All Eyes on North Korea

With talk of a “bloody nose” strike against North Korea being debated in Washington, public attention has focused on conventional military preparations for a U.S. attack on Pyongyang. Less noticed, but possibly even more telling, is the surge in recent months of intelligence resources.

Senior officials have made no secret of the fact that the administration is ramping up its intelligence capabilities to focus on the Korean Peninsula, but six sources familiar with U.S. planning described a nearly unprecedented scramble inside the agencies responsible for spying and cyber warfare.

In fact, the initial strike against the North Korean regime could be digital rather than physical, according to two former intelligence officials with knowledge of the preparations.

“The first shot will be cyber,” one of the former officials said.

As North Korean leader Kim Jong Un flaunts his nation’s strides in missile development, the U.S. government for the past six months has covertly begun laying the groundwork for possible cyberattacks on North Korea in countries including South Korea and Japan. This process involves installing fiber cables as bridges into the region and setting up remote bases and listening posts, where hackers may attempt to gain access to a North Korean internet that’s largely walled off from external connections.

Preparations for a cyberattack reflect a larger issue: America’s spies are pivoting the magnifying glass, funneling much of the weight of billions of dollars in technical infrastructure and trained professionals toward Pyongyang, current and former intelligence officials told Foreign Policy.

“The national technical focus is being switched,” one former intelligence official with knowledge of the developments told FP. There are “wholesale” shifts worth billions of dollars redirecting signals intelligence, overhead imagery, geospatial intelligence, and other technical capabilities, toward Pyongyang.

Regional analysts are also getting reassigned. “If you’re an Africa analyst, you’re fucked,” the former official said.

The preparations, according to those sources, include military intelligence analysts on reserve status being called back into service to focus on North Korea. Military and intelligence contractors have posted a number of job announcements in recent months seeking analysts with Korean-language skills, including positions to identify and recruit human intelligence sources.

In November 2017, rumors flew around the halls at CIA headquarters in Langley, Virginia, that the agency would also be surging analysts of all disciplines to work at the brand-new Korea Mission Center, established in May of that year, a symbol of serious potential for military action, one former intelligence official told FP. CIA Director Mike Pompeo has publicly confirmed that he’s funneling workers there.

“The Administration has made North Korea a top priority, and the CIA established its Korea Mission Center to harness the full resources, capabilities, and authorities of the Agency to address the threat posed by Kim Jong Un and his regime,” CIA spokesman Jonathan Liu wrote in an email. “We shift resources as appropriate to tackle our most pressing challenges.”

The Defense Intelligence Agency had an “oh, shit” moment after the holidays, another source described to FP, when contingency planning to shift resources toward East Asia kicked off in earnest. Some experts working on areas such as counterterrorism and counternarcotics are suddenly getting new assignments, or fear they soon might, and are being told to shift their gaze to the Korean Peninsula instead, yet another source indicated.

The Defense Clandestine Service, an espionage wing of the DIA, has ratcheted up its presence in the region. The government is working on “putting the elite of the elite on the peninsula to collect and respond,” a separate former military intelligence official told FP.

Pivoting to high-priority regions to serve the military is the DIA’s calling, said an agency spokesman, James Kudla. “DIA has the unique role of ensuring warfighters, defense planners and national policy makers understand foreign military capabilities and operational environments so they can prevent or decisively win wars,” he wrote in an email to FP.

These moves in the intelligence world mirror the reported military preparations for possible war with North Korea. But in the flurry of shifting intelligence resources, multiple current and former intelligence officials told FP, there is concern that the laser focus on North Korea could come at the expense of other hot spots, such as Syria or Iran.

“How does that leave us vulnerable?” one military intelligence source asked. The defense budget passed by Congress ultimately doesn’t end up matching the areas where the United States is spending the most, and resources aren’t unlimited. “We have what we have.”

