Informal Institute for National Security Thinkers and Practitioners

Quotes of the Day:

:The only way to deal with an unfree world is to become so absolutely free that your very existence is an act of rebellion.”

- Albert Camus

“Do not indoctrinate your children. Teach them how to think for themselves. How to evaluate evidence and how to disagree with you.”

- Richard Dawkins

“The reading of all good books is like a conversation with the finest minds of centuries past.”

- Rene Descartes

1. Nuclear attack by N. Korea will result in end of Pyongyang regime: U.S.

2. N Korea fires missiles toward sea as US warns over nukes

3. Japan Considers Buying U.S. Tomahawk Missiles to Deter North Korea and China

4. Yoon names new deputy NIS director

5. S. Korea, U.S. in close consultation to counter N. Korean provocation: ambassador

6. The Evolution of Kim Jong Un’s ‘All-Purpose Sword’

7. N. Korea builds ice cream factory on Kim Jong-un's order

8. Sohae Satellite Launching Station: Significant Activity Underway

9. Poland's deputy PM: Korea has high chance for nuclear plant partner

10. Air-to-Air Missiles Could Be the North Korean Defense Sector’s Next Breakthrough: Why It Matters

11. South Korean president dismisses Putin's warning

12. S. Korea, U.S. to conduct Vigilant Storm air drills next week amid N.K. threats

13. North Koreans embrace truth over consequences

14. South Koreans living near Korean border unperturbed by rising military tensions

1. Nuclear attack by N. Korea will result in end of Pyongyang regime: U.S.

Words that many of us have long recommended.

We will need all leaders to emphasize these words in their statements. We must make Kim understand this.

Excerpts:

"Any nuclear attack by North Korea against the United States or its allies and partners is unacceptable and will result in the end of that regime," said the NDS.

"There is no scenario in which the Kim regime could employ nuclear weapons and survive," it added, referring to North Korean leader Kim Jong-un.

(LEAD) Nuclear attack by N. Korea will result in end of Pyongyang regime: U.S. | Yonhap News Agency

en.yna.co.kr · by 변덕근 · October 28, 2022

(ATTN: UPDATES with remarks from NSC spokesperson John Kirby in paras 7-10; ADDS photo)

By Byun Duk-kun

WASHINGTON, Oct. 27 (Yonhap) -- A nuclear attack by North Korea against the U.S. or its allies will result in the end of the country's regime, the U.S. Department of Defense said Thursday.

In its National Defense Strategy (NDS), the department said the U.S. will also hold North Korea responsible for any transfer of nuclear weapons or related materials and technology to other actors.

"Any nuclear attack by North Korea against the United States or its allies and partners is unacceptable and will result in the end of that regime," said the NDS.

"There is no scenario in which the Kim regime could employ nuclear weapons and survive," it added, referring to North Korean leader Kim Jong-un.

The new U.S. defense strategy comes amid speculation that Pyongyang may soon conduct what will be its seventh nuclear test.

The North conducted its sixth and last nuclear test in September 2017.

John Kirby, spokesman for the White House National Security Council, said North Korean leader Kim Jong-un may be prepared to conduct a nuclear test at any time.

"Offensive as they are, which just causes more instability on the peninsula and contributes to a degradation in the security environment, we have said for months now that Mr. Kim could conduct another nuclear test at any moment. And we still believe that that's the case," the NSC strategic communications coordinator said in a press conference organized by the Washington Foreign Press Center.

Kirby reaffirmed U.S. commitment to engage with Pyongyang, but said the U.S. will continue to prepare for all contingencies at the same time.

"But again, I want to stress we are willing to sit down without preconditions and there is no reason for another test to occur," he said. "In the meantime, given that he (Kim) hasn't shown any inclination to want to talk, we have to do what we must make sure that we can defend ourselves and our allies."

Defense Secretary Lloyd Austin said the NDS is "clear eyed" about threats posed by North Korea and its evolving nuclear, missile capabilities.

"The NDS is also clear eyed about other serious threats and that includes North Korea's expanding nuclear and missile capabilities," he told a press briefing.

North Korea has launched a total of 44 ballistic missile launches this year, the largest number of ballistic missile it fired in a single year, according to U.S. officials.

"The NDS charges us to defend the U.S. homeland to deter strategic attacks against the United States and our allies and partners, to prepare to prevail in conflict when necessary," said Austin.

The NDS also highlights proliferation risks posed by North Korea.

"We will hold the (North Korean) regime responsible for any transfer it makes of nuclear weapons technology, material or expertise to any state or non-state actor," it said.

bdk@yna.co.kr

(END)

en.yna.co.kr · by 변덕근 · October 28, 2022

2. N Korea fires missiles toward sea as US warns over nukes

Was this in reaction to the new NDS? That would be a pretty fast response if that is so. Perhaps they received a read ahead copy of the strategy. (note sarcasm). Or perhaps they anticipated what would be in the strategy.

