This exploration was made possible by Skillshare, an online learning community with over 25,000
classes.
You can see he was being removed from pictures and video with Kim Jong Un.
You’ll spot him there on the left, but not on the right.
There he is again; but there he’s not.
Credit to the German newspaper Der Spiegel, which combed through screenshots from North
Korean state TV to see the differences (1).
Clearly the North Korean regime was trying to erase the existence of someone who had
often appeared with the dear leader- to purge him from the record.
But who, and why?
Often the case with opaque North Korea is that we simply don’t know anything, but
not in this example.
In this example, I can at least tell you the who- the man was Jang Song-thaek, a high ranking
official in the North Korean government under both Kim Jong Un, and Kim Jong Il before him.
Here he is on December 20th, 2011 at the laying in state of Kim Jong Il, and here he is walking
behind Kim Jong Un at the funeral a week later.
Jang Song-thaek was close to the Kims not because of his status in the government and
military, but because was family.
He was Kim Jong Il’s brother-in-law, and therefore Kim Jong Un’s uncle.
In fact he was so high ranking that in the final years of Kim Jong Il’s failing health,
North Korea observers believed Jang Song-Thaek was running the government while helping to
groom Kim Jong Un to take over after his father’s death (2).
Some even said he was a reformer, perhaps signalling new ways for North Korea under
new leadership.
And so everything seemed to be going to plan after Kim Jong Il died in 2011.
Kim Jong Un, the son with his uncle Jang Song-thaek walking alongside a 1976 Lincoln Hearse and
wailing crowds.
But questions remained.
Most glaring, how would the transfer of power from Kim Jong Il to Kim Jong Un play out?
The world knew so little about the dictator’s son.
At the time of his father’s death, we knew that Kim Jong Un had spent time in a school
in Switzerland as a child, and that he was ‘thought to be in his late 20’s’ (3).
But did he intend to follow in his father’s footsteps by keeping North Korea under an
iron thumb-- developing nuclear weapons, or might he handle domestic and international
affairs differently?
What would Kim Jong Un do?
Not long after his ascension, we learned the domestic part of the answer.
Within two years, December 2013, he had his uncle Jang Song-thaek arrested at a party
conference, accused of a vague ‘plot’ to form a faction.
See if you can parse the explanation by state media: “Jang Song Thaek violating the principles
of the cabinet and system ...[??] did tremendous harm to the work of the country and the improvement
of the people’s living and steeped in capitalist way of life … led a dissipated and degenerative
life”
Whatever his supposed crime, he was arrested, executed by anti aircraft machine guns, then
burned on the spot (31).
The record of his existence was then removed from pictures and videos.
So, very quickly, we learned that domestically, Kim Jong Un would continue the ruthlessness
of his father.
Which leaves only the second half of our question: what would he do on the international stage?
Voice 1: “NHS Blackpool Clinical Commissioning Group say all patients should avoid contacting
GPs or using hospital services "unless absolutely necessary”
Voice 2: 50% of phones at Whipps Cross are down.
All elective operations today and tomorrow are cancelled.
Pathology labs also severely affected so we can't get patient blood test results
Voice 1: We ask patients to only come to our A&Es if absolutely necessary.
"We do not yet know how long this incident will last, and therefore are cancelling all
outpatient, endoscopy, cardiology and radiology appointments scheduled for this weekend.
Voice 2: Kettle still working, so we'll be OK!
Around lunchtime on May 12th, 2017, computers in some of the largest hospital systems in
London began to lock up one by one.
Data about patients, appointments, scans- inaccessible.
But these computers weren’t crashing.
Instead, doctors or nurses who tried to use a PC were met with this message:
“Oops, your files have been encrypted!...Many of your documents, photos, videos, databases
and other files are no longer accessible because they have been encrypted.
Maybe you are busy looking for a way to recover your files, but do not waste your time.
Nobody can recover your files without our decryption service...Send $300 worth of bitcoin
to this address.”
As if that wasn’t chilling enough for a hospital, a timer on the left counted down
exactly 3 days, after which the price would double, and another timer with 1 week, after
which all files would vanish forever.
As news services like the BBC began reporting that the National Health Service had been
hit with a major ‘cyber attack’, hospital staff and doctor’s offices tried to stop
the bleeding by unplugging computers that hadn’t yet been infected (4).
But the ransomware attack was spreading at lighting speed.
It had already traversed from Southeast Asia to Russia, where it hit the Ministry of the
Interior, across the Atlantic into North America, where it affected businesses like FedEx, and
into mainland Europe where it grabbed the Spanish telecom Telefonica and France’s
Renault (6).
And now it was tearing across the United Kingdom and the Island of Ireland (5).
