DOJ Watch: October 15, 2026 — 14 Indicted in North Korean Remote IT Worker Conspiracy

ByEduardo Bacci

October 15, 2026

Federal prosecutors this week unsealed a cluster of cases that span national security, tax enforcement, health care billing, investor fraud and election law. The most far-reaching is a 58-page indictment in the Northern District of Ohio accusing 14 people of helping North Korean information technology workers obtain remote jobs at more than 70 U.S. companies. Below are the seven enforcement actions TIJ considers most significant from October 13–14, 2026, with context drawn from the Justice Department’s own announcements. Every charge described here is an allegation unless a conviction or sentence is expressly noted, and every defendant is presumed innocent until proven guilty in a court of law.

1. Fourteen Indicted in North Korean Remote IT Worker Conspiracy

According to a U.S. Attorney’s Office press release dated October 13, a federal grand jury in the Northern District of Ohio returned an indictment on October 1 naming 12 defendants, with two more defendants under seal. The indictment was unsealed this week. The charges include wire fraud conspiracy, money laundering conspiracy, conspiracy to commit identity theft and aggravated identity theft. Ten of the named defendants are described as residing in China, including in Dandong City, Liaoning and Shenzhen. Two, Michael James Bostelle of Philadelphia and Juan Cecilio Pena Carrillo of San Juan, Texas, were recently arrested and are expected to make initial appearances in the Northern District of Ohio.

Prosecutors allege the defendants ran a multi-year scheme to place workers in remote IT positions with American employers to generate revenue for North Korea. The Justice Department says U.S.-based facilitators allegedly helped the workers get hired and received company-issued laptops at their homes, an arrangement commonly called a “laptop farm.” In some cases, the release says, workers allegedly subcontracted entire jobs to third-party foreign nationals. The department puts the revenue generated at about $3 million, which it believes was sent to sanctioned entities controlled by the North Korean government. Victim companies reportedly span health care, communications, cyber support, retail and manufacturing in Ohio, other states and the District of Columbia.

The case matters because it targets the domestic enablers rather than only the overseas workers. The FBI’s Cleveland office, which led the roughly one-year investigation, also issued a business alert (IC3 PSA261013) for employers. The case was brought with the Criminal Division’s National Security Section. Ten of the named defendants remain at large, so any prosecution of them depends on arrests abroad or cooperation from foreign governments, according to the release.

2. Saudi National Charged in Alleged Recording-Device Plot at OpenAI

In a Justice Department announcement dated October 13, prosecutors said Abdulrahman Alfozan, 35, a Saudi national employed as an OpenAI engineer since July 2025, was arrested on October 9 and made an initial appearance on October 13. He is charged with using or endeavoring to use a device to intercept oral communications. If convicted, he faces up to five years in prison and a $250,000 fine.

According to the criminal complaint as summarized by the department, a recording device was allegedly installed in a USB port on the back of a television in an executive conference room in San Francisco on or about September 28. OpenAI reportedly discovered it around September 30, concealed in toilet paper with encrypted contents. The complaint alleges CCTV footage shows Alfozan near the room on multiple dates, that he allegedly had no authority to attend meetings there, and that a chatbot account allegedly tied to his spouse submitted prompts about building and concealing a recording device. A second device was allegedly found on October 5 in a bag he left unattended in another room.

The prosecution is led by the U.S. Attorney’s Office for the Northern District of California with the National Security Division’s Counterintelligence and Export Control Section and the FBI. The release notes the involvement of counterintelligence prosecutors, but it describes only allegations and does not state a motive or identify who, if anyone, may have received the recordings.

3. Justice Department Reports Results of First National Tax Enforcement Surge

On October 14, the department’s National Fraud Enforcement Division and IRS Criminal Investigation announced the results of what they called the department’s first National Tax Enforcement Surge, which ran from early September through October 14 and involved the Fraud Division’s Tax Section and 35 U.S. Attorneys’ Offices. The release reports actions against 76 defendants with an estimated intended loss to the government of more than $490 million. Of those, 23 actions brought new charges against 31 defendants (about $350 million in intended loss), while roughly 39 trials, pleas and sentencings affected 45 defendants (nearly $140 million).

Among the matters listed, an indictment in the Northern District of Texas names four defendants in a case the department values at $200 million, and an indictment in the Northern District of Georgia names three defendants in a $74 million matter. Sentences cited include 60 months for Nelai Mitchell in the Eastern District of North Carolina in a $13.8 million case and 51 months for Ephantus Mwangi in the District of Kansas in a $1.5 million case. The release notes that indictments and informations are allegations.

The surge is notable as an organizational signal: it is the first public product of a dedicated fraud division working across dozens of districts. Whether the volume of cases is sustained after the surge window ends is a question the department’s later filings will answer. Note also that “intended loss” is a sentencing-guidelines concept and is not necessarily the amount the Treasury actually lost.

