Laptop Farm Charges Explained: What the Matthew Knoot Case Means for North Texas
Laptop farm charges are federal crimes filed against Americans who host company laptops so overseas workers can pose as U.S. employees.
Nashville resident Matthew Isaac Knoot faced six federal counts for doing this, including conspiracy to commit wire fraud, money laundering conspiracy, computer damage, and aggravated identity theft.
On May 1, 2026, a federal judge sentenced him to 18 months in prison and ordered him to pay $15,100 in restitution and forfeit another $15,100.
His case offers a preview of what may come next in North Texas, where the FBI searched more than 40 Texas homes in September and seized about 100 devices in this region alone.
Below, we break down each of Knoot’s six charges, what they mean for anyone who agreed to “host” laptops, and what to do if agents have already knocked.
What Did Matthew Knoot Do to Face Laptop Farm Charges?
Matthew Knoot received laptops that U.S. companies shipped to a fake employee named “Andrew M.” at his Nashville homes, then installed remote access software so a foreign IT worker could control them from China.
According to the indictment, he did this from about July 2022 through August 2023.
The companies believed “Andrew M.” was a real American working from Tennessee.
In fact, a foreign national using the alias Yang Di had taken the identity of a real U.S. citizen named Andrew M. and used it to apply for the jobs.
The Justice Department describes the worker as a North Korean IT worker operating from China, part of a broader effort to raise money for North Korea’s weapons programs.
Which Companies Hired the Fake Employee?
Four companies hired “Andrew M.” based on the stolen identity, according to the indictment.
They were a media company in New York City, a financial institution headquartered in the United Kingdom with U.S. subsidiaries, a technology company in Portland, Oregon, and a media company in McLean, Virginia.
The indictment lists offers of $100,000 a year for a senior engineer role, $120,000 plus a bonus for a mid-level developer role, and $130,000 plus a bonus for a developer role.
During the hiring process, the worker submitted a Georgia driver’s license containing some of the real Andrew M.’s personal information.
How Did the Remote Access Setup Work?
Knoot logged into each laptop with credentials the worker sent him and installed programs such as AnyDesk and Splashtop Streamer, which let someone else run the computer over the internet.
The indictment says he connected one company’s laptop to its network and installed AnyDesk on August 8 and 9, 2022, then installed and ran AnyDesk on another company’s laptop on August 21, 2022.
In June 2023, he installed and ran Splashtop Streamer on a MacBook Pro sent by the British financial institution.
From August 2022 through March 2023, one company’s laptop at Knoot’s home was accessed from IP addresses that resolved to China, in violation of that company’s policies.
To each employer, the work appeared to come from Nashville.
How Much Was Knoot Supposed to Be Paid?
Knoot agreed to take $500 per month for each laptop plus 20 percent of net profits, but the indictment says he was paid only $15,100 in total.
The deal, made around July 21 and 22, 2022, also had him let the worker use his online business networking account and name, and help with U.S. employment and tax paperwork.
Over roughly the same period, the four companies paid the “Andrew M.” persona at least about $258,553.74 in wages.
The facilitator’s share was a small slice of the money that moved through the scheme, yet his name sat on every count.
Where Did the Money Go?
The paychecks moved through a Georgia bank account and an online payment platform before reaching accounts registered to people claiming to be in China and Bangladesh, according to the indictment.
One company sent $56,276.98 and another sent $60,310.04 to the Georgia account for work supposedly done by Andrew M.
Those funds went to a payment platform account opened under the name “Levani Erkomaishvili,” and from there $111,893.21 went to four more accounts.
Two of those accounts then sent money to an account belonging to a North Korean persona known as “Jiang YuZi.”
Knoot received twelve payments through the same platform, six of which came from accounts that had received the company paychecks, and he moved the money to his own bank account in Chicago.
What Were the Six Federal Charges in the Knoot Indictment?
A federal grand jury charged Knoot with six counts covering computer crime, fraud, money laundering, identity theft, and immigration law, plus a forfeiture allegation.
The table below compares each count by statute, maximum prison term, and the conduct prosecutors tied to it.
