Did a U.S. university teach North Korea to track down dissidents?
Just after Christmas, Reuters reported on the analysis of two German IT experts who downloaded a copy of North Korea’s Linux-based Red Star operating system and analyzed its code. Inside, they found something both horrifying and completely predictable. Red Star contains code for “tagging, or watermarking, every document or media file on a computer or on any USB stick connected to it.” Meaning?
That means that all files can be traced. “It’s definitely privacy invading. It’s not transparent to the user,” Grunow said. “It’s done stealthily and touches files you haven’t even opened.”
Nat Kretchun, an authority on the spread of foreign media in North Korea, said such efforts reflected Pyongyang’s realisation that it needs “new ways to update their surveillance and security procedures to respond to new types of technology and new sources of information”. [Reuters]
BoingBoing calls this “a marvel of paranoid terribleness, with lots of marvellously bad features.” (sic)
The one I was most interested in is its covert insertion of watermarks into every file that it touches, either on the OS’s launch disk or removable USB sticks. This is used to track down North Koreans who share illicit media files with their friends and mark them out for punishment in the country’s notorious gulags. [BoingBoing]
Quartz calls it “a dictator’s wet dream:”
One of Red Star’s key features is a watermarking system that secretly creates a record of everyone who’s touched that file.
Red Star quietly adds a unique identifier to media files—pictures, Word documents, or videos—the moment they are accessible. For example, if a USB drive containing an illicit document is plugged into a computer running Red Star, that file is automatically tagged with that computer’s unique identifier. If that file is copied to another machine, the new machine’s identifier is added to the watermark. [Quartz]
The BBC says the watermarking function allows “the state to trace the journey of that file from machine to machine,” “identify undesirable files and delete them without permission.”
The watermarking function was designed in response to the proliferation of foreign films and music being shared offline, says Mr Grunow. “It enables you to keep track of where a document hits Red Star OS for the first time and who opened it. Basically, it allows the state to track documents,” he says.
The system will imprint files with its individual serial number, although it is not known how easily the state can link those serial numbers to individual users.
One element puzzling Mr Grunow is the discovery of an extended version of the watermarking software which he and Mr Schiess do not fully understand, but which he says may help identify individual users.
“What we have seen is the basic watermarking, but we found evidence of an extended mechanism that is far more sophisticated, with different cryptography,” he says.
“It could be that this file is your individual fingerprint and they register this fingerprint to you, and that could help them track down individual users.” [BBC]
Perhaps I can contribute something to the answer to this mystery. Reading this, my elephantine memory recalled that back in 2002, former U.S. Ambassador to South Korea Don Gregg, who takes an oddly understanding view of North Korea’s human rights abuses, brokered an academic exchange program between a U.S. university and a North Korean university to share (among other technologies) something called “digital watermarking,” which inserts distinctive metadata into digital media to trace copyright violations.
One application of digital watermarking is source tracking. A watermark is embedded into a digital signal at each point of distribution. If a copy of the work is found later, then the watermark may be retrieved from the copy and the source of the distribution is known. This technique reportedly has been used to detect the source of illegally copied movies. [Wikipedia]
According to this book, entitled “Techniques and Applications: Digital Watermarking and Content Protection,” governments can also abuse this technology for censorship.
“[I]t is important to note the potential that particularly usage tracing and control mechanisms have for misuse by political entities. Outright censorship or the mere knowledge that any access to information is subject to surveillance by governmental entities can result in a severe curtailment of individual freedoms of expression and ultimately thought due to a lack or selective availability of relevant information. [Page 11]
Most of the online evidence of Gregg’s exchange program has since vanished from the Internet, but thanks to the Wayback Machine, we can still retrieve this 2003 academic paper, which lists Gregg and North Korea’s former U.N. Ambassador as co-authors. It describes a “bilateral research collaboration” project between Syracuse University and North Korea’s Kimchaek University of Technology (KUT), concerning a series of information technologies, including “digital copyright and watermarking programs.”
The project claimed to have “tacit support” from the U.S. State Department.
The 2003 paper provides scant detail on what technology was actually transferred to the North Koreans, but a 2009 online newsletter from Syracuse claimed that the “ongoing collaborative initiative” had “enhanced IT capability in North Korea.” The program kept up a steady drumbeat of activity, including more delegation visits, for several years.
