Home  >  Cyberwar / Engagement / Technology

The Commerce Department should review PUST’s export licenses for North Korea

Last week, several news outlets reported that representatives of PUST, the Pyongyang University of Science and Technology, are in the United States, seeking support to expand their curriculum in North Korea. PUST didn’t say what kind of support it seeks, but recent reports suggest that PUST has lost donors and had to slash its budget. PUST is probably looking for money. Donors, however, would be wise to keep their checkbooks closed until the Commerce Department and a U.N. Panel of Experts review precisely what PUST is teaching the North Koreans.

1. PUST needs to give better answers to charges it’s training North Korean hackers.

PUST teaches its mostly male, entirely elite students what their government wants them to learn. PUST trains doctors and nurses, and without knowing more, that’s probably unobjectionable. But PUST also teaches information technology subjects that could be a baseline for training hackers, such as those who hacked Sony Pictures and made terrorist threats against theaters showing “The Interview.” (North Korea both denied and applauded the attacks.) Subsequently, two defectors claimed that PUST is indeed training North Korean hackers. PUST denies the claim, but without the ability to track its alumni through some of the most secretive parts of North Korea’s government, it’s hard to see how PUST could possibly know this, one way or another.

If PUST is training North Korean hackers, it’s probably doing it pursuant to a license from a the U.S. Commerce Department. Without knowing exactly what PUST is exporting to North Korea, it’s impossible for me to say which of those exports are controlled by the Commerce Department, but the list of items that may require export licenses includes software, information security, telecommunications, and computers, and PUST has admitted that it operates pursuant to Commerce Department licenses. It’s past time for the Commerce Department to review those licenses, and (at a minimum) revoke those related to information technology. The continuation of some of those programs may well violate both U.S. law and U.N. Security Council resolutions.

2. U.S. law imposes mandatory sanctions for cyber-related activities.

Ethan Epstein’s post at The Weekly Standard raises another potential legal issue for PUST: the new sanctions law, and the executive order, section 104(a)(7) of which imposes mandatory sanctions on any person who facilitates North Korean hackers, and section 104(a)(8), which bans the export of software for the use of North Korea’s ruling party.  What I can’t say is exactly what North Korean entities PUST is dealing with and how those entities are linked to North Korea’s hacking operations. The government should investigate, and until it gets satisfactory answers, it should suspend PUST’s IT-related licenses.

3. The latest U.N. resolution requires the suspension of scientific and technical cooperation with North Korea, pending U.N. or U.S. government review.

If North Korea is using PUST to train hackers, it wouldn’t be the first time a scientific or academic engagement program came under suspicion of misuse for nefarious purposes. There was the time that North Korea’s aerospace agency tried to join the International Astronautical Federation, until the U.N. Panel of Experts pointed out that Federation might have given Pyongyang access to sensitive missile-related technology. Or the Indian institute that trained North Korean rocket scientists. Or the Russian institute that hosted North Korean nuclear scientists to conduct joint research, including one who is sanctioned by name. Or the program sponsored by Syracuse University that may well have taught the North Korean security forces how to digitally watermark and trace documents smuggled into North Korea on USB drives. But surely, an exchange program to help North Korea grow food couldn’t have sinister purposes? But yes, even a Swiss-funded project, ostensibly to teach North Korea how to make bioinsecticide, turns out to be perfectly suited to produce biological agents. All of which may explain why the U.N. Security Council adopted this provision late last year:

“11.  Decides that all Member States shall suspend scientific and technical cooperation involving persons or groups officially sponsored by or representing the DPRK except for medical exchanges unless:

(a) In the case of scientific or technical cooperation in the fields of nuclear science and technology, aerospace and aeronautical engineering and technology, or advanced manufacturing production techniques and methods, the Committee has determined on a case-by-case basis that a particular activity will not contribute to the DPRK’s proliferation sensitive nuclear activities or ballistic missile-related programmes; or

(b) In the case of all other scientific or technical cooperation, the State engaging in scientific or technical cooperation determines that the particular activity will not contribute to the DPRK’s proliferation sensitive nuclear activities or ballistic missile-related programmes and notifies the Committee in advance of such determination; [UNSCR 2321]

I read this language to require the U.S. government to suspend PUST’s scientific and technical cooperation with North Korea pending a full review. Whether you agree that that’s required by the letter of the resolution, that position is certainly consistent with the resolution’s spirit. Suspending PUST’s Commerce Department export licenses, and any licenses it has been granted by the Treasury Department’s Office of Foreign Assets Control, are the most obvious ways to effect that suspension.*

PUST wanted to “open a door to the outside world for the future leaders,” but as this blog has chronicled for more than a decade, this theory hasn’t worked so well in practice. Sixteen years after its founding, PUST admits that its staff “avoids talking about politics and religion in the classroom.” (Update: According to this report, PUST actually started teaching students in 2010.) For those who’ve read Suki Kim’s memoir of her experiences at PUST, that’s an understatement. She describes a suffocating, Orwellian environment where the air is thick with fear for one’s self, and for the others one might incriminate with a careless expression of free thought. PUST’s furious reaction to Ms. Kim’s book ” revealing its own efforts to vicariously censor her on Pyongyang’s behalf ” lent further credibility to her account.

So it always goes with those who engage Pyongyang, thinking they’ll change North Korea; it always works the other way around ” there are no exceptions. Invariably, they must enlist as Pyongyang’s propagandists, censors, or financiers, or they must leave. Every wide-eyed engager predicts a Pyongyang Spring, but in Pyongyang, it’s always Groundhog Day.

