[Global NK Interview] Kim Jong-un’s Cyber Strategy to Evade North Korea’s Economic Sanctions

YouTube Link: https://www.youtube.com/watch?v=4xPQQosv8HU

In this interview discussing North Korea's cyber attacks and South Korea and the U.S.'s response strategies, Jean H. Lee, Senior Fellow at the Wilson Center, explains that North Korean leader Kim Jong-un has cultivated specialized hacker units, known as 'cyber warriors,' since the early days of his rule. She emphasizes that despite stringent U.S. and UN sanctions on North Korea's missile and WMD programs, these units have successfully circumvented international economic sanctions by illicitly acquiring cryptocurrency through cybercrime. Furthermore, noting South Korea's extensive experience in countering North Korean cyber attacks and its position at the forefront of cryptocurrency technology, she recommends that the South Korean government strengthen the ROK-U.S. alliance's capabilities in cybersecurity and establish regulatory policies for virtual assets.

I. The Background Behind North Korea’s Cybersecurity Attacks

• As part of her research, Ms. Jean Lee looks into “how North Korea produces hackers when most of the people are disconnected from the internet.”

• Ms. Lee states that “Kim Jong-un has managed to add to his formidable weapons program,” notwithstanding “very little export and import for a country that relies on the outside world for fuel, food, and other basic necessities.”

• During her reporting trips to North Korea from 2008 to 2017, which she refers to as the “succession period” from the Kim Jong-il to Kim Jong-un regime, Ms. Lee notes that “the propaganda campaigns were centered on science and technology.” Under this campaign, Kim Jong-un “invested in an elite group of students to become computer-savvy” and “has overseen the cultivation of a core group of what we call “cyber warriors.”

• She claims that this was a way for Pyongyang to engage in illicit money-making; that is, to “find a new, modern way to get around the sanctions and make money.”

II. The Scale of North Korea’s Cybersecurity Attacks

• Ms. Lee states that “North Korea’s investment in cyber, as a form of money-making, is something that has been very successful for them in circumventing sanctions.” She evaluates that “North Koreans are constantly one step ahead.”

• Ms. Lee emphasizes that Pyongyang’s cyber-attacks largely remained under the surface because “we underestimate them.” Nonetheless, according to a confidential United Nations report in 2019, North Korea has managed to “steal more than two billion dollars in cyber theft” over 35 instances across 17 countries. This “doesn’t include the reported theft of more than 600 million dollars in cryptocurrency from a popular video game.”

• Pyongyang’s attacks have “reached a level of awareness among the South Korean public as well,” following the arrest of two South Koreans suspected of “spying for North Korea,” “paid with the digital currency of Bitcoin.”

• Although North Korean hackers seem distant from our everyday lives, they in fact, “target us in our everyday lives, every single day.” To illustrate, “our lives are so much online, especially in South Korea.” North Korean hackers can easily take advantage of how South Koreans can be “held hostage” in the online space.

• Not to mention, “the number of cyber-attacks from suspected North Korean hackers is over a million a day” in South Korea.

III. The Implications of North Korea’s Cybersecurity Attacks on the Sanctions Regime

• Ms. Lee underscores the importance of incorporating cyber in Washington’s policy circles, provided that it is an integral part of policy research “when it comes to sanctions.” As “sanctions and borders don’t matter in the world of cyberspace,” “North Korea is relying more heavily on cyber theft.”

• While she notes that “cyber is notoriously difficult to trace and very difficult to attribute,” “the North Koreans are leaving some tell-tale signs.” She claims that they are a “bit clumsy” because “they haven’t grown up in the internet the way we have.” Likewise, “there are slight variations in the spelling and vocabulary and some of those come up in the malicious codes that the North Koreans are using.”

• She suggests that sanctions regimes should “target those overseas networks;” that is, “young men were dispatched on legitimate visas to carry out IT work,” which the FBI believes to be “hacking.” Clamping down on overseas networks would “stem the flow of currency back to North Korea but also really make it very difficult for the North Koreans to operate overseas.”

• Ms. Lee posits that North Korea faces the challenge of “turning digital currency into fiat currency,” now that they’ve been investing in cryptocurrency.

IV. Prospects for ROK-U.S. Cooperation on Technology and Cyber

• While President Moon and Biden vowed on their summit last year “to create a working group on cyber,” “there hasn’t been much progress.”

• The recent summit between President Yoon and Biden was focused on “restoring alliances and reassuring allies in Asia.”

• As “South Korea has been a target of cyber-attacks from North Korea for such a long time,” Ms. Lee underscores that Seoul has “a depth of experience, and has a lot of experience to share.” It has been utilized by Pyongyang’s hackers as “a practice ground,” which is attested by the fact that “everything that we were seeing in South Korea, we’ve seen them try out elsewhere.”

• In this regard, Ms. Lee notes that “this is an area where South Korea can really take a lead,” especially provided that “South Korea is regarded by the rest of the world as being at the forefront of technology.”

V. Steps Forward for the Yoon Administration

• Ms. Lee assesses that North Korean hackers are taking advantage of the vulnerability that stems from “a lack of regulation both on the national level and internationally.” She advises that there should be “protection and information-sharing,” should the Yoon administration “embrace digital currency going forward.”

• If “South Korea is at the forefront in terms of embracing cryptocurrency,” Ms. Lee stresses that it should also be “on the forefront in enforcement and regulation.”

• She highlights the necessity of “marrying the understanding of technology with an understanding of the psychology, the policy.” Governments should “treat it like a policy issue rather than just a tech issue.”

• Ms. Lee adds that we cannot compete with the motivation Kim Jong-un has in training cyber warriors. That is to say, “they have more motivation and pressure than any of our cybersecurity experts could ever have.” To counter this, she proposes that “the South Korean government needs to invest in their cybersecurity experts and treat them like cyber warriors as well.” ■

※ Please cite accordingly when referencing this source.

VI. Biography

■ Jean H. Lee_ Senior Fellow at the Wilson Center. Master of Journalism from Columbia University, Global Fellow at the Wilson Center. Former chief of the AP Pyongyang bureau and AP's Korean Peninsula bureau chief. Recipient of the APME Award for Media Excellence in 2012 (U.S. and Canada) and the Online Journalism Award in 2013. Nominated for the Pulitzer Prize for Feature Writing in 2013. Contributes to The New York Times and appears as a Korean Peninsula expert on CNN, BBC, and NPR.

■ Managed and Edited by: Lee Seung-yeon, EAI Research Fellow

    Inquiries: 02 2277 1683 (ext. 205) | slee@eai.or.kr

Video Transcript

that means very little export and import for a country that relies on the outside world for fuel for food and other basic necessities and still kim jong-un has managed to add to his formidable weapons program north korea is relying more heavily on cyber theft sanctions and borders don't matter in the world of cyberspace uh because south korea has been a target of cyber attacks from north korea for such a long time has a depth of experience has a lot of experience to share south korea as being on the

forefront in terms of embracing cryptocurrency it'll need to be on the forefront in enforcement and regulations the south korean government need to invest in their cyber experts in their cyber security experts and treat them like cyber warriors as well