In-depth analysis of North Korean internet activity reveals an informed, modern, and technologically savvy ruling elite. Click here to download the complete analysis as a PDF. Executive Summary This is part bitcoin global mining nodes of our series on North Korea. North Korean cyber actors are not crazy or irrational: they just have a wider operational scope than most other intelligence services.
Here we enrich our analysis via our intelligence partner, Team Cymru, and conduct a comprehensive study revealing unique insights into how North Korean leadership and ruling elite use the internet and what that can tell us about their plans and intentions. Our analysis demonstrates that the limited number of North Korean leaders and ruling elite with access to the internet are actively engaged in Western and popular social media, regularly read international news, use many of the same services such as video streaming and online gaming, and above all, are not disconnected from the world at large or the impact North Korea’s actions have on the community of nations. Attempts to isolate North Korean elite and leadership from the international community are failing. In fact, their internet activity is in many ways not that different from most Westerners. The data set reviewed suggests that general internet activity in North Korea may not provide early warning of a strategic military action, contrary to conventional hypotheses.
If there is a correlation between North Korean activity and missile tests, it is not telegraphed by leadership and ruling elite internet behavior. North Korea is not using territorial resources to conduct cyber operations and most North Korean state-sponsored activity is likely perpetrated from abroad, which presents an opportunity to apply asymmetric pressure on the Kim regime. This analysis, together with part one of our blog series, demonstrates that there are likely other regime pressure points, and as a result, other tools, techniques, and partners that could be explored toward a path for North Korean denuclearization. South Korean media assesses that there may be as many as 4 million mobile devices in North Korea. A small minority of users, such as university students, scientists, and select government officials, are allowed access to North Korea’s domestic, state-run intranet via common-use computers at universities and internet cafes. The network, called Kwangmyong, currently connects libraries, universities, and government departments and is slowly making its way into homes of better-off citizens.
It houses a number of domestic websites, an online learning system, and email. The sites themselves aren’t much to get excited about: They belong to the national news service, universities, government IT service centers, and a handful of other official organizations. Computer lab at Kim Il Sung University. Among the select few with permission to use the country’s intranet are an even slimmer group of the most senior leaders and ruling elite who are granted access to the worldwide internet directly. There are three primary ways North Korean elites access the internet.
First is via their allocated . 22, which also hosts the nation’s only internet-accessible websites. The second method is via a range assigned by China Netcom, 210. Korea Posts and Telecommunications, Co, the state-run telecommunications company.
The third method is through an assigned range, 77. Two, we chose this date range, April 1 through July 6, 2017, because it represented one of the periods of highest missile launching and testing activity, and also because it was the time period during which the data had the greatest depth and fidelity. Analysis In the early hours of April 1, 2017, as many in the West were just waking up, checking email and social media, a small group of North Korean elites began the day in much the same manner. Some checked the news on Xinhua or the People’s Daily, others logged into their 163. Chinese-language videos on Youku and searched Baidu and Amazon.
Recorded Future’s analysis of this limited-duration data set has given us new insight into this isolated country and ruling regime. Our analysis demonstrates that the limited number of North Korean leaders and ruling elite with access to the internet are much more active and engaged in the world, popular culture, international news, and with contemporary services and technologies than many outside North Korea had previously thought. While this data source is not absolute, it gives us a detailed picture of North Korean internet use and activity during the April to July 2017 timeframe, and as a result, we are able to reach a number of unique new insights. The data reveals that North Korea’s leadership and ruling elite are plugged into modern internet society and are likely aware of the impact that their decisions regarding missile tests, suppression of their population, criminal activities, and more have on the international community. These decisions are not made in isolation nor are they ill-informed as many would believe.
For example, similar to users in the developed world, North Koreans spend much of their time online checking social media accounts, searching the web, and browsing Amazon and Alibaba. Additionally, North Koreans have distinct patterns of daily usage over this period as well. On weekdays, times of highest activity are from approximately 9:00 AM through 8:00 or 9:00 PM, with Mondays and Tuesdays being the days of consistently highest activity. Not an Early Warning for Missile Activity Many researchers and scholars have hypothesized that there may be a connection between North Korean cyber activity and missile launches or tests. In particular, that we may be able to forecast or anticipate a missile test based on North Korean cyber or internet activity.
Daily actual internet activity for April 1 through July 6, 2017. Red bars are dates of North Korean missile tests or launches. This current data set is too short a duration of time to apply any long-term conclusions about the utility of internet activity as a warning device for missile tests. However, our analysis does suggest that if there is a correlation between North Korean activity and missile tests, it is not telegraphed by leadership and ruling elite internet behavior.