Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Amazon reportedly did not identify a North Korean national from typing speed alone. According to secondary reports describing comments by Amazon Chief Security Officer Stephen Schmidt, security monitoring detected more than 110 milliseconds of unusual delay between keyboard input and the company systems receiving it. That persistent lag suggested that a supposedly U.S.-based laptop was being controlled remotely, prompting a broader investigation.
The incident is best understood as an employment-fraud and remote-access case—not as a proven “North Korean typing detector.” The latency signal reportedly helped expose a suspicious access path; identity, location, device, and employment evidence would have been needed to connect it to the wider North Korean remote-IT-worker campaign.
What Amazon reportedly detected
The reported clue was keystroke latency: the delay between a key being pressed and the resulting input reaching the monitored system. Tom’s Hardware reported that an Amazon systems administrator presented as U.S.-based generated input with more than 110 milliseconds of latency.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Cybernews described the delay as unusually high compared with the tens-of-milliseconds signal generally expected from an ordinary remote worker connecting through a normal path. The precise threshold and measurement method have not been publicly documented by Amazon in the sources available here, so the 110-millisecond figure should be treated as a reported detail, not an independently reproducible test.
#1 Best Overall
- KEYBOARD: The keyboard works for Windows with hot keys that enable easy access to Media, My Computer, Mute, Volume up/down, and Calculator
- EASY SETUP: Experience simple installation with the USB wired connection
- VERSATILE COMPATIBILITY: This keyboard is designed to work with multiple Windows versions, including Vista, 7, 8, 10 offering broad compatibility across devices.
- SLEEK DESIGN: The elegant black color of the wired keyboard complements your tech and decor, adding a stylish and cohesive look to any setup without sacrificing function.
- FULL-SIZED CONVENIENCE: The standard QWERTY layout of this keyboard set offers a familiar typing experience, ideal for both professional tasks and personal use.
Typing speed is not the same thing
- Typing speed: how many characters or words someone enters over a period.
- Typing cadence: the pattern and intervals between keystrokes.
- Keystroke latency: the delay before input reaches the monitored application or system.
- Network latency: the time data takes to travel between network endpoints.
- Remote-control latency: extra delay introduced when someone operates a computer through remote-desktop software, a proxy, jump box, virtual machine, or similar intermediary.
Those are different measurements. The available reporting supports the conclusion that Amazon noticed an input-delay anomaly—not that it identified a person by a unique typing rhythm or biometric “fingerprint.”
How a U.S.-based laptop can expose an overseas operator
The suspected arrangement follows a model that U.S. authorities call a laptop farm or laptop-hosting operation:
Operator abroad → remote-control connection → U.S.-based company laptop → employer systems
- A U.S. facilitator receives and hosts the employer’s laptop.
- The company sees the device connecting from an apparently legitimate U.S. location.
- A worker overseas controls the laptop remotely.
- Keystrokes, screen updates, commands, and authentication traffic travel through an additional network path.
- That extra path can add delay even though the physical laptop and its visible IP address are in the United States.
The FBI says U.S.-based facilitators may provide local internet connections, host company laptops, enable remote-desktop access, participate in interviews, create job-site accounts, and handle payments. Microsoft has also described the use of VPNs, remote-monitoring and management tools, and accomplices to hide the worker’s true location.
Rank #2
- Reliable Plug and Play: The USB receiver provides a reliable wireless connection up to 33 ft (1), so you can forget about drop-outs and delays and you can take it wherever you use your computer
- Type in Comfort: The design of this keyboard creates a comfortable typing experience thanks to the low-profile, quiet keys and standard layout with full-size F-keys, number pad, and arrow keys
- Durable and Resilient: This full-size wireless keyboard features a spill-resistant design (2), durable keys and sturdy tilt legs with adjustable height
- Long Battery Life: MK270 combo features a 36-month keyboard and 12-month mouse battery life (3), along with on/off switches allowing you to go months without the hassle of changing batteries
- Easy to Use: This wireless keyboard and mouse combo features 8 multimedia hotkeys for instant access to the Internet, email, play/pause, and volume so you can easily check out your favorite sites
What remains unknown about the Amazon case
Public reporting identifies the person as a sysadmin or systems administrator working for Amazon U.S. It does not establish the person’s name, whether the person was an employee or contractor, the exact team, the laptop-farm location, the remote-access software, the length of access, or whether data was stolen.
It also does not publicly prove that the operator was physically in North Korea. The reported evidence is consistent with an overseas operator, potentially in North Korea or another country, controlling a laptop placed in the United States. That distinction matters: the laptop’s location is not necessarily the operator’s location.
