When is it Enough for Putin and Russia?

Posted on March 31, 2017March 31, 2017 by Denise Simon

NBC

FBI: Russian Citizen Pleads Guilty For Involvement In Global Botnet Conspiracy

The summary below for the most part echoes the same testimony delivered by 6 panel members in two separate hearings before the Senate on March 30, 2017.

Two particular panel witness members were Clint Watts and Thomas Rid. (videos included)

There are several experts and those in media commentary that say there is no evidence of Russian intrusions. But there IS in fact evidence and attribution does required a long time to investigate, collaborate and convey, which is why the FBI has taken so long to provide. There are countless private corporations in the cyber industry, not tied to government in any form. They are hired to protect systems, investigate intrusions and research hacks and variations of interference both nationally and globally.

The United States is hardly the only victim of Russian intrusion, as Europe and the Baltic States are having the exact issues. But Americans rarely pay attention to anything outside the United States.

So, when is enough…enough for Putin? No one knows and due to the constant successes listed so far, there is very little reason for ‘active measures’ of asymmetric warfare tactics to cease….it is cheap ad effective and for the most part anonymous. The mission objective by the Kremlin is division, chaos, leaked propaganda and repeat….works doesn’t it.

DailyMail

Propaganda is nothing new. But Moscow is frighteningly effective—and worse is on the way.

***

What the Russians want: How Russia uses cyber attacks and hybrid warfare to advance its interests

What, exactly, do the Russians want? Their very active cyber operations obviously serve state goals, but what are those goals, and how can they inform a Western response?

ITSEF’s second day opened with a panel on Russian hybrid warfare—a combination of cyberattack and information operations with both conventional and irregular military operations. Larry Hanauer, of the Intelligence and National Security Alliance, chaired a discussion among the Hoover Institution’s Herb Lin, Lookout’s Mike Murray, and LIFARS CEO Ondrej Krehel.

Policy driven by resentment.

Hanauer’s opening question was open-ended: what are Russia’s policy goals, and how does it use hybrid warfare to advance them? The panel was in agreement that the key to understanding Russian actions in cyberspace is to recognize them as driven by resentment. Lin called that resentment “longstanding.” It stems from the collapse of the Soviet Union at the end of the Cold War and Russia’s treatment internationally since then. Russian leaders and a substantial set of the Russian population views that treatment as disrespectful, contemptuous.

Russia has a very long tradition of using deception and propaganda, Lin said, and he added that the country doesn’t draw clear lines between peace and war. “It’s always war, even below the level of armed conflict.” The long-term goal is restoration of Russia’s place in the world. Creation of chaos through the dissemination of fake news and other information operations is simply battlespace preparation. Cyber, he added, gives you low-cost tools you didn’t have before. “It’s an attack on brainspace, and we’re all in the attack surface.”

Murray agreed, noting one current success of Russian information operations. We’ve been distracted from their intervention in Syria by news and fake news surrounding the US elections.

One of the more prominent features of the Russian way of cyber warfare is their willingness and ability to use criminal organizations for operational purposes. During the Cold War, Krehel explained, “if you did harm to the US, you were a hero.” Among other possibilities, that harm could be reputational or it could be economic, and criminals are well-adapted to inflicting those kinds of harm. There’s a view now, among Russian leaders, that they can expose personal information of essentially all Americans, and that this will yield a comprehensive picture of American finances down to the individual level. It’s very important to the Russian government, Krehel observed, to understand what the US can afford, and what capabilities we’re investing in, and all manner of data go into building up that picture. Lin: agreed that Russian espionage aggregates data in ways that render those data more valuable than the simple loss would impose on any single victim.

As a side note on the Russian President, the panel appeared to agree, as one member put it, that we now see one man, President Putin, who is able to use the resources of a modern nation-state to redress a deeply held personal grievance.

Chaos as statecraft.

This general orientation, according to Murray, can be encapsulated by noting that all war, to Russia, is about political ends. There’s no separation of politics from the economy or business. The increase in chaos we see in Western news, information, and political culture is, from a Russian point of view, a desirable thing.

And chaos serves tactical as well as strategic ends. Krehel expanded on this by asserting that Russia wants chaos because it doesn’t have the funding, the financial resources, of, say, the US. Thus Russian security services hand intelligence over to criminal groups. “A normal government doesn’t hand over its political agenda to criminal groups,” he said, but Russia’s does.

Murray offered an evocative story: “The number two guy in Russia has two pictures on his desk: one of Putin, and the other of Tupac Shakur.” So there’s a kind of gangster ethos at the highest levels. And whie using criminal gangs as cutouts also affords an obvious form of deniability, we shouldn’t be deceived.

In response to Hanauer’s question about who might be the leading cyber actors in the Russian government, Krehel said that they were the organizations one would expect, with the FSB and GRU occupying prominent positions. Different units within the government do cooperate—resource and manpower constraints make this inevitable—and in those services “loyalty is high, and rated very highly.”