~   ~   ~

* I edited this paragraph after publication.

~   ~   ~

Update, 2/9: Two readers forwarded me links to Korean press reports that PUST spent donated funds on building a Juche research center and a Kim Il-sung monument on campus.

8Shares

6 Responses

  3. What would the Israelis do : I suspect send spies on the students and at the minimum write a report on their activities. There is a reason that Iraq’s nuke reactor got blown up twenty plus years ago. Lord, this is public domain stuff. Who knows what the spooks are up to. My guess: DPRK nuke containment is a game. The billionaires making-a-buck by Chinese labor might just rule DC. Obama is kite surfing with a plutocrat.

  4. Evangelicals teaching elite kids from DPRK. Strange bedfellows. How is this good? ROK can face better fed soldiers. Talk about ‘useful idiots’. The love of Jesus is going to weaken the state apparatus? My guess: the DPRK is trickier, more focused and adept.

  5. Great analysis and provision of further readings as always.

    Nevertheless, I have a different understanding of the UNSCR 2310, maybe you can elaborate a bit on your interpretation. I think the field of knowledge exchange is one of the last options for small scale interaction with North Korea and should not be prohibited completely. For me the whole Paragraph 11 sounds like “everything is still allowed unless it involves the nuclear or missile program”

    (a) […]nuclear science and technology, aerospace and aeronautical engineering and technology, or advanced manufacturing production techniques and methods[…]

    These majors are under stricter review and any exchange in these areas has to be reviewed by the committee who determines if it supports the nuclear or missile program and thus be allowed or not.

    According to my interpretation of (b), all other areas (computer science, electrical engineering and whatnot) are under less strict review and the member states determine whether it contributes to the nuclear or missile program.
    What is said in (b), how can you link the computer engineering program, supposedly supporting hacking skills, to the nuclear or missile program? I think you cannot use this UN sanctions passage in your argument against the computer engineering classes offered at PUST. The other arguments in your analysis are much more supportive of your claim against PUST.
    (of course with North Korea, in the end everything can be linked to the missile and nuclear program.)

    When it comes to the “spirit of the sanction”: While there are a lot of enhanced and strict passages, the above mentioned paragraph 11 as well as paragraph 46 leave the door open for (encourages?) cooperation and engagement.

    Regarding the US sanctions:
    The Department of Treasury OFAC in its general license 5 states as an allowed activity:
    (3) Activities to support education in North Korea, including combating illiteracy, increasing access to education, international exchanges, and assisting education reform projects;
    I wonder if, with a strict review of PUSTs activities, this paragraph will help them much to get a green light from OFAC. Only “international exchanges” can be claimed as part of their work, but that is only one small part (and this might be obsolete as well: http://english.yonhapnews.co.kr/search1/2603000000.html?cid=AEN20170201006400315) Or does sending foreign teachers to PY count as international exchange?
    I have no insight regarding the department of commerce but it would be interesting to see what role the department of commerce licenses plays for trade or any other interaction with North Korea in greater detail on your sanctions page. I remember reading that OFAC was in charge for bringing items to North Korea according to this article: https://www.nknews.org/2016/08/how-sanctions-are-and-arent-affecting-aid-work-in-north-korea/

  6. 1. I assume you mean 2321?

    2. I don’t think “knowledge exchange” should be prohibited completely and don’t believe I said that. For example, I specifically said that I see no harm in training medical personnel. I called for Commerce and the 1718 Committee to review PUST’s work, not instantly terminate it. Whether PUST’s activities violate the resolutions depends on the specific technology, goods, and services transferred, and their potential applications. As a technical non-expert working with incomplete facts, that’s not a judgment I can make here and now.

    3. But you should concede that computer science and computer engineering certainly have a wide range of potential applications in completely innocent things, and also, say, in predicting rocket trajectories, running a centrifuge cascade, or hacking into a computer system. That’s for the experts to decide after a careful review of the software, training, curriculum, and materials.

    4. I don’t read paragraph 11 the same way you read it. I read it as creating three categories of scientific cooperation: medical exchange, which is fine; nuclear science and the other items in 11(a), which must full-stop pending immediate 1718 Committee review; and “all other” scientific and technical cooperation, which (as I read 11(b)) member states are obligated to review to ensure they will not contribute to banned programs (note the shifting of the burden). Importantly, I read the 11(b) review as also subject to “suspend scientific and technical cooperation …. unless.” Thus, I read 11 as saying suspend “all other” scientific or technical cooperation pending member state review.

    5. If “[a]ctivities to support education,” as described in General License No. 5, also violate a UNSCR, the member state would be obligated to terminate the activity because the UN has banned certain forms of technical training to North Korea. Such was the case when the UN Panel of Experts called out Russia for allowing North Korean scientists to study at its atomic labs, India for allowing North Korean rocket scientists to study at one of its scientific institutes, or the International Astronautical Federation (which is a thing) for offering membership to North Korea’s state aerospace agency. Similarly, if activities falling within a general license assisted malicious cyber activity in violation of an Executive Order or statute, such as section 104(a)(7) of the NKSPEA, Treasury’s legal obligation would be to interpret that general license as not permitting those “[a]ctivities to support education.” U.N. resolutions, statutes, and executive orders all trump the interpretations of executive agencies.