At the 2015 Chaos Communication Congress, Florian and Niklaus presented an analysis of Red Star OS 3.0, the system which leaked online a year ago.
In their talk they provide technical backing for several observations about the system which have gained some press attention. The first is that the Operating System is designed without obvious backdoors and doing a reasonable job of security. This implies that it is aimed at a serious, internal market. The second point is that there is tracking of accessed content, also known as digital watermarking, occurring in the system. This can be seen as a malicious attempt of control over users of the system, which is the dominant interpretation made by the press. However, it’s worth pointing out that interpretation is dependent on a lot of context about how the system is used that we don’t have.
We know that RedStar is developed by KCC, the Korea Computer Center, which is one of the large government technology labs. We also know that a part of KCC’s business has been industrial contract work. They’ve run external branches intermittently, and work with foreign clients. So far, as pointed out in Florian’s talk, the only computers observed to run Red Star are some of the Publicly Internet facing servers, run in the country, like naenara.com.kp. It is not unreasonable to expect that these servers are operated by KCC as a contract service for the relevant entities.
First, I want to take a somewhat skeptical look at the purpose of this watermarking. I’ll admit that it absolutely introduces the capacity for surveillance, but I think in this case it’s a largely irrelevant point from a human rights perspective. First, this OS as far as we know is only being used in industrial settings. We’ve seen older versions of RedStar in e-libraries and show-computer-labs around the country, but so far version three has not been deployed to these semi-public machines. Computers available in stores that would be bought for personal ownership are universally running Windows, and that’s also what we see in the personal laptops of the PUST students. The Surveillance chain insinuated in the talk assumes that most machines are running the new OS, which is absolutely not the case.
Instead, we can see this development to be a reaction to two things that we know to be pressing issues in the country: The ability to clean up after viruses that have spread through an industrial network. KCC also develops its own antivirus software, and students at PUST often express concern about malware and gaining security against attacks from foreign state-level actors. This seems like a reasonable concern, given that such attacks have been admitted to. Having lineage on files passed around on USB sticks lets you find what other computers on your network have been infected. In this same vein we can see the digital watermarking as a digital auditing capability within an office, and here it is no more intrusive than the practices commonly in place in most global companies. To put this succinctly: the capability is one which we use, and know to have value – but we’re scared that it has a potential for misuse, though we haven’t seen evidence of that yet.
Recently, Joshua Stanton made the claim that this evidence of watermarking in RedStar should cause us to reconsider current academic engagement with the country. In particular, he points to a long-standing interaction with Syracuse university. The cited report on this collaboration mentions
Areas of particular interest included a secure fax program (this is now being marketed through a Japanese company), machine translation programs, digital copyright and watermarking programs, and graphics communication via personal digital assistants.
One trap this line of reasoning falls into is the common perception that North Korea is all one entity, somehow all working malevolently together to subvert whatever assistance is provided. In reality, the country like any other has many
different organizations and bureaus with different groups jockeying for power and substantial bureaucracy. The fact that the report mentions PIC, a rival computing center, is probably enough to indicate that the syracuse interaction wasn’t attached to KCC. Several other arguments can be made to separate this instance from the observed watermarking:
- The actual collaboration, as noted in the same report was on systems assurance. As a Computer Scientist, I’m willing to say that digital watermarking is not in that scope.
- Students at Kim Chaek have had a standard undergraduate computer science education, but have no exposure to linux programming. The standard curriculum that Kim Chaek graduates I’ve interacted with have had only covers programming in a windows environment.
- Digital Watermarking information is easily accessible on the internet. There’s no reason to expect that the US academics had any more knowledge or conveyed anything better than the books and online resources that KCC would easily be able to access and translate on its own.
I’m a strong believer of these arguments, and they cause me to remain in support of the syracuse-style (and PUST for that mater) interactions with university students in Pyongyang. I think there is a strong personal benefit in building these relationships. Without engagement, it’s really hard to change perceptions. These are some of the rare opportunities we have to access the future middle-class and well-connected people in Pyongyang and give them something more personal than just the evil US government to think of when they think of the US. In addition, these interactions are how the rest of the world learns about the state of technology in the country and is even able to have the conversation about whether Red Star is a surveillance tool.