You cheated them. Expect payback.

There’s also a common motivation, and Russian information operations play into it, especially domestically. “Russia believes all of you in this room cheated them,” Krehel said, and this theme is consciously exploited to the population as a whole, but particularly to the security services. “So the GRU’s big objective is to cripple you financially. And then they want to make you look ridiculous.”

Lin agreed. “That’s an accurate picture of how it works on the ground. Russia is a thugocracy, a state of organized crime.” He has seen reports (unconfirmed reports, he stressed, but he also clearly thought them plausible) that there are formal memoranda of understanding from the FSB to criminal gangs, outlining what the gangs can expect in return for services. “Other governments have done this, but it’s a way of life in Russia. The line between intelligence services and gangs is very vague.”

There’s no such thing as a win-win, Lin said, in the Russian worldview. “To Russia, it’s always win-lose.” Hanauer noted that this seemed a point of difference between Russia and China, and Lin agreed. Where there have been agreements of a sort between the US and China moderate conduct in cyberspace, Lin thinks there’s little evidence that such deterrent or confidence building agreements will have much effect in US-Russian relations.

Protect what’s important? Everything’s important (to the Russians).

Asked about defensive measures, Lin said that, “while there’s a logic to saying, ‘protect what’s important,’ to a good intelligence agency there’s never too much data.”

There are preferences for certain kinds of targets, which Krehel enumerated: first, oil, second, pharma, and a distant third, tech. Tech was less actively prospected because of Russian confidence that “they’re so much better at tech than we are.” Lin agreed, and said there was some basis for that confidence. “In the physics community, for example, we’ve long noted the sophistication of Russian physicists. They have great theoretical insight.”

Humiliation as statecraft, and the commodity tools used to do it.

Murray said he’d recently heard someone lamenting that he missed the Chinese, who just stole without embarrassing you. “That says a lot about Russian operations.”

Turning to the embarrassment inflicted during the US elections, Hanauer asked what kinds of tools the Russians were using for their attacks? Lin answered that the most consequential hack—Democratic Party operative John Podesta’s email—was phishing, a very basic approach.

Krehel said that, during the run-up to the election, he observed the Democratic and Republican National Committee networks being equally pressured by the Russians, the former more successfully than the latter. The approach in both cases focused on human engineering.

The Russian services, Murray explained, focus on engineering end-to-end systems. “‘PowerShell’ is the magic word for Russian coding.” There’s an emphasis on the least common denominator—phishing, PowerShell, darkside commodity tools—in effect a startup mentality. “All their tools are malleable and in motion, all the time.”

Critical infrastructure and acts of war.

Hanauer asked about the much-feared prospect of an attack on US critical infrastructure. Are we seeing, he asked, Russian attacks on US critical infrastructure? And if and when we do, would these be acts of war? “If they’re not trying [to hit US critical infrastructure]” Lin said, “then someone over there should be fired.” In Murray’s view, “Everyone’s trying to figure out the act-of-war line.” He reviewed briefly the history of Russian attacks (a coordinated mix of criminal and intelligence service attacks) on the Ukrainian power grid. He thought Russia would be more circumspect about doing such things to the US grid because, of course, the US is potentially a more dangerous adversary than Ukraine. But he also thought that if the Russians came to believe such attacks would be useful, they wouldn’t hesitate to undertake them.

– See more at: https://thecyberwire.com/events/sinet-itsef-2017/what-the-russians-want-how-russia-uses-cyber-attacks-and-hybrid-warfare-to-advance-its-interests.html#sthash.FnUREpYT.dpuf

Russia is a Threat, China Aggression is Under-Reported

Posted on March 28, 2017March 28, 2017 by Denise Simon

President Jimmy Carter gave away the Panama Canal which was officially transferred in 2000. Few know about the other canal project in Nicaragua, which is designed to be bigger and better. It was launched by a Chinese billionaire however, it appears the Chinese government is actually behind it.

Image result for china nicaragua canal

The whole matter is shrouded in secrecy while the Panama Canal is going through a huge expansion.

Image result for china militarize islands PBS

China has been creating islands in the South China Sea while other islands are a source of major dispute. China has been seen as militarizing the manufactured islands giving rise to concerns of major cargo and global shipping lanes. Could China be making a worldwide play to control commerce and sea transportation?

Chinese state firms have expressed an interest to develop land around the Panama Canal, the chief executive of the vital trade thoroughfare said, underlining China’s outward push into infrastructure via railways and ports around the world. China’s state firms have in recent years already chalked up investments in key logistics nodes, including Piraeus in Greece and Bandar Malaysia, a major development project that is set to be the terminal for a proposed high-speed rail link between Kuala Lumpur and Singapore. More here from Reuters.

So is there more to this under reported threat by China? Yes. For instance:

HONG KONG — When the United States Air Force wanted help making military robots more perceptive, it turned to a Boston-based artificial intelligence start-up called Neurala. But when Neurala needed money, it got little response from the American military.

