Category Archives: Cyber War

The Facts of North Korea Nuclear and WMD Program

Posted on by

Professionals at Los Alamos and Oak Ridge Laboratories estimate it would take up to ten years to dismantle all programs and operations in North Korea. Further, Tehran, Moscow and Beijing will work hard to delay what they can due to eliminating evidence of their respective involvement for decades in North Korea.

The Nine Steps Required to
Really Disarm North Korea

By WILLIAM J. BROAD, DAVID E. SANGER and TROY GRIGGS

NYT’s: The vast scope of North Korea’s atomic program means ending it would be the most challenging case of nuclear disarmament in history. Here’s what has to be done to achieve — and verify — the removal of the nuclear arms, the dismantlement of the atomic complex and the elimination of the North’s other weapons of mass destruction.

Nuclear Capabilities

  • Dismantle and remove
    nuclear weapons

    Take apart every nuclear weapon in the North’s arsenal and ship the parts out of the country.

  • Halt uranium enrichment

    Dismantle the plants where centrifuges make fuel for nuclear reactors and atom bombs.

  • Disable reactors

    Shutter the nuclear reactors that turn uranium into plutonium, a second bomb fuel.

  • Close nuclear test sites

    Confirm that the North’s recent, staged explosions actually destroyed the complex.

  • End H-bomb fuel production

    Close exotic fuel plants that can make atom bombs hundreds of times more destructive.

  • Inspect anywhere, forever

    Give international inspectors the freedom to roam and inspect anywhere.

Non-Nuclear Capabilities

  • Destroy germ weapons

    Eliminate anthrax and other deadly biological arms, under constant inspection.

  • Destroy chemical weapons

    Eliminate sarin, VX and other lethal agents the North has used on enemies.

  • Curb missile program

    Eliminate missile threats to the U.S., Japan and South Korea.

President Trump says he is meeting Kim Jong-un in Singapore because the North Korean leader has signaled a willingness to “denuclearize.’’

But that word means very different things in Pyongyang and Washington, and in recent weeks Mr. Trump has appeared to back away from his earlier insistence on a rapid dismantlement of all things nuclear — weapons and production facilities — before the North receives any sanctions relief.

Whether it happens quickly or slowly, the task of “complete, verifiable, irreversible denuclearization’’ — the phrase that Secretary of State Mike Pompeo keeps repeating — will be enormous. Since 1992, the country has repeatedly vowed never to test, manufacture, produce, store or deploy nuclear arms. It has broken all those promises and built a sprawling nuclear complex.

North Korea has 141 sites devoted to the production and use of weapons of mass destruction, according to a 2014 Rand Corporation report. Just one of them — Yongbyon, the nation’s main atomic complex — covers more than three square miles. Recently, the Institute for Science and International Security, a private group in Washington, inspected satellite images of Yongbyon and counted 663 buildings.

North Korea is the size of Pennsylvania. The disarmament challenge is made worse by uncertainty about how many nuclear weapons the North possesses — estimates range from 20 to 60 — and whether tunnels deep inside the North’s mountains hide plants and mobile missiles.

The process of unwinding more than 50 years of North Korean open and covert developments, therefore, would need to start with the North’s declaration of all its facilities and weapons, which intelligence agencies would then compare with their own lists and information.

***

Nuclear experts like David A. Kay, who led the largely futile American hunt for weapons of mass destruction in Iraq, argue that the North Korean arms complex is too large for outsiders to dismantle. The best approach, he contends, is for Western inspectors to monitor North Korean disarmament. The time estimates range from a few years to a decade and a half — long after Mr. Trump leaves office.

The magnitude of the North Korean challenge becomes clearer when compared with past efforts to disarm other nations. For instance, Libya’s nuclear program was so undeveloped that the centrifuges it turned over had never been unpacked from their original shipping crates. Infrastructure in Syria, Iraq, Iran and South Africa was much smaller. Even so, Israel saw the stakes as so high that it bombed an Iraqi reactor in 1981, and a Syrian reactor in 2007.

Undoing weapons of mass destruction

Full elimination Partial elimination
Steps North Korea Libya Syria Iraq Iran South Africa
Dismantle nuclear arms X X
Halt uranium enrichment X X X / X
Disable reactors X X X X
Close nuclear test sites X X
End H-bomb fuel production X
Destroy germ arms X X
Destroy chemical arms X X / X
Curb missile program X X

Here’s what is involved in each of the major disarmament steps:

Dismantle and remove
nuclear weapons

Under the eye of a declared nuclear state — like
the United States, China or Russia — take apart
every nuclear weapon in the North Korean arsenal
and safely ship the components out of the country.

missile_nkorea.jpg

North Korea released a photograph of the country’s leader, Kim Jong-un, center, inspecting what it said was a hydrogen bomb that could be fitted atop a long-range missile. Korean Central News Agency

John R. Bolton, Mr. Trump’s hawkish national security adviser, has argued that before any sanctions are lifted, the North should deliver all its nuclear arms to the United States, shipping them to the Oak Ridge National Laboratory in Tennessee, where inspectors sent Libya’s uranium gear.

It’s almost unimaginable that the North would simply ship out its weapons — or that the rest of the world would be convinced that it had turned over all of them.

Siegfried S. Hecker, a Stanford professor who formerly headed the Los Alamos weapons laboratory in New Mexico, argues that the only safe way to dismantle the North’s nuclear arsenal is to put the job, under inspection, in the hands of the same North Korean engineers who built the weapons. Otherwise, he said, outsiders unfamiliar with the intricacies might accidently detonate the nuclear arms.

Halt uranium enrichment

Dismantle the plants where centrifuges
spin at supersonic speeds to make fuel
for nuclear reactors and atom bombs.

Factories holding hundreds of centrifuges spin gaseous uranium until it is enriched in a rare form of the element that can fuel reactors — or, with more enrichment, nuclear arms.

It’s easy to shut down such plants and dismantle them. The problem is that they’re relatively simple to hide underground. North Korea has shown off one such plant, at Yongbyon, but intelligence agencies say there must be others. The 2014 Rand report put the number of enrichment plants at five.

Because uranium can be used to fuel reactors that make electricity, North Korea is almost certain to argue it needs to keep some enrichment plants open for peaceful purposes. That poses a dilemma for the Trump administration.

In the case of Iran, it has insisted that all such plants be shut down permanently. After arguing that the Obama administration made a “terrible deal” by allowing modest enrichment to continue in Iran, it is hard to imagine how Mr. Trump could insist on less than a total shutdown in North Korea.

Disable reactors

Shutter nuclear reactors that turn uranium
into plutonium, a second bomb fuel.

Inside a reactor, some of the uranium in the fuel rods is turned into plutonium, which makes a very attractive bomb fuel. Pound for pound, plutonium produces far more powerful nuclear blasts than does uranium. In 1986, at Yongbyon, North Korea began operating a five-megawatt reactor, which analysts say produced the plutonium fuel for the nation’s first atom bombs. Today, the North is commissioning a second reactor that is much larger.

Jan. 17, 2018 image from DigitalGlobe via Institute for Science and International Security

Reactors are hard to hide: They generate vast amounts of heat, making them extremely easy to identify by satellite.

But reactors that produce large amounts of electricity — such as the new one being readied in North Korea — pose a dilemma, because the North can legitimately argue it needs electric power. It seems likely that the Trump administration will come down hard on the North’s new reactor, but might ultimately permit its operation if the North agrees for the bomb-usable waste products to be shipped out of the country.

Close nuclear test sites

Confirm that the North’s recent, staged
explosions actually destroyed the deep
tunnels and infrastructure, or take additional
steps to make the complex unusable.

Atom and hydrogen bombs need repeated testing to check their performance. Since 2006, the North has detonated nuclear devices at least six times in tunnels dug deep inside Mount Mantap, a mile-high peak in the North’s mountainous wilds.

Last month, the North blew up test-tunnel portals at Mount Mantap as a conciliatory gesture before the planned denuclearization talks. Experts say the thick clouds of rising smoke and debris, while impressive for television cameras, leave open the question of whether the damage is irreversible. Presumably, the North could also dig new test sites beneath other mountains. The Trump administration has called for an end to all explosive testing.

End H-bomb fuel production

Close exotic fuel plants that can make atom
bombs hundreds of times more destructive.

