Ryongchon explosion revisited

March 23rd, 2010

UPDATE 2 (2011-9-8): According to the Donga Ilbo:

Hyundai Group Chairwoman Hyun Jeong-eun, who met North Korean leader Kim Jong Il in Pyongyang in 2007, is known to have said Kim believes the 2004 train station explosion in the North Korean town of Ryongchon was an attempt to assassinate him.

According to a diplomatic report released recently by WikiLeaks, Hyun told U.S. Ambassador to South Korea Kathleen Stephens in 2009, “Kim believed that the explosion at Ryongchon Station was a failed attempt to assassinate him, and the (North Korean) People’s Army became his most trusted group after the incident.”

Hyun was quoted as saying, “After the time when his train was to pass Ryongchon Station was revealed through mobile phones, North Korean leader Kim Jong Il believed that the explosion occurred when his train almost reached the station, and after the incident, the introduction of mobile phones in the North was markedly delayed.”

According to the report, the chairman said, “Kim Jong Il fears assassination and a coup the most. He was not an irrational person in the past, but I feel he has changed recently in certain aspects.”

UPDATE 1 (2010-3-23): Adam Cathcart tracks down the original Chinese source and offers a translation:

Curtis, I believe the original source is an article in the Chongqing (Sichuan, PRC) Evening News.  I’ll include the relevant Chinese text in two separate blocks and then translate it:

2004年4月22日中午时分,朝鲜平安北道龙川郡发生了一起严重的火车爆炸事故,导致近200人死亡,1500多人受伤,另有8000多幢房屋被毁。有分析认为,这次造成灾难性后果的朝鲜火车爆炸案,是一次针对朝鲜领导人金正日的暗杀企图。4月22日龙川爆炸事故时,有线索表明不良分子使用了手机,唯恐内部情报外泄,所以手机业务被停了。

On April 22, 2004, around noon, the story is that in North Korea’s North Pyong’an Province, Ryongchon County, a serious train explosion caused the deaths of nearly 200 people and injured more than 1,500 people, while more than 8000 homes were destroyed.

Some analysts believe that the catastrophic consequences of this North Korean train explosion followed from a attempted plan to target North Korean leader Kim Jong-Il for assassination.

At the time of the April 22 Ryongchon explosion, clues collected along the tracks indicated that unhealthy elements had used mobile phones. For fear that internal information would leak [to the outside], the mobile phone business would be stopped.

[Note: The last sentence is pretty interesting; the phrase used is “唯恐” which means “for fear that,” but it can also lead into the idiomatic expression 唯恐天下不乱 which means “in order that all under Heaven remain unchaotic,” which seems to be a tactful dynastic-type allusion to the idea that the DPRK could ignite whenever.]

停止移动电话服务举措的命令由朝鲜国防委员会直接下达,特别是在权力机关或特殊行业就职的人员使用手机受到了严格的限制,原先持有的手机也被没收。朝鲜在境内全面禁止使用手机之后,花大笔钱购置手机的居民大为不满,因为1台手机机身和入网费共约1300美元,在一夜之间就成了废品。

The order to stop mobile phone services came down directly from the [North] Korean National Defense Committee, particularly [stating] that the authority/rights of those in special business sectors to use mobile phones was [henceforth] strictly limited and that previously held mobile phones [should be] confiscated.

After North Korea totally banned mobile phone use within its borders, many residents/citizens, having spent big money (about 1300 USD for everything including accessories and network access fees) to purchase mobile phones, became dissatisfied due to the fact that their cell phones had been rendered into scrap overnight.

[As a side note, I wonder why this news is leaking out of the PRC at a time when Kim Jong Il is said to be mulling over a return trip to China, which would almost certainly be taken by train (through the same station?). It’s a bit mystifying. But then again, Chinese readers probably have more sympathy for North Korea’s striving elites than is often acknowledged and Xinhua, perhaps, puts this story out as a gentle reminder (at a time when people are getting arrested for downloading “unharmonious content” onto their mobile phones) that life in the PRC could be much, much worse. Just my two cents — hope this helps, and thanks for the post.]

ORIGINAL POST (3/22/2010): According to the Donga Ilbo:

A 2004 explosion at a railway station in North Korea was an attempt to assassinate leader Kim Jong Il, China’s state-run Xinhua News Agency quoted an analysis as saying yesterday.

“The train explosion at Ryongchon Station in North Pyongan Province on April 22 that year killed nearly 200 people, injured more than 1,500, and destroyed more than 8,000 homes. The explosion is believed to have been an attempt to assassinate Kim,” Xinhua said.

Though Xinhua quoted an analysis, it is quite unusual for the news agency to say the explosion was an assassination attempt on Kim. Xinhua mentioned the incident while reporting on mobile phone use in North Korea.

