52 comments

[ 2.9 ms ] story [ 110 ms ] thread
> DPRK IT workers have also assisted DPRK officials in procuring WMD and ballistic missile-related items for the DPRK’s prohibited weapons programs.

In what context are these programs "prohibited"? Do they violate a UN treaty that DPRK has ratified? How come USA can develop hypersonic nukes but DPRK is "prohibited"?

Also this explains why a Venmo transaction was held for a week after I put a joke about Glorious Leader in the description...

The very first mention in the PDF states "DPRK’s UN-prohibited WMD and ballistic missile programs".

So, that context. The United Nations.

You do stipulate "that the DPRK has ratified" - why does that matter? They are a member nation of the UN, so they are running afoul of the decisions of the body they are a part of.

That's not specific, nor explains why USA can legally pursue hypersonic nuke WMDs.

> They are a member nation of the UN, so they are running afoul of the decisions of the body they are a part of.

But this is a daily occurrence for the USA as well.

https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-be...

(The ICC was created by the UN)

And? What's your point? I'm not claiming the US has not done things prohibited by the UN, nor even what "degree" of prohibited, or any such thing. I'm pointing out that your objection to the classification of the DPRK's programs as "UN prohibited" is incorrect.

The UN has explicitly voted on and introduced sanctions against the DPRK for their WMD program, saying "yeah, don't do that" (the US has independently done so as well). That's it. That's the context around "prohibited". That's the answer to your question. Maybe what you mean is "how is that fair", or "why should the DPRK care about what others 'prohibit' them to do when they don't agree to it", and that's a different discussion; you're free to be an apologist for the DPRK, but to try and undermine the use of "prohibited" when the context is given -right there- in TFA is shitty rhetoric.

Also, if you want "specifics", https://www.armscontrol.org/factsheets/UN-Security-Council-R...

There is as far as I know no UN guidance preventing the DPRK from developing ballistic or hypersonic weapons, which aren't WMDs. It is incorrect to understand anything except their nuclear weapons program as prohibited by the UN. They were merely condemned by the UNSC.

The UN doesn't really have the authority to tell a country what it can and can't do beyond the treaties it has decided to sign, because that would obviously be a grave violation of sovereignty. The exception is sanctions, that in theory have to be followed.

From that link I shared -

Resolution 1718 (unanimously adopted by the UN Security Council on October 14, 2006): - Decides North Korea shall suspend all ballistic missile activities. - Decides North Korea shall abandon all WMD activities.

Resolution 1718’s Principal Sanctions: - Materials and technologies that could contribute to North Korea’s WMD programs and ballistic missile related activities, as set out in prior Security Council documents.

Member states are also required to: - Freeze the funds or financial assets of entities designated by the Security Council as providing support for North Korea’s nuclear, missile, and other WMD program

>> The UN doesn't really have the authority to tell a country what it can and can't do beyond the treaties it has decided to sign

So there are three things at issue here.

First, you carve out sanctions, well, there are sanctions at play here, as above, and the whole point of the document is to alert corporations that they may fall afoul of those sanctions.

Second, does the UN have 'legal authority' for actions like this? Well, yes, actually. Article 25 of the UN Charter stipulates "The Members of the United Nations agree to accept and carry out the decisions of the Security Council in accordance with the present Charter." Becoming a member nation of the UN requires accepting the Charter. Ergo, the DPRK agreed to be bound by decisions made by the security council when it joined the UN as a member nation. Arguing that this is unfair is like saying states shouldn't be bound by federal laws created since their initial joining of the US; no, joining was agreeing to the decisions of the rule making bodies as well. This differs from, say, the TPNW, which is a treaty that the general assembly adopted, and has had some nations who have signed onto, but which does not actually have legal binding even according to the UN's own charter because of that.

Third, does the UN have -enforcement- authority. This is more a pragmatic, rather than legal, concern. And no, it doesn't. It doesn't have a standing army, it isn't in control of any currency, it has no way to enforce a decision if the largest countries don't choose to enforce it for them via some method of coercion. Which is what is happening here; the US accepted the UNSC's decision, and imposed it, and this document is warning that if you don't adhere to that decision within the US' jurisdiction you will be committing a crime that the US will seek to prosecute you for. Which is the context for which "these programs are prohibited" is for.