N Korea fires missiles toward sea as US warns over nukes

AP · by HYUNG-JIN KIM and KIM TONG-HYUNG · October 28, 2022

SEOUL, South Korea (AP) — North Korea fired two short-range ballistic missiles toward the sea on Friday in its first ballistic weapons launches in two weeks, as the U.S. military warned the North that the use of nuclear weapons “will result in the end of that regime.”

South Korea’s military detected the two launches from the North’s eastern coastal Tongchon area around midday on Friday, Seoul’s Joint Chiefs of Staff said in a statement. It said both missiles flew about 230 kilometers (140 miles) at a maximum altitude of 24 kilometers (15 miles).

The statement said South Korea strongly condemns the launches, calling them “a grave provocation” that undermines regional peace and violates U.N. Security Council resolutions banning any ballistic activities by North Korea.

The U.S. Indo Pacific Command said the launches highlighted the “destabilizing impact” of North Korea’s illicit nuclear weapons and ballistic missile programs. The Japanese Defense Ministry said it also detected the launches and that the type of missiles used and their flight information were still being analyzed.

South Korea’s Foreign Ministry said its top nuclear envoy held separate phone talks with his U.S. and Japanese counterparts soon after the launches. It said the three agreed to strengthen trilateral coordination on North Korea while repeating their calls for the North to stop weapons tests and return to talks.

Japan

World shares lower, led by 3.7% drop in Hong Kong

Japan Cabinet OKs $200B spending plan to counter inflation

Asian shares mostly lower as Japan preps massive stimulus

EXPLAINER: What's up with the Bank of Japan's unique track?

The back-to-back launches, the North’s first ballistic missile tests since Oct. 14, came on the final day of South Korea’s annual 12-day “Hoguk” field exercises, which also involved an unspecified number of U.S. troops this year. Next week, South Korean and U.S. air forces plan to conduct a large-scale training as well.

North Korea sees such regular drills by Seoul and Washington as practice for launching an attack on the North, though the allies say their exercises are defensive in nature.

Next week’s “Vigilant Storm” aerial drills are to run from Monday to Friday and involve about 140 South Korean warplanes and about 100 U.S. aircraft. The planes include sophisticated fighter jets like F-35 from both nations, South Korea’s Defense Ministry said in a statement earlier Friday.

Since late September, North Korea has launched a barrage of missiles toward the sea in what it called simulated tests of tactical nuclear weapons systems designed to attack South Korean and U.S. targets. North Korea says its testing activities were meant to issue a warning amid a series of South Korea-U.S. military drills. But some experts say Pyongyang has also used its rivals’ drills as a chance to test new weapons systems, boost its nuclear capability and increase its leverage in future dealings with Washington and Seoul.

Tongchon, the launch site for the North’s Friday launches, is about 60 kilometers (37 miles) away from the inter-Korean land border. The area was closer to South Korean territory than any other missile launch site North Korea has used so far this year, according to South Korea’s Defense Ministry.

South Korea and the United States have strongly warned North Korea against using its nuclear weapons preemptively.

The Pentagon’s National Defense Strategy report issued on Thursday stated that any nuclear attack by North Korea against the United States or its allies and partners “will result in the end of that regime.”

“There is no scenario in which the Kim regime could employ nuclear weapons and survive,” the report said. The Pentagon said it will continue to deter North Korean attacks through “forward posture,” including nuclear deterrence, integrated air and missile defenses, and close coordination and interoperability with South Korea.

During a visit to Tokyo on Tuesday, U.S. Deputy Secretary of State Wendy Sherman reiterated that the United States would fully use its military capabilities, “including nuclear,” to defend its allies South Korea and Japan.

Last month, South Korea’s Defense Ministry warned North Korea that using its nuclear weapons would put it on a “path of self-destruction.”

There are concerns that the North could up the ante in the coming weeks by conducting its first nuclear test since 2017.

Rafael Grossi, chief of the International Atomic Energy Agency, said Thursday that a new nuclear test explosion by North Korea “would be yet another confirmation of a program which is moving full steam ahead in a way that is incredibly concerning.”

He said the U.N. agency has been observing preparations for a new test, which would be the North’s seventh overall, but gave no indication of whether an atomic blast is imminent.

In recent days, North Korea has also fired hundreds of shells in inter-Korean maritime buffer zones that the two Koreas established in 2018 to reduce frontline military tensions. North Korea has said the artillery firings were in reaction to South Korean live-fire exercises at land border areas.

On Monday, the rival Koreas exchanged warning shots along their disputed western sea boundary, a scene of past bloodshed and naval battles, as they accused each other of violating the boundary.

Associated Press writer Mari Yamaguchi in Tokyo contributed to this report.