The report said the number of mobile phone users in North Korea surged to 20,000 a year after mobile telecom service was launched in November 2002. Pyongyang, however, banned the use of mobile phones following the explosion.

Xinhua said the ban was imposed directly by the National Defense Commission, North Korea’s highest-ranking body, due to fears over the leak of news on the explosion outside of the communist country.

In the early days of mobile phone use, only officials at the people’s committee of the ruling Workers’ Party and the ministries of public safety, national security and defense could use them. After the explosion, however, as many as 10,000 mobile handsets were seized by authorities.

The cost of a mobile handset and registration was as high as 1,300 U.S. dollars when the greenback was traded at 1,200 to 1,300 North Korean won, equal to more than 600 months of monthly wages for the average North Korean worker (2.20 dollars).

In the face of mounting complaints over the ban, North Korean authorities re-allowed the use of mobile phones in March last year.

An estimated 120,000 North Koreans use mobile telecom service. Considering North Korea’s population of an estimated 24 million as of 2008, this translates into one handset per 200 people.

Xinhua added that mobile phones have brought about many changes in the lives of North Koreans.

I am taking this with a grain of salt until I find the source.  I post it here so you can judge for yourself.

Here are before/after images of the Ryongchon explosion.

Read the full srticle here:
“2004 Explosion Was Attempt on Kim Jong Il`s Life”
Donga Ilbo
3/22/2010

Share

Kumgang investors on the outs

March 23rd, 2010

According to the Donga Ilbo:

Ilyeon Investment Chairman Ahn Gyo-shik is nervous over Pyongyang’s latest moves. “I feel helpless since our company is rattled by external conditions, not our management’s ability,” he said.

The North has threatened to seize real estate owned by South Korean businessmen unless they visit North Korea for a land survey by Thursday. Ahn said he will cross the inter-Korean border with staff from the subcontractors of Hyundai Asan Corp. early Thursday morning.

Since launching a tour to Mount Kumgang in 2003, Ahn has built Kumgang Family Beach Hotel and a sashimi restaurant in the North. He has even served as a chairman of the Corporate Conference for South Korean Companies Doing Business at Mount Kumgang, a gathering of Hyundai Asan’s subcontractors.

In an interview with The Dong-A Ilbo yesterday, Ahn said the head of a conference member company recently died of a heart attack due to severe stress from his business in North Korea.

The suspension of the inter-Korean tours caused the late chairman’s company to teeter on the verge of bankruptcy, causing his death at age 55, Ahn said.

Ilyeon’s prospects are no better. Ahn has invested 14.7 billion won (12.9 million U.S. dollars) in his North Korea venture, including 13.4 billion won (11.8 million dollars) to build the hotel and additional facilities.

His company is six billion won (5.3 million dollars) in the red due to the suspension of the Kumgang tour. Its deficit slightly decreased in early 2007, but the killing of a South Korean tourist at Mount Kumgang in July 2008 by a North Korean soldier dealt another serious blow.

Since the shooting, Ilyeon has slashed the number of hotel staff from 119 (including North Korean workers) to three. Over the same period, Ilyeon’s office in South Korea has also downsized from 15 workers to four.

Ilyeon director Kim Rae-hyeon said, “Most member companies of the conference are almost bankrupt but cannot file for bankruptcy since their assets are in North Korea.”

On the North’s land survey Thursday, Ahn said, “Considering precedents and North Korea’s recent moves, Pyongyang is unlikely to make just empty threats. In the worst-case scenario, the North will confiscate assets held by South Korean companies after compensating South Korean investors with part of their investment.”

Worryingly, a Chinese tourist agency has released a six-day tour of both Kaesong and Mount Kumgang. This could encourage the North to deprive South Korean companies of their right to run businesses in the North.

Yang Mu-jin, a professor at the University of North Korean Studies in Seoul, said, “North Korea could mention Hyundai Asan’s underpayment of 400 million dollars as grounds to freeze assets held by South Korean companies. The North could also freeze the properties of South Korean companies, force them to recall their staff, annul existing contracts, and sign contracts with new companies.”

Other experts, however, say the North is unlikely to confiscate South Korean companies’ assets or deprive them of their exclusive right to do business.

For Thursday’s survey, Hyundai Asan said yesterday that 52 staff from 33 companies such as Hyundai Asan, its subcontractors, Korea Tourism Organization and Emerson Pacific will make the trip. Forty-eight workers from Hyundai Asan and its subcontractors had applied for their visit.

Shim Sang-jin, in charge of Mount Kumgang affairs for Hyundai Asan, will lead the group. The group will board a bus in Seoul and pass through the Customs, Immigration and Quarantine Office in Goseong County, Gangwon Province, around 9:40 a.m. Thursday.

