Fake news about North Korean troops, and a Russian attack on ROK websites
21:45 Share

Hello podcast listeners. I have an important announcement to share about upcoming changes to the NK News podcast.

Starting November 20, our full-length episodes with special guests will be exclusively available to NK News subscribers. This shift will allow us to invest more in bringing you top-quality interviews, cutting-edge analysis, and a more comprehensive NK News experience across our website and podcast platforms. Don't miss out! Subscribe now to stay fully informed and support our mission to raise the bar in North Korea reporting.

Until the end of November, podcast listeners can sign up for just $1 for their first month, with the following 12 months at 50% off. Head to nknews.org/join for more. You'll get full access to the NK News website, news, analysis and opinion every day, our daily update and week ahead newsletters, plus get exclusive invites to online webinars and occasional in-person events. Join our community today and help support the podcast grow.

Hello listeners and welcome to the NK News Podcast. I'm your host, Jack O's Wetsleut, and this episode was recorded on Tuesday, the 12th of November 2024, and I'm joined in the studio by Shreyas Reddy. Shreyas, welcome back on the show. Thank you. Good to be here.

Well, we are still tracking, of course, this major story about North Korean troop deployment to Russia to help in its war against Ukraine. Are we sure that there are North Korean troops in Russia and or Ukraine? I mean, have

Has either the Russian government or the North Korean government acknowledged this? Well, the Russian and North Korean governments haven't particularly confirmed it, but they've also kind of shifted their strategy from initially denying it and dismissing such reports as fake news to essentially saying, if we do it, it is well within our right to do so. Right.

Now, speaking of fake news, this brings us to the story that you brought out a week ago, but it's still very relevant, and everyone should go online to nknews.org and check it. And that story is called How North Korea's Troop Deployment to Russia Has Triggered a Rash of Fake News. And you've done a great investigation here using various tools. So,

Where do you want to start? Because people have been tweeting and sharing on all sorts of social media, photos and videos. I've mentioned it before, but you've done the deep dive. So get us into it.

Yeah. So I think, like you said, there have been a lot of photos and videos that have been going around in the past few weeks claiming to show North Korean troops in Ukraine or deployed to Russian forces at the very least. And a lot of them have clearly been aimed more at portraying the North Korean troops in negative light or showing them essentially not getting along with their Russian counterparts, but

But perhaps one that particularly stood out to us and what inspired this particular investigation was a photo of a supposed, well,

We just see a North Korean soldier lying on the ground, either dead or comatose, not sure, while someone above him, stands above him, holding what appears to be a military ID card. Right. Now, for me, looking at that photograph, and I don't have the

the graphics analysis tools that you have at your disposal here. But to me, I was immediately struck by the wording that, that sounded wrong on the front of that document. It says, uh, good in Shinbun or literally soldier identification paper or document. Uh,

And I wasn't sure whether the word Shinbunchung would be used in that way in North Korea. And it turns out probably not, right? Well, yeah, I think that was one thing that stood out to us as well. And one of the things that when I first saw the photo as well, I just...

ran a quick search through our KCNA watch archives to see where have they used this word. And they have used it in certain cases, usually more for civilian purposes or quite often for the early years of North Korea. But again, it was essentially in a civilian context. It's not something that they use in a military context.

And sure enough, we spoke to a defector and in fact, indirectly spoke to, got confirmation from multiple defectors. That is not a phrase that they would use. Certainly not the name on the actual document itself. Definitely not. For one thing, documents like those are not

known to be issued to regular soldiers. Now, even if we consider that this may be an exceptional case for troop deployments, the phrase that rather than Shinbunjang, they would be more likely to use Guninjang for military ID cards. Yeah, and that makes sense. So literally, what,

What, a soldier pass or a soldier card? Yeah, as opposed to Shinbunjung, which stands out a bit more because it's more the kind of term that you see in South Korea for South Korean soldiers.