4. Former Massachusetts Official Charged With SNAP Fraud

The U.S. Attorney’s Office for the District of Massachusetts announced on October 14 a criminal complaint charging Lamar Cook, 46, of Springfield, a former Western Massachusetts deputy director, with one count of SNAP fraud and one count of wire fraud. Prosecutors allege he applied for benefits on April 6, 2026, reporting zero income, less than $100 in the bank and a two-person household, while allegedly holding more than $8,800 in a bank account and living with a fiancée and her mother. He allegedly received about $546 monthly in SNAP benefits, including use during a July 2026 trip to Florida.

The release states Cook was terminated in October 2025 after state drug and firearm charges and was on pretrial release at the time of the application. Those state charges are likewise allegations. SNAP fraud carries up to five years in prison and wire fraud up to 20. The USDA and HHS inspectors general investigated, with assistance from state and local agencies. The case is a reminder that benefit-program fraud cases involving a former public employee can draw federal attention even at modest dollar amounts.

5. Washington Pastor Indicted in $13 Million Investor Fraud Case

A release from the Western District of Washington says Cristian Popescu, 46, of Bothell, a Romanian citizen residing in the U.S., was arraigned October 13 on ten counts of wire fraud and five counts of money laundering. He pleaded not guilty, and trial is set for December 21, 2026. Prosecutors allege he solicited more than 30 investors, many reportedly church members, for a Bellevue company called Followone, Inc., which he allegedly described as a valuable online marketplace and social network.

The indictment, as described by the U.S. Attorney’s Office, alleges the platform was non-functional, that claims of revenue, a pending Nasdaq listing and about 20 employees were false (only three people allegedly worked there), and that more than $4.5 million moved to accounts of Popescu, his wife and relatives. Prosecutors also allege he told questioning investors they were demonically possessed. The FBI and IRS Criminal Investigation investigated. Popescu was released on electronic monitoring over prosecutors’ objections. As with every case here, these are allegations; the defense has not yet presented its account in court.

6. Idaho Charges Two Canadian Citizens With Illegal Voting

The District of Idaho announced on October 13 that charges were filed October 7 against Taralynn Kathleen Bosco, 48, of Rexburg, and Stanley Richard Walton, 82, of Chubbuck, in separate cases. Each is alleged to have voted in the 2022 general election while a Canadian citizen and not a U.S. citizen. If convicted, each faces up to one year in prison and a fine of up to $100,000. Initial appearances are set for October 26 before U.S. Magistrate Judge Debora K. Grasham. Idaho State Police and Homeland Security Investigations investigated. The release stresses the charges are merely allegations. The announcement describes two separate cases and does not suggest a coordinated effort.

7. Former New Hampshire Psychiatrist Sentenced in Medicare Brace Fraud

On October 13 the District of New Hampshire announced that Steven Powell, 56, a former physician now living in Georgia, was sentenced by U.S. District Judge Paul Barbadoro to 12 months and a day in prison on one count of health care fraud and ordered to pay $761,202.75 in restitution. Prosecutors said he signed hundreds of orders for durable medical equipment such as braces for patients he never examined, covering roughly 1,400 claims totaling more than $1.9 million, of which Medicare paid $761,202.75. The government said he signed brace orders for more than 500 beneficiaries between December 2018 and March 2019. Unlike the other matters, this is a sentencing following a conviction. The FBI and HHS Office of Inspector General investigated. A related Medicare scheme was addressed the same day in a guilty plea by a Cape Cod man to conspiring to launder proceeds of a $6 million fraud.

Cases That Warrant Deeper TIJ Investigation

Several threads merit follow-up reporting through public records. First, the North Korean IT worker indictment: court dockets in the Northern District of Ohio should show how the two arrested U.S. facilitators are charged and whether any victim companies are identified in later filings. Second, the OpenAI case: the complaint and any detention or bail filings may clarify the government’s theory of who the intended audience for the recordings was. Third, the tax surge: the full list of 76 defendants and the $200 million Northern District of Texas indictment should be reviewed for the underlying scheme type and any preparers or promoters named. Fourth, the Followone case may show how faith-based networks are used in affinity fraud, with trial set for December.

Right of reply: TIJ will update this digest if any named individual or organization provides a response or if court records change the status of a case. All information is drawn from Justice Department press releases linked above; charges are allegations unless a plea, verdict or sentence is stated. Contact the editorial team at tij.news with corrections.

Sources: DOJ Fraud Enforcement News; DOJ press releases linked in each section above. Featured image: Robert F. Kennedy Department of Justice Building, Washington, D.C., by Pelajanela via Wikimedia Commons, licensed CC BY-SA 4.0.

ByEduardo Bacci

Investigative journalist and founder of The Investigative Journal. Specializing in OSINT-driven reporting on corporate malfeasance, government accountability, and institutional corruption.