Yes, exactly. The only binding part of the resolutions is the sanctions. The UNSC doesn't have the power to set universal international law, so the NK ballistic missile program is still legal under international law.

However, UN member states can't help NK in those endeavours.

If you look at the fine print of the resolution, you can see it is invoking Article 41 of Chapter 7, which allows : "The Security Council may decide what measures not involving the use of armed force are to be employed to give effect to its decisions, and it may call upon the Members of the United Nations to apply such measures. These may include complete or partial interruption of economic relations and of rail, sea, air, postal, telegraphic, radio, and other means of communication, and the severance of diplomatic relations."

It's weird like that, but the UNSC simply doesn't have the authority to impose arbitrary restrictions on the behaviour of member states (for obvious reasons).

"The UNSC doesn't have the power to set universal international law" - no one does, and no one is claiming otherwise. Why are you arguing against a strawman?
Because you claimed that a UNSC resolution made it illegal for NK to develop ballistic missiles. There is no provision in the UN charter that says that the UNSC can legally bind any country not to develop certain classes of weaponry.

So, for the UNSC to have the authority to make it illegal under IL for NK to develop such weapons would be tantamount to it having the authority to decide universal international law.

So unless you can find a chapter referred to by resolution 1718 that gives the power to ban the development of some types of weapon, the UNSC doesn't have the authority to make a country's weapon program illegal. All it can do is implement certain sanction or make military action legal.

In any case, if the UNSC did have this power, why would the NPT need to exist? It could just decide that developing nuclear weapons is illegal for here on out, no need to get countries to sign a treaty, right?

>> Because you claimed that a UNSC resolution made it illegal for NK to develop ballistic missiles.

I think what we have here is a disagreement in terms. There is no such thing as "universal international law". Period. Because unless there's a mutual agreement by all countries to accept some sort of governing body, over their own local law, and to supply enforcement, it can't exist.

That said, there -is- an international body, that has had most countries join, with a charter that stipulates certain things that body can decide, and how those member countries promise to respond.

That body's charter says "Members agree to accept and carry out the decisions of the Security Council". DPRK is a member. Ergo, it agreed to accept and carry out the decisions of the Security Council.

A decision of the security council was that the DPRK needs to "suspend all ballistic missile activities" and to "abandon all WMD activities." Ergo, that body has decided the DPRK is prohibited from doing those things (the original discussion, remember?). The DPRK has not done so.

Back to the point of this whole thread, the consequence of their not doing so is that member nations are forbidden from doing certain things for/with the DPRK ("sanctions"). Which is what this document is about. To say "how can it be 'prohibited' for the DPRK to engage in ballistic and WMD activities", -that's how-. That's the point of all of this. The UN prohibited it. And stipulated sanctions, which the US is adhering to.

"Well, that's not -illegal- then!" - what does that even mean in that case? "The DPRK didn't agree to -this- particular rule" - so what? I didn't agree to the speed limit; if I decide not to obey it, the US government can still enforce a punishment on me. I'm not really sure what you're arguing, except that the UN doesn't constitute "universal international law", but I don't even know what that means; certainly, whatever it does mean, given your objection, it doesn't exist, so I'm not sure why you'd think "prohibited" must mean the same thing as it; what are you trying to argue? The DPRK has not upheld the things it agreed to when joining the UN, the UN responded, and that response (and what it means for US based corporations) is obviously what is being referred to in the PDF.

>> In any case, if the UNSC did have this power, why would the NPT need to exist

Because ultimately the UNSC will not agree to non-proliferation. The NPT has no enforcement provision for those who do not sign it, but becomes a way to establish international norms for those who do. In short, the NPT is a way for a country to say "I believe non-proliferation should be standard, and will agree to not do it"; it is opt in, only applies to those who opt in, and any country can opt into it (or out of it). The UNSC is force; an agreement there can be decided on even against the wishes of another member state (as happened with the DPRK), just by dint of that other country being a member state, and carries with it penalties such as sanctions.