That's true. Although even in, now I haven't looked at South Korean ID card, but when Shinbunchung is the word for an ID document or an ID card, but you don't see Shinbunchung often used on that document that it's labeling. It's more what you see in terms of how people describe the document. Right, it's a description rather than the name of a document. Yeah. And so I think that was the thing that stood out to us. So

immediately decided, okay, let's dig into this picture. For one thing, it already looked a little suspicious with this soldier just lying face down on the ground. They looked a little odd, positioning a little stage, but still had to dig into it. So we used some photo forensics tools to conduct essentially one particular analysis we used was error level analysis. Now what that does is

It looks for things that are incongruous, things that stand out, and essentially highlights areas that are inconsistent, suggesting photo manipulation of sorts. Like basically a Photoshop. Essentially. Right. And so this is now, obviously, there's none of these techniques 100%, but...

when it shows you something that's a clear outlier, that's usually a good indicator that something's off. And in this case, certainly the passport, its edges, and definitely the text on it looked a little out of place. Now with text, that may just be because it's sharper feature. But the fact that all these things looked a lot of place seemed odd. And then also when you zoom in a little bit on the edges of the passport, there are little inconsistencies around the pixels suggesting something's a little off.

So, on the basis of that, as well as the broader context for the wording and everything, it just genuinely seemed like this particular photo did not make sense. And there were no, at least as far as I recall, there were no photographs of the inside of the document, right? It's not a card. It's like a little passport book. Exactly. So, there's no...

of the name page or any stamps that might be in there, anything. All you see is the cover. So in the absence of further corroborating information, I would dismiss this photograph. You too? Yeah, I think...

especially if they managed to get hold of this document, you would think they would at least have the sense to post a few more photos just to prove what they're saying. Show the man's name, his unit number, his serial number, something like that. So we don't know who this man is. We hope he's not dead or comatose. But at this stage, I wouldn't take that photograph on face value. Similarly, you mentioned...

a video that somebody sent to me on, I think it was on Twitter, purportedly showing a can of dog meat from North Korea. And immediately I looked at that and I thought, ha, North Korea, like in North Korea, they say dan gogi, sweet meat, rather than kaegogi, dog meat.

to describe the exact same thing. So when that label on the can said Kaegogi, I thought, yeah, that looks fake to me. What did you think? I mean, pretty much. So they tried to make it seem like, oh, this is a product. North Korea even had labels that tried to suggest it was manufactured in North Korea. Right. But...

that little telltale sign, that use of Khaegogi rather than Thangogi, that right away suggests someone probably just used an online translator or didn't particularly do their research before putting this together. But clearly they've gone to a lot of trouble, right? I mean, they've taken a can of meat, they've printed a label in color, they've stuck it around the can, so they've gone to the trouble of trying to make it look like this is a North Korean can of dog meat because it's got...

made in Choson Minjajuyin Min Gonggwa Guk on the back of it. It's not just a bit of photoshopping. They've gone to trouble here. Yeah, and I think that's one of those things where you've just got to ask, why are they doing this? What are they getting out of this? A lot of the things that we're seeing coming out of this, they seem to have particularly good production quality at the very least, whether it's the dog meat video, the soldier lying face down on the ground,

Or another video in which they claim to show a North Korean soldier in Russian uniform, heavily wounded, saying, oh, the Ukrainians will win and Putin will be defeated in this war. And again, even that stood out because for all the effort that went into it,

All the wording just seemed so heavily staged, it seemed out of place. Right, it seemed a little bit like he was repeating a practiced or rehearsed speech. Yeah, definitely felt a little like that. With some clear psychological messaging here. Yeah, and we've had people confirm that...

We had North Korean defectors confirm that he did speak in a North Korean dialect. So a lot of effort did go into this. But at the same time, it's just the little things that make it seem suspicious, that will make it seem out of place. Now, if these videos were real and these photographs were real, these would be the sorts of things that the Ukrainian government would want us to see. Have they been promoted through Ukrainian official channels? So...