| Count | Charge | Statute | Maximum Prison Term | Conduct Charged |
|---|---|---|---|---|
| 1 | Conspiracy to damage protected computers | 18 U.S.C. § 371 (object: § 1030(a)(5)(A)) | 5 years | Agreeing to install unauthorized remote access software on company laptops |
| 2 | Conspiracy to commit money laundering | 18 U.S.C. § 1956(h) | 20 years | Routing paychecks through bank and payment accounts to keep the scheme going and hide the source |
| 3 | Conspiracy to commit wire fraud | 18 U.S.C. § 1349 | 20 years | Agreeing to collect salaries through a fake identity and a false location |
| 4 | Intentional damage to a protected computer (aiding and abetting) | 18 U.S.C. §§ 1030(a)(5)(A) and 2 | 10 years | Installing and running remote access tools on the laptops |
| 5 | Aggravated identity theft | 18 U.S.C. § 1028A | Mandatory 2 years, added on top | Using Andrew M.’s name, date of birth, and Social Security number |
| 6 | Conspiracy to cause unlawful employment of aliens | 18 U.S.C. § 371 (object: 8 U.S.C. § 1324a) | 6 months | Referring an unauthorized worker for U.S. jobs for a fee |
The money laundering and wire fraud conspiracies carry the highest maximums at 20 years each, because both conspiracy statutes borrow the penalty of the crime the conspirators agreed to commit.
The identity theft count works differently, since it adds a fixed two years on top of whatever else the court imposes.
The immigration count is the lightest of the six, capped at six months.
Each count is explained below.
Why Did Installing Remote Access Software Count as Damaging a Computer?
Federal law defines “damage” as any impairment to the integrity or availability of data, a program, a system, or information, so installing unauthorized remote access software can qualify even when nothing physically breaks.
The felony version requires a loss of at least $5,000 during a one-year period.
“Loss” includes any reasonable cost of responding to the offense, assessing the damage, and restoring the system, which reaches well beyond broken hardware.
The indictment alleges at least $544,700 in damages to three of the companies, covering remediation of networks and devices, audits of code the worker wrote, and legal fees.
Count One charges the agreement under the general federal conspiracy statute, which carries up to five years and requires that at least one conspirator take an act to carry out the plan, and the indictment lists 16 such overt acts.
How Did Moving Paychecks Become a Money Laundering Conspiracy?
Count Two charges that Knoot agreed to conduct financial transactions with fraud proceeds, both to keep the scheme running and to hide where the money came from.
The federal money laundering statute covers transactions made with intent to promote the underlying crime and transactions designed to conceal the nature, location, source, ownership, or control of the proceeds.
Computer fraud under § 1030 is on the statute’s list of specified unlawful activity, and the indictment names computer fraud and wire fraud as the underlying crimes.
A money laundering conspiracy carries the same penalty as the laundering offense itself, which is up to 20 years in prison and a fine of up to $500,000 or twice the value involved, whichever is greater.
The government does not have to prove the defendant knew which crime produced the money, only that he knew it came from some form of felony activity.
What Does the Wire Fraud Conspiracy Count Cover?
Count Three charges the core of the scheme: an agreement to collect money from employers through false statements about who the worker was and where he was, using interstate and foreign wire communications.
Under 18 U.S.C. § 1349, a conspiracy to commit wire fraud is punished the same as wire fraud itself.
Wire fraud carries up to 20 years in prison, or up to 30 years if the violation affects a financial institution.
Unlike the general conspiracy statute, § 1349 does not cap the penalty at five years.
Wire fraud conspiracy is also one of the felonies that can trigger the aggravated identity theft charge in Count Five.
Why Is the Completed Computer Crime Charged Separately?
Count Four charges the completed offense of damaging the laptops, separate from the agreement in Count One, and it relies on federal aiding and abetting law.
Under 18 U.S.C. § 2, anyone who aids, abets, counsels, commands, induces, or procures a federal offense is punishable as a principal.
The count also depends on the definition of a “protected computer,” which includes any computer used in or affecting interstate or foreign commerce or communication.
Corporate laptops logged into company networks in New York, Oregon, and Virginia from a home in Tennessee fit that description.
A first offense of this kind carries up to 10 years in prison when the loss reaches $5,000 or more in a year.
Why Does Aggravated Identity Theft Carry Mandatory Prison Time?
Aggravated identity theft carries a mandatory two-year prison term that is added on top of the sentence for the underlying felony.
The statute bars probation, generally bars running the two years at the same time as other prison terms, and forbids the judge from shortening the other sentence to make up for it.
The charge applies when someone knowingly uses another person’s means of identification during and in relation to listed felonies, which include the fraud and computer offenses in Chapter 47 of Title 18 and the wire fraud offenses in Chapter 63.
Count Five relies on Andrew M.’s first name, last name, date of birth, and Social Security number, used on or about July 11, August 1, August 8, and August 9, 2022.
Why Was Knoot Charged With an Immigration Employment Crime?
Count Six charges a conspiracy to hire, recruit, or refer for a fee an unauthorized alien for U.S. employment, which 8 U.S.C. § 1324a makes unlawful.
The indictment says Knoot and his co-conspirators referred Yang Di for U.S. jobs for a fee, knowing he was not authorized to work in the United States.
The criminal version of this offense applies to a pattern or practice of violations and carries a fine of up to $3,000 per unauthorized worker and up to six months in prison for the entire pattern.