AP · by HYUNG-JIN KIM and KIM TONG-HYUNG · October 28, 2022

3. Japan Considers Buying U.S. Tomahawk Missiles to Deter North Korea and China

Japan Considers Buying U.S. Tomahawk Missiles to Deter North Korea and China

Tokyo seeks to develop long-range strike ability quickly, in shift from longstanding caution on defense

https://www.wsj.com/articles/japan-considers-buying-u-s-tomahawk-missiles-to-deter-north-korea-and-china-11666939905?mod=hp_listb_pos1

By Alastair GaleFollow

and Chieko TsuneokaFollow

Oct. 28, 2022 2:51 am ET

TOKYO—Japan is in talks with the U.S. about buying Tomahawk cruise missiles so that it can more quickly gain the ability to attack North Korean and Chinese military bases, people familiar with the matter said.

The long-range missiles would represent a big step up in Tokyo’s ability to strike regional rivals, a power that it traditionally held back from obtaining. Prime Minister Fumio Kishida has said he wants to improve deterrence, particularly after North Korea fired a missile that flew over Japan earlier this month and China’s military stepped up activity near Japan and Taiwan.

On Friday, North Korea fired two short-range ballistic missiles toward Japan that landed in the sea, according to the South Korean military, the latest of dozens of missile tests this year.

What’s Next After North Korea’s Latest Barrage of Weapon Tests

Yoon names new deputy NIS director | Yonhap News Agency

en.yna.co.kr · by 이해아 · October 28, 2022

SEOUL, Oct. 28 (Yonhap) -- President Yoon Suk-yeol on Friday named a former prosecutor as a deputy director of the National Intelligence Service, his office said, filling a vacancy created earlier this week by the resignation of one of his confidants.

Kim Nam-woo, who has been working as a lawyer since leaving the prosecution in 2020, was appointed the new deputy director for planning and coordination, three days after Jo Sang-jun resigned over what the presidential office and the NIS said were health and other personal reasons.

Jo's departure sparked a flurry of speculation as to why he quit because it came only four months after he took the job and a day before he was due to attend a parliamentary audit of the spy agency.

Rumors had it that Jo had clashed with NIS Director Kim Kyou-hyun over personnel issues or that he may have been caught drunk driving or involved in an irregularity.

hague@yna.co.kr

(END)

en.yna.co.kr · by 이해아 · October 28, 2022

5. S. Korea, U.S. in close consultation to counter N. Korean provocation: ambassador

S. Korea, U.S. in close consultation to counter N. Korean provocation: ambassador | Yonhap News Agency

en.yna.co.kr · by 변덕근 · October 28, 2022

By Byun Duk-kun

WASHINGTON, Oct. 27 (Yonhap) -- South Korea and the United States are working closely together to come up with strong and stern measures against any future provocation by North Korea, South Korea's ambassador to the U.S. said Thursday, amid speculation that Pyongyang may conduct a nuclear test at any time.

Amb. Cho Tae-yong reaffirmed the possibility of additional provocations by the North.

"As you may know, the situation on the Korean Peninsula is very serious. North Korea recently escalated tension by staging missile launches and artillery firing while putting the blame on South Korea and the U.S.," the ambassador said while meeting with reporters.

"We cannot rule out the possibility of North Korea conducting a nuclear test, launching an intercontinental ballistic missile or engaging in other provocations using conventional weapons," Cho added.

Pyongyang fired nearly a dozen ballistic missiles in less than three weeks from late September, bringing the total number of ballistic missiles launched this year to 44, the largest number ever fired in a single year, according to U.S. officials.

State department spokesperson Ned Price said earlier this week that the North may also conduct what will be its seventh nuclear test "at any point."

Cho said the allies are working to strengthen the U.S. extended deterrence while discussing ways to deal with a potential North Korean nuclear test.

"South Korea and the U.S. are continuing their close cooperation while closely consulting on ways to strengthen the extended deterrence, so that they can strongly and sternly react against North Korean provocations," the South Korean diplomat said.

Seoul and Washington held their first high-level dialogue on extended deterrence, known as the Extended Deterrence Strategy and Consultation Group (EDSCG), in five years last month, agreeing to take a "strong, whole-of-government response" against future North Korean nuclear tests.

North Korea conducted its sixth and last nuclear test in September 2017.

Cho said the allies will continue their close consultations when South Korean Defense Minister Lee Jong-sup visits Washington next week for an annual Security Consultative Meeting.

bdk@yna.co.kr

(END)

en.yna.co.kr · by 변덕근 · October 28, 2022

6. The Evolution of Kim Jong Un’s ‘All-Purpose Sword’

From my colleague and good friend Mathew Ha. For those who know Mathew, he is making a remarkable recovery from the stroke he suffered in August. He is now at home and going through multiple outpatient therapies to regain full function. The prognosis is optimistic and he may be able to gain full function in 6 to 9 months.

