North Korean server error exposes illegal cartoon work

North Korea's regime continues to generate revenue by exporting cartoons, thereby circumventing international economic sanctions. This was uncovered by Nick Roy, a keen observer of North Korea's limited online presence. In 2023, he found a server with a North Korean IP address that was incorrectly configured, so that extensive data material was freely accessible.

This was reported by the Stimson Center. In addition to logs, Nick Roy primarily found files showing the daily work progress of a North Korean animation studio on the one hand and work instructions on the other. There were also files whose purpose is unclear, such as a Chinese film about basketball or Russian instructions for keeping horses. The instructions for the animation studio were written in Chinese with North Korean translations.

Roy was able to identify some of the projects being worked on in North Korea together with the Stimson Center staff he had consulted: Season 3 of the Amazon.com series Invincible, a new superhero animated series for HBO Max, and a new Japanese series. In addition to an unidentified Chinese production, there was also the BBC animated series Octonauts, which was apparently not (or no longer) being worked on in North Korea.

Disguised export

There are no known indications that the financial backers in the USA and Japan knew that their orders were being completed in North Korea. Mandian, a Google subsidiary specializing in IT security, has analyzed the server logs. Mandian found that the server was accessed from North Korea, via virtual private networks and directly via IP addresses from Spain and China. Together with the Chinese instructions, this indicates that Chinese (sub)companies are accepting orders and outsourcing them to the cheaper workers in North Korea.

The hereditary dictatorship has been in the cartoon business for decades. The comic book Pyongyang by Canadian cartoonist Guy Delisle provides an interesting insight into the processes on the ground in 2001. At the time, he spent two months in the North Korean capital Pyongyang on behalf of the French TV station TF1 in order to get the work on site on track. Due to North Korea's nuclear weapons tests in 2006, the United Nations gradually imposed increasingly strict economic sanctions from that year onwards, so that cooperation, which was still legal in 2001, is now internationally prohibited.

The regime is, of course, constantly trying to circumvent the sanctions. The methods used include online crimes, arms and drug trafficking, front companies, diplomatic schemes, trade under false pretenses, the shipment of workers to sealed-off factories in various friendly countries, construction work in friendly states and the disguised export of services. In addition to cartoons, these include IT contracts of all kinds. North Koreans take on jobs under false, non-Korean identities or are even hired to work from home.

Western companies need to be more vigilant

The FBI and the South Korean government have been urging Western companies for years to be more careful, to check the identity of their contractors or employees more closely and also to keep a close eye on subcontractors. A new list of recommendations was published in October. Anyone who falls victim to North Korean deception should report this to the FBI, its South Korean partner NIS and the South Korean police.

In the fall, the US Department of Justice reported the seizure of 1.5 million US dollars and 17 internet domains that North Korea used to sell IT services under false pretenses. An American who had hooked up four laptops to his private internet connection was also caught. He received 400 US dollars a month for this. The laptops were used by North Korean IT workers as relays to make it appear to third parties that they were using private internet access in the USA. In addition, the American provided an account set up under his name on an online platform and sent the income generated from this, minus a commission, to China. Thousands of dollars a month.

(ds)