Officials of the tourism organization will head for the North today.

And from the Choson Ilbo:

South Korean officials on Monday duly presented themselves at North Korea’s Mt. Kumgang resort after the North last week threatened to confiscate any real estate held by South Koreans unless they turned up for a survey.   

Three Korea Tourism Organization officials including its Mt. Kumgang branch chief Cha Dong-young went to North Korea through the east coast checkpoint in the afternoon.

Cha claimed the officials “are going to North Korea to conduct our own survey one day before the North’s planned survey” because the KTO has a considerable amount of property in the Mt. Kumgang area. “We’re visiting the North in a cool-headed way. We just hope that tour programs will be normalized as early as possible through dialogue between the two governments,” he added.

North Korea has become increasingly frantic to resume the lucrative tours as hard currency flow dried up amid international sanctions and the fallout from a botched currency reform late last year. Last week’s threat is only the latest in a series of attempts to bully and cajole the South into resuming the tours, which were halted after the fatal shooting of a South Korean tourist in 2008.

The KTO officials and staff from tour operator Hyundai Asan and other South Korean firms will comply with the North’s summons on Thursday. The KTO officials will stay at least until March 31 depending on how long the process takes.

The KTO invested W90 billion (US$1=W1,138) in a cultural hall and a hot spring spa in the tourist area.

“We’ve already handed documents including floor space of facilities and investment amount over to Hyundai Asan for delivery to the North,” Cha said. “We don’t think there’ll be any worst-case scenario, but we’ll find out what the North is up to once we meet North Korean officials.” 

Sixteen staffers of Hyundai Asan and other South Korean firms are to leave Seoul around on Thursday morning and return the same day. 

Yonhap asserts that the DPRK could be laying the groundwork for Chinese operators to take over.  That probably would not be good for Chinese-South Korean relations if they take over seized assets.  Of course if the Chinese bought out the South Koreans then that would be a win-win.

Here is the original story about the assets being seized

Here are older posts on Kumgangsan.

Read the full story here:
NK`s Seizure Threat Rattles S. Korean Investors
Donga Ilbo
3/24/2010

S.Korean Officials Respond to N.Korean Summons
Choson Ilbo
3/25/2010

Share

News organizations distributing satphones in DPRK

March 23rd, 2010

Acording to the Netherlands Media Network:

A Seoul-based rights group said today that it has supplied contacts in North Korea with satellite phones to expand news coverage of the secretive communist state and minimise the use of riskier cellphones. Free North Korea Radio, run by North Korean defectors, said it gave satphones to “correspondents” in the North five months ago to try to break down the wall of secrecy.

Several rights groups in South Korea have contacts who relay news via Chinese cellphones with pre-paid cards, but these work only in border areas. Free North Korea Radio, which broadcasts to the North on shortwave as well as running an Internet service, said the satphones give it access to information from more parts of the country.

“Three satellite phones, on top of cellphones, have been in use since last October to bring more live and direct news out of North Korea,” its head Kim Seong-Min told AFP. The three satellite phone operators are based in the capital Pyongyang and the southwest, Mr Kim added. He said they helped spread reports last week that Pak Nam-Ki, a top financial official, had been executed for a failed currency revaluation.

Read the full story here:
Free North Korea Radio correspondents use satphones
Radio Netherlands Worldwide
Andy Sennitt
3/2/2010

Share

RoK cuts DPRK trade quotas in agriculture

March 21st, 2010

According to Yonhap:

South Korea has significantly reduced import quotas for eight North Korean agricultural goods, government officials said Sunday, amid the enforcement of strong U.N. economic sanctions on the communist nation.

According to a public notice posted by the Unification Ministry, the amounts of six North Korean goods allowed to be shipped to the country, including crab, shrimp and peanut products, have been reduced to half from those of last year while the import quota for sesame seed has been reduced from 300 tons to 100 tons.

An official at the ministry, Seoul’s key office on North Korean affairs, said the move had little to do with the U.N. sanctions that were imposed shortly after the North’s second nuclear detonation test last year.

“The items, whose import quotas have been reduced this year, are the ones we had little imports of in the past five years,” the official said, asking not to be identified. “The change was only to reflect the actual amount of imports.”

The import quota for mung beans doubled from 1,000 tons last year to 2,000 tons while that of soybeans also increased from 2,000 tons to 3,000 tons, according to the official.

The government places import quotas on certain items to protect domestic markets and producers, he noted.

This comes as South Korea ends imports of North Korean sand.

Share

Someone is not playing nice….

