Intelligence Perspective of the Man in North: Kim's Hackers

The Sony attack demonstrated the twenty-first-century capability of a twenty-first-century millennial dictator who also happens to be thin-skinned.

Following excerpts adapted from the Author's latest book, Becoming Kim Jong Un

by Jung H. Pak

Kim Jong Un strolls into the studio for his interview, wearing his usual dark Mao jacket and matching trousers. He settles into his chair and smiles broadly to show the world his sincerity in this live international broadcast. In addition to telling the interviewer that he loves karaoke and that he is an accomplished painter—in his effort to show the world that he’s just a normal person—he veers into politics, condemning the United States both for starting the Korean War and for incarcerating more people per capita than any other country, including his own. The atmosphere gets more tense as the interviewer challenges him about his gulags and how he spends hundreds of millions of dollars on his nuclear weapons program even as he starves his people. Glaring at the interviewer, who is ignoring the approved questions, Kim seethes, “Dave, you are incapable of conducting a real interview. You’re a joke!,” pulls out a gun, and shoots Dave Skylark, the hapless American television journalist. Millions of viewers across the globe gasp in horror and disbelief, and at least some in North Korea begin to doubt whether their leader is in fact the god they were taught to believe in.

Still furious, Kim orders his commanders to prepare their nuclear weapons for launch, as Skylark and his producer, Aaron Rapaport, attempt to escape in Kim’s private tank. Kim chases them in a helicopter, shooting at the tank, but the Americans dodge the bullets. Skylark and Rapaport fire from the tank, hitting Kim’s helicopter and turning it into a ball of flames. Kim is dead.

In the last decade, North Korea has inspired an array of tacky humor in the “stoner comedy” genre, including The Interview, from Sony Pictures Entertainment. The film is based on an improbable scenario: The Central Intelligence Agency sends a hard-drinking, pot-smoking, and fun-loving television personality and his ambitious producer into North Korea with nothing more than a couple of strips of ricin to assassinate Kim Jong Un. Once inside the reclusive country—where they stay at Kim’s personal residence, another element that requires viewers to suspend their disbelief, given the leader’s well-known paranoia—Skylark strikes up a friendship with Kim. The camaraderie is understandable, perhaps, given Dennis Rodman’s visits to Pyongyang and his relationship with Kim. The film is replete with gratuitous violence, scantily clad women, heavy drinking, and even a basketball game between Kim and Skylark as the two bond over their mutual insecurity about not living up to their fathers’ standards. Skylark learns that Kim likes margaritas—even though his father thought they were “gay”—and loves Katy Perry’s song “Firework.” Kim admits, “I am thirty-one years old….The fact that I am running a country is batshit crazy.”

Before The Interview, there were dozens of documentaries and films that ridiculed and criticized North Korea’s tyrants, including the successful movie Team America: World Police about Kim Jong Il from the creators of the irreverent show South Park. The difference was that The Interview, an action-comedy depicting a CIA plot to assassinate Kim Jong Un by enlisting the bumbling duo of Skylark (played by James Franco) and Rapaport (Seth Rogen), elicited a serious response and highlighted the extent to which Kim would go to defend his name and honor. Clearly, The Interview had hit a nerve with Kim, and true to form, he took action. In November 2014, North Korean hackers broke into the systems of Sony Pictures Entertainment, stole confidential information from the company, and posted it online. The regime then announced that the release of the movie would constitute an “act of war” and threatened 9/11-type attacks against theaters that showed the film.

What drove Kim to respond in the way that he did? Was it because the movie depicted the luxurious and frivolous lifestyle of Kim and his loyalists? Perhaps exposing the regime’s propaganda of Kim’s godlike status and its farcical claims that North Korea was a land of prosperity hit too close to home. Maybe the insinuations that Kim was effete were too insulting, or acknowledging that there were factions within North Korea that were intent on unmasking the hypocrisy of the existing regime and determined to foment a coup was too dangerous. Beyond the personal insult to Kim, the film had the potential to reach millions of North Koreans who were already smuggling in banned DVDs of South Korean TV dramas and films, given the increasingly porous borders and the people’s insatiable appetite for these types of entertainment.

