Thirteen months ago, South Korea's defense intranet was hacked for the first time, and the military accused North Korea of infecting hundreds, possibly thousands of computers with malware.
In December 2016, Han Min-koo, then defense minister, told lawmakers that the incident was not critical.
Now, the suggest that North Korean hackers might have acquired the so-called Operation Plan 5015 during the September 2016 cyberattack.
Oplan 5015, which, according to news reports, includes , is the key military operational blueprint drawn up by Washington and Seoul on how to react in the event of a North Korean invasion.
Pentagon officials have declined to comment on whether sensitive or secret information was leaked as a result of the hacking.
Kenneth Geers, a NATO Cooperative Cyber Defense Center of Excellence ambassador and a senior fellow at the Atlantic Council's Cyber Statecraft Initiative, told VOA's Korean service it was "entirely possible" that these plans had been hacked and that North Korea might have received help from Russia or China in obtaining them.
Geers also said that Moscow and Beijing seemed to be closely aligned with Pyongyang on cyberwarfare, as they want to go beyond testing the traditional U.S. military and assess its cyberwar capability.
Geers' 20 years of experience in the U.S. government includes time in the U.S. Army, at the National Security Agency and at the U.S. Naval Criminal Investigative Service. He has also worked as a senior global threat analyst at , a California cybersecurity company.
Geers discussed the latest developments in North Korea's cyberwarfare capabilities with VOA earlier this week. His remarks have been edited for clarity and length:
South Korean lawmaker Lee Cheol-hee, a member of the ruling Democratic Party and a member of the parliamentary national defense committee, said that North Korean hackers stole the U.S. and South Korean war plan, Operation Plan 5015. Does the North have the capacity to do this?
I think that once you digitize information it is very hard to hang on to it. That is true for everyone. The number of people who might have had access to these war plans and secrets is not low … so that increases the odds [they will get out]. Basically internet usage of cyberspace has made this a golden era for espionage. You can relatively easily hack into systems large enough to have multiple vulnerabilities and [find] timely information. North Koreans know well who in South Korea is intelligence personnel, who is involved in military planning, and who is communicating with the United States. They know whom to target.
Are you saying North Korea hacked this plan?
It is entirely possible these plans were hacked and stolen. And it is possible that North Korea got help from Russia or China because their geopolitical interests align with North Korea's on occasion. Challenging the geopolitical interests and the United States, or just testing the cyberwar defenses and capabilities, is also a possibility. There is only one internet and cyberspace, and we are all in it. That is what has allowed North Korean attacks, even attacks on the White House, denial of service attacks.
Is it easy to hack this kind of classified documents?
This case, it could be that these plans might be in possession to 500 to 1,000 people, potentially. Unless it is really tightly held secret, it is hard to hang on to it. We have seen in the past that even the NSA and the CIA get hacked and information released in WikiLeaks. Supersecret three-letter agencies can be hacked. It might not be directly through internet.
Why does North Korea hack systems?
North Korea, they are under sanctions, they have a budget shortfall like every other government, so they might use cyberattacks to steal money, because money, as is everything is now, . So it might purely be to gain money in a country that is actually very poor with nuclear weapons. That is one possibility. But number two, they really do want to know if they are about to be attacked … they are going to want the plans. They need the classified military plans of foreign nations — in this case, the United States, Korea and Japan.
According to news reports, a major Russian telecommunications company has begun . What do you think about this?