The CIA described the concern about limited resources as misplaced. “The CIA is no stranger to tackling multiple priorities and executing its mission aggressively. We are always mindful of our obligation to keep America safe from threats from all over the world,” wrote Liu, the agency spokesman.

Joseph DeTrani, the former associate director of national intelligence and mission manager for North Korea, said the intelligence community’s focus on North Korea has ebbed and flowed over the years. “I think we surged slightly a little more in 1999, when we confronted them with the uranium enrichment program,” he said.

In 2017, North Korea made rapid progress in developing advanced missiles — testing more than 20, though not all were successful. Kim Jong Un is a showman when it comes to missile testing, according to DeTrani. “[The North Koreans] want us to know they have these missile and nuclear capabilities,” he added.

DeTrani, who served as U.S. special envoy at the six-party talks with North Korea between 2003 and 2006, said the Donald Trump administration is making the regime and its nuclear program “very clearly priority No. 1.”

The Office of the Director of National Intelligence confirmed the increasing focus on North Korea but declined to provide specifics. (Earlier this month, the office posted an announcement seeking a Korea director to, in part, “oversee and monitor efforts to assess the state of collection, analysis, intelligence operations, and resource gaps” in the region.)

“North Korea has long been a very high priority for the Intelligence Community,” Timothy Barrett, a spokesman for the office, wrote in a statement to FP.

“Given this challenge and the high policy focus on this topic, the Intelligence Community has added priority, focus, and resources to our North Korea efforts over the past several years,” he continued. “We continue to make adjustments to our North Korea-focused resources as the situation warrants.”

The CIA has been particularly vocal on its Korea focus. In January, Pompeo told an audience at an event hosted by the American Enterprise Institute in Washington that supporting the U.S. “pressure campaign” on North Korea was “the kind of task that the CIA was designed for.”

While Pompeo would not go into detail about missions in East Asia, he noted that the CIA was helping support sanctions efforts to create economic pressure and was “working to prepare a series of options” in case diplomacy fails.

One of those options, a former intelligence official with knowledge of recent planning told FP, could be targeting North Korea’s heavy use of cryptocurrency. “Now they have a reason to hack Bitcoin,” the former official said.

The source predicted that a massive attack on the bitcoin exchanges could be a “shot across the bow.”

U.S. Cyber Command, which conducts offensive digital operations, declined to comment on its plans, or any options that may have been presented. “One of U.S. Cyber Command’s key responsibilities is to generate a full-spectrum of integrated military cyberspace options for policymakers and supported commanders,” Masao Doi, a spokesman for the command, wrote in an email to FP.

North Korea relies to some extent on cryptocurrency to evade international sanctions, and Pyongyang has also been actively targeting South Korea’s Bitcoin exchanges, according to Priscilla Moriuchi, who until last year led the National Security Agency’s East Asia and Pacific cyberthreats office.

Moriuchi, who now works for Recorded Future, a private digital intelligence firm, said she was able to identify several specific thefts of thousands of bitcoin and other forms of digital currency. But because not all exchanges report theft and it’s hard to attribute every attack, “it’s difficult to identify how many coins North Korea has at any one time,” she said.

Just from the thefts Moriuchi was able to identify, North Korea could have made between $15 million and $200 million, depending on when it cashed the digital coins in for real currency. “It’s evident that North Korea is evading sanctions,” she said. “It could be a substantial source of revenue — we just don’t know when they’re cashing out.”

Moriuchi said hacking North Korea’s cryptocurrency reserves or planning some other intelligence operation around them could prove tricky, since it’s difficult to track the individual users and the long trail from mining to stealing to laundering the reserves into cash. But keeping digital currency and operations in mind could be an important middle ground between physical military strikes and harsh rhetoric.

The United States needs to “find different levers” to contain North Korea, since sanctions alone aren’t enough to stop Kim Jong Un from continuing missile development. “Cryptocurrencies could give us a different lever,” Moriuchi said.