So Neurala turned to China, landing an undisclosed sum from an investment firm backed by a state-run Chinese company.

Chinese firms have become significant investors in American start-ups working on cutting-edge technologies with potential military applications. The start-ups include companies that make rocket engines for spacecraft, sensors for autonomous navy ships, and printers that make flexible screens that could be used in fighter-plane cockpits. Many of the Chinese firms are owned by state-owned companies or have connections to Chinese leaders.

The deals are ringing alarm bells in Washington. According to a new white paper commissioned by the Department of Defense, Beijing is encouraging Chinese companies with close government ties to invest in American start-ups specializing in critical technologies like artificial intelligence and robots to advance China’s military capacity as well as its economy. More here from the New York Times.

Humm, need more? Both China and North Korea are known for hacking. China may have some obscure agreement with North Korea to hack selected global sites. As we know, North Korea is a threat as they are continuing to advance their missile program and super thrust rocket engines which are tied to their nuclear weapons program. China provides that communications, telecom and internet platform and servers for North Korea.

Image result for china hacking BBC

North Korea relies on China for Internet connectivity, partially due to longstanding ties between the two nations and partly because it has few options. North Korea borders just three countries: South Korea, with which it is still technically at war, Russia and China. The Chinese Internet is well developed and the Russian border is far from Pyongyang, the North Korean capital, making China a good choice. Going back to 2014, the U.S. State Department was well aware of all these conditions between China and North Korea, still no solution by the Obama administration.

***

Hackers associated with the Chinese government have repeatedly infiltrated the computer systems of U.S. airlines, technology companies and other contractors involved in the movement of U.S. troops and military equipment, a U.S. Senate panel has found.

Cybersecurity expert Dmitri Alperovitch, chief technology officer with the security firm Crowdstrike, said China had for years shown a keen interest in th the logistical patterns of the U.S. military.

The investigation focused on the U.S. military’s ability to seamlessly tap civilian air, shipping and other transportation assets for tasks including troop deployments and the timely arrival of supplies from food to ammunition to fuel. U.S. authorities charged five Chinese military officers, accusing them of hacking into American nuclear, metal and solar companies to steal trade secrets.

Last month, Community Health Systems (CYH.N), one of the largest U.S. hospital groups, said Chinese hackers had stolen Social Security numbers and other personal data from some 4.5 million patients.

*** North Korea has an elite and secret hacking unit as well known as Bureau 121. The Department of Defense submitted a report to Congress on Bureau 121 using asymmetric warfare. North Korea also has an additional cyber unit known as Office 91.

Office 91 is thought to be the headquarters of North Korea’s hacking operation although the bulk of the hackers and hacking and infiltration into networks is done from Unit 121, which operates out of North Korea and has satellite offices overseas, particularly in Chinese cities that are near the North Korean border. One such outpost is reportedly the Chilbosan Hotel in Shenyang, a major city about 150 miles from the border. A third operation, called Lab 110, participates in much the same work.

There are also several cyberunits under North Korea’s other arm of government, the Workers’ Party of Korea.

Unit 35 is responsible for training cyberagents and is understood to handle domestic cyberinvestigations and operations. Unit 204 takes part in online espionage and psychological warfare and Office 225 trains agents for missions in South Korea that can sometimes have a cyber component. More here from PCWorld.

*** China is well aware of North Korea activities, while China has and is becoming more aggressive globally. There is clearly collusion, yet what is the West and in particular the United States prepared to do in response remains unclear. However, China did approve 38 Trump trademarks. President Trump meets with Xi Jinping, maybe we will know more in April.

North Korea’s Weapons Program Includes More Countries

Posted on March 20, 2017March 20, 2017 by Denise Simon

We can go back to 1968 when North Korea hijacked our naval intelligence ship USS Pueblo as a reminder for the basis on how to address North Korea today.

Image result for uss puelbo

Then as today, Russia collaborated with North Korea as does Iran. North Korea dispatched 2 MiG fighter jets along with several attack submarines in the capture of the Pueblo. At the time was also the Vietnam war of which Russia provided unmeasured military support to North Vietnam and did not want to add another theater of conflict with the United States, as noted by the Blue House raid. noted by the In fact, China cannot be overlooked either for many reasons.

Newly placed U.S. Secretary of State Rex Tillerson is traveling the region meeting with Asian leaders on the matter of stopping North Korea. The question is how far and wide are these talks with regard to additional countries cooperation with North Korea.

As for Iran and North Korea, The Telegraph reported the following:

The Shahab-3 is a modified version of North Korea’s Nodong missile which itself is based on the old Soviet-made Scud.

The Nodong, which Iran secretly acquired from North Korea in the mid-1990s, is designed to carry a conventional warhead. But Iranian engineers have been working for several years to adapt the Shahab-3 to carry nuclear weapons.

“This is a major breakthrough for the Iranians,” said a senior US official. “They have been trying to do this for years and now they have succeeded. It is a very disturbing development.”

