","sources":[{"credibility":1,"name":"DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas (Spokesman-Review)","type":"news_article","url":"https://www.spokesman.com/stories/2026/oct/13/doj-arrests-two-seizes-187-devices-in-north-korean/"}]},{"content":"Some case summaries describe DPRK remote-IT-worker schemes generally as using cryptocurrency to move proceeds to North Korea-controlled operators, and CyberScoop's article separately notes that a North Korean hacking group it calls 'Famous Chollima' has been linked to cryptocurrency theft in unrelated incidents. However, neither the Spokesman-Review nor CyberScoop article reviewed for this profile specifically states that cryptocurrency was the mechanism used to move proceeds in the Bostelle/Pena Carrillo indictment; the reporting describes wire payments and funds moved through bank accounts opened under false names. Any claim that this specific case involved cryptocurrency-routed proceeds should be treated as unverified pending the unsealed indictment's full text or further reporting, and is flagged here as low confidence.","heading":"Cryptocurrency Involvement: Unverified in Available Reporting","severity":"low","sources":[{"credibility":2,"name":"DOJ charges 14 over a sprawling North Korean remote work scheme (CyberScoop)","type":"news_article","url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"},{"credibility":1,"name":"DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas (Spokesman-Review)","type":"news_article","url":"https://www.spokesman.com/stories/2026/oct/13/doj-arrests-two-seizes-187-devices-in-north-korean/"}]}],"sources_used":[{"credibility":1,"name":"DOJ arrests two, seizes 187 devices in North Korean laptop farm crackdown in Texas (Spokesman-Review)","type":"news_article","url":"https://www.spokesman.com/stories/2026/oct/13/doj-arrests-two-seizes-187-devices-in-north-korean/"},{"credibility":2,"name":"DOJ charges 14 over a sprawling North Korean remote work scheme (CyberScoop)","type":"news_article","url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"},{"credibility":1,"name":"Justice Department press release on coordinated actions against North Korean remote IT worker scheme","type":"regulatory","url":"https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"}],"summary":"Michael James Bostelle, of Pennsylvania, was arrested on October 13, 2026, and charged with wire fraud, money laundering, and identity theft in connection with an alleged scheme to help North Korean nationals obtain remote IT jobs at U.S. companies using stolen and fabricated identities. Prosecutors allege Bostelle provided his own name and a fraudulent driver's license to facilitate the placements, part of a scheme that allegedly funneled roughly $3 million from more than 70 U.S. employers using the identities of at least 25 real Americans. He faces these charges alongside a second U.S. defendant and ten China-based co-defendants; as of this writing the charges are unproven allegations and no trial or plea has been reported.","timeline":[{"date":"2019","event":"North Korean IT workers, allegedly aided by U.S. and China-based facilitators including Michael James Bostelle, began holding remote jobs at U.S. companies using stolen or fabricated identities, according to the later-unsealed indictment.","source":"CyberScoop","source_url":"https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/"},{"date":"2026-09","date_evidence":"FBI searches between Sept. 21 and Sept. 25 at more than 40 residences in Texas","date_original":"2026-09-21","event":"FBI conducted searches at more than 40 residences in Texas (running through approximately September 25, 2026), seizing 187 devices as part of the investigation.","source":"Spokesman-Review","source_url":"https://www.spokesman.com/stories/2026/oct/13/doj-arrests-two-seizes-187-devices-in-north-korean/"},{"date":"2026-10-13","date_evidence":"Oct. 13, 2026 Updated Tue., Oct. 13, 2026 at 6:54 p.m.","event":"The Department of Justice announced the arrests of Michael James Bostelle and Juan Cecilio Pena Carrillo and unsealed an indictment in the Northern District of Ohio charging them with wire fraud, money laundering, and identity theft, alongside charges against ten China-based co-defendants.","source":"Spokesman-Review / CyberScoop","source_url":"https://www.spokesman.com/stories/2026/oct/13/doj-arrests-two-seizes-187-devices-in-north-korean/"}]},"v":1}