It's kind of curious in that sense, in that, yeah, this would be the sort of thing you'd expect would benefit Ukrainian propaganda to some extent. And we've seen certainly like the photograph of the dead soldier. It did pop up on one Ukrainian army regiment's telegram channel, but it wasn't originally from there. It does seem hard to say where these are coming from for sure.

What we can say is that at the highest levels, and by which I mean President Zelensky, they've certainly dismissed a lot of these reports. So, and I think...

Now, there are two ways to look at that. One, maybe they're saying we don't have anything to do with this. The other version could be continue spreading the propaganda, but distance the highest levels of the leadership from it. Just maintain plausible deniability because fundamentally, a lot of these, if you actually look into them and as we have done, prove that they aren't

that they aren't true or at least aren't likely to be true, it actually undermines the Ukrainian cause. It undermines what they're doing. And there's certainly been pro-Ukraine military channels, pro-Ukraine communication channels that have said, look, stop doing this. You're actually undermining what we're trying to do here by putting out this cheap propaganda. Maybe you think this is a joke, but...

fundamentally it makes it harder for people to trust what we're saying and doing if they think Ukraine is putting out false content like this. So to wrap this up, Shreyas, have there been any photographs or films that you've seen of North Korean soldiers on or near the battlefield that are reliable or verifiable?

I mean, at the moment, all we have is, you say we have audio clips from Ukrainian intelligence. We have the earlier videos of North Koreans in Russian training sites, but near the border for now, that's still something we'll have to wait and watch. At the moment, all we have to go on is the Ukrainian authorities based on audio reports and intelligence, but no firm concrete evidence. Okay. Well, we at NK News can at least...

slap ourselves on the back a little bit and be proud that we're being rigorous and fighting against misinformation and any tendency to try to sensationalize the story. Yeah, I think for now, I think just like with any propaganda from any side, we want to be a little skeptical. We want to analyze everything rather than just taking it at face value.

Okay, now a second story today. It seems that there are some pro-Russian hackers once again showing that South Korea is vulnerable in many aspects to cyber attacks. Yeah.

So essentially this came to light last week after the defense ministry website, the South Korean defense ministry website and a bunch of other Korean government websites went down through a distributed denial of service or DDoS attack. That's the most basic and common of all online attacks against a website to try to bring it down, right? I mean, depends on how you look at it. So it's one of those things that doesn't have to be particularly technically sophisticated, but if you essentially overwhelm

a website with enough internet traffic

It brings it down. So essentially, you just need people flooding the website. Right. And this has been going on for decades. I mean, this is the, you know, we're familiar with DDoS since the early 2000s, if not the late 90s. Yeah. So it's been definitely going on for a while. And North Korean cyber criminals certainly have their own history of doing that to South Korea. So initially, when this happened, there were suggestions in South Korean media. It could be pro-Russian hackers. It could be North Korean hackers. But...

Fundamentally, I think we also initially were considering the possibility of that. But fundamentally, they did stand out a little bit in that North Korea hasn't

conducted any major DDoS campaigns against South Korea since about 2013. That's quite a long time. Yeah, they've got the capabilities, but their interests now are fundamentally more aimed at the regime's strategic goals, so financially motivated cybercrime like cryptocurrency theft or stealing weapons designs, cyber espionage, etc. Right, useful information. So something like this, it certainly could suit their interests, but it's not the biggest priority for them.

And so while this is going on, while a lot of media outlets and even government sources in South Korea were saying, we're still looking into this, we're not sure where this is coming from. Essentially,

we found out that a pro-Russian hacktivist group had already claimed responsibility for it. In fact, they'd been announcing for days on their Telegram channel that they were planning to do this, which sites they had taken down. And so they claimed responsibility for this days before the South Korean government confirmed that it was a pro-Russian group.

