Propaganda and influence campaigns delivered behind fake sockpuppet identities have been used to great effect by many countries, perhaps most famously in recent times by Russia’s “Internet Research Agency” to sway U.S. voters’ opinions surrounding the 2016 elections.

Now, North Korean state media’s presence on the world wide web appears to be evolving in notable new ways, potentially operating at least one “sockpuppet” social media account.

Though apparently in its early stages, Pyongyang’s own foray into sockpuppetry targeting the western audience appears more similar to known instances of pro-Chinese “counterpropaganda” accounts exposed by international media and subsequently banned from Twitter.

“@coldnoodlefan,” a reference to one of North Korea’s hottest soft-power items emanating from September’s inter-Korean summit in Pyongyang, combines attempts to show the “human” (affluent) side of the the country (mostly the capital) with propagandist talking points straight from state media.

This formerly-Japanese, now-Russian outsider claims to have visited Pyongyang in the past, but appears to have near-daily access to proprietary on-the-ground material from Pyongyang, which they often say was provided directly by friends in North Korea.

This and other kinds of material are uploaded multiple times per week, in posts mostly attempting to ‘dispel misconceptions’ about North Korea, cover major events involving Kim Jong Un, and promote North Korean self-sufficiency, national beauty, traditions, brands, products, and tourist attractions.

But because some of the comments and pictures come straight from state outlet Sogwang – crucially sometimes appearing before that outlet posts them – the user may have exposed their own potential connections to the DPRK media apparatus.

So who is this mystery die-hard fan of North Korea, an “Anti-war, peace advocate” providing “unbiased news on the DPRK through exclusive video and photos,” as their profile claims? And how are they connected to North Korean state media?

Another fan front, or North Korean outreach operation?

Like many other pro-North Korean accounts either run openly by members of foreign friendship associations or behind fake pseudonyms, @coldnoodlefan presents themself as personable, rehashing North Korean talking point out of intense dedication to the cause.

But while similar Twitter accounts mostly repost KCNA (Korean Central News Agency) and other state media, or appropriate content from tourists or news sites (including NK News), @coldnoodlefan offers images which, while still often seeming staged, also appear more candid than those from KCNA.

Examples of @coldnoodlefan pushing back against ‘misconceptions’ of North Korea, and inviting them to visit the country (1, 2, 3, 4)

What became quickly obvious in @coldnoodlefan’s early posts was a level of access in North Korea absent from the other fan accounts, but which also appeared to be part of a professional media operation.

Most of @coldnoodlefan’s content comes from the Sogwang media group based in North Korea – a group comprising the bonafide Korean-language feature news outlet Sogwang (Dawn) and various social media accounts under the same name.

Sogwang’s content also shows up on various other social media accounts, but appears more formally connected with @coldnoodlefan and a few others, including a Youtube account called “Echo,” and perhaps the most successful in its network, a Weibo (China’s largest social media site) account named “DPRK Today” (not to be confused with the other DPRK Today) boasting more than 340 thousand followers.

Examples which will be detailed below show instances of each of @coldnoodlefan, Sogwang, and DPRK Today being the first to post content which is later uploaded by the other two, suggesting a shared source of material exists among the group.

But to better understand the nature and purpose of what appears to be a sockpuppet account as part of a new North Korean media operation, let us go back to the beginning.

The Beginning…

The account was established on May 3, 2017, and made their first post two months later with the default “Hello Twitter! #myfirstTweet.” They made a few posts in July and another few in November and December – mostly now-deleted tweets simply linking to videos from the above-mentioned Youtube account “Echo” – before disappearing on a long hiatus, returning for a few posts in June 2018, and finally posting more frequently starting in July.

Carrying the official name “The Beginning…,” @coldnoodlefan has over 2200 followers and growing as of mid-March 2019. Their habits with regards to liking other posts appears to fall under the “like everything for maximum exposure” strategy, eliciting few additional clues.

As for the person or people behind the account, @coldnoodlefan has most recently (and consistently) identified as a Russian named Yulia, using different North Korean paintings or photographs of women as their profile pictures.

But it appears @coldnoodlefan has multiple beginnings, switching from Japanese to Russian in a short span just after coming back from their long hiatus. On July 14, 2018, @coldnoodlefan was Japanese, and from a rough background.

Saying they “heard ordinary people can take part in running the government” in North Korea, @coldnoodlefan quipped this was “something we poors can only dream about here in Japan…” Notably, the tweet was deleted sometime since the screenshot was taken in late December.

The Yulia identity emerged just four days after that tweet, however, providing that name in a private message to NK News on July 18, 2018. It did not appear in their Twitter feed until August, however, when @coldnoodlefan said in response to a commenter asking their nationality: “No, I am Russian. I’m just trying to figure out commonness and difference between two Koreans.”

In a post describing the painting of a woman titled “Fragrance,” previously used as their profile image, @coldnoodlefan said they were “reminded of my naive girlhood ten years ago” and provided a comment in quotes signed with the name “Yulia.”