Seven excellent recommendations:

1. Escalate economic measures targeting the financial networks that launder North Korean funds.

2. Pressure China to dismantle North Korean cyber infrastructure.

3. Publicize information about cryptocurrency hacks

4. Conduct information operations against Pyongyang.

5. Commission research on public blockchains.

6. Foster more public-private cooperation and innovation in cryptocurrency, blockchain, and fintech.

7. Conduct studies within the U.S. intelligence community and other agencies to forecast trends in the use of cryptocurrency, blockchain and fintech by U.S. adversaries.

The Evolution of Kim Jong Un’s ‘All-Purpose Sword’

by Mathew Ha

fdd.org · October 28, 2022

Introduction

For decades, the Kim regime has used weapons tests, border conflicts, and acts of terrorism to gain attention and raise tensions. The regime then demands economic and political benefits in exchange for reducing the tensions it provoked. Pyongyang has the potential to add cyberattacks to this repertoire. Kim Jong Un reportedly described cyber warfare in 2012 as North Korea’s “all-purpose sword,” which provides “a capability to strike relentlessly.” In the decade since then, Pyongyang has wielded its growing cyber capabilities to reap financial, political, and strategic benefits to prolong the Kim regime’s survival.

Over the past four years, Pyongyang’s financially motivated cybercrime has become more prolific. North Korean cyberattacks increased by 32 percent year over year in 2020, according to South Korea’s National Intelligence Service. The blockchain data firm Chainalysis observed a steady increase in attacks on cryptocurrency exchanges between 2019 and 2021. This may reflect the regime’s desperation as it faces one of the most challenging economic crises in decades. North Korea has likely stolen “hundreds of millions of dollars, probably to fund government priorities, such as its nuclear and missile programs,” the U.S. intelligence community concluded in April 2021. Pyongyang’s hackers steal money directly from international banks and cryptocurrency exchanges, in addition to employing ransomware and cryptocurrency mining tools to generate funds.

Cybercrime is an integral element of the Kim regime’s hybrid warfare strategy. Accordingly, Pyongyang’s foreign intelligence agency, the Reconnaissance General Bureau, houses its cyber capabilities within Bureau 121, which is responsible not only for cybercrime but also for espionage, reconnaissance, and inciting “social chaos by weaponizing enemy network vulnerabilities.”

Within the North Korean military, the General Staff Department — the armed forces’ senior leadership organ — has developed cyber capabilities to quickly incapacitate the adversary by disabling command, control, and communications systems. To compensate for its limited resources and conventional military capabilities, Pyongyang seeks to exploit its adversaries’ weaknesses. In that vein, it may launch cyberattacks against critical civilian infrastructure such as banks, public transportation, the electric grid, and telecommunications in South Korea (or the United States). Doing so could spark mass chaos, delay evacuations, and complicate Seoul’s decision making in a wartime scenario. Such efforts could require only rudimentary cyber capabilities, such as DDoS attacks, wipers, or ransomware.

The Kim regime demonstrated this sort of capability in 2013, when the North Korean hacker group Dark Seoul launched destructive attacks against three banks and three media companies in Seoul, which inflicted over $800 million in total damage and sowed confusion across South Korea’s financial sector for several days. Fortunately, Seoul has reportedly improved its cyber defenses in recent years. The Korea Internet Safety Agency has successfully blocked numerous North Korean spear-phishing attempts. However, Seoul’s ability to thwart a major attack has yet to be tested.

FDD’s 2018 study of North Korea’s CEEW strategy concluded that the Kim regime has calibrated its cyber provocations to remain within the gray zone so as not to elicit a military response from South Korea and the United States, focusing instead on financially motivated cybercrime. This chapter examines the evolving tactics and motives of Pyongyang’s cybercrime and explores how North Korea’s financially motivated cyberattacks and theft of cryptocurrencies mitigate the effect of sanctions.

The chapter also explores how, as the North Korean economy deteriorates further, the regime may seek to divorce itself conclusively from the U.S.-led international financial order. Currently, North Korea’s illicit funds must often transit formal financial institutions or U.S.-based cryptocurrency exchanges to reach their final destination. A robust cryptocurrency marketplace disconnected from the U.S.-led banking system could provide Pyongyang with a long-term solution to this vulnerability.

This chapter concludes with policy recommendations designed not only to bolster the U.S. and allied governments’ cyber defense and deterrence strategies, but also to strengthen financial safeguards against the exploitation of cryptocurrencies by North Korea and other rogue states.

Tactics and Motives of North Korean Cybercrime

FDD’s 2018 study concluded that “the majority of North Korea’s current cyber activity is focused on making — or stealing — money or collecting data for the regime.” This holds true today. The primary mission of Pyongyang’s cyber operators is financial gain, Kim Heung-kwang, a North Korean escapee and a former computer science professor at North Korea’s Hamheung Computer Technology University, explained in 2017. ClearSky, a UK- and Israel-based cybersecurity company, similarly concluded that a unique characteristic of North Korean hackers is their “dual attack mission” of monetary theft and espionage. Other state-backed cyber actors tend to focus on national security priorities, not financial gain, the researchers noted.

