North Korean operatives could be involved in the design and sale of everything from VPNs and encryption software to fingerprint and facial recognition technology, according to a recent report that alleges it’s one way the country’s totalitarian government is generating new revenue.
The recent study by the James Martin Center for Nonproliferation Studies claims to offer insights into a “shadow sector” of North Korean IT services purposefully organized to obfuscate its origins:
North Koreans appear to have marketed virtual private networks (VPNs) and encryption software in Malaysia, sold fingerprint-scanning technology to large Chinese companies and parts of the Nigerian government, produced facial recognition software for law enforcement agencies via front operations, and built websites for myriad individual and corporate clients.
Per NPR, the report alleges that the North Koreans in question were very good at covering their tracks through a byzantine web of fronts and fake identities—to the extent where legitimate companies and even government agencies ended up purchasing the tools with no suspicion as to what was going on.
Some of the fronts, like one named Global Communications that set up a network of companies in Asia and sold bootleg military radios, have already been claimed to be controlled by North Korean intelligence services, NPR noted. The researchers wrote they had unveiled another front, Future TechGroup, in part because its website hosted North Korean pop songs and showcased mushroom-growing technology. (Mushrooms are very popular in North Korea, as evidenced by their scientists’ invention of a mushroom-based energy drink.)
Per NPR, the allegedly North Korean design work has even won awards:
Customers ranged from small European firms to “at least one reputable defense firm in a US-allied country” and possibly a U.S. primary school and law enforcement agencies. That means they may have unknowingly and indirectly paid the economically isolated country, which has been sanctioned for its nuclear weapons program.
...
Researchers verified a Future TechGroup claim that it recently won a prestigious award for its facial recognition software at an international competition in Switzerland.
The software was entered into the competition by “a seemingly reputable not-for-profit entity in a US-allied country” that authors did not name out of concern and which they think was unaware of the North Korean connection.
Though North Korea’s external image is often associated with poverty and famine, it also runs a sprawling group of state-controlled institutes that are not so bad at reverse-engineering foreign products as well as designing their own ones using limited resources. Numerous reports suggest it has specifically done pretty well for itself in the cyber department, training a new generation of programmers that are more than merely literate in modern technology—and that have also been linked to a number of high-profile hacks.
Of course, the North Korean government doesn’t really care much for international law and allegedly runs a number of crime rings, so it’s probably reasonable to wonder how much of this stuff was purely original work or involved at least some intellectual property theft. Either way, if the Center for Nonproliferation Studies report is to be believed, the results have been impressive.
This is all of some concern because virtually everything North Korea produces is under some form of international sanctions on the funding of its nuclear program, meaning this is merely a more clever version of its large smuggling operations in other sectors. The researchers specifically noted that the US government under President Donald Trump, which has used both the sanctions and fumbling diplomatic overtures to try and coax North Korea towards abandoning its nuclear program, seems to be paying greater attention to the country’s IT industry as a result:
It is possible that North Korea’s IT sector may yet become a more focused target of the “maximum pressure” campaign championed by the United States. Though IT exports writ large have yet to be subject to international sanctions, President of the United States Donald J. Trump signed, in September 2017, Executive Order 13810, which specifically includes North Korea’s IT sector under the new sanctions authority. Taken together with the sanctions on KCC in 2017, this indicates that the US Treasury may be paying greater attention to North Korean IT activities.
However, the report also noted that the North Korean IT sector appears to be getting better at blending in, so this is probably something that’s here to stay.