A person by the name Yulia Fong is credited with seven articles posted on the Sogwang.com site on July 8 last year, all said to be taken from their VK (Russian social media site) account. One even focused on Pyongyang cold noodles, which they said in the post had become a symbol of the April 27 inter-Korean summit.

A VK account appears to have existed for one Yulia Fong, 26 years old living in Beijing and Moscow depending on the archived search information, but it has since been shut down due to a terms of service violation.

Searches through Google and Russian search engine Yandex show that the account posted in both Russian and English promoting similar cultural themes as @coldnoodlefan, such as Korean music and children playing freely.

The account even used a painting of a Korean woman similar to @coldnoodlefan’s previous profile photo and others @coldnoodlefan has posted to Twitter.

Another author named Yulia Yun or simply Yulia was credited for articles on Sogwang in late June and early August about the book War and Peace by Russian writer Leo Tolstoy, and about Russian Foreign Minister Sergei Lavrov’s trip to Pyongyang last summer.

But @coldnoodlefan’s use of the Russian language both in Twitter posts and in archived posts from the possibly-connected VK account appears to be that of a non-native speaker, two native Russian speakers told NK News.

“The account owner’s Russian is broken,” said expert on North Korean history and politics Fyodor Tertitskiy, pointing to various examples of incorrect case and grammar use.

Tertitskiy, a fluent Korean speaker as well, also suggested that “the account owner’s English mistakes are ones a native Korean speaker would make, not a Russian one.”

But regardless of whether @coldnoodlefan is run by a genuine Russian, a multi-lingual North Korean, or even a Chinese person, it is almost certain the individual or individuals running the account are drawing from source material of one of the DPRK’s up-and-coming media companies.

Connected and coordinated

There are numerous instances which suggest @coldnoodlefan is privy to proprietary media content filmed and shot mostly in Pyongyang, beating the other Sogwang media partners to the post with the same exact content.

Sogwang.com has even posted additional photos from the same place and time of a @coldnoodlefan post only later, and included a poorly concealed screenshot of the original @coldnoodlefan tweet as part of the attached photo gallery.

Other clues, such as the use of different overlaid text than the Korean or Chinese text displayed in videos posted to Sogwang and DPRK Today, suggest that the account has privileged access to the content and could serve as an employee or partner of the Sogwang media group.

In one example, @coldnoodlefan posted a video on October 16 of the German All Stars Singapore football club visit to Pyongyang last year, shot covertly from across the field and showing the athletes drinking Taedonggang Beer from the sidelines.

When it was posted to Sogwang.com five days later, it included text and subtitles in Korean rather than in English, and directly on top of video suggesting both were edited by the same person or using the same source files. Masking over the scenes in order to include new text would be too timely or unlikely a task for the purpose of such a video.

The video does not appear to have been posted to DPRK Today, however – perhaps a strategic decision as Chinese viewers may not be as interested in North Korea’s popularity among German footballers. It was posted to Echo on November 8.

In another similar example, @coldnoodlefan posted a video of children playing doctor on January 27 using English overlayed text a day after a DPRK Today version with Chinese text, but five days before a Sogwang.com version with Korean text.

In November as well, @coldnoodlefan posted a video of the first snow of the year in Pyongyang six days after DPRK Today, but four days before Sogwang.com – also all with different overlaid text.

These examples show that @coldnoodlefan could not have merely downloaded the content from the public Sogwang site or DPRK Today, but that they had access to the original files.

As for image posts, in one example @coldnoodlefan posted photos of lunar new year celebrations in Kim Il Sung Square on February 5, two of which were posted to Sogwang.com later on February 8. The other two images in the @coldnoodlefan tweet do not appear on Sogwang, while the Sogwang version contains six unique images not seen elsewhere.

DPRK Today did not post any of the images, but posted just hours before @coldnoodlefan tweeted a high-resolution video from the same time and place showing the same individuals in the square, suggesting at least two photographers were on scene capturing the content provided to those working with Sogwang.

In a particularly revealing example, as mentioned above, @coldnoodlefan posted four images of a new tram design in Pyongyang on October 3 almost simultaneous to a DPRK Today post with nine images, but almost a month ahead of Sogwang.

The Sogwang post carried the same images as shown on the other accounts, but also five additional photos from the same time and place – and one screenshot of the @coldnoodlefan Twitter post with the name and profile photo blurred. It was liked by whoever took the screenshot (possibly @coldnoodlefan themselves, as they appear to like all of their own posts).

In another example of either coordination or copying between @coldnoodlefan and DPRK Today, both posted on November 5 not only the same image of a male hair stylist, but also the same text.

Both mentioned (@coldnoodlefan in English and DPRK Today in Chinese) that the stylist worked on Mirae Scientists Street and said that when “asked what made him to be a hairdresser, he said he wanted to give the best hairdressing to his mother and sister.”

Often times the two social media accounts can be observed reaching back into the Sogwang archives to post the same content on or around the same day as well, such as in October when @coldnoodlefan and DPRK Today posted within 12 hours of each other the same three images of children receiving school uniforms from the state. Sogwang posted those images months earlier on April 2.