At the heart of a missile warhead, an exploding atom bomb can act as a superhot match that ignites thermonuclear fuel, also known as hydrogen fuel. The resulting blast can be 1,000 times more powerful than the Hiroshima bomb. North Korea is suspected of having at least two sites for different aspects of H-bomb fuel production — one at Yongbyon, and one near Hamhung, on the country’s east coast.

The exotic fuels also have civilian uses for the manufacture of glow-in-the-dark lighting, exit signs and runway lights. The Trump administration stance is unclear. Atomic experts say the military threat can be reduced by shuttering large plants, building smaller factories and carefully regulating their products.

Inspect anywhere, forever

In a mountainous country, give
international inspectors the freedom
to roam and inspect anywhere — with
automated monitoring of key sites.

Under past nuclear agreements, inspectors from the International Atomic Energy Agency have lived in North Korea, but their movements were limited to small parts of the giant Yongbyon facility, where the nation’s nuclear reactors are located. For inspections to be effective, they must cover the whole country — including military facilities. (One of Mr. Trump’s complaints about the Iran agreement was that inspectors were inhibited from going anywhere.)

But inspecting all of North Korea — land of underground tunnels — would be an enormous job. American intelligence agencies have spent billions of dollars watching missiles move, mapping likely facilities, and using spy satellites and cyber reconnaissance to track the arms. But they have surely made mistakes, and missed some facilities. The problem gets larger if the inspectors are seeking out underground bunkers that hide missiles for quick strikes.

Destroy germ weapons

Eliminate anthrax and other deadly biological
weapons, under constant inspection.

Biological weapons can be more destructive than nuclear arms. A single gallon of concentrated anthrax is said to have enough spores to kill every person on Earth. The challenge is how to deliver the living weapons. The anthrax attacks of 2001 relied on letters, killing five people, sickening 17 others and frightening the nation.

North Korea is suspected of having a large complex for making germ weapons. The problem is learning its true dimensions, and verifying its dismantlement. While nuclear and missile tests advertise their developmental strides openly, the production and testing of deadly pathogens can be done behind closed doors.

Moreover, experts argue that the gear for producing germ weapons is often identical or similar to that of medicine and agriculture, making it extremely hard if not impossible for outsiders to verify that germ-weapon work has ended. The Trump administration’s stance is unknown other than it wants the North to end all work on biological weapons.

Destroy chemical weapons

Eliminate sarin, VX and other lethal
agents the North has used on enemies.

Last year, the deadly nerve agent VX was used to assassinate Kim Jong-nam, the estranged half brother of the North’s leader. The killing cast light on the North’s long pursuit of chemical weapons. Although the North denies having any, experts rank the nation as among the world’s top possessors, saying it harbors thousands of tons of the banned armaments.

The Trump administration’s negotiating list with the North includes chemical disarmament. Syria is a reminder of the difficulty. President Barack Obama cut a deal with Damascus to destroy its chemical arsenal. This year, the United States accused the Syrian government of using the banned weapons at least 50 times since the civil war began, topping previous official estimates. The attacks have maimed and killed hundreds of Syrians, including many children.

Curb missile program

Eliminate the long-range threat to the U.S. and
mid-range missile threat to Japan and South Korea.

In November, the North tested a greatly improved intercontinental ballistic missile that flew farther than any other — far enough to threaten all of the United States. It was a remarkable achievement that brought the current, long-escalating crisis to a head. While experts say the North still needs to do more testing to ensure that the missile’s warheads can survive fiery re-entry, the test flight showed that Mr. Kim had come remarkably close to perfecting a weapon that could threaten American cities.

Curbing the North’s missile program is high on the Trump administration’s negotiation list. A simple precaution is to limit the range of test flights — a fairly easily thing to monitor. A key question is whether arms negotiators will also try to redirect the North’s large corps of rocket designers and engineers into peaceful activities, such as making and lofting civilian satellites.

When a Fishing Ship is a Chinese Spy Ship

Posted on by

The Chinese are relentless in all parts of the world.

It may not have looked like much of a match — or a showdown for that matter — but when Australia’s largest warship HMAS Adelaide arrived at the Fijian port of Suva on Saturday, it had an interesting neighbour.

Key points:

  • Chinese fishing boat believed to be carrying wide range of surveillance equipment
  • Fiji tipped off Australian Navy about Chinese spy ship expected to dock next to HMAS Adelaide
  • China has a strong commercial and military presence in the South Pacific

A Chinese ship fitted with communications equipment docked alongside the new Canberra-class landing helicopter dock.

The Royal Australian Navy suspects the Chinese vessel is a spy ship, which deliberately arrived at the same time to carry out surveillance on the Australians.

HMAS Adelaide and other Australian warships visiting Fiji will “take the appropriate security precautions”, but the surveillance craft is “just another ship”, Captain Jim Hutton, Commander of the Navy’s Joint Task Group 661, said.

Deputy Chief of Navy Rear Admiral Mark Hammond also played down concerns about the presence of the Chinese vessel.

“That’s a space surveillance ship, it’s a scientific ship,” he told reporters on board HMAS Adelaide.

ABC News understands the primary purpose of the Chinese ship is to track satellite launches from out on the ocean, but it does have the capability to also collect intelligence on other naval vessels.

Australia’s High Commissioner to Fiji John Feakes also revealed the skipper of the Chinese vessel had even been invited to an on-board reception, although it is not clear whether the offer was accepted.

Australia’s Navy, like every navy around the world, is well-versed in these sorts of nautical games.

“If you’re in the Navy you presume that anytime that a fishing vessel or even merchant fleets of nations like China are around that they may have a dual purpose,” ANU academic and retired Australian Naval Commodore Richard Menhinick said.

“You just presume that they may well be tasked by government for other activities.”

China’s looking for South Pacific foothold

Chinese presence — both commercial and military — is common in the South Pacific.

Beijing sees economic opportunity in the region and economic imperatives commonly herald other strategic interests.

HMAS Adelaide Photo: The HMAS Adelaide is expected to be carefully scrutinised by its temporary neighbour. (File Photo: CPL Kyle Genner)

Agriculture and aquaculture projects in Vanuatu, Fiji, Tonga and other Pacific nations have been given significant help by the Chinese over the years, as have roads, ports and other infrastructure.

Media player: “Space” to play, “M” to mute, “left” and “right” to seek.

Audio: Chinese spy ship tipped to dock next to HMAS Adelaide in Suva (AM)

When you have more than 1.3 billion people back home to feed, finding secure food supplies are critical.

As China grows, Mr Menhinick said it was not surprising that the nation’s presence in the Pacific was also increasing.

“China’s a rising power… economic power’s always led and the military’s followed, and the Chinese economic interest in the south-west Pacific has increased substantially over the last fifteen year,” he said.

But Australia and its strategic partners are anxious China does not use its presence to jeopardise regional structures — political, economic and diplomatic.

Now a visiting US General has given the strongest public indication yet that his nation would like Australia to join in naval and air patrols to challenge Beijing’s claims in the South China Sea.

Asked whether joint American-Australian patrols would be welcomed by America, the commander of US Marines in the Pacific, Lieutenant General David Berger gave an enthusiastic response.

“Obviously that’s Australia’s decision, would we welcome that? Absolutely yes,” Lt Gen Berger said.

Meanwhile, all eyes are on Singapore….but in advance of the talks between the United States and North Korea in Singapore, there was a LOT of nefarious activity.

Related reading: Emissary Panda – A potential new malicious tool

photo

Independent: Hackers from China and Russia are targeting South Korea with cyber espionage attacks ahead of the summit between the US and North Korea, a leading security firm has claimed.

The foreign ministry and financial institutions were identified as potential targets by, US cyber security firm FireEye.

The company’s analysts noted the timing of the attacks and said they expected the intensity of the operations to increase in the build up to the historic meeting between US President Donald Trump and North Korean Chairman Kim Jong-un.

“South Korea has frequently been the target of cyber espionage. Though the biggest threat is North Korea actors. [FireEye] believes that China- and Russia- [based hackers] also target South Korea,” Ben Read, a cyber espionage analyst at the firm, told The Independent.

“With the heightened attention to inter-Korean relations in the lead up to a potential Trump–Kim meeting, we expect this targeting to continue at an increased pace.”