Paul Fischer, the author of A Kim Jong-Il Production, noted that the 2013 movie Olympus Has Fallen had not elicited Kim’s fury, probably because it was about North Korean commandos attacking the White House—Kim “had no problem being portrayed as rogue, dangerous, or aggressive. But funny…that’s taking it too far.” However, a story about the removal of Kim and the potential for a new government led by the North Korean people probably gave the regime good reason to worry. Perhaps they even read about the South Korean activist who wanted to use balloons to carry one hundred thousand copies of the movie on DVDs and USBs across the border in the belief that “North Korea’s absolute leadership will crumble if the idolization of leader Kim breaks down.” Jang Jin-sung, one of the North’s most prominent propagandists and a member of Kim Jong Il’s inner circle, due in part to his skill in nurturing the cult of personality, and who defected in 2004, said that “from the North Korean’s point of view, [the movie is] as explosive as if a real bomb were dropped on Kim Jong-un. It’s a cultural bomb….It’s so shocking. It’s beyond-the-pale blasphemous.”

The Sony attack demonstrated the twenty-first-century capability of a twenty-first-century millennial dictator who also happens to be thin-skinned. Not only is Kim comfortable with technology in the form of cell phones and laptops, but in the media he is also shown speaking earnestly with nuclear scientists and overseeing scores of missile tests, flying his own plane, providing guidance to the crew as he boards a submarine, and driving a tank. During their visit to Beijing in March 2018, Kim and his wife reportedly experienced a virtual reality demonstration and admired the latest technology shown to them by their Chinese hosts. Kim is a “digital native,” the term coined by the author Marc Prensky to describe the generation that is defined by the technological culture in which they grew up. And it’s apparent that Kim has fully embraced science and technology as part of his brand and a key component of his tool kit of coercion. Cyberattacks have the added benefit of ambiguity, since attribution takes a great deal of forensic work, creating plausible deniability for the regime that perpetrates these strikes.

It appears that Kim is determined to move beyond the development of nuclear weapons and ballistic missiles by using North Korea’s cyber capabilities to advance his goals. He is also looking to further establish his brand as a modern warrior by cultivating a generation of cyber guerrillas, to manipulate the environment through coercive means, regardless of geographic borders.


Around Thanksgiving 2014, about two weeks before The Interview’s red-carpet December 11 U.S. premiere, Sony Pictures Entertainment employees logged in to their computers to find this message:

We’ve already warned you, and this is just a beginning. We continue till our request be met….We’ve obtained all your internal data including your secrets and top secrets. If you don’t obey us, we’ll release data shown below to the world.

It was accompanied by a glowing red skeleton and signed “Hacked by #GOP,” or Guardians of Peace. At first, Sony employees were nonplussed. One person said, “It felt like getting hacked in the early ’90s….The message looked like something out of Hackers, the movie….It was a throwback. Almost cute.” In the days that followed, speculation about who was behind the Sony hack ranged from Russia to hacktivists to disgruntled Sony insiders. North Korea as the culprit was at the bottom of the list, even though in June of that year, when the movie trailer was shown, its Foreign Ministry spokesman threatened “merciless” retaliation if the film about an assassination attempt against Kim Jong Un was released. The state media quoted the spokesman as saying, “Making and releasing a movie on a plot to hurt our top-level leadership is the most blatant act of terrorism and will absolutely not be tolerated.” He added that the United States was using a “gangster filmmaker” to undermine the North Korean leadership. Seth Rogen joked on Twitter, “People don’t usually wanna kill me for one of my movies until after they’ve paid 12 bucks for it.” A little over a week after the hack, Wired magazine assessed it was “outlandish” to think that North Korea would be behind the Sony cyberattack. Among other reasons, Wired argued that “nation-state attacks don’t usually announce themselves with a showy image of a blazing skeleton posted to infected machines or use a catchy nom-de-hack like Guardians of Peace to identify themselves.”