In addition to requiring funds for its nuclear weapons and ballistic missile programs, North Korea needs cash to offset an ongoing domestic economic crisis. In August 2020, the Kim regime made an unprecedented admission that it failed to achieve the goals of its last five-year plan. Pyongyang blamed sanctions, foreign enemies, COVID-19, natural disasters, and poor policy implementation by lower-level leaders, but the admission was a clear sign of distress.

It is true that external factors exacerbated the regime’s economic woes. Sanctions are putting pressure on Pyongyang’s finances, and Typhoon Bavi in August 2020 hammered North Korea’s agricultural sector. It is the regime’s response to the COVID-19 pandemic, however, that has been particularly devastating. To prevent a viral outbreak inside North Korea, the regime closed its borders and cut itself off from foreign trade. According to the Korea Trade-Investment Promotion Agency in Seoul, North Korea’s trade volume with China dropped by 80.7 percent in 2020. This forced several North Korean factories to close because they rely on materials and inputs from China to keep facilities and power plants running. Alexander Matsegora, Russia’s ambassador to North Korea, said that “without imported materials, raw materials and components, many enterprises stopped, and people, accordingly, lost their jobs.” As North Korea’s economy continues to deteriorate, cybercrime remains a key source of revenue.

Over the last four years, Pyongyang’s hackers diversified their methods by experimenting with business email compromise (BEC) and card skimming schemes. BEC schemes involve stealing a company’s financial records and client contact information so that hackers can disguise themselves as vendors and receive payment for fraudulent invoices. In card skimming, or “Magecart,” schemes, hackers intercept customers’ credit card information from retail websites and then sell it on the black market. While this tactic is not new in the cybercrime world, North Korea’s first publicly known successful card skimming operation began in May 2019.

Still, the priority for Pyongyang’s hackers remains banks and cryptocurrency exchanges. The U.S. government reported that between 2015 and 2020, North Korea infiltrated banks and cryptocurrency exchanges in over 30 countries. This yielded Pyongyang over $200 million between 2017 and 2019 and an additional $300 million in 2020.

North Korean hackers have two primary ways of stealing funds from traditional financial institutions. First, they may seize control of a bank’s financial transfer system run by the Society for Worldwide Interbank Financial Telecommunications, or SWIFT, and then use that control to conduct fraudulent transactions. North Korean hackers employed this method to steal $80 million from the Bank of Bangladesh in 2017. The second tactic involves breaching ATMs. After gaining control, hackers remotely order select ATMs to dispense cash, which Pyongyang’s accomplices collect.

To steal from cryptocurrency exchanges, North Korean hackers have launched spear-phishing campaigns against exchange employees. Exchanges are attractive targets because, as FireEye explains, once hackers breach an exchange, “they potentially can move cryptocurrencies out of online wallets, swapping them for other, more anonymous cryptocurrencies or send them directly to other wallets on different exchanges to withdraw them in fiat currencies,” such as dollars or euros.

Three attacks on cryptocurrency exchanges in North America, Europe, and Asia between 2020 and 2021 yielded $50 million, according to the March 2022 report of the UN Panel of Experts on North Korea. Chainalysis, meanwhile, concluded that Pyongyang successfully stole nearly $400 million in cryptocurrency from seven intrusions in 2021. In April 2022, the FBI attributed a $620 million cryptocurrency hack to North Korea. In that operation, the hackers used stolen credentials (rather than a software vulnerability) to compromise the blockchain bridge — the tool for moving cryptocurrencies between different blockchains.

The FBI has suggested that North Korean hackers may prefer targeting cryptocurrency exchanges because they provide “relatively fewer complications” compared to traditional banks. In the past, banks’ safeguards have tripped up Pyongyang’s operatives. For instance, during the hack of the Bank of Bangladesh, the New York Federal Reserve detected suspicious activity, namely that one of the recipient addresses at a Filipino bank was named “Jupiter,” a name it shared with a U.S.-sanctioned oil tanker from Iran. The Fed then paid closer attention to the hackers’ payment requests and blocked them. Although the Bank of Bangladesh did lose $80 million, the Fed’s intervention prevented the hackers from executing their planned theft of $1 billion.

Another drawback of bank heists is they require a “larger network of criminals to help steal and then launder the money,” while cryptocurrency hacks “cut out nearly all the middlemen.” Indeed, North Korean hackers require extensive help to steal from ATM machines. For example, in 2017, Japan’s National Police Agency reported that up to 260 individuals affiliated with the Japanese yakuza and other international criminal organizations helped Pyongyang’s hackers steal up to $16.6 million from 1,700 ATM machines across 17 Japanese prefectures. In February 2021, the U.S. Justice Department revealed that North Korea collaborated with a North American criminal network to support ATM schemes targeting Pakistan’s BankIslami and an unnamed Indian bank in 2018.