March 19th, 2010

UPDATE: This is the second attempt to hack into my computer by someone claiming to be a journalist.  It is similar to the first attack but this time there is no PDF, just a link to a hostile server:

Dear Curtis Melvin,

My name is Ichikawa Hayami, from Nihon TV
Would you have some time to do a short
interview on the foreign direct investment in NK by letter?
If possible, prefer to below please.

documents

Best regards.

Ichikawa Hayami
Producer
Nihon TV World View

If you click on “documents” you are routed to a hostile server.

Here is the email header:

Delivered-To: [email protected]
Received: by 10.224.28.208 with SMTP id n16cs123243qac;
Tue, 6 Apr 2010 00:20:31 -0700 (PDT)
Received: by 10.220.107.227 with SMTP id c35mr3152197vcp.42.1270538430714;
Tue, 06 Apr 2010 00:20:30 -0700 (PDT)
Return-Path: <[email protected]>
Received: from imr-da03.mx.aol.com (imr-da03.mx.aol.com [205.188.105.145])
by mx.google.com with ESMTP id 26si25578441vws.46.2010.04.06.00.20.30;
Tue, 06 Apr 2010 00:20:30 -0700 (PDT)
Received-SPF: neutral (google.com: 205.188.105.145 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=205.188.105.145;
Authentication-Results: mx.google.com; spf=neutral (google.com: 205.188.105.145 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from imo-da04.mx.aol.com (imo-da04.mx.aol.com [205.188.169.202])
by imr-da03.mx.aol.com (8.14.1/8.14.1) with ESMTP id o367KUP1027363
for <[email protected]>; Tue, 6 Apr 2010 03:20:30 -0400
Received: from [email protected]
by imo-da04.mx.aol.com  (mail_out_v42.9.) id o.c35.7794a375 (44225)
for <[email protected]>; Tue, 6 Apr 2010 03:20:25 -0400 (EDT)
Received: from smtprly-mb03.mx.aol.com (smtprly-mb03.mx.aol.com [64.12.207.150]) by cia-dd08.mx.aol.com (v127_r1.2) with ESMTP id MAILCIADD083-5c6c4bbae0b8112; Tue, 06 Apr 2010 03:20:25 -0400
Received: from web-mmc-d04 (web-mmc-d04.sim.aol.com [205.188.103.94]) by smtprly-mb03.mx.aol.com (v127_r1.2) with ESMTP id MAILSMTPRLYMB032-5c6c4bbae0b8112; Tue, 06 Apr 2010 03:20:24 -0400
To: [email protected]
Subject: interview request
Date: Tue, 06 Apr 2010 03:20:24 -0400
X-MB-Message-Source: WebUI
X-AOL-IP: 211.103.134.39
X-MB-Message-Type: User
MIME-Version: 1.0
From: [email protected]
Content-Type: multipart/alternative;
boundary=”——–MB_8CCA370C27E93F1_136C_1AF_web-mmc-d04.sysops.aol.com”
X-Mailer: Mail.com Webmail 31226-STANDARD
Received: from 211.103.134.39 by web-mmc-d04.sysops.aol.com (205.188.103.94) with HTTP (WebMailUI); Tue, 06 Apr 2010 03:20:24 -0400
Message-Id: <[email protected]>
X-Spam-Flag:NO
X-AOL-SENDER: [email protected]

ORIGINAL POST: A week ago I received a personal email from someone requesting an interview.  However, this person was not who he/she claimed.  This person (unsuccessfully) tried to hack into my computer.  Details below:

——————————————————
From: [email protected]
To:
Date: Wed, Mar 10, 2010 at 2:05 AM
Subject: interview request

Dear Curtis Melvin,

My name is Greg Fayle, from SBS Radio
Australia’s program World View.
Would you have some time to do a short
interview on the latest developments regarding
Northeast asia and NK situation please?

I’m looking forward to hearing from you

Paper for Interview

Warm
regards,
Greg Fayle

Greg Fayle
Producer
SBS Radio World View
PO Box 290
South Melbourne VIC 3211
Tel: (03) 9749 2421
——————————————————

The “Paper for interview” was an attached PDF document that hid a virus.  Luckily it did not infect my computer.