Is that rare for a group to claim responsibility for DDoS attacks? Not really, actually. So a lot of them tend to mount these sorts of organized campaigns. Now, when it comes to cybersecurity issues related to anything in the Korean Peninsula, it's not something we're fundamentally used to because here we're more used to North Korean groups doing things their way. But a lot of these hacktivists or hacker activists essentially

they are motivated to broadcast what they're doing and why they're doing it. And so in this case, they had announced that

They objected to South Korean foreign minister and indirectly South Korean president talking about potentially contributing to Ukraine's war efforts by reviewing the possibility of providing lethal weapons support. And so they said in retaliation for this, we are going to take down South Korean government websites, critical services, essentially just take down the websites.

But at the same time, the group in question, so it's a pro-Russian group called No Name 057.

They typically just take down the websites briefly, no lasting damage, they don't steal data, nothing like that. It's about making a statement. Okay, and the statement here is not in response to South Korea actually sending weapons to Ukraine. It's in response to South Korea talking about maybe reviewing its policy of not sending weapons to Ukraine. So it's, I mean, gosh, if that's what they're doing for this, what would they do if South Korea actually sends weapons to Ukraine? Makes you wonder.

Were there any critical services taken offline? Anything really sensitive? I mean, the Ministry of Defense website, that is embarrassing. And you'd want South Korea to be more secure than that in its anti-cyber attacks. But anything critical? So they did take down the websites of critical infrastructure services, like, for example, electricity and power grid. But the thing is, they didn't actually take down the...

power grids themselves. It was just the website of the corporations, the organizations that were behind it. And fundamentally, it didn't really leave any lasting damage. I think for them, these groups aren't the types who try to disrupt services that people genuinely need to that extent. It's more about just making enough splash that the other side can recover.

no lasting costs, no lasting damages beyond just having to improve in better cybersecurity defenses. And so it is a bit of egg on the face of the South Korean government because they've suffered a number of different kinds of hacks and leaks and attacks over the number of years. Are they any worse than other governments? Should they be doing better? I mean, yes and no. I think certainly those of us who have...

braved South Korean government websites know that they're not ideal. They've certainly got their weaknesses. We spoke, in fact, when I was speaking to a German cybersecurity organization that consulted with us on this particular story, they expressed surprise that the website, the defense ministry website wasn't yet up by the time they spoke to me like a day later. And I pointed out that it's mostly inconsistency with the website. It

In some cases, it was still loading. In some cases, it wasn't. But I think also at the same time, it must be said that the reason a campaign like this is so effective is because it's not about technical sophistication. The way this group operates is it mobilizes a very large follower base, a very large user base to mount coordinated attacks against a website.

They have a basic toolkit that they use to carry out these DDoS attacks, but fundamentally it's all about numbers. It's all about scale. And so when it comes down to that, many websites will be vulnerable. I think you'd have to be the kind of website that is genuinely geared for high traffic to avoid that sort of problem. So it's brute force, basically.

Well, gosh, let's see what happens if and when South Korea does actually change its policy on sending weapons. This is a foretaste of things to come, perhaps. Thank you, Shreyas Reddy, for coming on the show and walking us through these big stories. People, check it out on nknews.org. Thanks a lot.

A reminder that starting from November 20th, our full-length episodes with special guests will be exclusively available to NK News subscribers. This shift will allow us to invest more in bringing you top-quality interviews, cutting-edge analysis, and a more comprehensive NK News experience across our website and podcast platforms. So don't miss out. Subscribe now to stay fully informed and support our mission to raise the bar in North Korea reporting.

Until the end of November, podcast listeners can sign up for just a dollar for their first month with the following 12 months at 50% off. Head to nknews.org slash join for more. You'll get full access to the NK News website, news, analysis, and opinion every day, our daily update and week ahead newsletters, plus get exclusive invites to online webinars and occasional in-person events where you might even meet me. Join our community today and help support the podcast grow.

Ladies and gentlemen, that brings us to the end of our podcast episode for today. Our thanks go to Brian Betts and Alana Hill for facilitating this episode and to our post-recording producer genius, Gabby Magnusson, who cuts out all the extraneous noises, awkward silences, bodily functions, and fixes the audio levels. Thank you and listen again next time.