While North Korea does not need as many accomplices to move its cryptocurrency revenues, hackers must still rely on money launderers to transfer virtual currency into fiat currency. For example, in March 2020, the Justice and Treasury departments respectively indicted and sanctioned two Chinese currency traders, Tian Yinyin and Li Jiadong, for helping North Korean hackers convert over $100 million in stolen cryptocurrency into fiat currency through Chinese banks via several hundred small transactions. To eliminate these middlemen, North Korea would likely need to rely on emerging crypto-based payment and transaction systems.

To that end, Pyongyang invited Virgil Griffith, an American cryptocurrency software developer based in Singapore, to present at the DPRK Cryptocurrency Conference in 2019 on the topic of “potential money laundering and sanctions evasion applications of cryptocurrency and blockchain technologies.” The U.S. Justice Department later indicted Griffith for providing “highly technical information to North Korea, knowing that this information could be used to help North Korea launder money and evade sanctions.” Griffith pleaded guilty and was sentenced to five years in federal prison.

Cryptocurrency as an Engine of Sanctions Resistance

The Kim regime may shift its cryptocurrency strategy from an emphasis on acquiring cash to building resistance against sanctions. Rather than converting digital currency into fiat currency, Pyongyang could build large reserves of numerous cryptocurrencies to spend in a cryptocurrency exchange independent of the U.S.-led financial system. For the moment, that goal is mostly aspirational. Yet North Korea is adept at identifying its enemies’ structural weaknesses. The lax governance and regulatory structure surrounding digital currency is ripe for exploitation. This strategy would align with the ideological tenets of juche, the regime’s doctrine of self-reliance, by providing Pyongyang with greater financial autonomy.

However, North Korea’s ability to leverage cryptocurrency for these objectives will likely be contingent upon technological advances by other rogue states with more robust economies. Alone, North Korea cannot challenge the U.S.-led financial order.

On September 6, 2018, in Los Angeles, California, First Assistant U.S. Attorney Tracy Wilkison announces charges against a North Korean national for a range of cyberattacks. (Mario Tama/Getty Images)

Fortunately for Pyongyang, Moscow and Beijing are already exploring ways to reduce their dependence on the dollar through digital currency. In March 2021, Russian Foreign Minister Sergey Lavrov recommended during a visit to China that “we [Russia and China] need to reduce sanctions risks by bolstering our technological independence by switching to payments in our national currencies and global currencies that serve as an alternative to the dollar.” That need has only increased since Russia’s invasion of Ukraine and the West’s imposition of sanctions. China, Russia, and even Iran have started creating their own national digital currencies and blockchain platforms. Moscow, Beijing, and others are looking for ways to operate “economies outside the U.S.-led financial system” to “reduce Washington’s ability to impose sanctions,” as FDD scholars observed in 2019.

Separately, according to the UN Panel of Experts, North Koreans based in Hong Kong developed a blockchain-enabled digital currency in 2018 called Marine Chain Token for use in shipping-related transactions. The Panel hypothesized that the Marine Chain platform was funded by stolen cryptocurrencies, pointing to the platform’s ties to North Korean operatives “who have extorted Bitcoin from online companies.” In a 2021 indictment against three North Korean hackers, the Justice Department added that the Marine Chain Token enabled Pyongyang to evade sanctions and “secretly obtain funds from investors” abroad who purchased partial ownership of shipping vessels.

However, these advances still fall far short of Beijing’s and Moscow’s achievements. China began developing its own digital currency and payment systems as early as 2014 and has made significant progress. China’s most recent five-year plan noted the significance of blockchain applications for supply chain management, e-governance, fintech, and other purposes. President Xi Jinping seeks “a new industrial advantage” through blockchain. As a result, Chinese companies are filing more blockchain patents than their U.S. counterparts. Beijing’s leadership intends to leverage this new digital currency not only to support its commercial and trade activities, but also “to displace the U.S. dollar as a global reserve currency,” FDD scholars concluded in 2019.

If China succeeds in establishing an alternative system, North Korea will quickly try to attach itself to that system because Pyongyang conducts over 80 percent of its trade with Beijing. Despite significant decreases in the volume of bilateral trade — which in 2021 was down 40 percent from the previous year and 90 percent compared to pre-pandemic levels — China remains North Korea’s main trading partner.

China’s cooperation with North Korea in this emerging fintech space may have its limits if Beijing concludes that a visible role for North Korea would deter other nations from participating in a Chinese-led system, for which Beijing has global ambitions. Nonetheless, China is unlikely to reject North Korea’s participation entirely, because preventing instability inside North Korea is a long-term strategic objective for Beijing.