According to the reporting, Amazon determined that the laptop was being remotely controlled after investigating the suspicious activity. The latency appears to have been a trigger for investigation, not the complete proof of nationality or intent.
Amazon’s reported scale of the problem
Amazon reportedly told the source that it had blocked more than 1,800 suspected North Korean infiltration attempts since April 2024. It also reportedly said attempts increased by approximately 27% quarter over quarter during 2025. These are Amazon-reported figures, not government statistics or independently audited totals.
Rank #3
- All-day Comfort: The design of this standard keyboard creates a comfortable typing experience thanks to the deep-profile keys and full-size standard layout with F-keys and number pad
- Easy to Set-up and Use: Set-up couldn't be easier, you simply plug in this corded keyboard via USB on your desktop or laptop and start using right away without any software installation
- Compatibility: This full-size keyboard is compatible with Windows 7, 8, 10 or later, plus it's a reliable and durable partner for your desk at home, or at work
- Spill-proof: This durable keyboard features a spill-resistant design (1), anti-fade keys and sturdy tilt legs with adjustable height, meaning this keyboard is built to last
- Plastic parts in K120 include 51% certified post-consumer recycled plastic*
The wider North Korean remote-worker campaign
The broader operation uses fraudulent employment to generate revenue for North Korea and evade sanctions. Skilled IT workers seek software, web-development, administrator, and other remote roles while presenting themselves as people located elsewhere.
The U.S. Department of Justice describes tactics including stolen identities, alias email accounts, fabricated professional profiles, job-site accounts, proxy computers, U.S.-based facilitators, false websites, supporting documents, and cross-border payment arrangements. Microsoft has reported that AI can help improve fake resumes, profile photographs, identity documents, and voice presentation.
Getting hired is not necessarily the endpoint. The FBI warns that workers may copy source-code repositories, harvest credentials and session cookies, obtain unauthorized access, exfiltrate data, or extort companies. Wages and other payments may also be diverted through facilitators or overseas channels.
Recommended Free Tools
What laptop-farm investigations show
Government enforcement actions demonstrate that laptop hosting is a real infrastructure pattern, while not proving that any particular operation was used against Amazon.
Rank #4
- 【Dreamy Rainbow Gaming Keyboard】K521 Gaming Keyboard Adopts a Different LED Backlight Design, Upgraded on the Traditional LED Backlight Effect, Making the Light More Penetrating, Giving You a More Dazzling Visual Effect, Making Your Gaming Process More Enjoyable
- 【One Touch Opens & Visual Feast】The K521 Red Dragon Keyboard has a One-Touch on/off Lighting Button for Added Convenience. It also has a Three-Position Adjustable Breathing Mode and a Four-Position Adjustable Brightness Lighting Mode
- 【Mechanical Feeling & Fast Tapping】The PC Keyboard Keys are Designed for Mechanical Feeling, Giving You a Better Feel During Use and the Ability to Trigger Keys Quickly, Allowing You to Win All Your Games
- 【19 Keys Anti-Ghosting Keyboard】Anti-Ghosting Ensures Every Button Can Be Triggered. This Allows You to Trigger Key Combinations In The Game Accurately, And Each Skill Can Be Accurately Released to Increase Your Winning Rate. Redragon K521 Will Be Your Perfect Partner
- 【12 Multimedia Combination Keys】The K521 Wired Gaming Keyboard is Equipped with 12 Multimedia Keys That Can Greatly Enhance Your Gaming/Office Efficiency and Make It More Convenient to Use
Between June 10 and June 17, 2025, the FBI searched 21 premises across 14 states and seized approximately 137 laptops connected to suspected North Korean remote-IT-worker schemes, according to the DOJ.
In a separate Arizona case, the DOJ said facilitator Christina Chapman’s home contained more than 90 laptops and that her operation allegedly helped North Korean workers obtain jobs at 309 U.S. companies. That case is useful context for the scale of laptop hosting, but the available sources do not connect that specific laptop farm to the Amazon incident. Criminal defendants are presumed innocent unless proven guilty.
Why 110 milliseconds is a clue, not proof
A delay above 110 milliseconds is not uniquely North Korean and is not a universal cutoff for remote access. Legitimate causes can include:
- poor Wi-Fi or cellular connectivity;
- congested routing;
- VPNs;
- remote-desktop or virtual-machine software used for legitimate reasons;
- endpoint, browser, operating-system, hardware, or accessibility effects;
- monitoring artifacts or application-specific measurement differences; and
- a legitimate worker located farther away than an employer believes.