Scheduled to take place on 12 June in Singapore the leader are expected to discuss the denuclearisation of North Korea.

It will be the first meeting between a sitting US president and leader of North Korea.

Some experts have suggested that a formal end to the  Korean War – more than six decades after the 1950-1953 conflict – could be declared.

Although an armistice was signed, no peace treaty has ever been signed to formally end the war.

The two hacking groups identified by the FireEye researchers were TempTick and Turla, both of which are suspected of being state-sponsored operations.

TempTick has previously been involved in attacks on Chinese dissident organisations, as well as Japanese public and private sector institutions. It has been active since 2009.

The earliest known attacks linked to the group known as Turla are from 2006.

FireEye researchers noted: “They consistently target governments worldwide in search of information that can inform Russian government decision making.”

 

Hat Tip to the FBI for Operation Wire Wire

Posted on by
Beyond phishing, there is vishing and smishing.
Vishing is using the phone, either a land line or cell.
Smishing is scamming your text messages.
Tactics are constantly being developed. Are you paying attention?
Department of Justice
Office of Public Affairs
FOR IMMEDIATE RELEASE
Monday, June 11, 2018

74 Arrested in Coordinated International Enforcement Operation Targeting Hundreds of Individuals in Business Email Compromise Schemes

42 Alleged Fraudsters Arrested in the United States

Federal authorities announced today a significant coordinated effort to disrupt Business Email Compromise (BEC) schemes that are designed to intercept and hijack wire transfers from businesses and individuals, including many senior citizens.  Operation Wire Wire, a coordinated law enforcement effort by the U.S. Department of Justice, U.S. Department of Homeland Security, U.S. Department of the Treasury and the U.S. Postal Inspection Service, was conducted over a six month period, culminating in over two weeks of intensified law enforcement activity resulting in 74 arrests in the United States and overseas, including 29 in Nigeria, and three in Canada, Mauritius and Poland.  The operation also resulted in the seizure of nearly $2.4 million, and the disruption and recovery of approximately $14 million in fraudulent wire transfers.

BEC, also known as “cyber-enabled financial fraud,” is a sophisticated scam often targeting employees with access to company finances and businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments.  The same criminal organizations that perpetrate BEC also exploit individual victims, often real estate purchasers, the elderly, and others, by convincing them to make wire transfers to bank accounts controlled by the criminals. This is often accomplished by impersonating a key employee or business partner after obtaining access to that person’s email account or sometimes done through romance and lottery scams.  BEC scams may involve fraudulent requests for checks rather than wire transfers; they may target sensitive information such as personally identifiable information (PII) or employee tax records instead of, or in addition to, money; and they may not involve an actual “compromise” of an email account or computer network.  Foreign citizens perpetrate many BEC scams.  Those individuals are often members of transnational criminal organizations, which originated in Nigeria but have spread throughout the world.

“Fraudsters can rob people of their life’s savings in a matter of minutes,” said Attorney General Sessions. “These are malicious and morally repugnant crimes. The Department of Justice has taken aggressive action against fraudsters in recent months, conducting the largest sweep of fraud against American seniors in history back in February. Now, in this operation alone, we have arrested 42 people in the United States and 29 others have been arrested in Nigeria for alleged financial fraud. And so I want to thank the FBI, nearly a dozen U.S. Attorneys’ Offices, the Secret Service, Postal Inspection Services, Homeland Security Investigations, the Treasury Department, our partners in Nigeria, Poland, Canada, Mauritius, Indonesia, and Malaysia, and our state and local law enforcement partners for all of their hard work. We will continue to go on offense against fraudsters so that the American people can have safety and peace of mind.”

“This operation demonstrates the FBI’s commitment to disrupt and dismantle criminal enterprises that target American citizens and their businesses,” said FBI Director Christopher A. Wray. “We will continue to work together with our law enforcement partners around the world to end these fraud schemes and protect the hard-earned assets of our citizens. The public we serve deserves nothing less.”

“The Secret Service remains committed to aggressively investigating and pursuing those responsible for cyber-enabled financial crimes,” said U.S. Secret Service Director Randolph “Tex” Alles.  “Although the explosive expansion of the cyber domain has forced us to develop innovative ways of conducting these types of investigations, our proven model remains the same.”

“FinCEN has been a leader in the fight against BEC and other cyber-enabled crime,” said FinCEN Director Kenneth A. Blanco. “Since 2014, working with our domestic and international partners, our Rapid Response Program has helped recover over $350 million stolen from innocent Americans.  We must continue to be smarter, quicker, and better than the criminals that we face every day.  Today’s action is a victory, but it will take vigilance, time, and resources to take this fight into the future.  In defense of the victims of these crimes, we are ready for the challenge.”

“The U.S. Postal Inspection Service has a long history of successfully investigating complex fraud and corruption cases,” said Chief Postal Inspector Guy Cottrell. “We are proud to work alongside our fellow law enforcement partners in major efforts, such as Operation Wire Wire, to target those individuals who take advantage of the American public for illegal profits. Anyone who engages in deceptive practices like this should know they will not go undetected and will be held accountable, regardless of where they are. Postal Inspectors will continue to work tirelessly to protect our customers from fraud.”

A number of cases involved international criminal organizations that defrauded small to large sized businesses, while others involved individual victims who transferred high dollar funds or sensitive records in the course of business.  The devastating effects these cases have on victims and victim companies, affect not only the individual business but also the global economy.  Since the Internet Crime Complaint Center (IC3) began keeping track of BEC and its variant, Email Account Compromise (EAC), as a complaint category, there has been a loss of over $3.7 billion reported to the IC3.  BEC and EAC is a prevalent scam and the Justice Department along with our partners will continue to aggressively pursue and prosecute the perpetrators, including money mules, regardless of where they are located.

Money mules may be witting or unwitting accomplices who receive ill-gotten funds from the victims and then transfer the funds as directed by the fraudsters.  The money is wired or sent by check to the money mule who then deposits it in his or her own bank account.  Usually the mules keep a fraction for “their trouble” and then wire the money as directed by the fraudster.  The fraudsters enlist and manipulate the money mules through romance scams or “work-at-home” scams.

Starting in January 2018, this coordinated enforcement action targeted hundreds of BEC scammers.  In addition, law enforcement agents executed over 51 domestic actions including search warrants, money mule warning letters, and asset seizure warrants totaling nearly $1 million.  Local and state law enforcement partners on FBI task forces across the country, with the assistance of multiple District Attorney’s Offices, charged 15 alleged money mules for their role in defrauding victims.  These money mules were employed by the fraudsters to launder their ill-gotten gains by draining the funds into other accounts that are difficult to trace.

Among those arrested on federal charges in BEC schemes include:

  • Following an investigation by the FBI and the U.S. Secret Service, 23 individuals were charged in the Southern District of Florida with laundering at least $10 million from proceeds of BEC scams, including eight people charged in an indictment unsealed last week in Miami. These eight defendants are alleged to have conspired to launder proceeds from numerous BEC scams, totaling at least approximately $5 million, including approximately $1.4 million from a victim corporation in Seattle, as well as various title companies and a law firm.
  • Following an investigation led by the FBI with the assistance of the IRS Criminal Investigation, Gloria Okolie and Paul Aisosa, both Nigerian nationals residing in Dallas, Texas, were charged in an indictment filed on June 6 in the Southern District of Georgia.  According to the indictment, they are alleged to have victimized a real estate closing attorney by sending the lawyer a spoofing email posing as the seller and requesting that proceeds of a real estate sale in the amount of $246,000 be wired to Okolie’s account.  They are charged with laundering approximately $665,000 in illicit funds.  The attorney experienced $130,000 in losses after the bank was notified of the fraud and froze $116,000.
  • Adeyemi Odufuye aka “Micky,” “Micky Bricks,” “Yemi,” “GMB,” “Bawz” and “Jefe,” 32, and Stanley Hugochukwu Nwoke, aka Stanley Banks,” “Banks,” “Hugo Banks,” “Banky,” and “Jose Calderon,” 27, were charged in a seven-count indictment in the District of Connecticut in a BEC scheme involving an attempted loss to victims of approximately $2.6 million, including at least $440,000 in actual losses to one victim in Connecticut.  A third co-conspirator Olumuyiwa Yahtrip Adejumo, aka “Ade,” “Slimwaco,” “Waco,” “Waco Jamon,” “Hade,” and “Hadey,” 32, of Toledo, Ohio, pleaded guilty on April 20 to one count of conspiracy to commit wire fraud.  Odufuye was extradited from the United Kingdom to the United States and on Jan. 3, pleaded guilty to one count of conspiracy to commit wire fraud and one count of aggravated identity theft. Nwoke was extradited to the United States from Mauritius on May 25, marking the first extradition in over 15 years from Mauritius.  His case is pending.
  • Richard Emem Jackson, aka Auwire, 23, of Lagos, Nigeria, was charged in an indictment filed on May 17 in the District of Massachusetts with two counts of unlawful possession of a means of identification as part of a larger fraud scheme. According to the indictment, on two occasions in 2017, Jackson is alleged to have possessed the identifications of two victims with the intent to commit wire fraud conspiracy.  In another case being prosecuted in the District of Massachusetts, a 25-year-old Fort Lauderdale, Florida man was indicted in federal court in Boston on June 6 on one count of money laundering conspiracy. According to the indictment, the individual was part of a conspiracy that engaged in wire fraud. It is alleged that in early 2018, the defendant’s co-conspirators gained access to email accounts belonging to a Massachusetts real estate attorney and sent emails to recipients in Massachusetts that “spoofed” the real estate attorney’s account in an attempt to cause the email recipient to transfer nearly $500,000, which was intended to be used for payment in connection with a real estate transaction, to a shell account belonging to a money mule recruited and controlled by the defendant.

The BEC scam is related to other forms of fraud such as:

  • “Romance scams,” which lull victims to believe that their online paramour needs funds for an international business transaction, a U.S. visit or some other purpose;
  • “Employment opportunities scams,” which recruits prospective employees for work-from-home employment opportunities where employees are required to provide their PII as new “hires” and then are significantly overpaid by check whereby the employees wire the overpayment to the employers’ bank;
  • “Fraudulent online vehicle sales scams,” which convinces intended buyers to purchase prepaid gift cards in the amount of the agreed upon sale price and are instructed to share the prepaid card codes with the “sellers” who ignore future communications and do not deliver the goods;
  • “Rental scams” occur when renters forward a check in excess of the agreed upon deposit for the rental property to the victims and request the remainder be returned via wire or check and back out of the rental agreements and ask for a refund; and
  • “Lottery scams,” which involves persons randomly contacting email addresses advising them they have been selected as the winner of an international lottery.

The cases were investigated by the FBI, U.S. Secret Service, U.S. Postal Inspection Service, U.S. Immigration and Customs Enforcement’s Homeland Security Investigations, the U.S. Department of the Treasury Financial Crimes Enforcement Network (FinCEN) and IRS Criminal Investigation.  U.S. Attorney’s Offices in the Districts of Central California, Connecticut, Eastern Virginia, Massachusetts, Nebraska, New Jersey, Southern Florida, Southern Georgia, Southern Texas, Eastern Pennsylvania, Eastern Washington, Western Pennsylvania, Western Tennessee, Western Washington, Utah, and elsewhere have ongoing investigations some of which have resulted in arrests in Nigeria.  The Justice Department’s Computer Crime and Intellectual Property Section, Money Laundering and Asset Recovery Section and Office of International Affairs of the Criminal Division provided assistance. District Attorney’s Offices of Caddo Parrish in Shreveport, Louisiana; Harris County, Texas and Los Angeles are handling state prosecutions. Additionally, private sector partners and the Nigerian Economic and Financial Crimes Commission, Canadian law enforcement including the Toronto Police Service, the Mauritian Attorney-General and the Commissioner of Police, Polish Police Central Bureau of Investigation, Indonesian National Police Cyber Crimes Unit, and the Royal Malaysia Police provided significant assistance.

This operation, which was funded and coordinated by the FBI, serves as a model for international cooperation against specific threats that endanger the financial well-being of each member country’s residents.  Attorney General Sessions expressed gratitude for the outstanding efforts of the participating countries, including law enforcement actions that were coordinated and executed by the Economic and Financial Crimes Commission (EFCC) in Nigeria to curb business email compromise schemes that defraud businesses and individuals alike.

Victims are encouraged to file a complaint online with the IC3 at bec.ic3.gov. The IC3 staff reviews complaints, looking for patterns or other indicators of significant criminal activity, and refers investigative packages of complaints to the appropriate law enforcement authorities in a particular city or region. The FBI provides a variety of resources relating to BEC through the IC3, which can be reached at www.ic3.gov.

For more information on BEC scams, visit: www.ic3.gov/media/2018/180611.aspx

Is a Chinese Hack on our Naval Weapons an Act of War?

Posted on by

It is long been a question of the point that a foreign hack for espionage and theft is an act of war with emphasis on our naval weapons programs or those of the Army or Air Force.

Cyber warfare is an issue few care about or have control over because data resides outside of our individual control but that is NOT the case when it comes to government. They are accountable for safeguarding networks and data.

Washington – After a hiatus of several years, Chinese state hackers are once again penetrating networks at a range of U.S. corporations in a campaign to steal secrets and leapfrog ahead in a race for global technology supremacy, cyber researchers say.

Companies in fields such as biomedicine, robotics, cloud computing and artificial intelligence have all been hit by cyber intrusions originating in China, the researchers say.

“It’s definitely accelerating. The trend is up,” said Dmitri Alperovitch, cofounder and chief technology officer at CrowdStrike, a threat intelligence firm based in Sunnyvale, Calif.,

Chinese state hacking teams linked to the People’s Liberation Army and the Ministry of State Security are becoming visible on U.S. networks again, although they are using new methods to remain undetected, researchers said.

“In the last few months, we’ve definitely seen … a reemergence of groups that had appeared to have gone dormant for a while,” said Cristiana Brafman Kittner, principal analyst at FireEye, a cybersecurity firm that has tracked China hacking extensively.

The activity comes after a sharp drop in Chinese hacking that began in September 2015, when former President Barack Obama and Chinese leader Xi Jinping reached an agreement to end the hacking theft of commercial secrets. The agreement quelled U.S. anger over its charge that China is the “world’s most active and persistent perpetrator of economic espionage.”

U.S. prosecutors in 2014 indicted five PLA officers for economic espionage for hacking into firms like Westinghouse, U.S. Steel and Alcoa. The 56-page indictment said the five men worked for Unit 61398 of the PLA’s Third Department in Shanghai. The highly detailed complaint entered into details that U.S. officials later said were meant to “name and shame” China for commercial hacking.

Why China’s hackers may be getting back into the game is not readily clear. Renewed trade tensions may be a reason. President Donald Trump has threatened to impose $50 billion of tariffs on China-made products to cut the U.S. trade deficit of $375 billion with China.

Another factor may be the conclusion of a massive reorganization of China’s military, which began in late 2015 and under which various signals intelligence and cyber hacking units “were dissolved and absorbed into this one mega organization, called the Strategic Support Force,” said Priscilla Moriuchi, an expert on East Asia at Recorded Future, a cyber-threat intelligence firm based in Somerville, Mass.

China’s Xi has laid out ambitious goal of catching up with the United States and Europe in 10 key sectors, including aerospace, semiconductors and robotics, under its “Made in China 2025” program.

Moriuchi, who spent 12 years in the U.S. intelligence community, eventually leading the National Security Agency’s East Asia and Pacific cyber threats office, said China’s hackers are broadening tactics, burrowing into telecommunications networks even as they steal secrets to help party leaders achieve “Made in China 2025” goals.

“The sectors that they are going after are things like cloud computing, (Internet of Things), artificial intelligence, biomedicines, civilian space, alternative energy, robotics, rail, agricultural machinery, high-end medical devices,” Moriuchi said.

“There are companies in all of these sectors that have experienced intrusions over the past year from actors who are believed to be China state-sponsored,” she said.

Since early in the past decade, U.S. officials have alleged that Chinese state hackers were tasked with obtaining commercial secrets from Western corporations to help Chinese firms, many of them state-owned, overtake competitors to the global forefront in technology.

In a renewed warning alert for China, a March 22 report from the Office of the U.S. Trade Representative on China’s trade actions said, “Beijing’s cyber espionage against U.S. companies persists and continues to evolve.