The Shahab 3 has a range of 800 miles, enabling it to hit a wide range of targets throughout the Middle East – including Israel.

Image result for north korea high thrust engine UPI

Further in 2015, Forbes reported collaboration between Iran and North Korea where the exchange of engineers and scientists between the two countries is common:

North Korea and Iran are believed to be exchanging critical stuff – North Korean experts and workers remaining in place while Iran sends observers to check out intermittent North Korean missile launches and see what North Korea is doing about staging a fourth underground nuclear explosion.

The nuclear exchange revolves around North Korea’s program for developing warheads with highly enriched uranium – with centrifuges and centrifuge technology in part acquired from Iran. At the same time, North Korea is able to assist Iran in miniaturizing warheads to fit on missiles – a goal the North has long been pursuing – and also can supply uranium and other metals mined in its remote mountain regions.

“North Korea continues to supply technology, components, and even raw materials for Iran’s HEU weaponization program,” says Bruce Bechtol, author of numerous books and studies on North Korea’s military and political ambitions. Moreover, he says, “They are even helping Iran to pursue a second track by helping them to build a plutonium reactor.”

That assessment supports the view of analysts that Iran is counting on North Korean expertise in constructing a reactor that produces warheads with plutonium. The reactor would be a more powerful version of the aging five-megawatt “experimental” reactor with which the North has built perhaps a dozen warheads at its nuclear complex at Yongbyon, including three that it’s tested underground — in October 2006, May 2009 and February 2013, two years ago this month.

Then comes China, where the entire North Korea internet platform used by North Korea is hosted by China. Beyond managing cyber systems for North Korea, China is also collaborating with North Korea on nuclear weapons at key production sites producing lithium for thermonuclear and boosted fission research and development.

Sanctions have been placed on North Korea due to violations of UN resolutions due to the weapons of mass destruction operations which does include missiles and the nuclear program. However, North Korea has not been affected with regard to the research/development and production due to out of country front operations where China and Malaysia are involved.

Forbes also reported:

Although the UN resolutions have highly restricted North Korea’s access to the financial system on paper, the report suggests that these sanctions have not affected the ability of North Korean networks such as Pan Systems Pyongyang to finance its operations, asserting that the network maintains bank accounts in China, Malaysia, Singapore, Indonesia, and the Middle East. By conducting financial transactions under the names of its affiliates such as Pan Systems Singapore, the company has been able to maintain sufficient financial access to the international financial system that it was able to transfer funds to a supply chain of more than twenty companies in China, and has also used front companies to conduct transactions via Hong Kong-registered companies that were cleared through U.S. correspondent banks in New York. The Panel of Experts report also provides details on the interception in the Suez Canal of the Cambodian-flagged and North Korean-crew piloted Jie Shun in what it categorizes as the “largest interdicted ammunition consignment in DPRK sanctions history,” superseding the 2013 interdiction of the North Korean flagged Chong Chon Gang ship that was loaded with vintage Cuban munitions and airplane parts. The interdiction of the Jie Shun by Egypt revealed a cargo from North Korea through the Suez Canal containing 30,000 PG-7 rocket propelled grenades (RPG) and related sub-components shipped in wooden crates concealed under 2,300 tons of limonite (iron ore). The Jie Shun evaded detection by cutting off GPS during most of its journey, with the exception of transit through heavily trafficked straits and ports. The shipment from Haeju in North Korea to an undisclosed Middle Eastern destination were falsely labeled as “assembly parts for an underwater pump,” and the bill of lading showed the address of the “Dalian Haoda Petroleum Chemical Company, Ltd.”

Rex Tillerson stated that ‘strategic patience’ has run out with regard to North Korea and all options remain on the table including preemptive strikes. North Korea has launched 46 missiles since 2011 and the most recent launch was to test a super high thrust rocket steering engine which was designed by Russian blueprints and engineers.

Tillerson at the DMZ lexpress.fr

The addition of a four-chamber steering engine further points toward a design rooted in Soviet missile technology as RD-250 and its descendants – when used on the R-36 missile and Tsiklon-2/3 orbital launchers – were coupled with a four-chamber RD-68M steering engine.

Photo: KCNA

This engine adaptation in all likelihood uses Unsymmetrical Dimethylhydrazine and Nitrogen Tetroxide propellants – a more powerful combination in terms of specific impulse compared to the Nitric Acid / UDMH propellant used by North Korea’s Unha booster

September 2016 Test Setup vs- March 2017 Test Setup – Images: KCTV/KCNA

North Korea = Iran, China, Syria, Russia, Egypt

Posted on March 15, 2017March 15, 2017 by Denise Simon

There are many worries about building military actions by North Korea such that deployments of U.S. military assets along with that of Japan, S. Korea and other nations in the region are preparing for various conditions due to continued threats by the DPRK.

CNN

There is a standing sanction program against North Korea, but they are not holding due to Africa.