Here is what  my friend tells me about the email itself — it did not come from Australia:

inetnum:      222.96.0.0 – 222.122.255.255
netname:      KORNET
descr:        KOREA TELECOM
descr:        Network Management Center
country:      KR
admin-c:      DL248-AP
tech-c:       GK40-AP
remarks:      ***********************************************
remarks:      KRNIC of NIDA is the National Internet Registry
remarks:      in Korea under APNIC. If you would like to
remarks:      find assignment information in detail
remarks:      please refer to the NIDA Whois DB
remarks:      http://whois.nida.or.kr/english/index.html
remarks:      ***********************************************
status:       Allocated Portable
mnt-by:       MNT-KRNIC-AP
changed:      [email protected] 20031027
changed:      [email protected] 20041007
source:       APNIC
person:       Dong-Joo Lee
address:      128-9 Yeong-Dong Jongro-Ku Seoul
address:      Network Management Center
country:      KR
phone:        +82-2-766-1407
fax-no:       +82-2-766-6008
e-mail:       [email protected]
e-mail:       [email protected]
nic-hdl:      DL248-AP
mnt-by:       MAINT-NEW
changed:      [email protected] 20061010
source:       APNIC
person:       Gyung-Jun Kim
address:      KORNET
address:      128-9, Yeong-Dong, Jongro-Ku
address:      SEOUL
address:      110-763
country:      KR
phone:        +82-2-747-9213
fax-no:       +82-2-3673-5452
e-mail:       [email protected]
e-mail:       [email protected]
nic-hdl:      GK40-AP
mnt-by:       MNT-KRNIC-AP
changed:      [email protected] 20061009
source:       APNIC
inetnum:        222.96.0.0 – 222.122.255.255
netname:        KORNET-KR
descr:          Korea Telecom
country:        KR
admin-c:        IA9-KR
tech-c:         IM9-KR
status:         ALLOCATED PORTABLE
mnt-by:         MNT-KRNIC-AP
remarks:        This information has been partially mirrored by APNIC from
remarks:        KRNIC. To obtain more specific information, please use the
remarks:        KRNIC whois server at whois.krnic.net.
changed:        [email protected]
source:         KRNIC
person:         ijeksolrusyun a
descr:         aijeksolrusyun
descr:         4cheung jaehyunbilding 230beonji jongro6ka jongroku
descr:         110-126
country:        KR
phone:         +82-2-3676-7100
e-mail:         [email protected]
nic-hdl:        IA9-KR
mnt-by:         MNT-KRNIC-AP
changed:        [email protected]
source:         KRNIC
person:         IP Manager
descr:         DACOM Corporation
descr:         Hangangno1Ga, Yongsan-gu, Seoul
descr:         65-228DACOM Bldg.
descr:         135-987
country:        KR
phone:         +82-2-2089-7755
fax-no:         +82-505-888-0706
e-mail:         [email protected]
nic-hdl:        IM9-KR
mnt-by:         MNT-KRNIC-AP
changed:        [email protected]
source:         KRNIC

Here is what my friend tells me about the virus–it was pretty sophisticated:

To analyze the PDF  file (which contained the virus), we used scripts to parse through and pick out sections of the code that had Javascript (the virus) embedded in it.  We received an error parsing the /FlateDecode filter sections of the PDF. This section of the document is where the compressed Javascript (virus) and other embedded objects would live, and it has different object and reference pointers. We found that the text section of the code instead of starting with /FlateDecode started with [null character] latedecode. We believe this was done intentionally to make de-obfuscation and analysis by a novice more difficult. We used a Hex Editor to correct the null character byte and make it an ASCII F. Once this was done we were able to see heavily obfuscated javascript and pull it out of the document.

The javascript code contained two well known PDF exploits, one for Reader version 8 and another for Reader version 9. The virus was structured this way because most people use one of these versions of Reader to view PDF documents. One other interesting thing to note was that the PDF document itself was blank.

Here is what we know about the payload from behavioral analysis. Once the PDF runs, it will execute the payload and instruct Adobe’s internal updater (update.exe) to download a file from a non-Adobe owned DNS name which resolves to an IP address in Malaysia. All of the attacking code references the same DNS names. Once downloaded this file will sit on the system and acts as a second stage (or stager) for the additional files to be downloaded. So in summary, the first stage was the initial payload in the PDF shellcode.  This first stage downloads a secod stage program which in turn downloads (we believe) a ‘rootkit’ before deleting itself. This leftover ‘rootkit’ is how the attackers would maintain full command and control of the system.

We visited the website from which the files were to come and found a default instance of Apache and cPanel–so we can assume one of two things: First, whoever administers this server probably doesn’t realize it is being used in this fashion (it was probably compromised by the attackers). Second, perhaps this is the attacker’s server and they want to throw us off by throwing up a cPanel install so we’ll think it’s a compromised host. We think the first scenario is more likely.

The files themselves that come after do behave in a ‘rootkit’ like fashion. What we have observed is that they install themselves in the %WINDOWS%\System32 directory. They modify the registry to allow themselves to be used as a system service (this is done through the second stage payload); they hide their existence from view once they are installed (total rootkit behavior); and they start to call out to the server for additional commands. We noticed that these additional commands were not actually coming back as 200 OK status messages, but instead where coming back as 404 NOT FOUND HTTP messages. This could mean that the reference files have been removed, or it could mean that the 404’s are acting as a beacon.  We are not sure which scenario is the case here at this time.

