North Korea continued to circumvent UN sanctions on shipping and trade, according to a new mid-term report from the UN Panel of Experts (PoE) published on Thursday.

Poor sanctions implementation allows North Korea continued access to the global financial system, while the DPRK has also stepped up large scale hacking efforts, the report noted.

“(North Korea) continued to violate sanctions through ongoing illicit ship-to-ship transfers and the procurement of weapons of mass destruction-related items and luxury goods,” the report reads.

“These and other sanctions violations are facilitated through the country’s access to the global financial system, through bank representatives and networks operating worldwide.”

SHIPPING AND SMUGGLING

According to the PoE report, North Korea continued to engage in oil and coal transfers at sea, a practice prohibited by UN resolutions which also keeps the North’s trade off-books and away from national customs authorities.

UN resolution 2397 limits the DPRK’s refined petroleum imports to 500,000 barrels per year, but information provided to the PoE by Washington indicates the DPRK may have breached the annual quota in the first quarter of the year.

“The Panel received a report from the United  States of America and 25 other Member States containing imagery, data, calculations and an assessment that the annual cap for 2019 … had been exceeded in the first four months of 2019,” the report reads.

Washington reportedly called on the UN Security Council (UNSC) to make a determination that the cap had been breached and to call on member states to cease all further exports to the DPRK, though the move was opposed by Moscow and Beijing.

The PoE noted the DPRK’s use of continued concealment and obfuscation practices, with North Korea using numerous sanctions evasion techniques in combination to hide its oil trade.

Photographs obtained by the PoE show both ship-to-ship transfers between DPRK vessels and unknown counterparts, and deliveries to North Korea’s Nampho oil terminal.

In one instance highlighted by the PoE, a DPRK tanker appeared to conduct an illicit transfer in waters close to the Russian Far East.

The PoE noted that North Korea also continued to develop its maritime sanctions evasion techniques, using smaller vessels which are more difficult to track in their ship-to-ship transfer networks.

“The Panel notes the ongoing use of already well-documented evasion techniques, including Automatic Identification System turn-off; physical disguise; the use of small vessels without IMO numbers, name-changing, night transfers and other forms of identity fraud,” the PoE wrote.

“In addition, the Panel found during the period under review the use of previously unreported evasion methods to circumvent sanctions.”

The PoE also included photographs of North Korean tankers meeting with smaller “feeder” vessels, noting that they could meet multiple times before the DPRK tankers set sail for home.

The smaller tankers also manipulated their Automatic Identification System (AIS) to appear as fishing vessels, while the transfers often happened at dawn or dusk to make observation more difficult.

Foreign-flagged vessels also delivered fuels to North Korea directly, the PoE noted, expanding on a case first reported by NK News and C4ADS in February when a Vietnamese tanker was pictured at the DPRK’s Nampho oil terminal.

The PoE noted that its investigation into the case continues, though had so far found that the ship was chartered under a network operating through China and Singapore.

North Korea continues to use similar methods to flout a UN prohibition on its coal exports, with DPRK coal ships photographed next to other vessels in waters near Shanghai and near Vietnam.

“According to a Member State, it is believed to have exported a total of 930,000 metric tons of coal through at least 127 deliveries during the first four months of 2019,” the Poe wrote.

Recent NK Pro reports have also tracked odd vessel behavior in the Ningbo – Zhousan port area near Shanghai, noting how DPRK vessels appeared to loiter there and return back to the DPRK without docking at any local facilities.

“The Member State provided to the Panel images showing vessels loaded with coal off the Ningbo-Zhoushan port area, which it identified as Democratic People’s Republic of Korea-associated vessels,” the PoE wrote.

But according to the PoE, Beijing declined to look into the case further even though the transfers appear to be occurring in its territorial waters.

“The information provided by the Panel lacks timeliness and cannot lead to on-site investigation. The information of relevant vessels is ambiguous and lacks accuracy, which does not constitute a full evidence chain or basis for further investigation,” China told the PoE.

FINANCIAL SANCTIONS AND HACKING

In their mid-term report, the PoE noted that North Korea’s continued access to the financial systems directly supports its oil and coal smuggling programs, while its hacking and cyber theft operations provide new difficult-to-trace avenues for obtaining foreign currency.

“(North Korea’s) networks continue to evade financial sanctions in ways that make it difficult to detect illicit activity and that Member States continue to fail to take the measures required under the resolutions,” the PoE wrote.

“The increasing scope and sophistication of cyberattacks by the Democratic People’s Republic of Korea to steal funds from financial institutions and cryptocurrency exchanges also allows the country to evade financial sanctions and generate income in ways that are harder to trace.”

North Korean bank representatives employed by sanctioned entities continue to operate abroad, the PoE noted, with DPRK banks active in “China, Indonesia, Libya, the Russian Federation, the Syrian Arab Republic and the United Arab Emirates.”

According to the PoE, the North’s bank representatives play an “active role” in the DPRK’s ship-to-ship transfer activities, while complicated networks were used in well-publicized cases like those of the Wise Honest.

The Panel also revealed it is investigating  “at least 35 reported instances of Democratic People ’s Republic of Korea actors attacking financial institutions, cryptocurrency exchanges and mining activity designed to earn foreign currency.”

North Korea’s hacking activities are global, with Bangladesh, Chile, Costa Rica, Gambia, Guatemala, India, Kuwait, Liberia, Malaysia, Malta, Nigeria, Poland, South Korea, Slovenia, South Africa, Tunisia, Vietnam all reporting cases of possible DPRK cyber activities.

The DPRK expanding cyber and hacking capabilities have likely earned it billions of dollars, the PoE concluded.

“The Panel’s investigations show a marked increase in the scope and sophistication of cyberactivities, including attacks in violation of financial sanctions,” the PoE wrote.

“Some estimates placed the amount illegally acquired by the Democratic People’s Republic of Korea at as much as $2 billion.”

Edited by James Fretwell

Featured image: PoE report via a member state