JOHANNESBURG (AP) — North Korean weapons barred by U.N. sanctions ended up in the hands of U.N. peacekeepers in Africa, a confidential report says. That incident and others in more than a half-dozen African nations show how North Korea, despite facing its toughest sanctions in decades, continues to avoid them on the world’s most impoverished continent with few repercussions.

The annual report by a U.N. panel of experts on North Korea, obtained by The Associated Press, illustrates how Pyongyang evades sanctions imposed for its nuclear and ballistic missile programs to cooperate “on a large scale,” including military training and construction, in countries from Angola to Uganda.

Among the findings was the “largest seizure of ammunition in the history of sanctions” against North Korea, with 30,000 rocket-propelled grenades found hidden under iron ore that was destined for Egypt in a cargo vessel heading toward the Suez Canal. The intended destination of the North Korean-made grenades, seized in August, was not clear.

A month before that, the report says, a U.N. member state seized an air shipment destined for a company in Eritrea containing military radio communications items. It was the second time military-related items had been caught being exported from North Korea to Eritrea “and confirms ongoing arms-related cooperation between the two countries.” Eritrea is also under U.N. sanctions for supporting armed groups in the Horn of Africa.

***

Experts point to China as the father and manager of North Korea and there is real truth to that, yet the collaborations go far beyond China, to include Iran, Syria and Russia and in some cases Egypt. Nearly all of the North Korea country’s communications and Internet traffic is routed through China. Firms that monitor that traffic say it is comparable to only about 1,000 high-speed homes in the United States.

North Korea has intermediate-range ballistic missiles as well. North Korea has tested nuclear weapons on three occasions; Iran and Syria’s nuclear programs have raised suspicions that those countries are pursuing nuclear weapons. However, Iran has, according to the IC, halted its nuclear weapons program, and Syria does not appear to have an active nuclear weapons program.

Congress has held numerous hearings regarding these countries’ nuclear and missile programs. It has also passed legislation providing for sanctions on countries whose entities assist Iran, North Korea, and Syria to obtain weapons of mass destruction (WMD) and missile delivery systems. For example, the Iran, North Korea and Syria Nonproliferation Act (INKSNA, P.L. 106-178) imposes penalties on countries whose companies’ exports. See report here.

***

Secretary of State Rex Tillerson will warn China’s leaders that the United States is prepared to step up missile defenses and pressure on Chinese financial institutions if they fail to use their influence to restrain North Korea’s nuclear and missile programs, according to several officials involved in planning his first mission to Asia.

Reinforcing military ties, Gen. Joseph F. Dunford Jr., the chairman of the Joint Chiefs of Staff, conducted a 30-minute phone call on Tuesday with his South Korean counterpart, Gen. Lee Sun-jin. A Pentagon statement said the generals discussed the possibility that North Korea could carry out “provocative actions” during the joint American and South Korean exercises now underway, or in April when North Korean authorities commemorate the birthday of Kim Il-sung, the founder and first leader of the country.

Daniel L. Glaser, a former Treasury official who constructed many of the sanctions, and now a principal at the Financial Integrity Network, said in an interview that the largest Chinese banks often shun dealings with North Korea and that some of the smaller ones have little exposure to the American banking system. More here from the NYT’s.

Trump administration officials have signaled there will be even greater financial pressure placed on Beijing if it doesn’t cut off North Korea, a step that risks Chinese retaliation. “We are putting the world on notice: The games are over,” Commerce Secretary Wilbur Ross said while announcing the sanctions on ZTE last week. [….]

U.S. officials said Mr. Tillerson would be discussing North Korea at all his stops in Asia, including the issue of “secondary” sanctions against non-North Korean companies that have been aiding Pyongyang. “All of the existing tools that we have to try to bring pressure on North Korea are on the table, and we’ll be looking to try to see what the most effective combination is,” said a senior U.S. official briefed on the Asia trip.

Republican senators wrote Treasury Secretary Steven Mnuchin last month and called for an investigation into the Bank of China and other Chinese firms for their alleged roles in helping North Korea. [Wall Street Journal, Jay Solomon; link to senator’s letter here]

***

Nuclear Proliferation

Kumsan Trading. Member states are supposed to freeze the assets of, and expel the representatives of, companies involved in North Korean nuclear, missile, and other WMD proliferation. According to the Panel, the Korea Kumsan Trading Corporation is a front for North Korea’s General Bureau of Atomic Energy and helps it procure materials and fund its operations. Kumsan advertises itself online openly as dealing in sanctioned products, including vanadium and precious metals, with locations in both Moscow and Dandong. (Paras. 18-20.)

Korea Mining Development Trading Corp. (KOMID) is North Korea’s main arms dealer. It was designated in 2009 for WMD proliferation, but probably earns most of its revenue through violations of an embargo on conventional arms sales, by selling to governments in Africa and the Middle East. KOMID operates through multiple front companies that do business more-or-less openly in China. China is required to expel the representatives of these companies, but it almost never does. When one of them is exposed, it may revoke a business license or registration, but the operative goes right back into business under a new name at a new address. The Panel also found that at least nine KOMD representatives traveled through China in 2016, despite a requirement that member states deny them entry. (Table 8, Page 68.)

