Lifetimes ago as an intelligence officer I spent years tracking DPRK activities and developments.
People shouldn’t underestimate their technical capacities or ability to recruit smart hard working people.
People shouldn’t underestimate their technical capacities or ability to recruit smart hard working people.
People hear about third-world living conditions and deprivation and say "aww, cute" as though it's sticks and rocks they're launching into the sea of Japan. They have money...it's all poured into the military.
I don't understand why the media downplays them so heavily.
And I don't understand why the media upplays them so heavily, as some kind of peer threat capable of meaningful force projection.
(Well, I do understand it, someone needs to keep pounding the drum to keep this country on a forever-war footing.)
When someone gets mugged on your street, you can consider taking precautions. If your response is to roll out half a mile of barbed wire, electric fencing, and landmines all through the perimeter of your property, I would say that is absolutely 'upplaying' the actual level of threat.
Most Americans' understanding of the actual threat posed to the US by NK is ludicrously upplayed. NK is a credible offensive threat to SK, but that's a very limited problem for anyone living in Nashville, Tennessee.
Perhaps TN is just a radically different world, I'd frankly believe it, but I haven't seen anything too significant at all. The last time people were really concerned about NK for like... 3 days, I think it was ~2012 or so.
I wasn't criticizing the blog post, I was responding to a comment in this thread that claimed that for some strange reason the danger of NK is systemically underplayed by the media.
I argue that no, the media more typically overplays it, much like it overplays the threat from other non-peer nations. I'm assuming you don't feel like the news is telling you that Iran is a threat either... Which would put you in an informed minority.
Because in the same way as morale can be a force multiplier, an extreme lack of it can be a force divider. Combine that with their (very likely) inability to sustain even a regional war for more than a few weeks, their antiquated equipment, and their largely unsuccessful domestic military developments, and it's not hard to write them off as largely a non-threat, whether or not this is truly the case.
The major downside is that even if they only manage to sustain for a few weeks, that's plenty of time to level Seoul and inflict damage on cities further south should they decide to make a push against the ROK, and this is what shouldn't be downplayed.
Also, during a kinetic conflict where you're invading, it's often more strategically valuable to lie dormant in their networks than it is to scorch them, a la America sitting inside of Iraq's phone networks and just listening.
There's a lot of work being done now to change it [1], but I've heard from multiple cybersecurity grunts in critical infrastructure that they just assume foreign APTs are in their networks. Strategically, why in the world wouldn't they be? There's basically no downside other than burning TTPs. We should damn well expect the NSA to have their fingers in every foreign pot they can reach.
[1] To be fair, there was a lot of work before too. But now people are more scared.
I also don’t think it matters because they would be pretty dumb to use them. I’m of the mindset that they will most likely simply collapse at some point and the nukes will become unmaintained and useless.
> third-world living conditions [...]
There are a few reasons that interlock.
- The DPRK government is a mob family with sovereign status and nukes. Most folks in western countries don't have a strong sense of what that means - looking through the lens of mostly free nations, it is hard to imagine the realities on the ground, and they fill in the blanks with what they know about bureaucratic states.
- Lots of western folks, but USians in particular, are extremely ignorant and incurious about Asia and asian cultures. This amplifies the above problems and tends to lead to ridiculous ideas being believable.
- DPRK's propaganda encourages some of this. Their interests are served when people in the west are thinking about their nukes and ignoring the hacking that pays for them. A side order of "we're so mean and crazy we starve our people" helps stoke the mad-man authoritarian archetype.
Perhaps you meant the media for some specific country, but news media in Japan do seem to take North Korea quite seriously, and missile launches frequently ends up being the first headline on NHK world news.
And much more of it after crypto gained popularity. Darknet Diaries went through investigating some of their hacks. Amounts from one can be more than entire GDP of a small country. Some crypto is washed through Macanese etc banks but most is just used to pay for weapons and stuff directly.
including non-nationals?
Of course, there are different senses of "recruitment". The best recruits don't know they even have been..
The take-away here is that it's 99% social engineering and 1% a script-kiddy payload drop. Their SE play is based on our innate ability to be recruited, because we want to be. Because we spend our school and college days being conditioned to want to be valued, to feel needed, to look for validation and reward, to make beneficial connections and sell ourselves. Self commodification/reification is the beating heart of capitalism.
They're smart to use that against us, by reaching out to security researchers, who (from personal experience) often feel isolated and/or undervalued.
After all it's just "international collaboration" , right?
Without due diligence in checking out new contacts (especially if they contact you to discuss things that they know interest you and then stroke the ego of your specialism) recruitment is easy.
In the end you can't easily know whether that charismatic voice on the phone is really from your government, from Google, from a fellow researcher who wants to "share and collaborate"... and you probably wouldn't know what would constitute a credible proof of identity.
Intelligence agencies could do well to spend a little money on benevolently watching out for commercial, civic, academic or hobbyist researchers who are valuable targets and sending a polite heads-up when the packets start arriving from N Korea.