So as you read about the stolen data from the Navy by China consider this: Should the NSA get inside the Chinese networks now and infect and or re-steal our intelligence?

Unmanned underwater vehicles take advantage of advanced ... photo

(Note: according to the Washington Post item below, the contractor is not named, however ‘Inside Defense’ in September of 2016 published an item that GD Electric Boat was awarded the $105.5 million contract modification moving it into the second phase.)

electric boat « Breaking Defense - Defense industry news ... photo

WaPo: Chinese government hackers have compromised the computers of a Navy contractor, stealing massive amounts of highly sensitive data related to undersea warfare — including secret plans to develop a supersonic anti-ship missile for use on U.S. submarines by 2020, according to American officials.

The breaches occurred in January and February, the officials said, speaking on the condition of anonymity to discuss an ongoing investigation. The hackers targeted a contractor who works for the Naval Undersea Warfare Center, a military organization headquartered in Newport, R.I., that conducts research and development for submarines and underwater weaponry.

The officials did not identify the contractor.

Taken were 614 gigabytes of material relating to a closely held project known as Sea Dragon, as well as signals and sensor data, submarine radio room information relating to cryptographic systems, and the Navy submarine development unit’s electronic warfare library.

The Washington Post agreed to withhold certain details about the compromised missile project at the request of the Navy, which argued that their release could harm national security.

The data stolen was of a highly sensitive nature despite being housed on the contractor’s unclassified network. The officials said the material, when aggregated, could be considered classified, a fact that raises concerns about the Navy’s ability to oversee contractors tasked with developing cutting-edge weapons.

The breach is part of China’s long-running effort to blunt the U.S. advantage in military technology and become the preeminent power in east Asia. The news comes as the Trump administration is seeking to secure Beijing’s support in persuading North Korea to give up nuclear weapons, even as tensions persist between the United States and China over trade and defense matters.

The Navy is leading the investigation into the breach with the assistance of the FBI, officials said. The FBI declined to comment.

On Friday, the Pentagon inspector general’s office said that Defense Secretary Jim Mattis had asked it to review contractor cybersecurity issues arising from The Post’s story.
Navy spokesman Cmdr. Bill Speaks said, “There are measures in place that require companies to notify the government when a ‘cyber incident’ has occurred that has actual or potential adverse effects on their networks that contain controlled unclassified information.”

Speaks said “it would be inappropriate to discuss further details at this time.”

Altogether, details on hundreds of mechanical and software systems were compromised — a significant breach in a critical area of warfare that China has identified as a priority, both for building its own capabilities and challenging those of the United States.

“It’s very disturbing,” said former Sen. Jim Talent (R-Mo.,) who is a member of the U.S. China Economic and Security Review Commission. “But it’s a of a piece with what the Chinese have been doing. They are completely focused on getting advanced weapons technology through all kinds of means. That includes stealing secrets from our defense contractors.” Talent had no independent knowledge of the breach.
Undersea priority

The Sea Dragon project is an initiative of a special Pentagon office stood up in 2012 to adapt existing U.S. military technologies to new applications. The Defense Department, citing classification levels, has released little information about Sea Dragon other than to say that it will introduce a “disruptive offensive capability” by “integrating an existing weapon system with an existing Navy platform.” The Pentagon has requested or used more than $300 million for the project since late 2015 and has said it plans to start underwater testing by September.

Military experts fear that China has developed capabilities that could complicate the Navy’s ability to defend U.S. allies in Asia in the event of a conflict with China.

The Chinese are investing in a range of platforms, including quieter submarines armed with increasingly sophisticated weapons and new sensors, Adm. Philip S. Davidson said during his April nomination hearing to lead U.S. Indo-Pacific Command. And what they cannot develop on their own, they steal — often through cyberspace, he said.

“One of the main concerns that we have,” he told the Senate Armed Services Committee, “is cyber and penetration of the dot-com networks, exploiting technology from our defense contractors, in some instances.”

In February, Director of National Intelligence Daniel Coats testified that most of the detected Chinese cyber-operations against U.S. industry focus on defense contractors or tech firms supporting government networks.

In recent years, the United States has been scrambling to develop new weapons or systems that can counter a Chinese naval buildup that has targeted perceived weaknesses in the U.S. fleet. Key to the American advantage in any faceoff with China on the high seas in Asia will be its submarine fleet.

“U.S. naval forces are going to have a really hard time operating in that area, except for submarines, because the Chinese don’t have a lot of anti-submarine warfare capability,” said Bryan Clark, a naval analyst at the Center for Strategic and Budgetary Assessments. “The idea is that we are going to rely heavily on submarines in the early effort of any conflict with the Chinese.”

China has made closing the gap in undersea warfare one of its three top military priorities, and although the United States still leads the field, China is making a concerted effort to diminish U.S. superiority.

“So anything that degrades our comparative advantage in undersea warfare is of extreme significance if we ever had to execute our war plans for dealing with China,” said James Stavridis, dean of the Fletcher School of Law and Diplomacy at Tufts University and a retired admiral who served as supreme allied commander at NATO.

The U.S. military let its anti-ship weaponry languish after the Cold War ended because with the Soviet Union’s collapse, the Navy no longer faced a peer competitor on the seas. But the rapid modernization and buildup of the Chinese navy in recent years, as well as Russia’s resurgent forces at sea, have prompted the Pentagon to renew heavy investment in technologies to sink enemy warships.

The introduction of a supersonic anti-ship missile on U.S. Navy submarines would make it more difficult for Chinese warships to maneuver. It would also augment a suite of other anti-ship weapons that the U.S. military has been developing in recent years.
Ongoing breaches

For years, Chinese government hackers have siphoned information on the U.S. military, underscoring the challenge the Pentagon faces in safeguarding details of its technological advances. Over the years, the Chinese have snatched designs for the F-35 Joint Strike Fighter; the advanced Patriot PAC-3 missile system; the Army system for shooting down ballistic missiles known as Terminal High Altitude Area Defense; and the Navy’s new Littoral Combat Ship, a small surface vessel designed for near-shore operations, according to previous reports prepared for the Pentagon.

In some cases, suspected Chinese breaches appear to have resulted in copycat technologies, such as the drones China has produced that mimic U.S. unmanned aircraft.

[Chinese cyberspies stole a long list of U.S. weapons designs]

Speaks, the Navy spokesman, said: “We treat the broader issue of cyber intrusion against our contractors very seriously. If such an intrusion were to occur, the appropriate parties would be looking at the specific incident, taking measures to protect current information, and mitigating the impacts that might result from any information that might have been compromised.”

The Pentagon’s Damage Assessment Management Office has conducted an assessment of the damage, according to the U.S. officials. The Office of the Secretary of Defense declined to comment.

Theft of an electronic warfare library, Stavridis said, could give the Chinese “a reasonable idea of what level of knowledge we have about their specific [radar] platforms, electronically and potentially acoustically, and that deeply reduces our level of comfort if we were in a close undersea combat situation with China.”

Signals and sensor data is also valuable in that it presents China with the opportunity to “know when we would know at what distance we would be able to detect their submarines” — again a key factor in undersea battles.

Investigators say the hack was carried out by the Chinese Ministry of State Security, a civilian spy agency responsible for counterintelligence, foreign intelligence and domestic political security. The hackers operated out of an MSS division in the province of Guangdong, which houses a major foreign hacking department.

Although the Chinese People’s Liberation Army is far better-known than the MSS when it comes to hacking, the latter’s personnel are more skilled and much better at hiding their tracks, said Peter Mattis, a former analyst in the CIA counterintelligence center. The MSS, he said, hack for all forms of intelligence: foreign, military and commercial.

In September 2015, in a bid to avert economic sanctions, Chinese President Xi Jinping pledged to President Barack Obama that China would refrain from conducting commercial cyberespionage against the United States. Following the pact, China appeared to have curtailed much, although not all, of its hacking activity against U.S. firms, including by the People’s Liberation Army.

Both China and the United States consider spying on military technology to fall outside the pact. “The distinction we’ve always made is there’s a difference between conducting espionage in order to protect national security and conduct military operations, and the theft of intellectual property for the benefit of companies inside your country,” said Michael Daniel, the White House cybersecurity coordinator under Obama.