One of KOMID’s fronts is Namchongang Trading, which was designated by the U.N. in 2009 for procuring nuclear-related items. It operates openly in Beijing and Dandong, China, through several Chinese commercial websites. (Para. 156.) Namchongang has also operated as (or in cahoots with) Taeryonggang Trading, Namhung Trading, and Sobaeksu United Corporation, which operates in Beijing, Yingkou and Dandong. The EU designated Sobaeksu in 2010 for “the research and acquisition of sensitive products and equipment.” The Panel suspects that this entire network is involved with KOMID. (Paras. 156-59.) KOMID also does business through a front company called Beijing New Technology. (Para. 163.)

Another KOMID front, Korea Heungjin Trading, which was designated in 2012, for nuclear, missile, and other WMD proliferation, also operates openly in Dandong and Dalian. A North Korean diplomat posted at the embassy in Beijing serves as its director. (Para. 187-89.)

Green Pine Associated was designated by the U.N. in 2012 for its involvement in North Korea’s nuclear, missile, and other WMD programs. It’s still doing business openly in both Beijing, Shenyang, and Hong Kong as Green Pine, Natural Resources Development Investment Corporation, King Helong International Trading, Korea Unhasu Trading Company, and Saeng Pil Trading Corporation. (Paras. 166-83.) Green Pine is the company behind the attempted sale of the lithium from … guess where:

24. The Panel investigated the 2016 attempted online sale of lithium metal by the Democratic People’s Republic of Korea. The enriched lithium-6 isotope, and products or devices containing it, are on the list of prohibited nuclear-related items adopted by the Security Council (see annex 4-4). According to IAEA, lithium-6 is used to produce tritium, an isotope found in boosted nuclear devices. This sales attempt suggests that the Democratic People’s Republic of Korea has access to remaining quantities of the material.

25. Li-6 is advertised for sale by a company of the Democratic People’s Republic of Korea, General Precious Metal, which the European Union has identified as an alias of Green Pine Associated Corporation (Green Pine). Mr. Chol Yun was listed as the contact person of General Precious Metal for sale of the mineral and has an address and phone numbers in Beijing (see annex 4-5). The same name appeared as third secretary of the embassy of the Democratic People’s Republic of Korea in Beijing on an official diplomatic list dated 24 September 2012 (see annex 4-6). The Panel notes a pattern whereby the Democratic People’s Republic of Korea has accredited Green Pine overseas representatives as diplomats. The Panel continues to investigate this diplomat’s involvement in prohibited activities and his possible connection with another prohibited activity (see para. 91).

Korea Ryonha Machinery Joint Venture was designated in 2013 for WMD proliferation, mainly for buying, selling, and manufacturing machine tools used for making both conventional weapons and WMDs. It shows up in POE reports year after year because it continues to operate, and to display its wares at trade shows, in both Russia and China. In 2016, a Chinese company exported several machine tools to North Korea, and the Chinese government was reportedly investigating (!) Ryonha’s involvement. (Para. 196.)

[From the U.N. Panel’s 2014 report]

Training of scientists. The resolutions ban member states from training North Koreans in sensitive technology that could be used for North Korea’s WMD programs. The North Korean universities that train the country’s nuclear and missile scientists have exchange agreements with universities in Russia and China. The Panel asked the Chinese universities to explain, but they never responded. (Para. 135.)

Missile Proliferation

Kwangmyongsong missile parts. Someone, presumably the U.S. Navy, recovered the pieces of a Kwangmyongsong missile North Korea launched in February 2016 and found that it contained “ball bearings and engraved Cyrillic characters … identical to those from the 2012 Unha-3, and a “camera [and] EMI filter” from a “Chinese manufacturer, Beijing East Exhibition High-Tech Technology Co. Ltd.” (Paras. 57-58.) That “someone” also discovered the Pyongyang had imported pressure transmitters from the U.K. and Ireland, via the manufacturer’s distributor in China, via middlemen in China. (Para. 59.) This suggests several layers of violations — China’s failure to expel North Korean representatives of sanctioned entities, to enforce export controls, or to inspect cargo going to North Korea.

Shipment of Scud parts to Egypt. Paragraphs 71-77 of last year’s report discuss a shipment of Scud missile parts to Egypt. Since then, the Panel has determined that the whole scheme was run out of the North Korean embassy in Beijing. (Paras. 88-89.) The shipper was Ryongsong Trading Company, and the seller was Rungrado Trading Company, which you may remember for its human trafficking in Europe. Rungrado was designated by the Treasury Department last year for “the exportation of workers” from North Korea to earn foreign currency for Pyongyang, some of which went to North Korean agencies that were designated for supporting WMD programs. South Korea considers Rungrado to be an alias for Ryongsong. (FN.99.) Although the U.S. Treasury Department routinely designates aliases, it has not designated Ryongsong.

