North Korean Internet Users Shun Facebook and Google for Chinese Alternatives

Cut off from the world by a punishing sanctions regime and the authoritarian policies of their leader, the tiny slice of the North Korean population with access to the wider internet are a surprising bunch. They use social media. They play games. They surf the web in search of news and information.

In other words, they’re a lot like everyone else.

That’s the surprising conclusion of a new report from security firm Recorded Future, which describes the internet browsing habits of the 200 or so North Koreans who have access to the web.

But with North Korean leader Kim Jong Un attempting a rapprochement with the United States and South Korea, whose leader he will meet at a summit later this week, the North’s internet users are turning away from Western sites and toward their Chinese counterparts.

Last year, Recorded Future found North Korean internet users to be regular visitors to Facebook, Google, and Instagram. Now, visits to those sites have all but ended, with Chinese sites such as Alibaba, Tencent, and Baidu taking their place.

The tiny group of North Koreans with access to the internet “are moving away from services where they could likely encounter Western governments and moving toward Chinese ones, where they are arguably just as comfortable but not as exposed,” says Priscilla Moriuchi, the director of strategic threat development at Recorded Future, a cybersecurity firm providing so-called “threat intelligence,” and a former National Security Agency analyst.

Over the same time period — from December through March of this year — North Korean internet users have taken greater steps to hide their internet browsing habits from the world. Based on an examination of internet metadata collected by the security firm Team Cymru, Recorded Future observed a 1,200 percent increase in the use of obfuscation services such as virtual private networks and the Tor browser.

For most North Koreans, internet access is limited to the country’s intraweb, a collection of sites controlled by the regime and which promote government-approved content. But for the political and military elite perceived as most loyal to the regime, internet access appears to be basically unfettered.

And the data obtained by Recorded Future provides a rare glimpse into how the elite members of a closed society are spending their time online. They like, for example, to play online games. Quake, Diablo II, World of Warcraft, and League of Legends are among their favorites. They use both Playstation and Nintendo and are active on online platforms such as Steam and Blizzard.

This interest in online games may not be wholly benign. Researchers have documented North Korean hackers creating counterfeit games as a form of revenue generation or running scams in games that involve stealing weapons and gear and then reselling them for cash.

On the weekends, members of the North Korean elite appear to enjoy some free time. According to the Recorded Future data, on Saturday evenings and Sunday mornings, video streaming and gaming activity picks up. During the nine-to-five work week, activity is more focused on web-browsing.

The data also provides some insight into matters of North Korean concern. Recorded Future observed research activity into mitigation tools for distributed denial of service attacks, examinations of security firms such as Kaspersky Labs and Symantec. Other browsing activity examined the physics and engineering departments at top tier American universities.

Despite a punishing sanctions regime seeking to dissuade North Korea from nuclear weapons and missile testing, the country’s continued access to the internet has become a powerful tool in resisting Western power. “In a way, they are innovating how rogue regimes can circumvent international controls and pressure,” Moriuchi says.

North Korea runs an active Bitcoin mining operation, which appears to be providing the regime with cryptocurrency, though the mining activity is likely limited to a small number of machines, according to Moriuchi.

In recent months, North Korea has expanded its interest in cryptocurrencies and has begun mining Monero, a type of cryptocurrency that is far more anonymous than earlier variants such as Bitcoin. The use of a more anonymous cryptocurrency could provide the regime with a more effective way to evade sanctions.

At the same time, North Korean hackers have carried out a series of audacious heists targeting South Korean bitcoin exchanges, which have likely provided the regime with much needed digital currency at a time when international sanctions are attempting to strangle the North’s economy.

Data collected by Recorded Future indicates that North Korea is carrying out transactions using Bitcoin, though the scale and volume of those payments is unknown.

Moriuchi describes the work of examining a closed society like North Korea as analyzing “scraps.” Defectors will occasionally provide candid accounts of life beyond the demilitarized zone. Official media statements provide some insight into Pyongyang’s perspectives. Open source material such as satellite imagery and forensic examinations of official photographs can pry open ever so slightly the closed door of North Korean society.

And, now, the trail of elite internet use provides a limited portrait of their interests and life online. “Every little scrap counts,” Moriuchi says.