 

Hey Secret Service, Check it out While in Singapore

Posted on by

10 Best Things to Do in Sentosa Island - Best Attractions ... photo

So, while the United States is finding a discreet way to pay for Kim Jung Un’s travel and hotel stay in Singapore on Sentosa Island as North Korea is cash strapped…ah yeah sure, there are some other things going on in Singapore and Malaysia.

Let’s begin a few years ago. Sit back with this article, it is long but perspective and context is required.

Malaysian authorities shutter two North Korean companies ... photo

(Note, it is allegedly closed, or Singapore denies it, but Secret Service check it all out)

(Reuters) – It is in Kuala Lumpur’s “Little India” neighborhood, behind an unmarked door on the second floor of a rundown building, where a military equipment company called Glocom says it has its office.

Glocom is a front company run by North Korean intelligence agents that sells battlefield radio equipment in violation of United Nations sanctions, according to a United Nations report submitted to the Security Council seen by Reuters.

Reuters found that Glocom advertises over 30 radio systems for “military and paramilitary” organizations on its Malaysian website, glocom.com.my.

Glocom’s Malaysian website, which was taken down late last year, listed the Little India address in its contacts section. No one answers the door there and the mailbox outside is stuffed with unopened letters.

In fact, no company by that name exists in Malaysia. But two Malaysian companies controlled by North Korean shareholders and directors(also known as a Nominee Director) registered Glocom’s website in 2009, according to website and company registration documents.

And it does have a business, the unreleased U.N. report says. Last July, an air shipment of North Korean military communications equipment, sent from China and bound for Eritrea, was intercepted in an unnamed country. The seized equipment included 45 boxes of battlefield radios and accessories labeled “Glocom”, short for Global Communications Co.

Glocom is controlled by the Reconnaissance General Bureau, the North Korean intelligence agency tasked with overseas operations and weapons procurement, the report says, citing undisclosed information it obtained.

A spokesman for North Korea’s mission at the U.N. told Reuters he had no information about Glocom.

U.N. resolution 1874, adopted in 2009, expanded the arms embargo against North Korea to include military equipment and all “related materiel”.

But implementation of the sanctions “remains insufficient and highly inconsistent” among member countries, the U.N. report says, and North Korea is using “evasion techniques that are increasing in scale, scope and sophistication.”

Malaysia is one of the few countries in the world which had strong ties with North Korea. Their citizens can travel to each other’s countries without visas. But those ties have begun to sour after North Korean leader Kim Jong Un’s estranged half-brother was murdered at Kuala Lumpur’s international airport on Feb 13.

PAN SYSTEMS

According to the “WHOIS” database, which discloses website ownership, Glocom.com.my was registered in 2009 by an entity called International Global System using the “Little India” address. A similarly named company, International Golden Services is listed as the contact point on Glocom’s website.

Glocom registered a new website, glocom-corp.com, in mid-December, this one showing no Malaysian contacts. Its most recent post is dated January, 2017 and advertises new products, including a remote control system for a precision-guided missile.

Glocom is operated by the Pyongyang branch of a Singapore-based company called Pan Systems, the U.N. report says, citing an invoice and other information it obtained.

Louis Low, managing director of Pan Systems in Singapore said his company used to have an office in Pyongyang from 1996 but officially ended relations with North Korea in 2010 and was no longer in control of any business there.

“They use (the) Pan Systems (name) and say it’s a foreign company, but they operate everything by themselves,” Low told Reuters referring to the North Koreans at the Pyongyang office.

Pan Systems Pyongyang utilized bank accounts, front companies and agents mostly based in China and Malaysia to buy components and sell completed radio systems, the U.N. report says. Pan Systems Pyongyang could not be reached for comment.

One of the directors of Pan Systems Pyongyang is Ryang Su Nyo. According to a source with direct knowledge of her background, Ryang reports to “Liaison Office 519”, a department in the Reconnaissance General Bureau. Ryang is also listed as a shareholder of International Global System, the company that registered Glocom’s website.

Reuters has not been able to contact Ryang.

SMUGGLING CASH

Ryang frequently traveled to Singapore and Malaysia to meet with Pan Systems representatives, the U.N. report says.

On one such trip in February 2014, she and two other North Koreans were detained in Malaysia for attempting to smuggle $450,000 through customs at Kuala Lumpur’s budget airport terminal, two sources with direct knowledge of the situation told Reuters.

The North Korean trio told Malaysian authorities they all worked for Pan Systems and the cash belonged to the North Korean embassy in Kuala Lumpur, according to the two sources.

The Malaysian Attorney General decided not to press charges because of insufficient evidence. A week later, the trio was allowed to travel, and the North Korean embassy claimed the cash, the sources said. All three had passports assigned to government officials, the sources said.

Malaysia’s Customs Department and the Attorney General’s office did not respond to requests for comment over the weekend.

The Pan Systems representative in Kuala Lumpur is a North Korean by the name of Kim Chang Hyok, the U.N. report says.

Kim, who also goes by James Kim, was a founding director of International Golden Services, the company listed in the contacts section of the Glocom website. Kim is director and shareholder of four other companies in Malaysia operating in the fields of IT and trade, according to the Malaysian company registry.

He did not respond to requests for comment by mail or email.

The United Nations panel, which prepared the draft report, asked the Malaysian government if it would expel Kim and freeze the assets of International Golden Services and International Global System to comply with U.N. sanctions. The U.N. did not say when it made the request.

“The panel has yet to receive an answer,” the report said.

Reuters has not received a response from the Malaysian government to repeated requests for comment about Glocom.

POLITICAL CONNECTION

One of Glocom’s early partners in Malaysia was Mustapha Ya’akub, a prominent member of Malaysia’s ruling United Malays National Organisation (UMNO). Since 2014, he has been listed as a director of International Golden Services

As secretary of the UMNO youth wing’s international affairs bureau, Mustapha fostered political connections in the 1990s with countries, such as Iran, Libya and North Korea. Glocom’s Little India address once housed a company owned by UMNO Youth.

Mustapha, 67, said he had been a Glocom business partner “many years back” and said it has been continuously controlled by several North Koreans, including Kim Chang Hyok, whom he said he knew. He did not divulge his role in the company, and denied any knowledge of Glocom’s current business.

“We thought at the time it might be a good idea to go into business together,” Mustapha told Reuters about his first meeting with his North Korean business contacts. He did not say who those contacts were or what they discussed. He denied any knowledge of Glocom’s current business.

Glocom advertises and exhibits its wares without disclosing its North Korean connections.

“Anywhere, Anytime in Battlefield,” reads the slogan on one of several 2017 Glocom catalogs obtained by Reuters.

An advertisement in the September 2012 edition of the Asian Military Review said Glocom develops radios and equipment for “military and paramilitary organizations”.

A spokesman for the magazine confirmed the ad had been bought by Glocom, but said the magazine was unaware of its alleged links to North Korea.

Glocom has exhibited at least three times since 2006 at Malaysia’s biennial arms show, Defence Services Asia (DSA), according to Glocom’s website.

At DSA 2016, Glocom paid 2,000 ringgit ($450) to share a table in the booth of Malaysia’s Integrated Securities Corporation, its director Hassan Masri told Reuters by email.

Hassan said he had nothing to do with Glocom’s equipment and was unaware of its alleged links to North Korea.

Aside from the North Koreans behind Glocom, clues on its website also point to its North Korean origins.

For instance, one undated photo shows a factory worker testing a Glocom radio system. A plaque nearby shows the machine he is using has won a uniquely North Korean award: The Model Machine No. 26 Prize,” named in honor of late leader Kim Jong Il, who is said to have efficiently operated “Lathe No. 26” at the Pyongyang Textile Factory when he was a student.

*** It gets worse.

Executive Summary

In April 2018, Recorded Future published research on the internet browsing behavior of North Korea’s most senior leaders and revealed stark changes in how North Korea’s ruling elite utilize the internet from our original analysis in July 2017. Utilizing a data set spanning from December to mid-April, we compiled a significant amount of information on North Korea’s technology architecture, including which types, manufacturers, and models of hardware and software North Korean leaders used to access the internet.

