North Korea's Cyber Operations: Strategy and Responses
Total Page:16
File Type:pdf, Size:1020Kb
DECEMBER 2015 1616 Rhode Island Avenue NW Washington, DC 20036 202-887-0200 | www.csis.org Lanham • Boulder • New York • London 4501 Forbes Boulevard Lanham, MD 20706 301- 459- 3366 | www.rowman.com North Korea’s Cover photo: Scott LaFoy Cyber Operations Strategy and Responses A Report of the CSIS Korea Chair AUTHORS Jenny Jun Scott LaFoy Ethan Sohn ISBN 978-1-4422-5902-7 PROJECT DIRECTORS 1616 Rhode Island Avenue NW Victor D. Cha Washington,Ë|xHSLEOCy259027z DC 20036v*:+:!:+:! 202-887-0200 | www.csis.org James A. Lewis Blank North Korea’s Cyber Operations Strategy and Responses AUTHORS Jenny Jun Scott LaFoy Ethan Sohn PROJECT DIRECTORS Victor D. Cha James A. Lewis A Report of the CSIS K orea Chair December 2015 Lanham • Boulder • New York • London 594-63946_ch00_3P.indd 1 12/16/15 8:20 PM About CSIS For over 50 years, the Center for Strategic and International Studies (CSIS) has worked to develop solutions to the world’s greatest policy challenges. Today, CSIS scholars are providing strategic insights and bipartisan policy solutions to help decisionmakers chart a course toward a better world. CSIS is a nonprofit organ ization headquartered in Washington, D.C. The Center’s 220 full- time staff and large network of affiliated scholars conduct research and analy sis and develop policy initiatives that look into the future and anticipate change. Founded at the height of the Cold War by David M. Abshire and Admiral Arleigh Burke, CSIS was dedicated to finding ways to sustain American prominence and prosperity as a force for good in the world. Since 1962, CSIS has become one of the world’s preeminent international institutions focused on defense and security; regional stability; and transnational challenges ranging from energy and climate to global health and economic integration. Thomas J. Pritzker was named chairman of the CSIS Board of Trustees in November 2015. Former U.S. deputy secretary of defense John J. Hamre has served as the Center’s president and chief executive officer since 2000. CSIS does not take specific policy positions; accordingly, all views expressed herein should be understood to be solely those of the author(s). © 2015 by the Center for Strategic and International Studies. All rights reserved. ISBN: 978-1-4422-5902-7 (pb); 978-1-4422-5903-4 (eBook) Center for Strategic & International Studies Rowman & Littlefield 1616 Rhode Island Ave nue, NW 4501 Forbes Boulevard Washington, DC 20036 Lanham, MD 2 0706 202-887-0200 | www . csis . org 301 - 459 - 3366 | www . rowman . com 594-63946_ch00_3P.indd 2 12/16/15 8:20 PM Contents Preface iv Acknowl edgments vi Abbreviations vii Introduction 1 Purpose, Scope, and Methods 1 A Note on Open- Source Reporting on DPRK 2 Executive Summary 4 1. Strategic Context 11 DPRK Military and Po liti cal Strategy 11 Strategic Use of Cyberspace 17 DPRK Cyber Strategy 26 2r . O g a n i z a t i o n 3 5 Reconnaissance General Bureau 35 General Staff Department of the Korean People’s Army 45 Technology and Industrial Base 52 3. Future Trends and Policy Recommendations 60 Future Trends 60 Policy Objectives 63 Recommendations for the United States 64 Recommendations for the U.S.- ROK Alliance 72 Appendix. Disruptive Cyber Operations Commonly Associated with North Korea 79 Bibliography 80 About the Project Directors and Authors 96 | III 594-63946_ch00_3P.indd 3 12/16/15 8:20 PM Preface he impetus for this study was the cyber attack against South Korean banks and media T agencies in March 2013. The subsequent cyber attack against Sony Pictures Entertain- ment in November 2014 made our research efforts directly relevant to the U.S. policy debate on cyber conflicts. The U.S. government’s designation of North Korea as the re- sponsible party for the act, which released sensitive files and communications from Sony, was a surprise to many in the cybersecurity field and in theK orea expert community as few had estimated the Demo cratic People’s Republic of Korea (DPRK) to be capable of such activity. We started to look into the issue and found quickly that there was very little open- source and unclassified information about North Korean cyber operations. There had been occasional studies done by scholars and industry, but the lit er a ture was sparse at best. Our initial conversations found the lack of any single go-to source primer about what we know about these North Korean capabilities. This revelation led us to consider a one- year study that would comb the open- source lit er a ture, conduct inter- views, and perform field research to get a better understanding of North Korean cyber operations. The research team, consisting of the primary authors on this report, Jenny Jun, Scott LaFoy, and Ethan Sohn, had the right combination of cybersecurity, North Korea, and international security expertise to undertake the work. At CSIS my colleague James Lewis, director and se nior fellow in the Strategic Technologies Program, agreed to serve along with me as se nior authors