Also worth noting, the second stage payload prevented hooking with a debugger for analysis during runtime and also prevented analysis through virtual machines. The file also leveraged potential DLL Injection to make other executables run commands on its behalf. This means that it would be obscured from routine detection.  We ran the final rootkit executable through a debugger for static analysis and noticed code sections that contained messages within the application stack like “installation as a system service”, “calls to winspool (which is the library for printing and potentially document creation?)”, “calls to imm32.dll (which could be used for keylogging)”, and some very interesting UNICODE characters that we are still deciphering.

As you can tell, we are still conducting additional research and do not want to reveal the exact location of where we have seen this code before. What we can say is that a quick Google search for this code snippet revealed few results with the same region of the world.  In conclusion, I must say that this was not an amateuristic attack–these people were good. But certain things don’t make sense and we are still looking at the file.

Share

Seoul moves to halt imports of DPRK sand

March 19th, 2010

According to the Financial Times:

South Korea is to phase out its main import from North Korea, delivering a heavy blow to an impoverished regime already reeling economically from confiscated arms shipments and bungled currency reforms.

Sand was the biggest export to South Korea from the north in 2008, earning Pyongyang $73m (£47m). That represents about twice as much as it gains annually from wages at factories in Kaesong, a cross-border industrial zone for South Korean companies.

South Korean officials told the Financial Times that Seoul would phase out sand exports when existing contracts with its northern neighbour expired.

“Once those companies receive their sand, for which they have already paid, that will be the end,” a senior South Korean security official said.

It could have a profound political impact – but South Korean officials insist the decision was taken because Seoul increasingly dredges its own sand domestically.

Officials admit that South Korea has long worried that money paid for sand goes to the military, but they say increased dredging and the imminent conclusion of numerous outstanding contracts have given it the opportunity to end the trade.

North Korea is trying to compensate for South Korea’s decision by seeking alternative sand markets in Russian construction projects.

Russia’s Itar-Tass news agency reported late last year that North Korea would ship sand to Vladivostock for use in building projects for the Asia-Pacific Economic Co-operation summit in 2012.

Sand shipments to South Korea started in 2002 amid inter-Korean rapprochement – but were suspended last March while North Korea prepared to fire a long-range missile over Japan.

Pressed by construction companies that have been affected by the import ban, Seoul resumed imports from North Korea in November. The current flow, however, is less than one-fifth of previous levels.

In an effort to salvage the trade with South Korea, Pyongyang has offered to provide sand to South Korean companies in exchange for other building materials and fuel.

But the South Korean unification ministry said domestic companies were not interested and had not applied for export licences to conduct such swaps.

Previous posts on North Korean sand can be found here

Read the full story here:
North Korea hit by Seoul move to end valuable sand imports
Financial Times
Christian Oliver and Song Jung-a
3/19/2010

Share

North Korean logger detained in Russian east

March 19th, 2010

According to the Associated Press (via Los Angeles Times):

The North Korean’s note, scrawled in pen, was simple: “I want to go to South Korea. Why? To find freedom. Freedom of religion, freedom of life.”

The ex-logger, on the run from North Korean authorities, handed the note over to a South Korean missionary in the Russian city of Vladivostok last week in hopes it would lead to political asylum.

Just before he was to meet Thursday with the International Organization for Migrants, a team of men grabbed him, slapped handcuffs on him and drove off, rights activists in Moscow said Friday. He was spirited away to the eastern port city of Nakhokda, where he is sure to be handed back over to North Korean officials and repatriated to his communist homeland, activists said in Seoul.

Police in Vladivostok refused to comment. A senior South Korean diplomat in Vladivostok said he had no information. Officials from the U.S. consulate in Vladivostok could not be reached for comment.

The 51-year-old would be the third North Korean logger in Russia in a week to make a bid for asylum. On March 9, two other North Koreans who had fled their jobs as loggers managed to get into the South Korean consulate in Vladivostok.

Russia’s RIA Novosti news agency reported last week that two North Koreans climbed a fence, ran past the guards and entered the consulate, saying they wanted political asylum. ITAR-Tass carried a similar report.

The incidents focused attention on the precarious existence of tens of thousands of North Koreans sent by the impoverished regime to work in neighboring Russia.

Russian government figures from 2007 put the number of North Korean laborers at 32,600, most of them working in logging in the remote east.

The Rev. Peter Chung, a Seoul-based activist, said there are about 40,000 North Korean loggers in Russia, but that some 10,000 of them have fled their work sites. Some are finding work as day laborers while others are in hiding as they try to map out how to win asylum in foreign diplomatic missions.

