8 ms·

State Dept Guidance on DPRK IT Workers [pdf]

78 points by martialg 4y ago

monksy 4y ago
How do you get IT workers there being highly skilled when most of the population isn't on the internet. Also, considering the treatment of throwing lots of them in forced labor camps over percieved slights and poverty.. I just don't understand where are these people coming from? It's not like NK has universities and a lively educated class.
- timecube 4y ago
  North Korea literally does have universities and an educated class.
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- _jal 4y ago
  I suspect you have an unrealistic view of the country. Even very poor countries with hereditary dictators are very large places.
  - monksy 4y ago
    Poor countries with hereditary dictators aren't nearly as secretive, closed off, or have such sanctions as NK.
- toss1 4y ago
  You are missing the fact that not all societies are open Closed authoritarian societies, even those under sanction, have a ruling and privileged classes that DO have all the amenities — basically by extracting all the wealth to the small ruling classes. Even if it is only a microscopic percentage of the society that is at the top, it can still amount to substantial numbers.
  - DoctorNick 4y ago
    - toss1 4y ago
      Indeed the USA does have some aspects of this - certainly it is too lax in preventing a set of extractive and exploitative industries/industrialists from hoarding most of the resources and income and taxing it too little But the USA, while an unhelathy democracy, is NOT yet an authoritarian state. It is, however, within one minor and one major election from becoming one. If you think the above description actually fully describes the USA, you REALLY haven't seen anything yet. If small-d democracy fails in the next two elections, these will truly look like the good old days, and you'll be telling your grandchildren how good it was in the early 2020s, as the USA (and probably most western democracies with it) descend to the authoritarian depths of Russia, Venezuela, China, NK, etc. While it is far from perfect, it is critical to understand the differences, and get out and vote while you still can to prevent the much worse failure from becoming reality.
      - A4ET8a8uTh0 4y ago
        Thank you for stating this. As much as I worry about US ( and my adopted home ), it is a ridiculous exaggeration to call it outright authoritarian ( or closed for that matter ). It does not mean that there are no attempts at making it so, but I think we are still somewhat far from it for now. Sometimes I wonder if the exaggeration is just the way we communicate today ( everything is a crisis / sky is falling / we are all gonna die / find out which commonly used household item is deadly ) as that is what the population was taught about the world by interacting with ads online.
        toss1 4y ago
        Yes, while there is a heavy dose of hyperbole in the media and internet spheres, I think the effect is actually to obscure the level of the present danger. Kind of the "Boy Who Cried Wolf" problem — e.g., while people yelled "Nazi!" at GW Bush and D Cheney, many of the new crop in that party have already literally tried to steal an election and will implement authoritarian policies if they get power - so much so that even Cheney's daughter is an outcast for merely trying to adhere to democratic principles. The difference is whether the voters choose their leaders or the leaders choose their voters. So, while we are most definitely not there yet, democracy is literally teetering on the brink, and if too many people fail to vote, everyone will get to see up close what a real autocracy looks like. Seriously, the only thing on the ballot this year is democracy, and people must show up and vote for small-d democratic candidates down to dogcatcher. Get you and every friend you know to show up.
- woodruffw 4y ago
  It's still a pretty large country: around 26 million people. And it's not exactly a destitute state: it's a kleptocratic state with an educated (often abroad) elite class. It's hard to get an exact estimate of their current HDI, but the UN placed it at 0.766 back in the 1990s[1]. That puts them in around the same tier as Yugoslavia today. [1]: https://hdr.undp.org/sites/default/files/reports/259/hdr_1998_en_complete_nostats.pdf#33 https://hdr.undp.org/sites/default/files/reports/259/hdr_199...
  - deleted 4y ago
    [deleted]
- fomine3 4y ago
  I wonder why some NK people really great about hacking/computer science/rocket science despite the country is poor. Looks like successful of education.
- somenameforme 4y ago