A six-month maximum makes the target offense a Class B misdemeanor, and the general conspiracy statute caps punishment at the misdemeanor’s maximum in that situation.
The count frames the host as someone who placed an unauthorized worker in American jobs for a fee.
How Did the Knoot Case End?
Judge Eli Richardson of the Middle District of Tennessee sentenced Knoot on May 1, 2026, to 18 months in prison followed by one year of supervised release.
He was also ordered to pay $15,100 in restitution to the victim companies and forfeit an additional $15,100, the amount the overseas workers paid him.
The Justice Department’s announcement does not state which counts Knoot was convicted on.
His role in the scheme ended when the FBI searched his home on August 8, 2023, and the Justice Department says he then made multiple false and misleading statements and destroyed evidence to obstruct the investigation.
He was arrested and charged in August 2024, about a year after the search.
How Does Knoot’s Sentence Compare to Other Laptop Farm Cases?
Knoot’s 18-month sentence matched the one given to Erick Ntekereze Prince of New York, and the Justice Department announced both as the seventh and eighth laptop farm sentences in five months.
Prince was ordered to forfeit $89,000, and the companies in his case paid the associated workers more than $943,069 in salary.
Arizona resident Christina Chapman received 102 months in prison after pleading guilty to wire fraud conspiracy, aggravated identity theft, and money laundering conspiracy.
Her case involved 68 stolen identities, 309 U.S. businesses, more than 90 laptops seized from her home, and at least $17.1 million in revenue.
The same basic conduct has produced sentences ranging from 18 months to 102 months, depending on the facts of each case.
What Happened During Operation Lonestar Roundup in Texas?
Between September 21 and 25, 2026, the FBI searched more than 40 Texas residences suspected of operating as laptop farms and seized about 187 laptops and KVM devices.
About 100 of those devices came from North Texas, according to the U.S. Attorney’s Office for the Northern District of Texas.
U.S. Attorney Ryan Raybould announced the results in Dallas on October 13, 2026, describing the investigation as “far more than fraud.”
No arrests had come from the North Texas searches at the time, but Raybould promised that people who willingly hosted the laptop farms would be indicted, CBS Texas reported.
The same day, the Justice Department announced an Ohio indictment charging 14 people, including Juan Cecilio Pena Carrillo of Texas, in a separate scheme that generated about $3 million.
Why Did Agents Seize KVM Devices Along With Laptops?
KVM over IP devices let someone control a computer’s keyboard, video, and mouse remotely through hardware instead of software.
The FBI’s October 2026 public service announcement lists devices such as TinyPilot, PiKVM, and GL.iNet among the tools these workers use to control employer laptops.
The same announcement says workers have shifted to running more laptop farms with fewer laptops at each location.
Knoot’s case centered on remote desktop software, so the Texas seizures show the government is looking at hardware setups as well.
Can You Face Laptop Farm Charges If You Did Not Know About North Korea?
Yes, because the statutes in Knoot’s indictment focus on what the host knew about the deception, and the worker’s nationality is not an element of any of them.
The money laundering statute, for example, requires knowing that the money came from some form of felony activity, though not which form.
That makes knowledge and intent the central questions in a defense: what the host understood, when, and what the messages and payment records show.
The FBI says these workers rely on both witting and unwitting Americans, post freelance gigs on well-known job boards asking people to receive and host laptops, and target people under financial stress.
The FBI also says these activities are illegal and put participants at risk of law enforcement scrutiny.
What Do Prosecutors Point to as Proof of Knowledge?
In the Knoot indictment, prosecutors relied on the terms of the deal and the specific steps he took.
The agreement included per-laptop fees and a cut of profits, help with U.S. employment and tax paperwork, and use of his own business networking account and name.
The laptops arrived addressed to someone else, and Knoot used login credentials for “Andrew M.” to install remote access tools.
In Texas, Raybould told reporters it is hard to claim ignorance when someone is hosting dozens of laptops at home.
What Should You Do If You Hosted Laptops for a Remote Employer?
If you received company laptops for someone else or installed remote access tools on them, stop, keep everything as it is, and talk to a federal criminal defense lawyer before you talk to anyone else.
The steps below track the conduct the Justice Department highlighted in the Knoot case.
Each one applies whether or not agents have contacted you yet.
Why Should You Avoid Deleting or Wiping Anything?
Destroying records or objects to impede a federal investigation is a separate felony under 18 U.S.C. § 1519, punishable by up to 20 years in prison.
The Justice Department specifically noted that Knoot destroyed evidence after the FBI searched his home.
Deleting messages, wiping a device, or uninstalling remote software after you learn of an investigation can create new exposure.
Keep devices, chats, job postings, and payment records as they are, and let your lawyer decide how to handle them.