Despite the North’s formidable nuclear and ballistic missile programs, it is all too easy to underestimate the small country. Alexandra Alter of The New York Times noted that “North Korea is a long-running punch line in American pop culture.” In the movie Team America: World Police, Kim Jong Il turns into a cockroach. On the television show 30 Rock, Margaret Cho plays the cheese-loving, cognac-swilling leader Kim Jong Il, and late-night talk and variety shows like Saturday Night Live and The Daily Show have gotten laughs with endless Kim jokes. The Korea historian Charles Armstrong told Alter, “North Korea embodies all the stereotypes of imagery from the Cold War, but in an absurd way, so we can poke fun at it in a way that we couldn’t poke fun at the Soviet Union or Communist China….We don’t take North Korea seriously enough.” Michael Lynton, the chief executive of Sony Pictures Entertainment, said, “At that point in time, Kim Jong-un was relatively new in the job, and I don’t think it was clear yet how he was different from his father….Nobody ever mentioned anything about their cyber capabilities.” After all, wasn’t North Korea an isolated, backward country? How could they possibly have the technical prowess and the nerve to attack and threaten political coercion against a major movie studio?

The extent of the damage quickly became clear. An employee said, “It was like a bomb went off….We looked around. We were still alive. So we started doing triage.” An ex-employee remembered, “Everything was so completely destroyed. It was surreal. Everything was down.” It wasn’t just that the Sony employees had to handwrite everything, couldn’t get paid on schedule, and had to work longer hours to complete tasks that normally took much less time. The Sony staff thought they could manage those problems.

But the hack did more than destroy the data of Sony Pictures Entertainment: Confidential information, including salary lists, nearly fifty thousand Social Security numbers, and five unreleased films, was dumped onto public file-sharing sites. The cyberattack exposed the movie industry’s dirty laundry, sending a “ripple of dread across Hollywood to Washington.” The hackers released massive amounts of emails and other documents revealing gossip, celebrities’ online aliases, and battles about projects and actors, setting off a feeding frenzy by media hungry for salacious information about Hollywood stars, including Angelina Jolie, Natalie Portman, and Tom Hanks. But even the rank and file at Sony were hurt: Their identities were stolen, details about their medical procedures were exposed, and cybercriminals drained their personal bank accounts.

When the FBI investigated, a spokesman for the National Defense Commission—which at that time was North Korea’s highest governing organization—denied their involvement in or knowledge of the hack, but gloated that the attack “might be a righteous deed of the supporters and sympathizers” of the regime. The NDC statement also said The Interview was a “film abetting a terrorist act while hurting the dignity of the supreme leadership” of North Korea. A little over a week later, the Guardians of Peace threatened 9/11-type attacks if Sony went ahead and released the film, warning in ungrammatical English, “We will clearly show it to you at the very time and places The Interview be shown, including the premiere, how bitter fate those who seek fun in terror should be doomed to….The world will be full of fear….Remember the 11th of September 2001.”

No one could have anticipated that a raunchy bro-com movie could have led to a national security crisis. Sony and the multiplex operators—and the malls that housed them—took the threats of terrorism seriously. The film debuted in Los Angeles on December 11, but Sony canceled the wide release on December 17, and then reversed its decision two days later. But the major theater chains refused to show it over the holidays, fearful of another event like the 2012 massacre in Aurora, Colorado, in which a gunman murdered twelve people and injured scores of others during a screening of the film The Dark Knight Rises. The withdrawal of the movie by Sony and the refusal by major cinemas to show it led to soul-searching in the media and provoked a larger discussion about freedom of speech and artistic expression in the face of terroristic threats. Many Sony employees who had already suffered the brunt of the cyberattacks and were feeling vulnerable were in no mood to be in any further danger, especially for a product that wasn’t by any measure an artistic achievement. “Why are we all paying the price for a movie that isn’t even very good?” one employee asked. Others, like George Clooney, Steve Carell, and Michael Moore, felt compelled to advocate a firm stance against this type of coercion and criticized Sony for failing to protect artistic freedom.