Weapons Trafficking

North Korea is subject to a U.N. embargo on the import, export, sale, or purchase of weapons, including weapons components, technology, services, training, and dual-use items. Since March, China has been required to inspect all cargo “that has originated in the DPRK, or that is destined for the DPRK, or has been brokered or facilitated by the DPRK or its nationals, or by individuals or entities acting on their behalf or at their direction, or entities owned or controlled by them, or by designated individuals or entities, or that is being transported on DPRK flagged aircraft or maritime vessels.” (Para. 18.) Pretty clearly, that isn’t happening.

Syria rocket shipment. You’ve already read my post on this, right? Last August, Egyptian authorities seized a record haul of North Korean weapons, mostly PG-7 antitank rockets, hidden under iron ore aboard the M/V Jie Shun. I guessed that Syria was the destination because of the geography, but it’s possible that the client could have been Hamas or Hezbollah (which have also been Pyongyang’s arms clients).

This transaction also relied heavily on North Korean agents based in China. The bill of lading lists a shipper whose address is a hotel room in Dalian, a city often used by North Korean operatives. (Para. 63.) The holder of the ship’s compliance document was one Fan Mintan. A second man, Zhang Qiao, was its emergency contact, arranged for the ship’s insurance, and registered the ship’s operator in the Marshall islands. (Paras. 65-66.) Zhang is also involved in the coal trade with North Korea (para. 68), and thus played a role in violating UNSCR 2270 and 2321. He is also linked to another suspected North Korean smuggling ship, the M/V Light. A third man, Li Anshan, whom the Panel links to Ocean Maritime Management, a North Korean shipping company designated by the U.N. for arms smuggling, helped arrange for the Jie Shun’s Cambodian registration.

Eritrea radios shipment and Glocom. I previously posted about Glocom, the Reconnaissance General Bureau front company that manufactured sophisticated military radios and was based in Malaysia. Glocom made headlines after it was exposed just after the assassination of Kim Jong-nam. Starting at Paragraph 72 of its report, the Panel described how Glocom shipped radios to Eritrea. According to the Panel, that shipment “originated in China.”

75. The air waybills listed the shipper as Beijing Chengxing Trading Co. Ltd. According to the Chinese business registry, the company is still active, mainly trading in electronics, mining equipment and machinery (see annex 8-3). Mr. Pei Minhao (???) was listed as a legal representative until 26 February 2016 and still owns most shares in the company (see para. 164).

Glocom had North Korean representatives based in both Malaysia and China; had bank accounts, front companies, and procurement agents in both Malaysia and China; used mostly Chinese suppliers; and shipped its components to Beijing or Dandong for assembly (the report didn’t specify where). (Para. 77-84, 164.) Glocom did most of its business in U.S. dollars or euro through a sanctioned bank, Daedong Credit Bank, “to transfer funds to a supply chain of more than 20 companies located primarily on the Chinese mainland; in Hong Kong, China; and in Singapore.” (Paras. 233-25.)

Naval vessel repair & construction. Last year, the Panel reported that Green Pine had refurbished military patrol boats for Angola in violation of the arms embargo. The parts were shipped from China, the Panel has asked China for an explanation, and China still hasn’t given one. (Para. 103.)

North Korean UAV that crashed in South Korea. A Beijing company, Microfly Engineering and Technology, made it. After that, the trail leads to another Chinese company and two middlemen, who either point fingers at one another or deny all involvement. The Panel asked China to investigate, but China hasn’t responded. (Para. 107.) More here to FreeKorea, remarkable work.

Maritime Traffic, Pirates, Smuggling and Dark Beacons

Posted on March 14, 2017March 14, 2017 by Denise Simon

Maritime traffic is hardly considered a top priority and it should be. For illicit activities on the high seas, there is major intelligence value when it comes to smuggling and pirates.

— Israeli navy veteran Ami Daniel points at his computer screen and explains why the ship he was tracking should have been stopped and searched. It sailed near the Libyan port of Tobruk and waited four days more than a mile off the coast without ever docking, then moved west to Misrata, which it had never visited before.

Next came Greece, where it waited another four days offshore.

Whatever was on the ship — possibly drugs, weapons or people — likely eventually made its way to Europe’s shores, he said.

At a time of deep concern over migrant smuggling, Daniel said his company Windward has the ability to pick up such suspicious maritime behavior that would otherwise go unnoticed.

Ninety percent of the world’s trade is via the oceans, and ports simply cannot check even a fraction of all the containers. For that reason, they try to narrow it down with watch lists of ships.

But with turbulence in northern Africa and the collapse of Libya, smuggling networks have taken advantage of the situation while also becoming more sophisticated, Silvia Ciotti, head of the EuroCrime research body, explained.