  The fact they're capable of successfully building, deploying, and advancing nuclear technology should tell you that your stereotypes are missing some things. The Wiki page [1] is very outdated, but has plentiful information to at least start challenging your stereotypes. For instance almost 40 years ago now, North Korea had reportedly 23,000 college/university teachers alongside 4000 other postsecondary teachers teaching upwards of 300,000 university level students at the time, with an educational system largely focused on STEM. And it's reasonable to expect those numbers have increased since. Education through secondary is mandatory, and there is then a competitive process for admittance to higher education. Adult education is also an ongoing process with workers continuing to participate in educational groups daily and also having, and having the opportunity to participate in the equivalent of educational 'boot camps' to learn advanced trades. I feel in modern society that we are increasingly failing to learn from the past (and present) due to presenting things such that evil is evil through and through, and good - well it at least has some flaws, but tends to be more or less good through and through. Reality isn't quite so kind. [1] - https://en.wikipedia.org/wiki/Education_in_North_Korea https://en.wikipedia.org/wiki/Education_in_North_Korea
charlescearl 4y ago
From the review of Dr. Suzy Kim’s “Everyday Life in the North Korean Revolution, 1945-1950”: “The anglophone archive on the DPRK is a bleak record of imperialist slander, replete with the most lurid and theatrical tales of passively suffering masses and the flamboyant pseudo-socialist “regime” that supposedly keeps them in a state of total servitude. Between hypocritical fears of its nuclear power and conscience-rattling anxieties over the alleged condition of human rights within, the DPRK looms as a symbol of the negation of liberal freedoms. It is within this context that Suzy Kim’s Everyday Life in the North Korean Revolution, 1945-1950 must be considered.” https://liberatedtexts.com/reviews/socialist-construction-in-korea-suzy-kims-everyday-life-in-the-north-korean-revolution-1945-1950/ https://liberatedtexts.com/reviews/socialist-construction-in...
- hderms 4y ago
  What's your point? It's pretty obviously a country ruled by an authoritarian regime with a really low standard of living. Is there something noteworthy about the fact that the US slanders it?
trhway 4y ago
> DPRK IT workers can individually earn more than USD 300,000 a year in some cases i'd say it is one of the best description of the current successful state of remote work :) And in overall that guidance reads like an advertisement for the offshoring to DRPK - can you imagine how highly disciplined those workers given that they are managed by the NK security service who is taking a share of their money - imagine missing a deadline with a gun to your head - the word "fired" gets that Schwarzenegger's meaning :)
op00to 4y ago
So weird, this part about validating for DRPK workers: Conduct a pre-employment background check, drug test, and fingerprint/biometric log-in to verify identity and claimed location. Background check, sure. Fingerprint/biometric identity verification? Lol. I would never, ever submit to such a thing. DRUG TEST? How the hell does that catch DRPK workers?
- aaaaaaaaata 4y ago
  Where are they going to submit a drug test...?
sgammon 4y ago
> DPRK IT companies and their workers normally engage in a wide range of IT development work of varying complexity and difficulty, such as: > building virtual currency exchange platforms and digital coins, > DPRK IT workers often take on projects that involve virtual currency. > Some DPRK IT workers have designed virtual currency exchanges or created analytic tools and applications for virtual currency traders and marketed their products themselves @bitfinexed lol
pphysch 4y ago
> DPRK IT workers have also assisted DPRK officials in procuring WMD and ballistic missile-related items for the DPRK’s prohibited weapons programs. In what context are these programs "prohibited"? Do they violate a UN treaty that DPRK has ratified? How come USA can develop hypersonic nukes but DPRK is "prohibited"? Also this explains why a Venmo transaction was held for a week after I put a joke about Glorious Leader in the description...
- aaaaaaaaata 4y ago
  Makes me wonder if the "ISIS beer fund" guy ever had his funds released.
- lostcolony 4y ago
  The very first mention in the PDF states "DPRK’s UN-prohibited WMD and ballistic missile programs". So, that context. The United Nations. You do stipulate "that the DPRK has ratified" - why does that matter? They are a member nation of the UN, so they are running afoul of the decisions of the body they are a part of.
  - pphysch 4y ago
    That's not specific, nor explains why USA can legally pursue hypersonic nuke WMDs. > They are a member nation of the UN, so they are running afoul of the decisions of the body they are a part of. But this is a daily occurrence for the USA as well. https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-becomes-law https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-be... (The ICC was created by the UN)
    - lostcolony 4y ago