Recommendations

As North Korean cyber operations evolve, the U.S. government must bolster American defenses and strengthen deterrence measures. The Cybersecurity and Infrastructure Security Agency at the Department of Homeland Security has distributed numerous technical alerts on North Korean malware to help private-sector entities harden their networks. The U.S. government has also sought to impose costs on North Korea’s hackers and programmers through sanctions and criminal indictments. However, the measures have been insufficient. The United States and its allies must consider innovative ways to change the regime’s calculus. The first four recommendations below originally appeared in FDD’s 2018 report on North Korean CEEW but have been updated with current information. What follows are three additional recommendations for how the U.S. government should address the risks and opportunities presented by the accelerating global adoption of cryptocurrencies and blockchain technology.

1. Escalate economic measures targeting the financial networks that launder North Korean funds. Over the long-term, North Korea may reduce or eliminate its need for financial middlemen to launder funds and convert digital currency into fiat currency. In the meantime, however, this is a strategic weakness. The U.S. Treasury Department should sanction the individuals, companies, and banks that facilitate financial transactions on behalf of Pyongyang’s hackers and the Kim regime in general. Washington’s earlier sanctions and indictments related to North Korean cyber operations were largely symbolic because they did not target the key nodes supporting North Korean cyber operations. To be effective, sanctions should target the foreign partners, front companies, and overseas financial institutions that work with North Korea. For example, the Justice Department case against Tian Yinyin and Li Jiadong revealed that nine Chinese banks helped launder North Korea’s stolen cryptocurrency. Treasury should confirm that these banks have blocked additional suspicious transactions and are no longer complicit in such activity. If Treasury finds any further issue, it should impose additional penalties, fines, and sanctions.

2. Pressure China to dismantle North Korean cyber infrastructure. Pyongyang dispatches hackers abroad — particularly, although not exclusively, to China — to access more robust internet infrastructure capable of supporting more complex operations. Operating abroad also increases plausible deniability for the Kim regime. By contrast, relying on personnel and computer networks based solely in North Korea would create a “significant operational weakness” and leave Pyongyang vulnerable to cyberattacks that would “limit current North Korean cyber operational freedom,” according to Recorded Future. Washington should therefore urge China to repatriate all North Korean hackers. If Beijing and other foreign governments fail to dismantle Pyongyang’s illicit cyber infrastructure, the White House should consider deploying the North Korean Sanctions and Policy Enhancement Act, which grants Treasury the authority to designate individuals and entities who “have knowingly engaged in, directed, or provided material support to conduct significant activities in undermining cybersecurity.”

3. Publicize information about cryptocurrency hacks. Cryptocurrency exchanges have become regular targets of cyber criminals but often do not share the details of those hacks. Without this information, researchers, law enforcement, and government officials have limited ability to decode criminal methodologies. The United States, South Korea, and other partner countries should therefore issue breach-notification rules. They should also establish a framework for sharing information about attacks that combines regulatory and government authorities with virtual currency exchanges and providers.

4. Conduct information operations against Pyongyang. In 2017, Cyber Command reportedly launched DDoS attacks on suspected North Korean networks to limit the regime’s cyber operations. While the Defense Department should continue to employ such tactics as part of its “defend forward” strategy, cyber measures alone will not impose sufficient costs. Washington should leverage North Korean elites’ access to the global internet to expose them to foreign media and other restricted information. The Kim regime fears uncensored information that could compromise its ideological grip on the North Korean populace, such as evidence of its atrocities, corruption, and economic malpractice. Over the long term, creating a rift between these elites and Kim’s inner circle could lay the groundwork for a change in leadership and, in the short term, may convince Kim to restrict North Korean cyber operations because their cost is too great.

More broadly, the United States must develop policies to cope with the long-term risks that cryptocurrencies and blockchain technology may pose to the U.S.-led global financial system and the role of the dollar in international trade. A March 2022 executive order on digital currencies directs the Treasury Department, the Federal Reserve, the Consumer Financial Protection Bureau, and other agencies to study these issues. This is a critical first step toward safeguarding financial stability, innovation, and consumer protection.

5. Commission research on public blockchains. While the Chinese and Russian governments have advanced their study and early implementation of various blockchain tools to harden their network defenses, Beijing and Moscow have invested less in public blockchain systems, preferring private blockchains in which a single entity controls the chain and knows the identity of all participants. A public blockchain is decentralized, anonymous, and open to anyone’s participation if the individual verifies data added to this blockchain. According to the Blockchain Council, a U.S.-based group of experts, public blockchains are more secure than private networks because it is difficult for a single bad actor to compromise enough of the decentralized network to corrupt the data within the blockchain. The United States should become a leader in public blockchain technology, which not only adheres to American liberal norms and values but also is garnering more use within the consumer marketplace.