And with the influx of hundreds of thousands of refugees across the seas, resources in Europe have been stretched threadbare.

The same smugglers taking desperate migrants and refugees into Europe also take contraband goods, Ciotti said.

“One day it is drugs. One day it is weapons. They do not care,” she said. If a ship’s activities are unusual — turning off its radar or visiting an at-risk port — it will be flagged. More here for ToI.

The company is Windward, a rather new company that did get an interesting investor, former CIA director, General David Petraeus.

Using what it calls activity-based intelligence, Windward, a five-year-old maritime data and analytics firm here, probes beyond the ship-tracking services available on today’s market to validate identities of ocean-going vessels.

It compares their patterns of behavior and past associations with other ships —even where they loaded or didn’t load in specific ports of call.

“Nobody knows who’s the real owner of 75 percent of the world’s vessels,” said Daniel. “The reason is, for business reasons, they are registered under various flags of convenience by a lawyer who has one share and nobody knows who’s on top of him.

“So the tools of looking at data bases or registries are great in theory, but not in practice.”

The same holds true, company executives here say, for the Automated Information System (AIS), satellite-supported tracking system initiated in recent years by the US Coast Guard and now required by ocean-going vessels and passenger ships. Specific findings from the report showed an increase in GPS manipulation of 59 percent over the past two years; that 55 percent of ships misreport their actual port of call for the majority of their voyage; that large cargo ships shut off AIS transmissions 24 percent longer than others; and that 19 percent of the ships that “go dark” are repeat offenders.

To illustrate this point, Windward conducted an analysis specifically for Defense News, in which the company employed “reverse engineering” of a known arms smuggling incident to highlight similarly suspicious behavior by a ship that managed to evade detection by law enforcement authorities.

Its baseline case was the Haddad, a 39-year-old, Bolivian-flagged cargo vessel that embarked from Iskenderun, Turkey, in early September. It was ultimately seized by Greek authorities south of Crete with a cache of some 5,000 shotguns and a half million rounds of undocumented ammunition.

Using the route plied by the 66-meter Haddad, which sailed along the Turkish coast en route to Libya before being stopped, Windward came up with a similar profile of another ship which, for a variety of legal and proprietary reasons, it preferred to call Vessel X.

Like the Haddad, Vessel X was more than 30 years old and around the same size, about 75 meters. It left the same Turkish port on Aug. 19 — less than a month prior to Haddad — bearing a flag of convenience, this one from the South Pacific island of Vanuatu.

A day later, Vessel X stopped in an area near the Turkish shore where there was no other port in the area or any other reason to stop at that location, company analysts found. More here from DefenseNews.

Meanwhile, pirating is back in the news.

Somali pirates just hijacked a commercial ship for the first time in five years

WaPo: In 2010 and 2011, groups of armed Somali men were hijacking merchant vessels off Somalia’s coast at an almost daily pace. Thousands of hostages of myriad nationalities were taken, and billions of dollars were lost on ransoms, damages and delayed shipments.

The crisis was so severe that a naval task force with more than two dozen vessels from European Union countries, the United States, China, Russia, India and Japan banded together to restore order to one of the world’s busiest shipping routes. They largely succeeded. In 2015, there were 17 pirate attacks near Somalia, down from 151 in 2011. Many of those attacks were on smaller fishing boats from nearby countries, mostly by disgruntled Somali fishermen, but not commercial ships.

Until Tuesday.

Somali officials acknowledged that the Aris 13, an oil tanker, had been escorted to the Somali coast by at least eight and perhaps as many as dozens of armed men on two small skiffs. Reports from organizations that monitor piracy could not conclusively identify which flag the ship was flying or where it was owned, but Sri Lanka’s Foreign Ministry confirmed that eight of its nationals were on board as crew. The ship was on its way south to Mogadishu, Somalia’s capital.

The attack originated in the Puntland region, which is semiautonomous. “The vessel’s captain reported to the company they were approached by two skiffs and that one of them could see armed personnel on board,” an unidentified Middle East-based official told the Associated Press. “The ship changed course quite soon after that report and is now anchored.”

The U.S. Navy’s 5th Fleet oversees anti-piracy efforts along Somalia’s coast. Concerns about piracy’s reemergence in the region have been growing in concurrence with greater exploitation of Somalia’s waters by foreigners engaged in illegal fishing. Deprived of a livelihood, some Somali fishermen have turned back to hijacking to get by.

Salad Nur, described as a “local elder” by the Associated Press, said that the men involved in Tuesday’s hijacking had been searching for a commercial vessel for days on the open water. “Foreign fishermen destroyed their livelihoods and deprived them of proper fishing,” Nur said.

Piracy is also on the rise on the other side of Africa. Armed groups based along Nigeria’s coast have made that region the most dangerous for seafarers. That coast is also a major oil shipping route. Now that oil prices have dropped, pirates there have taken to kidnapping crew members for ransom rather than siphoning off oil, as the abductions have proved more lucrative.