Finally, on December 19, less than a month after the GOP threat appeared on Sony computers, the FBI announced that the North Korean government was responsible for the intrusion. Following an intensive investigation that involved multiple government agencies and the intelligence community, the FBI said that technical analysis revealed links to other known North Korean malicious cyberactivity. Director of National Intelligence James Clapper recalled in his memoir that “without a shadow of a doubt in my mind and those of our top cyber specialists…the Sony hacks had originated in North Korea.” The FBI press release stated:

We are deeply concerned about the destructive nature of this attack on a private sector entity and the ordinary citizens who worked there….Though the FBI has seen a wide variety and increasing number of cyber intrusions, the destructive nature of this attack, coupled with its coercive nature, sets it apart. North Korea’s actions were intended to inflict significant harm on a U.S. business and suppress the right of American citizens to express themselves. Such acts of intimidation fall outside the bounds of acceptable state behavior. The FBI takes seriously any attempt—whether through cyber-enabled means, threats of violence, or otherwise—to undermine the economic and social prosperity of our citizens.

The 9/11-type attack never happened, but the fear was real and the chaos and confusion it engendered shaped the decision-making of private U.S. entities and the exercise of their rights. President Obama criticized Sony’s decision and cautioned, “We cannot have a society in which some dictator someplace can start imposing censorship here in the United States….Imagine if producers and distributors and others start engaging in self-censorship because they don’t want to offend the sensibilities of somebody whose sensibilities probably need to be offended.” Peter Singer, a top U.S. expert on cyberwarfare, said, “The problem now is not the hack. It’s how Sony responded to it. It’s the cave-in….They rewarded and incentivized attacks on the rest of us.”

The over-the-top North Korean response to the release of the movie showed that the regime’s tools of coercion go beyond missiles and nuclear weapons and that Kim Jong Un has the will and the capacity to punish perceived offenses outside his country’s borders. “The movie offers an alternative that North Koreans aren’t even given the leeway to think about. It offers an alternative imagination,” said Jang Jin-sung, the propagandist-cum-defector. “It’s not that people really believe all this propaganda about Kim Jong-un, that he’s a God, and need someone to tell them otherwise or show them another way of thinking. North Koreans are people, and they aren’t stupid. In the North Korean system, you have to praise Kim and sing hymns about him and take it seriously, even if you think it’s only a shit narrative.” And Kim Jong Un was making sure that no one challenges that narrative, even Americans. The Sony incident was the result of Kim’s paranoia combined with his brazenness and high risk tolerance for testing his capabilities. The New York Times reporter David Sanger concluded, “Cyberweapons were tailor-made for North Korea’s situation in the world: so isolated it had little to lose, so short of fuel it had no other way to sustain a conflict with greater powers, and so backward that its infrastructure was largely invulnerable to crippling counterattacks.”



Becoming Kim Jong Un is a work of nonfiction. As of the time of initial publication, the URLs displayed in this book link or refer to existing websites on the Internet. Penguin Random House LLC is not responsible for, and should not be deemed to endorse or recommend, any website other than its own or any content available on the Internet (including without limitation at any website, blog page, information page) that is not created by Penguin Random House. Portions of this book are drawn from an essay by Jung H. Pak titled “The Education of Kim Jong Un,” published by the Brookings Institution in February 2018, as well as other articles by the author. All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the Central Intelligence Agency (CIA) or any other U.S. Government Agency. Nothing in the contents should be construed as asserting or implying U.S. Government authentication of information or CIA endorsement of the author’s views. This material has been reviewed by the CIA to prevent the disclosure of classified information.

Copyright © 2020 by Jung H. Pak

All rights reserved.

Published in the United States by Ballantine Books, an imprint of Random House, a division of Penguin Random House LLC, New York. BALLANTINE and the HOUSE colophon are registered trademarks of Penguin Random House LLC.