      And? What's your point? I'm not claiming the US has not done things prohibited by the UN, nor even what "degree" of prohibited, or any such thing. I'm pointing out that your objection to the classification of the DPRK's programs as "UN prohibited" is incorrect. The UN has explicitly voted on and introduced sanctions against the DPRK for their WMD program, saying "yeah, don't do that" (the US has independently done so as well). That's it. That's the context around "prohibited". That's the answer to your question. Maybe what you mean is "how is that fair", or "why should the DPRK care about what others 'prohibit' them to do when they don't agree to it", and that's a different discussion; you're free to be an apologist for the DPRK, but to try and undermine the use of "prohibited" when the context is given -right there- in TFA is shitty rhetoric. Also, if you want "specifics", https://www.armscontrol.org/factsheets/UN-Security-Council-Resolutions-on-North-Korea https://www.armscontrol.org/factsheets/UN-Security-Council-R...
jackpirate 4y ago
My work brings me into regular contact with DPRK IT professionals, for example by [teaching open source sotware](https://izbicki.me/blog/teaching-open-source-in-north-korea.html https://izbicki.me/blog/teaching-open-source-in-north-korea....) or [teaching proper web design](https://izbicki.me/blog/fixing-north-korea-kcna-webpage.html https://izbicki.me/blog/fixing-north-korea-kcna-webpage.html). I make a lot of effort to respect sanctions, but documents like this are incredibly unhelpful. I've read through the document, and it seems completely devoid of actionable, DPRK-specific information that can help IT professionals avoid sanctions violations. For example, the document encourages websites to monitor for the following activity as "indications of DPRK IT workers who may be using their platforms": • Multiple logins into one account from various IP addresses in a relatively short period of time, especially if the IP addresses are associated with different countries; • Developers are logging into multiple accounts on the same platform from one IP address; • Developers are logged into their accounts continuously for one or more days at a time; • Router port or other technical configurations associated with use of remote desktop sharing software, such as port 3389 in the router used to access the account, particularly if usage of remote desktop sharing software is not standard company practice; • Developer accounts use a fraudulent client account to increase developer account ratings, but both the client and developer accounts use the same PayPal account to transfer/withdraw money (paying themselves with their own money); • Frequent use of document templates for things such as bidding documents and project communication methods, especially the same templates being used across different developer accounts; • Multiple developer accounts receiving high ratings from one client account in a short period, with similar or identical documentation used to establish the developer accounts and/or the client account; • Extensive bidding on projects, and a low number of accepted project bids compared to the number of projects bids on by a developer; and • Frequent transfers of money through payment platforms, especially to PRC-based bank accounts, and sometimes routed through one or more companies to disguise the ultimate destination of the funds. This list is so generic that I'm not sure what the point of it is. I think it would make sense to ban some of these practices from a general security perspective. But these practices would give way too many false positives if you were trying to use them to identify DPRK developers. I'm honestly really confused about who the target audience is for publications like this. It can't be actual IT professionals due to the lack of actionable information. Is it journalists? Do we publish these things just to remind them that we don't like the DPRK?
Animats 4y ago
Will this soon apply to Russian developers?
- Apofis 4y ago
  Yes, and permanently.
- thriftwy 4y ago
  They'll just work on some military hardware instead.
  - tablespoon 4y ago
    > They'll just work on some military hardware instead. A lot of Russian developers are leaving Russia instead: https://www.nytimes.com/2022/04/13/technology/russia-tech-workers.html https://www.nytimes.com/2022/04/13/technology/russia-tech-wo.... This is the first geopolitical event that I actually have some inside experience with. I work with a lot of Russian developers, and 90% of them have relocated since the war started.
    - nikita2206 4y ago
      Those who were already working with companies from abroad have largely left. I’m wondering about those who were working with Russian orgs their entire lives, those people are a lot less mobile, they can’t speak other languages very well and usually feel like ‘nobody’s waiting for them out there.’
    - helge9210 4y ago
      By the time USSR started to crumble KGB decided to embed spies and criminals into Western societies hiding them amongst a wave of refugees and economic migrants. I would expect the same happening this time.