Our analysis reveals the overwhelming presence of American hardware and software on North Korean networks and in daily use by senior North Korean leaders. We also examined the broad legal regime that restricts U.S. trade with North Korea and discovered that it is insufficient to prevent U.S. electronics, hardware, and software from reaching North Korea.

Key Judgements

  • This failure to keep American technology from reaching North Korea has enabled North Korea’s destabilizing, disruptive, and destructive cyber operations as well as its internet-enabled circumvention of international sanctions.
  • International inconsistency in the definition of the term “luxury goods” has also facilitated the Kim regime’s acquisition of American technology.
  • For seven years, between 2002 and 2017, the United States allowed the exportation of “computer and electronic products” to North Korea, totaling more than $430,000. Our analysis demonstrates that many of the electronic devices North Korean elite utilize are older models or are running older software, and that at least some of those devices could have been legally acquired from the U.S. during these seven years.
  • All U.S. exporters are liable for any violation of the sanctions regime, but beyond the implementation of a robust compliance program, there’s relatively little that can be done to actually stop prohibited goods from reaching sanctioned countries. This is especially true for North Korea, as they have proven to be sophisticated at utilizing intermediaries or spoofing identities.

History of Export Controls Against North Korea

Since the split of North and South Korea following World War II, the United States has regarded the Democratic People’s Republic of Korea (DPRK or North Korea) as an adversary. Despite the lack of open hostilities for nearly 65 years, the U.S. has never normalized diplomatic relations with the “Hermit Kingdom.” From the 1950s to 1980s, North Korea’s status as a Communist government, and sponsorship of international terrorism, ensured that the two countries remained enemies. Then, in 1988, after the bombing of Korean Air Flight 858, North Korea was officially designated as a state sponsor of terrorism by the Reagan administration, inaugurating the modern export control regime against North Korea.

Separately, export control as a response to North Korea’s nuclear proliferation efforts dates back to 1992 when the U.S. imposed sanctions on two North Korean companies due to their missile proliferation activities. Between June 1992 and June 2000, some restrictions were lifted as a result of the U.S.-North Korea bilateral missile talks, but the respite was short lived and the U.S. ratcheted up sanctions from January 2001 through to 2006. This period included the notorious labeling of North Korea as part of the “Axis of Evil” in President Bush’s 2002 State of the Union Address.

In 2006, the first widespread international sanctions began after North Korea carried out its initial nuclear weapons test. This test prompted the UN Security Council (UNSC) to pass two resolutions imposing sanctions on North Korea — first Resolution 1695, and then Resolution 1718. These resolutions together banned a broad range of both imports and exports to North Korea by any UN member states.

While these resolutions initially focused on military materiel, they were supplemented by broader sanctions from the U.S., Australia, and Japan. After North Korea conducted its second underground nuclear test in May 2009, the UNSC adopted Resolution 1874, which further expanded the arms embargo and sought to target Pyongyang’s financial apparata. From 2009 to the present day, both the U.S. and UNSC have progressively strengthened and expanded earlier sanctions with Resolution 2087, 2094, 2270, 2371, 2375, and 2397, which covered everything from missile materiel to textiles and caps on oil trading.

Despite a perceived thaw in diplomatic relations beginning earlier this year, U.S. officials have re-emphasized numerous times that “all sanctions and maximum pressure must remain,” while denuclearization of the Korean peninsula is negotiated.

State of Current U.S. Sanctions Against North Korea

Current United States sanctions against North Korea can be split into two categories:

  1. Sanctions that specifically target North Korea.
  2. Sanctions related to “Weapons of Mass Destruction Proliferators.”

Until 2008, the bulk of U.S. sanctions specific to North Korea were implemented via the Trading With the Enemy Act (1917), which empowers the federal government to prohibit any and all trade with designated countries. On June 26, 2008, the Bush administration issued Executive Order (E.O.) 13466 under the authority of the International Emergency Economic Powers Act. That same year, the National Emergencies Act. E.O. 13466 was supplemented by Executive Orders 13551, 13570, 13687, 13722, and the North Korea Sanctions Regulations (31 C.F.R. part 510). These measures extended a variety of trade restrictions and blocking of interests belonging to various figures in North Korea.

Pre-dating these sanctions, E.O. 13382 was issued in 2005 targeting various entities engaged in WMD proliferation. Three North Korean entities and numerous North Korean persons were listed as blocked entities.

Today, these regulations have culminated in six prohibited categories of transactions involving North Korea:

  1. Blocked property belonging to the state of North Korea and certain North Korean nationals (E.O. 13466, 13551, 13687, 13722, and 13382).
  2. U.S. persons are prohibited from registering vessels in North Korea, flying the DPRK flag, or operating any vessel flagged by North Korea (E.O. 13466).
  3. Goods, services, and technology from North Korea may not be imported into the U.S. (E.O. 13570).
  4. No new investment in North Korea by U.S. persons is allowed (E.O. 13722).
  5. No financing by a U.S. person involving North Korea is allowed (E.O. 13722).
  6. And most importantly for our purposes, goods, services, and technology may not be exported to North Korea from the U.S., or by a U.S. person wherever located, without a license (E.O. 13722).

U.S. export enforcement responsibility falls under three executive branch agencies: the Office of Foreign Asset Control within the Department of Treasury, the Office of Export Enforcement within the Department of Commerce’s Bureau of Industry and Security, and Homeland Security Investigations within the Department of Homeland Security. These three agencies enforce the Executive Orders, U.S. sanctions, International Trafficking in Arms Regulation, Export Administration Regulation, and other laws which make up the body of export control laws in the United States. In 2010, Executive Order 13558 created the Export Enforcement Coordination Center to further strengthen the partnership between these independent agencies.

The United States is one of the only countries which enforces its export laws outside of its national boundaries. Federal agents located in foreign countries work in conjunction with local authorities to conduct end use license checks, knocking on doors to see whether the parties are still upholding their stated exporting intentions.

Currently, civil penalties of up to the greater of $284,582, or twice the amount of the transaction, can be imposed against any party that violates these sanctions. Similarly, upon conviction, criminal penalties of up to $1 million, imprisonment for up to 20 years, or both, may be imposed on any person that willfully violates the sanctions.

North Korea Leverages a Breadth of U.S. Technology Despite Export Controls

North Korea’s Technology Architecture

Numerous third-party data sources used for this analysis gave Recorded Future visibility into what types of devices North Korea’s most senior leadership use to access the global internet. As has been widely publicized over the past several years, Kim Jong Un has been photographed on several occasions with Apple devices, and North Korean-made mobile phones have been assessed as mimicking Apple technology.

While we cannot confirm the actual users behind the activity we see, our analysis indicates that numerous American and Western-manufactured devices are being used by North Korean elite to access the global internet. Several reports and accounts have documented how few North Koreans are granted access to the global internet. At most, only the inner circle of North Korea’s leadership, such as party, military, and intelligence leaders and their families, are allowed to own computers and independently utilize the global internet. This is one of the data points we use to determine with such certainty that North Korea’s ruling elite are the users of this hardware and software.

North Korea’s use of proxies and load balancers limited our ability to identify exactly how many of each device was present, but we can determine some models and versions:

  • Windows 7
  • Windows 8.1
  • Windows 2000
  • Windows XP
  • Windows 10
  • Microsoft Terminal Server
  • Samsung Galaxy S5
  • Samsung Galaxy J5
  • Samsung Galaxy S7
  • Samsung Galaxy S8 Plus
  • Huawei Mate 95c 6 v6
  • Apple iPhone 4S
  • Apple iPhone 5
  • Apple iPhone 5S
  • Apple iPhone 6
  • Apple iPhone 6S Plus
  • Apple iPhone 7 Plus
  • Apple iPhone 8 Plus
  • Apple iPhone X
  • Apple MacBook
  • IBM Tivoli Storage Manager server
  • Conexant Hasbani web servers
  • Ascend Communications1 switches
  • F5 BIG-IP load balancer

While the majority of North Korean cyber operations are likely conducted from abroad, a small minority historically have been conducted from territorial North Korea. These operations have been conducted utilizing this very same hardware and software. This means that minimally, U.S. technology has enabled North Korea’s destabilizing, disruptive, and destructive cyber operations as well as its internet-enabled circumvention of international sanctions.

Where Technology Export Control Fails

According to a Congressional Research Service study conducted in 2016, U.S. trade restrictions with North Korea are extensive, but do not amount to a comprehensive embargo.