6. Foster more public-private cooperation and innovation in cryptocurrency, blockchain, and fintech. A core finding of the U.S. Cyberspace Solarium Commission is the need for greater public-private collaboration on cybersecurity. The U.S. government should sponsor business incubator programs that promote blockchain-based solutions for regulatory challenges related to cryptocurrencies’ impact on global finance and banking. Specifically, Congress should appropriate funding for the National Science Foundation to help companies working on blockchain and other distributed ledger technologies. A report from the Center for a New American Security assessed that leading the development of blockchain applications would position Washington to maintain the value of coercive economic tools, including sanctions.

7. Conduct studies within the U.S. intelligence community and other agencies to forecast trends in the use of cryptocurrency, blockchain and fintech by U.S. adversaries. The Biden administration should task the intelligence community with studying adversarial ambitions to undermine the existing financial order using cryptocurrencies, blockchain, and other fintech. The objective should be to identify future threats along with the long-term implications of current trends. Beijing has stated that it intends to design a universal digital payment network over the next 10 years to support digital currency transfers and payments worldwide. Understanding threats to America’s long-term national and financial security must be a priority.

Conclusion

To counter the North Korean cyber threat, the United States and its allies must employ a tailored approach that focuses both on the immediate needs of cyber defense and deterrence and future challenges posed by illicit financial networks and their state sponsors. With proactive measures, America and its allies can ensure that cryptocurrencies and blockchain technology become assets to protect the integrity of the global financial order.

fdd.org · October 28, 2022

7. N. Korea builds ice cream factory on Kim Jong-un's order

Kim doesn't just build nuclear weapons and missiles.

N. Korea builds ice cream factory on Kim Jong-un's order | Yonhap News Agency

en.yna.co.kr · by 이원주 · October 27, 2022

SEOUL, Oct. 27 (Yonhap) -- North Korea has completed building an ice cream factory in Pyongyang as instructed by leader Kim Jong-un, its state media reported Thursday, amid an economy faltering under global sanctions.

A ceremony was held the previous day to celebrate the construction of a "modern" ice cream production base in the center of Taesongsan, according to the official Korean Central News Agency (KCNA).

Jon Hyon-chol, chairman of the budget committee of the Supreme People's Assembly, delivered a speech at the ceremony, stressing that the "project for improving the welfare of the people cannot be delayed regardless of how severe the hardships are."

He added that the construction was completed within a short period of time thanks to "special measures" taken by leader Kim to speed up the project.

Taesongsan is a mountain at the edge of Pyongyang with major attraction sites, including amusement parks, swimming pools and a zoo.

North Korea has recently been dialing up efforts to improve its people's livelihoods amid chronic food shortages and prolonged global sanctions.

julesyi@yna.co.kr

(END)

en.yna.co.kr · by 이원주 · October 27, 2022

8. Sohae Satellite Launching Station: Significant Activity Underway

imagery at the link: https://www.38north.org/2022/10/sohae-satellite-launching-station-significant-activity-underway/

Sohae Satellite Launching Station: Significant Activity Underway

BY: PETER MAKOWSKY AND JACK LIU
OCTOBER 26, 2022

Kim Jong Un’s visit to North Korea’s Sohae Satellite Launching Station in March 2022 provided a clear mandate to upgrade and expand the site’s capabilities. While it took a few months for this transformation to begin, major changes were underway by early September. Commercial satellite imagery from October 23 and 24 indicates significant activity taking place throughout the site, especially at key areas such as the launch pad and VIP housing area. Additionally, a new road network may provide the North Koreans more direct access from the complex to the workers’ housing areas and eventually down to the sea.

Launch Pad

There has been significant activity at the Sohae launch pad since late summer.

Since July, work appears to have started on modifying the gantry tower. Additionally, the mobile transfer shelter, used to move assembled rockets to the gantry tower, has been moved away from the rocket processing/preparation building, exposing the access opening to the underground rail-receiving area.[1]

Work to expand the capacity of the fuel and oxidizer bunkers located to the south and southwest of the launch pad continues. Furthermore, since July, neatly arranged stacks of materials have been observed on the south side of the pad: some appear to be cylindrical—five large and four small—and may be fuel and oxidizer canisters removed from the bunkers when refurbishment activities began.

In addition, the foundations for two buildings are now underway at the northwest end of the launch platform. It is too early to suggest their purpose, but each is subdivided into a series of interior rooms. Immediately east of these buildings, a road and bridge are under construction that will eventually connect the main road to the underground receiving area of the launch pad. This will likely allow rocket components to be moved into the facility by both road and rail.

On the hilltop southwest of the launch pad area, two probable water tanks have been installed. These are likely intended for fire suppression and will employ a gravity feed when complete, although no evidence of trenching for piping is yet observed.

Figure 1. Construction ongoing at the launch pad.