The North Korean described the conditions as unbearable. His government took half his meager wages, while the North Korean company operating the logging camp took 35 percent. He kept just 15 percent — about $60 a month — an arrangement that rendered him “virtually a slave,” he told activists.

He eventually fled the logging camp, taking odd jobs to survive. He also became a Christian, Chung and Kim Hi-tae said, which could draw severe punishment, even execution, back home.

The successful asylum bid of two other former North Korean loggers inspired Kim to make a similar attempt, Chung said.

Previous posts on the North Korean loggers in Russia can be found hereMore here. And here. And here.

Read the full story below:
3rd North Korean logger attempts to defect in Russia, propelled by dream of ‘freedom of life’
Associated Press (via Los Angeles Times)
Kim Kwang Tae
3/19/2010

Share

More DPRK census analysis

March 19th, 2010

According to the Hankyoreh:

According to the final report on North Korea’s 2008 census, the population of the country listed under the category of ‘sex’ is 11,721,838 men and 12,330,393 women, for a total population of 24,052,231. However, under the category of ‘region,’ the totals are 11,059,489 men and 12,290,370 women, for a total population of 23,349,859. In other words, some 702,372 people are missing from the second total.

What accounts for the difference? One clue is the fact that the total population by region omits the population residing in military camps, which is included in the population under the category of sex. Additionally, men accounted for 94.3 percent of the omitted population, or 662,349 people, while women represented just 5.7 percent, or 40,023 people. According to age, some 96.4 percent of the omitted total, or 676,737 people, were in the population aged 15 to 29. In particular, people aged 20 to 24 accounted for 57 percent, or 400,052, of the omitted number. In short, this means that men aged 15 to 29 were systematically left out of the estimates for total population by region. Seoul National University Professor Park Keong-suk, who analyzed the census results, said, “This appears to indicate an attempt by North Korean authorities, for security reasons, to avoid clear information coming to light on the distribution of population at military camps by region.”

In any event, the results of the census, which included military camps in examination, essentially confirm a population of 702,372 people residing at military camps in North Korea. Does this mean that the total scale of the North Korean People’s Army is just over 700 thousand troops? It is still too early to reach any conclusions. According to a statistic on “distribution of economically active population aged 16 and older by region,” a total of 699,020 people (425,319 men, 273,701 women) were listed as being employed in the areas of public administration, national defense and social security. These figures do not include residents at military camps, and due to a lack of detailed information, it is impossible to confirm how many of these 699,020 people are employed in the area of national defense.

Thus, while a precise determination is impossible, it can be estimated that the scale of the Korean People’s Army is 702,372 troops plus some additional, unspecified number. This differs markedly from South Korean Ministry of National Defense estimates, which put the size of North Korea’s regular army at 1.19 million people as of December 2008. In view of the fact that 27 percent of enlisted men in the South Korean military as of 2008 were noncommisioned and commissioned officers with addresses outside their bases, analysts say there are grounds for viewing the Defense Ministry’s estimates on the scale of the North Korean army as inflated.

I translated some of the data into excel so I could start playing with it.  Here are the DPRK’s top ten largest cities by population:

top-10-cities.jpg

It should be noted that the number of residents listed in Pyongyang are for the Province of Pyongyang–not just the city center.

Here is some more thoughtful analysis of the census data by the Wall Street Journal and links to the census reports.

Share

DPRK threatens to seize Hyundai assets at Kumgang

March 18th, 2010

According to Yonhap:

North Korea has informed South Korea of its plan to look into all of the real estate owned by South Koreans inside the scenic mountain resort along its east coast, the South’s government confirmed Thursday, as Pyongyang apparently grows impatient with Seoul’s refusal to allow its citizens to travel there.

In a recently faxed message to the South Korean government, the North’s Asia-Pacific Peace Committee, a state agency in charge of cross-border exchanges, said, “South Korean figures who possess real estate in the Mount Kumgang district should come to Mount Kumgang by March 25,” according to the Unification Ministry, which deals with inter-Korean affairs.

The North went on to say, “All assets of those who do not meet the deadline will be confiscated and they won’t be able to visit Mount Kumgang again.”

An inter-Korean tourism program to the mountain, once a cash cow for the impoverished North, has been suspended since the summer of 2008, when a female South Korean tourist was shot dead by a North Korean soldier while traveling there. A luxury hotel, a golf course, and other facilities built by the South Korean conglomerate Hyundai there have since remained idle. A similar joint tour business to the ancient city of Kaesong, just north of the two Koreas’ border, has been also halted.

North Korea, feeling the pinch of U.N. sanctions imposed for its missile and nuclear tests, has called for the South to immediately resume the tours.