The United States curtails trade with North Korea for reasons of regional stability, that country’s support for acts of international terrorism, lack of cooperation with U.S. antiterrorism efforts, proliferation, and its status as a Communist country and a nonmarket economy. The United States also prohibits transactions relating to trade with certain North Korean entities identified as those who procure luxury goods, launder money, smuggle bulk cash, engage in counterfeiting goods and currency, and traffic in illicit narcotics.

Further, ”a U.S. company may apply for a license to export to North Korea, but for nearly all items other than food and medicine, there is a presumption of denial.”

This is despite the fact that North Korea has been on and off the State Sponsors of Terrorism list twice in the last 10 years (President Bush rescinded the declaration in 2008 and President Trump re-applied it in November 2017). In terms of exportation of technology to North Korea, the State Sponsors of Terrorism designation has relatively little impact in and of itself because the sanctions resulting from that designation govern primarily U.S. foreign aid, defense exports, and dual-use items. There is a provision for sanctions on “miscellaneous financial and other restrictions,” however, it is not clear whether that provision goes above and beyond the existing prohibitions on technology exports to North Korea.

Most electronics, including laptop computers, digital music players, large flat-screen televisions, and “electronic entertainment software” are considered “luxury goods” and fall under the broad trade Export Administration Restrictions (EAR) for North Korea administered by the Department of Commerce.

While the United Nations (UN) clarified its definition of “luxury goods” in Resolution 2321 as not including electronics, each UN member state is allowed to interpret the “luxury goods” term as including different products, “creat[ing] a situation of uneven practice” in the application of export controls. For instance:

  • The European Union bans “electrical/electronic items and appliances for domestic use of a value exceeding EUR 50 each.”
  • Australia bans all “consumer electronics.”
  • Japan prohibits “portable computing devices consisting of at least a central processing unit (CPU), a keyboard, and a display.”
  • South Korea broadly restricts and governs trade with the North including “electronic goods” as a luxury item.
    China has not made a distinction on embargoed luxury goods and does not “honor the luxury goods lists of other countries when it exports to” North Korea.

The Saga of ZTE

In March 2016, Zhongxing Telecommunications Equipment (ZTE), a Chinese cellular device and hardware manufacturer, was added to the Export Administration Regulations (EAR) Entities List. The EAR “imposes additional licensing requirements on and limits the availability of most license exceptions for, exports, reexports, and transfers (in-country) to those listed” on the Entities List. ZTE was initially placed on the Entities List for violating U.S. sanctions by selling American-made goods to Iran and North Korea. Placement on the Entities List prohibited U.S. companies from selling goods to ZTE without a license, and because nearly all ZTE-manufactured products contained U.S. goods, essentially crippled the company.

For more than two years, ZTE and the U.S. government went back and forth attempting to reach an agreement over penalties and validate that ZTE was no longer violating U.S. sanctions. In April 2018, the Department of Commerce (DOC) ended the negotiations by imposing a denial order, prohibiting American companies from selling to ZTE for seven years.

The denial order was the end of a lengthy export control enforcement process which would have bankrupted ZTE. Instead, in late May, the DOC negotiated an agreement which lifted the denial order and re-opened ZTE to U.S. exports.

The case of ZTE, a company which was placed on the Entities List and under a denial order for violating U.S. sanctions against North Korea, is a useful example of how impactful successful export control can be — if allowed to be. Had ZTE been allowed to fail, it would have sent a powerful message to companies around the world indicating how seriously the U.S. considers these violations. Instead, the message is that a company can violate U.S export controls and sanctions if it is large enough and aligned with an economically powerful nation.

Technology Exports to North Korea Were Not Always Prohibited

The question of how U.S. technology gets to North Korea is not entirely a story of failed export control or inconsistent application. According to Department of Commerce data, the U.S. has actually exported over $176 million of goods to North Korea since 2002. While this number pales in comparison to export volume with nations such as China or Canada, it is important to note that the export of “computers and electronic products” to North Korea occurred until this year.

At its peak in 2014, the U.S. exported $215,862 worth of computers and electronic products to North Korea. We do not know exactly which products or how many were exported to North Korea that year. However, based on the Department of Commerce definition of “computers and electronic products,” we have an idea of what kind of electronics these exports might have included. This category includes “computers, computer peripherals (including items like printers, monitors, and storage devices), communications equipment (such as wired and wireless telephones), and similar electronic products (including audio and video equipment and semiconductors),” as well as components for these products.

Again, while we do not know exactly which computer and electronic products were exported to North Korea over the past 15 years, that data can be useful in an exercise to demonstrate exactly how much value North Korea could have derived from that amount of money.

For example, in 2014, a decent desktop could cost around $500, while a similarly specified laptop would cost $700. Hypothetically, if North Koreans were paying the average prices for computers, they could have purchased over 350 computers from U.S. suppliers in 2014 alone. In total, since 2002, the U.S. has legally exported $483,543 worth of computers and electronics to North Korea — a sum that could have legally supplied some of the ruling elites’ electronics needs.

Our analysis demonstrates that many of the electronic devices North Korean elite utilize are older models or are running older software. These legal exports certainly do not account for all of the devices we have observed on North Korean networks, nor is $483,543 sufficient to completely build a moderately sized and proxied network. However, it presents an interesting part of the answer to the question of exactly how North Korea could have acquired all of their Western hardware and software. At least some of the computers and software we observed being used in North Korean networks today was probably acquired during these past 15 years.

Outlook

It is the responsibility of any U.S. exporters to be familiar and compliant with federal export controls, as penalties can include fines, civil or criminal charges, imprisonment, negative publicity, revocation of exporting privileges, or debarment from U.S. government contracting. As explained by the Massachusetts Export Center, “[Even if the exporter is selling only] innocuous products or selling only to ‘friendly’ countries … the exporter is ultimately responsible to have a thorough understanding of export regulations and to establish operating procedures aimed at preventing violations.”

For U.S. companies and persons to avoid the risk of being found guilty of violating sanctions, it is expected that an effective export compliance program is implemented. The U.S. Department of Commerce’s Bureau of Industry and Security suggest eight elements for an effective program:

  1. Statements and commitments from management
  2. Risk assessment of potential export violations
  3. Export authorization
  4. Effective record keeping
  5. Instituting training programs for employees
  6. Auditing records
  7. Detecting and correcting export violations
  8. Maintaining an export compliance manual

Generally, all U.S. business are not expected to perfect all eight elements, but any deviation from a robust compliance program poses a risk that an entity could be found in violation of the U.S. export regime. However, while a U.S. company may have a robust program, sanctioned states often use false flags or non-national facilitators to skirt even the most advanced programs. As a recent report from Arms Control Wonk and Reuters pointed out, the North Koreans are adept at falsifying addresses and names to circumvent sanctions programs. This flow of technology is not one way, either — recent reports point out that North Korea has used shell companies and various aliases to export various technologies, including facial recognition software to U.S. allies and encryption software in Asia.

One transaction involving the DPRK shell company Glocom that was widely reported last year demonstrates the ease with which North Korea is able to avoid technology control sanctions. Glocom used a network of Asian-based front companies to purchase components from electronic resellers, and the payment was even cleared through a U.S. bank account. Glocom, the company at the center of these transactions, was tied to Pan Systems Pyongyang via invoices uncovered by the UN and International Global System via WHOIS website registration data. Ryang Su Nyo is listed as a director of Pan Systems Pyongyang and a shareholder of International Global System, and Reuters has reported that Ryang reports to “Liaison Office 519,” a department within the North Korean Reconnaissance General Bureau.

Today, the varied interpretation of the term “luxury goods,” a sophisticated sanctions evasion operation, and lax enforcement of technology and electronics as a subcategory has created a situation where the Kim regime can acquire U.S. electronics, software, and hardware virtually at will. Technology resellers, North Koreans abroad, and the Kim regime’s extensive criminal networks all facilitate the transfer of American technology for daily use by one of the world’s most repressive governments. Unless there’s a globally unified effort to impose comprehensive sanctions on the DPRK, and multilateral cooperation to ensure that these sanctions cannot be thwarted by a web of shell companies, North Korea will be able to continue its cyberwarfare operations unabated with the aid of Western technology.