Estimates say a third of all hospital trusts in the UK were affected in those hours, along
with 600 other doctor’s offices.
At least 19,000 appointments were cancelled, though officials stopped counting, while major
surgical operations were cancelled, ambulances diverted to unaffected hospitals, and overloaded
phone lines meant some chemo patients weren’t able to reach emergency lines (4,p1) . A few
hospitals, mistakenly believing the coast was clear, flipped machines back on only to
find them immediately caught in the ransomware.
In all, over 230,000 computers in more than 150 countries succumbed to the spread (7).
Each new device got the same message with the same running timer ticking down.
The software came to be known as Wannacry.
And unbeknownst to anyone that day, a clue about the perpetrator’s identity was lurking
in Wannacry’s software: a bit of code copied from an attack done by the cybercrime group
Lazarus.
Now this clue wouldn’t be conclusive, but there’s one important detail to know about
Lazarus: they’re widely believed to work on behalf of North Korea (8,9).
The crimes of North Korea go back decades.
And when I tell you ‘crimes’, I don’t mean it in a ‘North Korea bad.
America good’ way.
I mean North Korea’s literal involvement in international crime like drug smuggling,
counterfeiting, and insurance fraud (10).
In 1974, under the leadership of Kim Jong Un’s grandfather, Kim Il Sung, the North
Korean government was strapped for cash for its military programs and the lavish lifestyle
of the leadership.
So it opened the doors on a shiny new government bureaucracy: ‘Room 39’ (11).
Named for the original office number, ‘Room 39’ became a large operation under Kim Jong
Il.
Its task was the acquisition of hard currency through international activity.
Some of these activities included the legal export of “exotic mushrooms, ginseng, and
seaweed” (12), but also insurance fraud on claims of industrial accidents, natural
disasters, and inexplicable helicopter crashes (10).
The department also directed the production and distribution of heroin, opium, meth, counterfeit
cigarettes, weapons, and Viagra (10).
Their most iconic scheme involved the production of fake 100 dollar bills (13).
And it’s suspected room 39 continues to launder money through a chain of 150 North
Korean themed restaurants across Southeast Asia, where guests are served by women in
traditional dress while enjoying dog meat soup and photos on the wall of former president
Clinton with King Jong Il (16;17)(11,p5).
It’s all part of a larger so-called ‘revolutionary fund’ and ‘court economy’ that’s carried
on into the present day, utilizing front companies and tens of thousands of North Koreans domestically
and worldwide- raising slush funds for the dear leader and top party officials to the
tune of an estimated 500 million to 2 billion dollars per year (13;14;15).
But it’s important to caveat that most sourcing on the illegal international operations of
the North Korean regime date back between 2009 and 2011, during Kim Jong Il’s reign
and before Kim Jong Un succeeded him in the dynastic line.
Which leads us back to the ransoming of computers worldwide in 2017.
Is it possible that upon seizing control after his father’s death, Kim Jong Un directed
these arms of his government to focus their efforts on cybercrime- to achieve political
ends and acquire hard currency through the use of hacking?
We have a couple examples.
You might remember the 2014 hack of Sony pictures around the release of ‘The Interview’,
during which the Lazarus Group tried to undermine a satirical film about Kim Jong Un by leaking
a copy of the movie along with the personal data of Sony employees.
You might have also heard about their 2016 botched attempt to steal $1 billion from the
Federal Reserve in New York.
Both these examples led many to believe Kim Jong Un was steering his outside operations
towards cybercrime.
And so when the copied code from a previous Lazarus attack appeared in the Wannacry ransomware
in 2017, many suspected North Korea might have been behind the attack that crippled
computers at hospitals and private companies worldwide (20).
Suspicions were backed up with some evidence when cyber firms as well as the US and UK
governments accused North Korea with a “very high level of confidence” (18;19).
Here’s how they and public reporting say it happened:
In August of 2017, former National Security Agency contractor Harold Martin was arrested
at his home in Maryland, accused of literally carrying out 50 terabytes of classified NSA
data in hard copies and on thumb drives to be kept at his home, in his car, and in his
backyard shed (21;22).
Authorities suspected, though the evidence has never bore out, that Mr. Martin had to
do with a threat from an organization called the shadow brokers.
A year earlier, the mysterious organization advertised online that they were selling,
for $580 million dollars, stolen ‘cyber weapons’ from the NSA.
Among them, an exploit of Windows called Eternal Blue which moves across local area networks
and the internet- devastating because it could infect computers on its own without a user
accidentally downloading from a spammy website or clicking a shady link (23).
But when they failed to sell the stolen wares, the Shadow Brokers dumped all their files
onto the internet for anyone to download for free.