Another shared aspect is a seeming obsession with “beautiful girls” from the Sogwang-linked social media accounts – posting North Korean paintings of women or even highlighting certain adoring female fans of Kim Jong Un during his trips abroad.

These instances, however, reveal not only additional evidence of either shared account runners or strategic directives, but also the unusual nature of the style of content being pushed in this new media operation.

What the above examples show is a likely coordinated effort by those working for or with Sogwang media to push a predetermined narrative on North Korea, sometimes showing freedom to write their own copy and sometimes posting the same ideas either roughly or verbatim.

North Korean media specialist Martin Weiser agreed, telling NK News upon reviewing the same content posted to Sogwang and @coldnoodlefan that “the pictures clearly are coming from the same source.”

“It seems likely to me that the Twitter account gets ‘privileged access’ to the content,” he added.

The similarities in posting could also come down to a tendency for each to merely copy each other from time to time, but their individual access to the original source content appears almost certain.

Coldnoodlefandom

It is apparent that a more modern companion to established North Korean state outlets such as KCNA or even outer-track sites such as Uriminzokkiri has emerged in the form of Sogwang and its partners across international social media platforms.

@coldnoodlefan appeared to admit to a connection to Sogwang when asked by NK News through Twitter, saying that they “have nothing unreasonable in the relationship with Sogwang media” and that “the contents from Sogwang media please my interest and my purpose of running the account.”

In a message last July, they told NK News that in 2017 they “visited the country [North Korea] by invitation from Sogwang media,” and that their connections to DPRK individuals include “mainly business people and few media persons.”

“I am just trying to show people what it is like in DPRK,” they said, adding in a later message that they would like to reassure “that I am not running my account for anyone or with anybody’s help.” This claim, however, is clearly in question considering the evidence provided above.

@coldnoodlefan was also defensive after receiving a series of questions about their connections and identity, however, saying they “regard your intention itself as an offence [sic] upon my human right and a wanton insult on me.”

But just because @coldnoodlefan is not completely forthcoming about their position within North Korea’s newest foreign outreach operation does not mean their account is not a valuable source for information on North Korea.

Yes, @coldnoodlefan regurgitates state propaganda, and reveals through its special access to Sogwang content that their page is more of a propaganda operation than a mere personal fan account. But the use of a convenient platform like Twitter with posts in English nevertheless provides valuable photos and information of changing lifestyles in Pyongyang – however confined to the privileged class those instances may be.

The account runner(s) tries to interact with commenters from time to time, and posts about things unrelated to North Korea (more so in the past than recently, however), though these may be part of a strategy to actually engage with potential DPRK fans or, more importantly, those curious to learn more about the country.

“If it is semi-official, it’s a new way of doing things for the North Koreans but it doesn’t appear to be very successful or convincing so far,” said Martyn Williams, a North Korea media and tech specialist who runs the website North Korea Tech.

“North Korea is pretty bad at foreign propaganda and it shows here,” he said.

If determined by Twitter to be operated as a sockpuppet account on behalf of a North Korean state outlet, @coldnoodlefan may also face a ban, however.

Such was the case in 2014, where the advocacy group Free Tibet exposed a network of accounts on the platform pushing a pro-China message behind fake identities and Twitter banned many of them soon after it was reported in the New York Times.

Other North Korean outlets such as Uriminzokkiri, which have faced bans on other social media platforms in the past, continue to openly operate Twitter accounts in Korean. The official Sogwang account ceased posting earlier this year.

Sogwang and the bigger picture

The online habits detailed above have revealed a network of accounts in multiple languages and across multiple platforms geared towards key target audiences in the U.S. and other English-speaking countries, South Korea, and China.

Previous activities on Russian site VK in connection with @coldnoodlefan also suggest past and possibly ongoing efforts to attract fans in Russia as well.

The Sogwang media company appears to be at least facilitating and likely also coordinating messages and strategies with these accounts, based on the evidence above.

But while @coldnoodlefan attempts to obfuscate their identity and connections, Sogwang lists its address in Pyongyang on its homepage, and DPRK Today openly promotes the involvement of its Chinese editors.

There is also evidence pointing to Sogwang being another major new conglomerate in the world of North Korea’s emerging business and connected class – investing in restaurants, operating an art house similar to Mansudae which advertises art for sale through the DPRK Today Weibo, and even calling themselves a “hi-tech corp.” These connections and the activities of the other media platforms will be explored in a later article.

Sogwang is a name that will likely continue to spread as the company gets involved in more enterprises, as its current trajectory suggests, or perhaps as its foreign media operation more directly attempts greater outreach.

@coldnoodlefan, in this case, may continue to serve as a resource for images from Pyongyang and a contact point for curious readers. But they may have to do so as a known operative – paid or voluntary – of North Korean state media.

Edited by Oliver Hotham

Featured image: Screenshot of @coldnoodlefan’s Twitter page taken on March 13, 2019