BBC Korea obtained computer recordings and internal messenger logs that show how North Korean IT workers are managed as part of an organized fake-employment operation rather than as isolated freelancers. The material and expert review describe layered roles for security managers, tasking managers, support staff preparing fake resumes/accounts, and workers who use borrowed or stolen identities to seek remote development jobs abroad. The operation uses social and dating platforms to recruit identity-rental partners, manages multiple accounts and devices, and applies rules to hide location and North Korean origin, including interview-language guidance, Gmail restrictions, time-zone alignment, and AI-assisted profile or interview preparation. A former North Korean IT worker described large shared workspaces, constant monitoring, monthly foreign-currency quotas, limited personal freedom, and revenue flows that largely return to the state and intermediaries.