78 points by martialg 4y ago

How do you get IT workers there being highly skilled when most of the population isn't on the internet. Also, considering the treatment of throwing lots of them in forced labor camps over percieved slights and poverty.. I just don't understand where are these people coming from? It's not like NK has universities and a lively educated class.

timecube 4y ago
North Korea literally does have universities and an educated class.
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
_jal 4y ago
I suspect you have an unrealistic view of the country. Even very poor countries with hereditary dictators are very large places.
- monksy 4y ago
  Poor countries with hereditary dictators aren't nearly as secretive, closed off, or have such sanctions as NK.
toss1 4y ago
You are missing the fact that not all societies are open Closed authoritarian societies, even those under sanction, have a ruling and privileged classes that DO have all the amenities — basically by extracting all the wealth to the small ruling classes. Even if it is only a microscopic percentage of the society that is at the top, it can still amount to substantial numbers.
- DoctorNick 4y ago
  - toss1 4y ago
    Indeed the USA does have some aspects of this - certainly it is too lax in preventing a set of extractive and exploitative industries/industrialists from hoarding most of the resources and income and taxing it too little But the USA, while an unhelathy democracy, is NOT yet an authoritarian state. It is, however, within one minor and one major election from becoming one. If you think the above description actually fully describes the USA, you REALLY haven't seen anything yet. If small-d democracy fails in the next two elections, these will truly look like the good old days, and you'll be telling your grandchildren how good it was in the early 2020s, as the USA (and probably most western democracies with it) descend to the authoritarian depths of Russia, Venezuela, China, NK, etc. While it is far from perfect, it is critical to understand the differences, and get out and vote while you still can to prevent the much worse failure from becoming reality.
    - A4ET8a8uTh0 4y ago
      Thank you for stating this. As much as I worry about US ( and my adopted home ), it is a ridiculous exaggeration to call it outright authoritarian ( or closed for that matter ). It does not mean that there are no attempts at making it so, but I think we are still somewhat far from it for now. Sometimes I wonder if the exaggeration is just the way we communicate today ( everything is a crisis / sky is falling / we are all gonna die / find out which commonly used household item is deadly ) as that is what the population was taught about the world by interacting with ads online.
      - toss1 4y ago
        Yes, while there is a heavy dose of hyperbole in the media and internet spheres, I think the effect is actually to obscure the level of the present danger. Kind of the "Boy Who Cried Wolf" problem — e.g., while people yelled "Nazi!" at GW Bush and D Cheney, many of the new crop in that party have already literally tried to steal an election and will implement authoritarian policies if they get power - so much so that even Cheney's daughter is an outcast for merely trying to adhere to democratic principles. The difference is whether the voters choose their leaders or the leaders choose their voters. So, while we are most definitely not there yet, democracy is literally teetering on the brink, and if too many people fail to vote, everyone will get to see up close what a real autocracy looks like. Seriously, the only thing on the ballot this year is democracy, and people must show up and vote for small-d democratic candidates down to dogcatcher. Get you and every friend you know to show up.
woodruffw 4y ago
It's still a pretty large country: around 26 million people. And it's not exactly a destitute state: it's a kleptocratic state with an educated (often abroad) elite class. It's hard to get an exact estimate of their current HDI, but the UN placed it at 0.766 back in the 1990s[1]. That puts them in around the same tier as Yugoslavia today. [1]: https://hdr.undp.org/sites/default/files/reports/259/hdr_1998_en_complete_nostats.pdf#33 https://hdr.undp.org/sites/default/files/reports/259/hdr_199...
- deleted 4y ago
  [deleted]
fomine3 4y ago
I wonder why some NK people really great about hacking/computer science/rocket science despite the country is poor. Looks like successful of education.
somenameforme 4y ago
The fact they're capable of successfully building, deploying, and advancing nuclear technology should tell you that your stereotypes are missing some things. The Wiki page [1] is very outdated, but has plentiful information to at least start challenging your stereotypes. For instance almost 40 years ago now, North Korea had reportedly 23,000 college/university teachers alongside 4000 other postsecondary teachers teaching upwards of 300,000 university level students at the time, with an educational system largely focused on STEM. And it's reasonable to expect those numbers have increased since. Education through secondary is mandatory, and there is then a competitive process for admittance to higher education. Adult education is also an ongoing process with workers continuing to participate in educational groups daily and also having, and having the opportunity to participate in the equivalent of educational 'boot camps' to learn advanced trades. I feel in modern society that we are increasingly failing to learn from the past (and present) due to presenting things such that evil is evil through and through, and good - well it at least has some flaws, but tends to be more or less good through and through. Reality isn't quite so kind. [1] - https://en.wikipedia.org/wiki/Education_in_North_Korea https://en.wikipedia.org/wiki/Education_in_North_Korea