and advisers for the proj ect. The caveat with any study on North Korea is that one does research with very little information. There are no websites that can be easily accessed of North Korean origin; no studies of their cyber strategy; and no experts that one can easily access. North Korea is considered one of the hardest intelligence targets in the world. Through our concerted efforts, this study offers one of the first primers in En glish on the strategy b ehind North K orea’s cyber operations; the institutions within the DPRK government that are associated with t hese operations; and a study of North Korea’s tech- nology base. We learned a great deal in completing the study, and learned quickly of its interest to the public and private sector when we released the executive summary for the study in September 2015. IV | 594-63946_ch00_3P.indd 4 12/16/15 8:20 PM We would like to thank the current and former CSIS K orea Chair staff, including Sang Jun Lee and Ellen Kim, the Strategic Technologies Program office, and the CSIS Publications Office for their tireless work on this proj ect. We hope that you will find the research and analy sis in this study useful. Victor Cha Se nior Adviser and Korea Chair CSIS N ORTH KOREA’S CyBER OPERATIONS | v 594-63946_ch00_3P.indd 5 12/16/15 8:20 PM Acknowl edgments he primary authors would like to express deep gratitude for those who made this T proj ect pos si ble, through their hard work, patience, and support. This proj ect would never have been pos si ble without Dr. Victor Cha, who encouraged an extended study of the topic, generously agreed to provide institutional support for the proj ect, provided constant guidance throughout numerous revisions and overhaul of the content, and, most impor- tantly, sparked our interest on North Korean issues years ago as a mentor. We also thank Dr. James Lewis for offering his extensive expertise and insight into this topic throughout the proj ect. We thank and acknowledge the efforts of staff of the CSIS Korea Chair, especially Ellen Kim, Sang Jun Lee, Marie DuMond, Andy Lim, and Lisa Collins, who provided extensive assistance to our proj ect and made sure that all components of the proj ect progressed seamlessly. We would also express deep gratitude to our interviewees, including Joseph Bermudez Jr., Catherine Lotrionte, Lim Jong-in, Kim Heung- kwang, yoo Dong- yeul, Choi Sang- myung, as well as many others who wish to remain anonymous. They shared their extensive knowledge and insight, which was vital to the creation of this publication. We also thank interns Min- hyung Kang and Min- jeong Lee for their hard work and time dedi- cated to this proj ect. Jenny Jun, Scott LaFoy, and Ethan Sohn vi | 594-63946_ch00_3P.indd 6 12/16/15 8:20 PM Abbreviations APCERT Asia Pacific Computer Emergency Response Team APEC Asia- Pacific Economic Cooperation APEC- TEL APEC Telecommunications and Information Working Group ASEAN Association of Southeast Asian Nations C4ISR command, control, communications, computers, intelligence, surveillance, and reconnaissance CBM confidence building mea sure CERT computer emergency response team CNE computer network exploitation CNO computer network operations CSIRT computer security incident response team DDoS distributed denial of ser vice DMZ demilitarized zone DNI director of national intelligence DPRK Demo cratic Pe ople’s Republic of K orea (North Korea) ECCM electronic c ounter- countermeasure EO executive order EW electronic warfare GPS global positioning system GSD General Staff Department of the Korean Pe ople’s Army (North Korea) IP Internet protocol ISO/OSI International Standards Or ga ni za tion/Open Systems Interconnection IT information technology ITU- IMPACT International Telecommunication Union– International Multilateral Partnership Against Cyber Threats KCC K orea Computer Center (North K orea) KPA Korean Pe ople’s Army (North Korea) KPTC K orea Posts and Telecommunications Corporation (North Korea) KWP Korean Worker’s Party (North K orea) MND Ministry of National Defense (South K orea) MPAF Ministry of Pe ople’s Armed Forces (North K orea) MSS Ministry of State Security (North K orea) NDC National Defence Commission (North Korea) NIS National Intelligence Ser vice (South K orea) |II V 594-63946_ch00_3P.indd 7 12/16/15 8:20 PM NKIS North Korea Intellectuals Solidarity PIC Pyongyang Informatics Center (North Korea) PLA People’s Liberation Army PLC programmable logic controller R&D research and development RGB Reconnaissance General Bureau (North Korea) ROK Republic of Korea (South Korea) SCADA supervisory control and data acquisition TCP/IP transmission control protocol/Internet protocol TTPs tactics, techniques, and procedures UN GGE United Nations Group of Government Experts WMD weapons of mass destruction v III | JENNy JUN, SCOTT LAFOy, and ETHAN SOHN 594-63946_ch00_3P.indd 8 12/16/15 8:20 PM Introduction Purpose, Scope, and Methods PURSE PO This report aims to provide a comprehensive overview of North Korea’s cyber strategy and operations based on open- source lit er a ture.