> That's not specific, nor explains why USA can legally pursue hypersonic nuke WMDs.

That's easy, the US has a permanent seat on the security council. It can veto any attempt to restrict it with international law. Same for Russia and China's WMDs.

The UNSC can't make just anything illegal. It's legal for NK to develop ballistic missiles under international law.

It wasn't legal for NK to develop nukes because of the NPT. In theory further developments after they left the NPT are legal.

A more interesting example would be, for example, Pakistan, which never joined the NPT and isn't on the security council, yet legally developed nuclear weapons.

Makes me wonder if the "ISIS beer fund" guy ever had his funds released.
My work brings me into regular contact with DPRK IT professionals, for example by [teaching open source sotware](https://izbicki.me/blog/teaching-open-source-in-north-korea....) or [teaching proper web design](https://izbicki.me/blog/fixing-north-korea-kcna-webpage.html). I make a lot of effort to respect sanctions, but documents like this are incredibly unhelpful. I've read through the document, and it seems completely devoid of actionable, DPRK-specific information that can help IT professionals avoid sanctions violations. For example, the document encourages websites to monitor for the following activity as "indications of DPRK IT workers who may be using their platforms":

• Multiple logins into one account from various IP addresses in a relatively short period of time, especially if the IP addresses are associated with different countries;

• Developers are logging into multiple accounts on the same platform from one IP address;

• Developers are logged into their accounts continuously for one or more days at a time;

• Router port or other technical configurations associated with use of remote desktop sharing software, such as port 3389 in the router used to access the account, particularly if usage of remote desktop sharing software is not standard company practice;

• Developer accounts use a fraudulent client account to increase developer account ratings, but both the client and developer accounts use the same PayPal account to transfer/withdraw money (paying themselves with their own money);

• Frequent use of document templates for things such as bidding documents and project communication methods, especially the same templates being used across different developer accounts;

• Multiple developer accounts receiving high ratings from one client account in a short period, with similar or identical documentation used to establish the developer accounts and/or the client account;

• Extensive bidding on projects, and a low number of accepted project bids compared to the number of projects bids on by a developer; and

• Frequent transfers of money through payment platforms, especially to PRC-based bank accounts, and sometimes routed through one or more companies to disguise the ultimate destination of the funds.

This list is so generic that I'm not sure what the point of it is. I think it would make sense to ban some of these practices from a general security perspective. But these practices would give way too many false positives if you were trying to use them to identify DPRK developers.

I'm honestly really confused about who the target audience is for publications like this. It can't be actual IT professionals due to the lack of actionable information. Is it journalists? Do we publish these things just to remind them that we don't like the DPRK?

The simplest first thing that U.S. companies should do is implement E-Verify and require that all subcontractors do the same. This publication does not even mention E-Verify.
That would only help you if they claim to be US-based in the first place. They do mention background checks, there are some companies offering those internationally.
They mention forged social security cards. The government has a system for verifying them, E-Verify, provided for free to employers.
I tried to help a family member set up E-Verify for her small manufacturing company in 2019, and the government would not approve her business for E-Verify, even though they had been established for 50 years and had almost 200 employees on the payroll.

They ran just about everything in-house (including payroll) and because they didn't use a PEO, the government didn't want to deal with them, and they had to get someone in Congress to intervene on their behalf before getting the approval.

I have implemented it for two businesses, a software consultancy with 32 employees at the time and a tugboat company with 50 employees at the time. It was tedious, but we had no real obstacles.
Why would an employer get to see my social security card? Not just the number, which is a "fuck the law" thing by this point, but the actual card? Might as well ask the dimensions of my intestines.

[Flashback May 19 23:19: someone did once check out my organs that way! A brain scan I only found out about because I was asked to participate in a class action suit against Aetna for not paying! Thanks for not paying, Aetna! You know I didn't sign on to that suit against you, that's why I didn't! Otherwise it would have been like picking up money off the street, which I have done, and it was easy, but I didn't see it that way because of the immorality of suing you! They were committing malpractice to harm me, spying on me with a brain scan! I sincerely thank you for not covering that claim, only thing that limited my time in the torture ward. I would be in there to this day if you paid and kept paying those fraudulent claims.]

