The new connection was first spotted by Internet analysts at Oracle Dyn, who noted that a new connection for North Koreans provided by the Russian firm TransTeleCom appeared in Internet routing databases about 5:38 p.m. Pyongyang time Sunday.
The new connection appears to supplement a connection run by China Unicom that has operated since 2010. With two connections, experts argue, North Korean Internet users could expect a higher international bandwidth capacity as well as a greater ability to withstand attacks.
“In practical terms, [having multiple connections] will allow additional resiliency if one of those connections were to be rendered inactive for any number of reasons,” said Doug Madory, director of Internet analysis at Oracle Dyn.
The new connection “will improve the resiliency of their network and increase their ability to conduct command and control over those activities,” Bryce Boland, cybersecurity firm FireEye’s chief technology office for the Asia-Pacific region, told Reuters.
On Saturday, The Washington Post reported that a U.S. Cyber Command operation had targeted hackers at North Korea’s military spy agency, the Reconnaissance General Bureau. The U.S. operation used what is known as a denial-of-service attack, choking off access to the Internet for North Korean users. It ended Saturday, shortly before North Korea's new Internet connection went online.
Martyn Williams, an expert on North Korean technology who first reported on the new connection at the website 38 North, wrote that “relying on one Internet provider has always left North Korea in a precarious situation.” In 2014, after a cyberattack on Sony Pictures that was widely attributed to North Korea, the country suddenly lost its connection to the Internet in what many suspected was U.S. retaliation.
TransTeleCom is part of Russian Railways, a huge state-owned infrastructure and transport company formerly headed by Vladimir Yakunin, a U.S.-censured former KGB agent considered a close ally of Russian President Vladimir Putin. Although Yakunin was reportedly ousted in 2015, the organization still has deep ties to the president, experts say.
“This means that the opening of the connection has Russian government backing behind it,” said Andrei Soldatov, co-author of the book “The Red Web: The Struggle Between Russia's Digital Dictators and the New Online Revolutionaries.”
TransTeleCom did not respond to a request for comment, but a spokesman for the company told the Financial Times that it has a long relationship with Pyongyang and has “historically had a backbone network interface with North Korea under an agreement with Korea Posts and Telecommunications Corp. struck in 2009.”
Madory said it was not clear to him exactly how TransTeleCom built the infrastructure needed for the new network. If it needed to lay fiber optic lines, it would likely have taken “days or weeks,” Madory said, though that installation time may have been shorter if there was existing infrastructure that could have been reused.
U.S. officials say that as China has increased economic pressure on North Korea in line with U.N. sanctions, Russian entrepreneurs have stepped into the gap, quietly undermining sanctions with illicit trade and smuggling. In an email, Kent Boydston of the Peterson Institute for International Economics said it was unclear if the new network broke any sanctions.
“Telecommunications haven’t been specifically targeted by U.N. Security Council resolutions, although it’s hard to see how this wouldn’t violate UNSCR 2375’s proscription of joint ventures with the North Korean government,” Boydston wrote, referring to the strict sanctions imposed in September by the United Nations.
The new network was an “example of Russia stepping in once North Korea feels pressure,” said Anthony Ruggiero, a senior fellow at the Foundation for Defense of Democracies and a former U.S. Treasury Department official.