charlescearl 4y ago

From the review of Dr. Suzy Kim’s “Everyday Life in the North Korean Revolution, 1945-1950”: “The anglophone archive on the DPRK is a bleak record of imperialist slander, replete with the most lurid and theatrical tales of passively suffering masses and the flamboyant pseudo-socialist “regime” that supposedly keeps them in a state of total servitude. Between hypocritical fears of its nuclear power and conscience-rattling anxieties over the alleged condition of human rights within, the DPRK looms as a symbol of the negation of liberal freedoms. It is within this context that Suzy Kim’s Everyday Life in the North Korean Revolution, 1945-1950 must be considered.” https://liberatedtexts.com/reviews/socialist-construction-in-korea-suzy-kims-everyday-life-in-the-north-korean-revolution-1945-1950/ https://liberatedtexts.com/reviews/socialist-construction-in...

hderms 4y ago
What's your point? It's pretty obviously a country ruled by an authoritarian regime with a really low standard of living. Is there something noteworthy about the fact that the US slanders it?

trhway 4y ago

> DPRK IT workers can individually earn more than USD 300,000 a year in some cases i'd say it is one of the best description of the current successful state of remote work :) And in overall that guidance reads like an advertisement for the offshoring to DRPK - can you imagine how highly disciplined those workers given that they are managed by the NK security service who is taking a share of their money - imagine missing a deadline with a gun to your head - the word "fired" gets that Schwarzenegger's meaning :)

op00to 4y ago

So weird, this part about validating for DRPK workers: Conduct a pre-employment background check, drug test, and fingerprint/biometric log-in to verify identity and claimed location. Background check, sure. Fingerprint/biometric identity verification? Lol. I would never, ever submit to such a thing. DRUG TEST? How the hell does that catch DRPK workers?

aaaaaaaaata 4y ago
Where are they going to submit a drug test...?

sgammon 4y ago

> DPRK IT companies and their workers normally engage in a wide range of IT development work of varying complexity and difficulty, such as: > building virtual currency exchange platforms and digital coins, > DPRK IT workers often take on projects that involve virtual currency. > Some DPRK IT workers have designed virtual currency exchanges or created analytic tools and applications for virtual currency traders and marketed their products themselves @bitfinexed lol

pphysch 4y ago

> DPRK IT workers have also assisted DPRK officials in procuring WMD and ballistic missile-related items for the DPRK’s prohibited weapons programs. In what context are these programs "prohibited"? Do they violate a UN treaty that DPRK has ratified? How come USA can develop hypersonic nukes but DPRK is "prohibited"? Also this explains why a Venmo transaction was held for a week after I put a joke about Glorious Leader in the description...