Federal agencies regularly and deliberately issue vague guidance. It's designed to scare the maximum number of people from doing anything for fear that whatever they're doing will be construed as illegal. It would be less effective if they actually articulated in a specific actionable manner. Arbitrary and capricious is the name of the game.
> I make a lot of effort to respect sanctions

Are there certain things you aren't able to teach when you travel, or is that fairly unrestricted? I had no idea people were doing work like this.

It does not take much to run afoul of sanctions on a country that has total embargo status. Even normally legal counsel advice may be prohibited to US persons to provide ( sorry for odd syntax ). In other words, OP does not have to deal with anything beyond normal IT work and still could be restricted on what information he can provide.

Not to search too far, although that is a more exotic example, recently crypto guy got smacked for providing crypto speech ( classified as technical advice ) to DPRK(1).

(1)https://www.justice.gov/opa/pr/us-citizen-who-conspired-assi...

Do you have an example where the defendant didn't specifically and purposefully provide guidance on how to use tech to circumvent sanctions? It's not like he was generically talking about crypto.
I mean, we would have to see all sides of information, but this is not normal IT work.

On another note, would this case be directly related to the 400 million hack north korea did?

Will this soon apply to Russian developers?
They'll just work on some military hardware instead.
> They'll just work on some military hardware instead.

A lot of Russian developers are leaving Russia instead: https://www.nytimes.com/2022/04/13/technology/russia-tech-wo....

This is the first geopolitical event that I actually have some inside experience with. I work with a lot of Russian developers, and 90% of them have relocated since the war started.

Those who were already working with companies from abroad have largely left. I’m wondering about those who were working with Russian orgs their entire lives, those people are a lot less mobile, they can’t speak other languages very well and usually feel like ‘nobody’s waiting for them out there.’
By the time USSR started to crumble KGB decided to embed spies and criminals into Western societies hiding them amongst a wave of refugees and economic migrants.

I would expect the same happening this time.

Yes, and permanently.
How do you get IT workers there being highly skilled when most of the population isn't on the internet. Also, considering the treatment of throwing lots of them in forced labor camps over percieved slights and poverty..

I just don't understand where are these people coming from? It's not like NK has universities and a lively educated class.

North Korea literally does have universities and an educated class.
(comment deleted)
(comment deleted)
I suspect you have an unrealistic view of the country.

Even very poor countries with hereditary dictators are very large places.

Poor countries with hereditary dictators aren't nearly as secretive, closed off, or have such sanctions as NK.
You are missing the fact that not all societies are open

Closed authoritarian societies, even those under sanction, have a ruling and privileged classes that DO have all the amenities — basically by extracting all the wealth to the small ruling classes. Even if it is only a microscopic percentage of the society that is at the top, it can still amount to substantial numbers.

Indeed the USA does have some aspects of this - certainly it is too lax in preventing a set of extractive and exploitative industries/industrialists from hoarding most of the resources and income and taxing it too little

But the USA, while an unhelathy democracy, is NOT yet an authoritarian state. It is, however, within one minor and one major election from becoming one.

If you think the above description actually fully describes the USA, you REALLY haven't seen anything yet. If small-d democracy fails in the next two elections, these will truly look like the good old days, and you'll be telling your grandchildren how good it was in the early 2020s, as the USA (and probably most western democracies with it) descend to the authoritarian depths of Russia, Venezuela, China, NK, etc.

While it is far from perfect, it is critical to understand the differences, and get out and vote while you still can to prevent the much worse failure from becoming reality.

Thank you for stating this.

As much as I worry about US ( and my adopted home ), it is a ridiculous exaggeration to call it outright authoritarian ( or closed for that matter ). It does not mean that there are no attempts at making it so, but I think we are still somewhat far from it for now.

Sometimes I wonder if the exaggeration is just the way we communicate today ( everything is a crisis / sky is falling / we are all gonna die / find out which commonly used household item is deadly ) as that is what the population was taught about the world by interacting with ads online.

Yes, while there is a heavy dose of hyperbole in the media and internet spheres, I think the effect is actually to obscure the level of the present danger.