The Syracuse posting also raises the perennial question about engagement with Pyongyang — who changed who? If the objective of engagement is to reform North Korea, lure it into the norms and standards of civilization, and reconcile it with the U.S. and South Korea, its effect seems to have been closer to the opposite. Instead, the North Korean participants inflexibly praised Kim Jong-il and justified his nuclear proliferation, while the American academics they engaged parroted Pyongyang-friendly views of North Korea’s history, and even its nuclear program. There is more evidence that Syracuse’s program reinforced North Korea’s resistance to the norms and standards of civilization than evidence that it encouraged North Korea to conform to them. Sorry for the long quote:
“With the division of the peninsula, the U.S. virtually created a ‘Korea problem,’” says George Kallander, assistant professor of history and expert on Korea, who is on research leave this semester at the Academy of Korean Studies in South Korea. “Koreans themselves did not have a problem. Their country had never been divided like this before.”
He points out the importance of Korean pride and tenacity. “The division of the peninsula was unprecedented and no Korean wanted it. Korea has at various times in the past used foreign forces to overcome domestic political and military problems, but always, always, always Korea has prevailed. This period of division is an anomaly and will not last.
“No matter what people say, the Koreas will unite someday.”
The 1945 partition set the stage for today’s high-stakes diplomacy over North Korea’s nuclear weapons. In April of this year, North Korea withdrew from the Six-Party Talks on nuclear disarmament and has since taken steps to restart its plutonium reprocessing facility and tested a weapon.
Jongwoo Han, an adjunct professor of political science and an expert on Korean politics, traces the evolution of the North Korean weapons program to 1991, when the Soviet Union’s collapse changed the balance of power in Asia and made relationships with America much more important. North Korea began to develop its nuclear strategy as a bargaining chip to gain recognition from the United States.
“North Korea knows its regime security is guaranteed only if the United States recognizes it,” says Han, the co-leader of the exchange program with Kim Chaek University. [….]
In 2002, a North Korean diplomat told Han, “We are going to go all-in” in playing the nuclear development card to gain recognition from the United States, as Han wrote in a 2009 article in the Australian Journal of International Affairs. He explained, “Pyongyang has pursued nuclear proliferation primarily in order to attain security and economic aid,” a point the late South Korean President Kim Dae-jung made in 2007 as he hosted visitors from Syracuse.
[George S. Bain, Syracuse U., Maxwell School, News & Events, 2009]
Oh, and in the newsletter, Gregg pointed to Kim Jong-un’s Swiss education, suggesting that this time, reform was finally here! I could fisk that, but Gregg’s reaction to Kim Jong-un’s fourth nuclear test has so much greater a wealth of material, and Don Kirk has already done a fisking for the ages. It’s a must-read.
Ironically, the target of Red Star’s watermarking function is to stamp out intellectual and cultural engagement between North Koreans and the Outer Earth. Increasingly, that engagement takes place through computers that North Koreans purchase in the markets. Many — though we can’t be sure how many — probably use Red Star. Groups like the North Korea Strategy Center, founded by gulag survivor Kang Chol-hwan, are smuggling flash drives and DVDs loaded with books and movies into North Korea as part of a guerrilla engagement strategy designed to bring social change to one of the world’s most isolated, deprived, and militarized societies. That’s the kind of change Pyongyang is determined to stop.
The question that deserves closer technical examination, then, is whether an American university has unwittingly helped the North Korean security forces track down and punish North Koreans who read that content. We can divide that question into subparts.
- Did Syracuse University teach North Korea digital watermarking? By its own claims, it intended to do so, although Syracuse hasn’t clearly said what technology it actually transferred.
- Did North Korea deploy a similar technology to censor digital content? Yes.
- Did North Korea use Syracuse’s technology, or a derivative of that technology, to censor digital content? For now, that’s probably impossible to know, but it seems like a strong possibility. It’s fair to point out that the regimes in Iran, China, and other countries also employ similar samizdat-tracking software. We can’t rule out other sources.
What should be clear is that this revelation gives Syracuse an ethical responsibility to suspend its exchange program with KUT pending a thorough, independent, and transparent review. That review should examine the watermarking technology in North Korea’s OS, compare it to the technology Syracuse transferred to North Korea, and determine whether the technologies Syracuse shared with KUT are subject to misuse.
Really, then, the questions this post raises are logically related to those raised by the still-unanswered allegations that exchange programs are training North Korean hackers, or helping North Korea weaponize anthrax. Proponents of exchange programs with North Korea can’t be oblivious to the nature of the regime they’re engaging, and the potential for it to misuse the technologies they share. Instead, they have a heightened duty to safeguard against the misuse of potentially harmful technologies with a regime of this nature.
Unfortunately, those involved in Syracuse’s project may be far too gullible to see this. That’s why it should not be left to them to reevaluate the ethical responsibility of their IT exchange programs with North Korea.