In its statement issued March 4, the North Korean committee said, “We would open the door to the tour of the Kaesong area from March and that of Mount Kumgang from April.”

It said it may revoke all accords and contracts on the business unless the South stops blocking the resumption of the joint ventures.

South Korea has urged the North to first fully guarantee the safety of South Korean tourists. Related working-level talks between the two sides last month failed to yield a deal due to differences over details on a security guarantee.

The Unification Ministry expressed regret over the North’s latest threat.

“North Korea’s measure violates agreements between South and North Korean authorities, as well as between their tourism business operators,” the ministry said in a press release. “It also goes against international practice.”

It stressed the North should abide by accords with the South, and all pending issues should be resolved through dialogue.

“As the tours to Mount Kumgang and Kaesong are issues directly related with our people’s safety, there is no change in the government’s existing position that it will resume them only after the matters are settled,” it added.

Meanwhile, the head of the South Korean operator of the tours offered to resign to take responsibility for snowballing losses from the suspended businesses.

Cho Gun-shik, president of Hyundai Asan Corp., expressed his intent to step down in a statement emailed to all staff earlier Thursday, company officials said.

The Choson Ilbo has more:

In the message, North Korea said, “From March 25, North Korean authorities and experts will conduct a survey of all South Korean assets in the presence of South Korean officials concerned,” including Hyundai Asan staffers, who have assets in the area. “All South Koreans with real estate in the Mt. Kumgang area must report to the mountain by March 25,” it added.

According to the ministry, Hyundai Asan signed a lease with the North for a plot of land in Mt. Kumgang until 2052. South Korean firms have invested a total of W359.2 billion (US$1=W1,134), including W226.3 billion from Asan, in a hotel, a hot spring spa, a golf course, and a sushi restaurant there. The South Korean government owns a meeting hall for separated families opened in 2008 that cost more than W60 billion to build.

Nonetheless the threat is likely to fall on deaf ears. A South Korean security official said, “The North apparently wants South Korean firms that are in danger of losing their assets in the North to put pressure on the government, but the government won’t back down.”

A South Korean businessman operating in the Mt. Kumgang region said, “The North is threatening to seize our firms’ real estate there while talking about attracting large amounts of foreign investment. What South Korean or foreign business will make new investments in the North under these circumstances?”

Read the full stories here:
N. Korea threatens to seize S. Korean assets at Mount Kumgang
Yonhap
3/18/2010

N.Korea Ramps Up Threats Over Mt. Kumgang Tours
Choson Ilbo
3/19/2010

Share

Hyundai Asan chief offers resignation over Kumgangsan

March 18th, 2010

According to Yonhap:

The chief of Hyundai Asan Corp., a South Korean firm that runs tours to North Korea, expressed his intention to step down on Thursday to take responsibility for failing to resume the inter-Korean tour business.

“(I) couldn’t settle them even after running to revive tours (to Mount Kumgang and Kaesong) and normalize business,” Hyundai Asan President Cho Kun-shik said in an e-mail sent to company employees. “I thought taking clear responsibility for results as a president was critical for the firm and the business”.

He intends to resign after a shareholder meeting scheduled for next Wednesday.

Hyundai had been operating tourism projects to the scenic Mount Kumgang on North Korea’s east coast and Kaesong, the ancient capital of the Goryeo Dynasty (A.D. 918-1392).

Cho, a former vice minister with the Ministry of Unification, took the company’s helm in August 2008, a month after tours to the famed mountain resort were suspended following the shooting death of a South Korean woman in the area. Visits to Kaesong were stopped in December of the same year.

He took office vowing to reopen the tour programs, which remain on hold as the two Koreas have yet to reach an agreement over terms for their resumption.

The postponement in relaunching the tours has prompted almost 70 percent of the company’s employees to leave the firm. “I felt regretful for not having reinstated those who had left,” Cho said.

Last week, North Korea accused the Seoul government of effectively blocking South Koreans from visiting its tourist attractions and warned it could revoke all deals covering inter-Korean tours.

But Seoul has demanded an official apology for the shooting death and a pledge that such an incident will not occur in the future, while saying a formal investigation must be carried out to determine why the shooting occurred.

As of February, Hyundai Asan suffered a loss of 257.9 billion won (US$228.1 million) in sales stemming from the travel suspension, according to the company.

Amid growing losses, the firm sold off part of its assets, previously used for the tour program, including 51 tour buses and 41 heavy vehicles.

Mount Kumgang had been a popular tourist spot for South Koreans since it was opened to them in 1998 as a symbol of inter-Korean rapprochement spearheaded by the liberal government of Kim Dae-jung at that time.

Read the full story here:
Hyundai Asan chief offers to resign over suspended inter-Korean tour program
Yonhap
3/18/2010

Share