aaaaaaaaata 4y ago
Makes me wonder if the "ISIS beer fund" guy ever had his funds released.
lostcolony 4y ago
The very first mention in the PDF states "DPRK’s UN-prohibited WMD and ballistic missile programs". So, that context. The United Nations. You do stipulate "that the DPRK has ratified" - why does that matter? They are a member nation of the UN, so they are running afoul of the decisions of the body they are a part of.
- pphysch 4y ago
  That's not specific, nor explains why USA can legally pursue hypersonic nuke WMDs. > They are a member nation of the UN, so they are running afoul of the decisions of the body they are a part of. But this is a daily occurrence for the USA as well. https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-becomes-law https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-be... (The ICC was created by the UN)
  - lostcolony 4y ago
    And? What's your point? I'm not claiming the US has not done things prohibited by the UN, nor even what "degree" of prohibited, or any such thing. I'm pointing out that your objection to the classification of the DPRK's programs as "UN prohibited" is incorrect. The UN has explicitly voted on and introduced sanctions against the DPRK for their WMD program, saying "yeah, don't do that" (the US has independently done so as well). That's it. That's the context around "prohibited". That's the answer to your question. Maybe what you mean is "how is that fair", or "why should the DPRK care about what others 'prohibit' them to do when they don't agree to it", and that's a different discussion; you're free to be an apologist for the DPRK, but to try and undermine the use of "prohibited" when the context is given -right there- in TFA is shitty rhetoric. Also, if you want "specifics", https://www.armscontrol.org/factsheets/UN-Security-Council-Resolutions-on-North-Korea https://www.armscontrol.org/factsheets/UN-Security-Council-R...

jackpirate 4y ago

My work brings me into regular contact with DPRK IT professionals, for example by [teaching open source sotware](https://izbicki.me/blog/teaching-open-source-in-north-korea.html https://izbicki.me/blog/teaching-open-source-in-north-korea....) or [teaching proper web design](https://izbicki.me/blog/fixing-north-korea-kcna-webpage.html https://izbicki.me/blog/fixing-north-korea-kcna-webpage.html). I make a lot of effort to respect sanctions, but documents like this are incredibly unhelpful. I've read through the document, and it seems completely devoid of actionable, DPRK-specific information that can help IT professionals avoid sanctions violations. For example, the document encourages websites to monitor for the following activity as "indications of DPRK IT workers who may be using their platforms": • Multiple logins into one account from various IP addresses in a relatively short period of time, especially if the IP addresses are associated with different countries; • Developers are logging into multiple accounts on the same platform from one IP address; • Developers are logged into their accounts continuously for one or more days at a time; • Router port or other technical configurations associated with use of remote desktop sharing software, such as port 3389 in the router used to access the account, particularly if usage of remote desktop sharing software is not standard company practice; • Developer accounts use a fraudulent client account to increase developer account ratings, but both the client and developer accounts use the same PayPal account to transfer/withdraw money (paying themselves with their own money); • Frequent use of document templates for things such as bidding documents and project communication methods, especially the same templates being used across different developer accounts; • Multiple developer accounts receiving high ratings from one client account in a short period, with similar or identical documentation used to establish the developer accounts and/or the client account; • Extensive bidding on projects, and a low number of accepted project bids compared to the number of projects bids on by a developer; and • Frequent transfers of money through payment platforms, especially to PRC-based bank accounts, and sometimes routed through one or more companies to disguise the ultimate destination of the funds. This list is so generic that I'm not sure what the point of it is. I think it would make sense to ban some of these practices from a general security perspective. But these practices would give way too many false positives if you were trying to use them to identify DPRK developers. I'm honestly really confused about who the target audience is for publications like this. It can't be actual IT professionals due to the lack of actionable information. Is it journalists? Do we publish these things just to remind them that we don't like the DPRK?

Animats 4y ago

Will this soon apply to Russian developers?

Apofis 4y ago
Yes, and permanently.
thriftwy 4y ago
They'll just work on some military hardware instead.
- tablespoon 4y ago
  > They'll just work on some military hardware instead. A lot of Russian developers are leaving Russia instead: https://www.nytimes.com/2022/04/13/technology/russia-tech-workers.html https://www.nytimes.com/2022/04/13/technology/russia-tech-wo.... This is the first geopolitical event that I actually have some inside experience with. I work with a lot of Russian developers, and 90% of them have relocated since the war started.
  - nikita2206 4y ago
    Those who were already working with companies from abroad have largely left. I’m wondering about those who were working with Russian orgs their entire lives, those people are a lot less mobile, they can’t speak other languages very well and usually feel like ‘nobody’s waiting for them out there.’
  - helge9210 4y ago
    By the time USSR started to crumble KGB decided to embed spies and criminals into Western societies hiding them amongst a wave of refugees and economic migrants. I would expect the same happening this time.