Seoul urged to tighten vigilance against North Korean hackers

'NK cyber warfare has potential to cause greater damage than nuclear weapons'

By Lee Kyung-min

South Korea should raise its guard against cyberattacks from North Korea, as it has been increasingly vulnerable to Pyongyang's tech-driven cyberwarfare, experts said Tuesday.

They added that the international community should take North Korea's fast-advancing, cyber manipulation tactics more seriously, as cyberattacks are becoming an easier, more cost-effective alternative to nuclear and missile threats.

Contrary to common misunderstanding that the North is an isolated, poor and undeveloped country with no modernization or technological capabilities, Balbina Hwang, a visiting professor at Georgetown University, said the country's activities in online crime was alarming.

"The notion dangerously underestimates North Korea's growing sophistication and participation in so-called hybrid warfare utilizing asymmetric capabilities, especially in the cyber-realm. It has the potential to cause greater global damage or chaos than its nuclear weapons program," the former U.S. State Department senior adviser told The Korea Times.

What is of more concern is that the "disturbing" developments come amid the now-drawn-out standstill in nuclear disarmament negotiations, during which the international community's attention has been drawn away from many crucial threats posed by Pyongyang.

"The standoff with North Korea that has been simmering for well over three decades now, has in many ways distracted focus from its pursuit of other weapons of mass destruction involving chemical and biological, conventional military threats, participation in many illicit activities such as trafficking drugs, counterfeit or banned goods. And most alarming of all, aggressive participation in cybercrimes," the professor added.

Hwang's concern came after a recent news story by the Associated Press that cited a report from the United Nations Security Council about North Korean cyber experts having "illegally raised money for the country's weapons of mass destruction programs with total proceeds to date estimated at up to $2 billion."

According to the U.N. report, North Korea is using cyberspace "to launch increasingly sophisticated attacks to steal funds from financial institutions and cryptocurrency exchanges to generate income."

The report said North Korea's large-scale attacks against cryptocurrency exchanges allow the country "to generate income in ways that are harder to trace and subject to less government oversight and regulation than the traditional banking sector."

The hardest-hit was South Korea, the victim of 10 North Korean cyberattacks, followed by India with three attacks and Bangladesh and Chile with two each.

South Korea's Bithumb, one of the largest cryptocurrency exchanges in the world, was reportedly attacked at least four times. It said the first two attacks in February 2017 and July 2017 each resulted in losses of approximately $7 million, while a June 2018 attack led to a $31 million loss and a March 2019 attack to a $20 million loss.

When contacted, Bithumb declined to comment on the matter citing the sensitivity of the issue.

Michael Raska, an assistant professor at the S. Rajaratnam School of International Studies (RSIS) in Singapore, said that Pyongyang aims to gain a strategic advantage by pursuing cyber warfare in conjunction with nuclear and ballistic missile programs as asymmetric capabilities.

"These provide relatively low-cost but effective means to exert its influence and provide a capability for political, economic and military coercion without triggering a major armed conflict," Raska said.

'Cyber-escalation' looming larger

According to Raska's analysis, the worrying trend is that North Korea has gradually demonstrated a resolve for what he called a "cyber-escalation" ― targeting critical infrastructures of other nations as well as private corporations and banks for varying political motives.

This is a grave cause for concern because cyberattacks could help the North facilitate retaliation, coercion, covert intelligence gathering and illicit financial gain by bypassing strict international sanctions all the while securing foreign currency.

In Hwang's view, the internet may be an "ideal" arena for the North to be an aggressive participant, because cyberattacks have relatively lower costs while posing greater challenges and difficulties to the international community to respond adequately.

"The cyber arena is where the perpetrator's identity as well as activities are far more difficult to ascertain ― as opposed to a missile launch or nuclear test. This diminishes the effectiveness of a unified response or even defense against such activities."

Against this backdrop, the experts stressed that the international community should pay more attention to the North's cyber capabilities and its cybercrimes as much as it does to the nuclear issue.

Raska called for Seoul and Washington to develop anti-cyberattack capabilities via closer integration under the strategic alliance between the two countries, a task that should be equally prioritized with shaping international dialogue on cyber norms.

"While core security concerns have been more about responding effectively against North Korea's growing WMD capabilities, the South Korean government should boost cyber capabilities, both offensive and defensive, as part of a full-spectrum military readiness posture against a range of potential North Korean provocations," he said.