This included the potent NSA-developed cyberweapon Eternal Blue (24).
A month before the global ransomware attack, bad actors worldwide had access.
Now Microsoft had already taken on the task of patching Windows 7, 8, and 10 after being
tipped off about the leak of Eternalblue.
However, Windows XP, a version still in use by the UK’s National Health Service, was
no longer supported with security patches from Microsoft.
So XP computers and any pre Windows 10 PCs without the patch were vulnerable on the day
of the attack: May 12 2017 (25).
The first breakout was in Asia at 7:45 AM GMT.
The virus proceeded within 30 minutes over LAN connections and internet to Latin America.
Then within two hours to mainland Europe, then North America (26).
The ransomware was moving at lightning speed as designed.
But of course its most consequential impact would be in the UK’s National Health Service.
As money began to pour into the designated Bitcoin wallet, surgeries and appointments
cancelled- ambulances redirected, the system braced itself for disruption lasting well
into the weekend and beyond (4,p1).
Until, and this is true, a man registered a domain.
Marcus Hutchins, a 22 year-old working for Kryptos Logic was examining the ransomware
code that afternoon when he noticed it was linked to an unregistered domain.
When he registered the domain, the virus stopped spreading (27).
That simple.
Now, if an unregistered domain sounds a bit amateur hour for a government-backed hacking
organization, it’s a good moment to bring up that some have speculated the attack was
accidental or premature.
Others have suggested it was a false flag by another group to frame the North Koreans
(18).
But even if the public and private sector consensus says all signs point to North Korea,
it’s not that hard to see how this particular kind of doubt rings true for many.
After global panic and a quarter million disabled machines, it all seems kind of pathetic and
anticlimactic.
A man in his bedroom at home stopped a group that hacked Sony and almost swindled a billion
from the Federal Reserve?
All they nabbed that weekend was about 50,000 dollars, and every now and again someone drops
another 8 cents, another 47 cents into the BitCoin wallet.
Doesn’t this all seem below a government?
But this ignores one final detail: ’Criminal Sovereignty’.
It’s the name of a report from the Strategic Studies Institute, and a concept tossed around
by several journalists (11;28).
Criminal Sovereignty describes the specific way the North Korean government involves itself
in crime.
Think of a typical corrupt government somewhere in the world.
The government is either incapable of stopping a criminal enterprise, or they’re paid off
to turn a blind eye (think how former Mexican President Pena Nieto took 100 million bucks
from drug lord El Chapo) (29).
In the worst cases, government officials and criminal enterprises are intertwined.
It recently came out that Brazil’s president Bolsonaro, after running a campaign of anti
corruption, has a son linked to a death squad named “the crime bureau” (30).
This corruption exemplifies crime infiltrating governments.
But at their essence, they’re two separate things: government and criminal enterprise.
But with North Korea, the government and criminal enterprise are one in the same.
The government bureaucracy is designed to violate international law as a matter of course.
When the North Koreans traffic drugs, counterfeit money, hack computers, smuggle weapons, they
aren’t corrupting legitimate government functions, those are the functions.
It uses its flag, its diplomatic immunities, its sovereignty to carry out the business
of keeping the regime afloat.
The crime is the institution.
So what connects a chain of money laundering restaurants and indiscriminate ransomware
attacks, besides that they’re bizarre and petty, is that neither are below the heavily
isolated and internationally sanctioned government.
They are part of a quilt of illegal activity used to keep the Kims comfortable and the
nuclear program progressing.
Kim Jong Un presents a smilier face than his father to his nation, to South Korea, and
to the wider world, but just as the execution of his uncle shows the domestic brutality
remains in his early regime, so too do various hacks since his ascension demonstrate that
while the tactics change, the international criminality remains the same.
Here’s a transition: you know what else is rough about North Korea?
Average people don’t have Skillshare.
Whether it’s video editing, animation, design, photography, or starting a business, Skillshare
has more than 25,000 classes just right for you and your goals.
Premium membership grants you unlimited access to courses taught by experts, designed to
empower you to learn critical skills, and unlock new opportunities.
Now, specifically, I want you you join me in Mike Vardy’s class on using ToDoist to
increase productivity.
ToDoist is a digital task manager I’ve used for a few years now, and this course helped
me to reverse engineer my productivity framework.
Annually, Skillshare premium membership is super affordable- less than $10 a month.
So join the 7 million creators learning and thriving with Skillshare.
The first 500 members of this community to use the promo link in the description will
get their first 2 months free to try it out.
So be one of the first 500 to click the link in the description and get the 2-month risk-free
trial.
Learn new skills.
Do what you love.
Create.
Try Skillshare today.