A useful signal is one that is persistent and consistent, conflicts with the claimed location, and correlates with other evidence such as remote-management software, simultaneous logins from different regions, identity inconsistencies, or unusual data movement. A single latency observation should lead to verification—not automatic termination, accusation, or a conclusion about nationality.
Best Value
- All-day Comfort: This USB keyboard creates a comfortable and familiar typing experience thanks to the deep-profile keys and standard full-size layout with all F-keys, number pad and arrow keys
- Built to Last: The spill-proof (2) design and durable print characters keep you on track for years to come despite any on-the-job mishaps; it’s a reliable partner for your desk at home, or at work
- Long-lasting Battery Life: A 24-month battery life (4) means you can go for 2 years without the hassle of changing batteries of your wireless full-size keyboard
- Simply plug the USB receiver into a USB port on your desktop, laptop or netbook computer and start using the keyboard right away without any software installation
- Simply Wireless: Forget about drop-outs and delays thanks to a strong, reliable wireless connection with up to 33 ft range (5); K270 is compatible with Windows 7, 8, 10 or later
What employers should check
Before hiring
- Verify identity documents and confirm that the person completing interviews is the person being hired.
- Cross-check resumes, education, employment history, phone numbers, email addresses, and professional profiles.
- Ask location- and education-specific questions that are difficult to answer from a prepared script.
- Audit staffing firms and intermediaries that recruit or host remote workers.
- Use stronger checks for roles with privileged access to code, credentials, production systems, or sensitive data.
During onboarding
- Bind accounts to managed devices and require phishing-resistant multifactor authentication where practical.
- Record device, sign-in, network-path, and location telemetry in a transparent and legally compliant way.
- Inspect for unauthorized remote-desktop, remote-management, proxy, or virtualization tools.
- Complete as much onboarding and equipment handoff in person as the role and geography reasonably allow.
- Apply least privilege until identity and access patterns are established.
During employment
- Look for impossible travel, repeated country changes, unusual login times, and simultaneous sessions.
- Correlate endpoint location with authentication and network telemetry.
- Monitor for code repositories, credentials, session cookies, or data moving to personal accounts or unapproved cloud services.
- Investigate payment-account changes and requests to redirect compensation.
- Use timing telemetry, if collected, as one security signal rather than a standalone employee score.
What to do if a signal fires
- Preserve endpoint, authentication, VPN, remote-access, and network logs.
- Temporarily restrict high-risk privileges while preserving evidence and following HR and legal procedures.
- Verify the worker’s identity and physical location through an independent channel.
- Examine active remote sessions, installed software, device-management records, and network paths.
- Review source-code, cloud, credential, and data-transfer activity.
- Search for linked accounts, reused contact details, resumes, payment information, or staffing intermediaries.
- Involve security leadership, HR, legal counsel, and relevant law-enforcement contacts.
- Rotate credentials and revoke tokens if compromise is plausible.
- Report suspected activity rapidly through the FBI’s Internet Crime Complaint Center, as the FBI recommends.
The privacy boundary
Detecting suspicious input timing does not require assuming that an employer records the content of every keystroke. The safer distinction is between analyzing timing and endpoint telemetry and capturing what a worker actually typed. Any monitoring should be limited, disclosed where required, secured, and reviewed against applicable employment, privacy, and data-protection rules.
The inspected sources do not establish what Amazon collected, whether it recorded keystroke content, or how long any telemetry was retained. Employers should not present a latency-monitoring system as a nationality classifier or use it without appropriate governance.
Where security products fit
No single product is a reliable “North Korean typing detector.” An effective program combines identity verification, device attestation, endpoint detection, remote-access controls, sign-in analytics, data-loss monitoring, and human investigation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Microsoft Defender for Endpoint can support endpoint telemetry, investigation, and response, particularly in Microsoft-centric environments.
- Microsoft Entra ID can help correlate identity, device posture, sign-in risk, and location anomalies, but cannot by itself prove who is physically operating a laptop.
- CrowdStrike Falcon is aimed at endpoint detection, threat hunting, and managed detection, with complexity and cost that may not suit a small employer.
- Okta Workforce Identity can strengthen workforce identity and access policies in mixed-device and multicloud environments, but does not replace endpoint inspection.
- Persona can support configurable identity-document and onboarding checks, although a valid document does not prove that the same person operates the device.
The right choice depends on the employer’s existing identity provider, endpoint fleet, security staffing, data sensitivity, and tolerance for investigation overhead. Buying a keyboard-testing tool alone would address the wrong problem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