Why Should You Avoid Talking to Agents Without a Lawyer?
Making a materially false statement to federal agents is its own crime under 18 U.S.C. § 1001, carrying up to five years in prison.
The Justice Department said Knoot made multiple false and misleading statements after the search of his home.
Even honest people get dates, amounts, and details wrong under pressure, and every statement can become evidence.
You can decline to answer questions and ask to speak with your lawyer.
Why Get a Lawyer Before an Indictment Is Filed?
Knoot’s home was searched in August 2023, but he was not charged until August 2024.
North Texas residents whose homes were searched in September 2026 may be in a similar window now, since prosecutors have said indictments will follow.
A lawyer can communicate with prosecutors, learn whether you are a target, and evaluate whether cooperation, a pre-indictment resolution, or a defense makes sense.
A pre-indictment resolution, by definition, is only possible before the grand jury acts.
What Other Penalties Come With a Laptop Farm Conviction?
Prison is only part of the exposure, because a conviction can also bring forfeiture, restitution, supervised release, and fines.
Knoot’s sentence included three of those four.
Each is imposed in addition to any prison term.
What Property Can Be Forfeited in a Laptop Farm Case?
The Knoot indictment sought forfeiture of proceeds traceable to the offenses, plus a money judgment equal to their value.
For computer crimes, § 1030(i) says the court shall order forfeiture of personal property used to commit the offense and any proceeds obtained from it.
The indictment also gave notice that if the proceeds could not be located or had been transferred, the government would seek other property of equal value.
Knoot ultimately forfeited $15,100, the full amount the workers paid him.
Do Laptop Farm Defendants Owe Restitution?
Knoot was ordered to pay $15,100 in restitution to the victim companies on top of his forfeiture.
The Justice Department says his conduct and his co-conspirators’ conduct caused the companies more than $500,000 in costs to audit and fix their devices, systems, and networks.
Restitution is a separate obligation from forfeiture, so a defendant can owe both.
How Are Identity Theft Victims Harmed in These Cases?
The wages in Knoot’s case were falsely reported to the IRS and the Social Security Administration in the name of the real Andrew M., according to the Justice Department.
In the Chapman case, prosecutors said the scheme created false tax liabilities for the 68 people whose identities were used.
A person whose identity is used this way can be left with tax and benefits records showing income they never earned.
Need Help With Laptop Farm Charges?
Laptop farm charges stack computer, fraud, laundering, identity theft, and immigration counts onto one course of conduct, and the Knoot case shows that a host who earned $15,100 can still go to federal prison.
As a federal criminal defense attorney in Dallas, Michael Lowe can help you respond to a laptop farm investigation, search warrant, or indictment.
Contact the Law Office of Michael Lowe today for a free consultation by calling 214-526-1900.
Michael Lowe has been Board Certified in Criminal Law since 2007.
Frequently Asked Questions
Is hosting a laptop farm a federal crime?
Yes. Hosting company laptops so an overseas worker can pose as a U.S. employee can bring federal charges for wire fraud conspiracy, money laundering conspiracy, computer damage, aggravated identity theft, and unlawful employment of aliens. Matthew Knoot of Nashville faced all of these counts, and the FBI calls hosting laptops for North Korean IT workers a federal crime.
How long was Matthew Knoot sentenced to prison?
Matthew Knoot was sentenced on May 1, 2026, to 18 months in federal prison, followed by one year of supervised release. Judge Eli Richardson of the Middle District of Tennessee also ordered him to pay $15,100 in restitution to the victim companies and to forfeit another $15,100, which equals the amount the overseas workers paid him.
Does aggravated identity theft carry mandatory prison time?
Yes. Under 18 U.S.C. § 1028A, aggravated identity theft carries a mandatory two-year prison term added on top of the sentence for the underlying felony. The court cannot grant probation on that count, generally cannot run it at the same time as other prison terms, and cannot shorten the other sentence to make up for it.
Can I be charged if I did not know the workers were North Korean?
Yes. The statutes used in laptop farm cases turn on what the host knew about the deception, such as fake identities, false locations, or the illegal source of the money. The worker’s nationality is not an element of these offenses. The FBI says these workers recruit both witting and unwitting Americans.
What did the FBI seize in Operation Lonestar Roundup?
Between September 21 and 25, 2026, the FBI searched more than 40 Texas residences suspected of operating as laptop farms and seized about 187 laptops and KVM devices. About 100 of those devices came from North Texas, and the U.S. Attorney for the Northern District of Texas announced the operation in Dallas on October 13, 2026.
Comments are welcomed here and I will respond to you -- but please, no requests for personal legal advice here and nothing that's promoting your business or product. Comments are moderated and these will not be published.
Leave a Reply