Kind of the "Boy Who Cried Wolf" problem — e.g., while people yelled "Nazi!" at GW Bush and D Cheney, many of the new crop in that party have already literally tried to steal an election and will implement authoritarian policies if they get power - so much so that even Cheney's daughter is an outcast for merely trying to adhere to democratic principles.

The difference is whether the voters choose their leaders or the leaders choose their voters.

So, while we are most definitely not there yet, democracy is literally teetering on the brink, and if too many people fail to vote, everyone will get to see up close what a real autocracy looks like. Seriously, the only thing on the ballot this year is democracy, and people must show up and vote for small-d democratic candidates down to dogcatcher. Get you and every friend you know to show up.

It's still a pretty large country: around 26 million people. And it's not exactly a destitute state: it's a kleptocratic state with an educated (often abroad) elite class.

It's hard to get an exact estimate of their current HDI, but the UN placed it at 0.766 back in the 1990s[1]. That puts them in around the same tier as Yugoslavia today.

[1]: https://hdr.undp.org/sites/default/files/reports/259/hdr_199...

(comment deleted)
I wonder why some NK people really great about hacking/computer science/rocket science despite the country is poor. Looks like successful of education.
The fact they're capable of successfully building, deploying, and advancing nuclear technology should tell you that your stereotypes are missing some things. The Wiki page [1] is very outdated, but has plentiful information to at least start challenging your stereotypes. For instance almost 40 years ago now, North Korea had reportedly 23,000 college/university teachers alongside 4000 other postsecondary teachers teaching upwards of 300,000 university level students at the time, with an educational system largely focused on STEM.

And it's reasonable to expect those numbers have increased since. Education through secondary is mandatory, and there is then a competitive process for admittance to higher education. Adult education is also an ongoing process with workers continuing to participate in educational groups daily and also having, and having the opportunity to participate in the equivalent of educational 'boot camps' to learn advanced trades.

I feel in modern society that we are increasingly failing to learn from the past (and present) due to presenting things such that evil is evil through and through, and good - well it at least has some flaws, but tends to be more or less good through and through. Reality isn't quite so kind.

[1] - https://en.wikipedia.org/wiki/Education_in_North_Korea

From the review of Dr. Suzy Kim’s “Everyday Life in the North Korean Revolution, 1945-1950”:

“The anglophone archive on the DPRK is a bleak record of imperialist slander, replete with the most lurid and theatrical tales of passively suffering masses and the flamboyant pseudo-socialist “regime” that supposedly keeps them in a state of total servitude. Between hypocritical fears of its nuclear power and conscience-rattling anxieties over the alleged condition of human rights within, the DPRK looms as a symbol of the negation of liberal freedoms. It is within this context that Suzy Kim’s Everyday Life in the North Korean Revolution, 1945-1950 must be considered.”

https://liberatedtexts.com/reviews/socialist-construction-in...

What's your point? It's pretty obviously a country ruled by an authoritarian regime with a really low standard of living. Is there something noteworthy about the fact that the US slanders it?
> DPRK IT workers can individually earn more than USD 300,000 a year in some cases

i'd say it is one of the best description of the current successful state of remote work :)

And in overall that guidance reads like an advertisement for the offshoring to DRPK - can you imagine how highly disciplined those workers given that they are managed by the NK security service who is taking a share of their money - imagine missing a deadline with a gun to your head - the word "fired" gets that Schwarzenegger's meaning :)

So weird, this part about validating for DRPK workers:

Conduct a pre-employment background check, drug test, and fingerprint/biometric log-in to verify identity and claimed location.

Background check, sure. Fingerprint/biometric identity verification? Lol. I would never, ever submit to such a thing. DRUG TEST? How the hell does that catch DRPK workers?

Where are they going to submit a drug test...?
> DPRK IT companies and their workers normally engage in a wide range of IT development work of varying complexity and difficulty, such as:

> building virtual currency exchange platforms and digital coins,

> DPRK IT workers often take on projects that involve virtual currency.

> Some DPRK IT workers have designed virtual currency exchanges or created analytic tools and applications for virtual currency traders and marketed their products themselves

@bitfinexed lol