A mysterious network of dozens of websites, blogs, and social media accounts have since May 2015 been posting hundreds of cartoons, infographics, and political messages criticizing North Korea’s human rights record and leader Kim Jong Un, an investigation by NK News has shown.

The network, which analysts say is likely state-sponsored but that South Korea’s spy service denied a connection to, appears to be based in the Republic of Korea and methodically cross-posts translations of the same material between a network of at least 55 accounts targeting regional audiences around the world.

It has also notably posted multiple elaborate and purpose-designed graphics to showcase and promote the work of the secretive Cheollima Civil Defense group, an entity that claims to have helped protect Kim Han Sol following the assassination of his father, Kim Jong Nam, last February.

But multiple NK News attempts to identify backers via communication to usernames, email addresses, and website contacts associated with the network returned only one result: from a volunteer Spanish translator in London who said he doesn’t know who or what is behind the campaign.

And while evidence points to the campaign being orchestrated in South Korea, 14 activists, donors, and defectors working in the North Korea human rights community all told NK News they don’t know who is behind the ongoing initiative, a notable disconnect given the small size of the community.

“FREEDOM AND HUMAN RIGHTS IN NORTH KOREA”

Petitions and open letters created and promoted by the network have called for Kim Jong Un to be referred to the International Criminal Court, for the White House to relist North Korea as a state sponsor of terror, and for Russia to end all its trade with North Korea, among others.

Graphic animations depicted, among other things, a tearful Kim Jong Un masturbating next to portraits of his grandfather and father, showed forced abortions in North Korean prison camps, and simulated what a North Korean ICBM attack on San Francisco might be like.

Professional quality paintings and infographics, as well as crude, bizarre, and sometimes technically-sophisticated cartoons are together adapting global and North Korea-specific news to draw attention to Pyongyang’s human rights record, nuclear program and hacking capabilities.

Using encrypted internet connections to conceal the origins of its material, NK News investigation showed the largely unconnected network to publish material most prominently through the website of an entity called “Freedom and Human Rights in North Korea” (FHRNK), which online literature says is a “nonprofit organization based in LA.”

Despite this description, no record of the NGO exists on a U.S. Internal Revenue Service (IRS) list of tax exempt organizations while – as like all other assets within the network – individuals listed as directing FHRNK did not respond to repeated communication requests from NK News.

And despite portraying itself as a U.S.-based organization, digital footprints associated with FHRNK analyzed by NK News show it is highly likely based in South Korea, raising questions as to who is behind the campaign, how it is being financed, and what purposes it serves.

No record of the NGO exists on a U.S. Internal Revenue Service (IRS) list of tax exempt organizations

CARTOON CHARACTERISTICS

Accounts associated with the network in January posted as many as 38 separate anti-DPRK cartoons and infographics to social media outlets like Instagram, Twitter and Pinterest, the FHRNK website itself, as well as English, Japanese, and Russian language blogs.

Topics covered in designs mirrored recent developments in the niche North Korea news cycle, with artists rendering cartoons of defector Ji Seong-ho following his appearance at the State of Union in Washington DC, highlighting Jordan’s severance of ties with the DPRK, and recent EU sanctions on the DPRK, for example.

Reverse image searches of several designs showed after their first posting, many were promptly reproduced with translated English, Chinese, Russian, and Japanese annotations across a myriad of other websites, social media accounts, and blogs within the network.

Accounts associated with the network in January posted as many as 38 separate anti-DPRK cartoons and infographics to social media

But while much of the artwork can be seen across the full constellation of English, Russian, Chinese and Japanese properties in the network, designs in the Korean language appear to be missing entirely.

And as many of the materials published by the English-language pillar of the network show, the cartoons produced in foreign languages often feature extremely awkward language which suggest they are not produced by native speakers, Russian and Chinese speakers told NK News.

In addition, apparently fake signatures accompany some of the cartoons produced for the network, either designed such that they are impossible to read or regularly changing name despite, apparently, being produced by the same artist.

The majority, however, feature no credit line for the artists or graphic designers producing the material, another unusual characteristic.

Gregory Pence, a cartoonist who contributes to the Seoul-based Daily NK and is familiar with the handful of people known to regularly produce North Korea-cartoons, said he had never come across the artists behind this network’s output.

“These parody accounts feature the works of multiple creators…it’s a hodgepodge.”

But while he said some were composite designs of existing work – a recent Washington Post design, for example, simply modified for use by the network – analysis of other designs suggested to him that a significant investment in production time would be required.

“A few images indicate professional skill, and color adds significant time to the production of any artwork,” Pence said. “The more advanced illustrations may necessitate upwards 15-20 hours.”

CAMPAIGN CHARACTERISTICS

Despite significant effort going into the production of unique graphics, videos, petitions and other materials published by the network – which comprises at least 55 separate vectors – there is in contrast little attention paid to ensuring anyone actually sees the material.

So while one user in the network created videos to simulate a nuclear bomb arriving in San Francisco and to call for Kim Jong Un to be sent to the ICC, both including relatively sophisticated video production and professional English voiceovers, the videos had just 14 views each at the time of writing.

“It’s almost like they’re filling a content quota”

Another 25 unique videos produced and uploaded by David John – who is the most prominently listed figure at the FHRNK website but who nobody appears to know – average at between 5-20 views each, extremely low numbers when considering the level of effort associated with animated video production.

And Twitter, Instagram, Pinterest and Google Plus accounts maintained by the network – among the main outlets for the graphics and art – overwhelmingly have follower numbers mostly in the low hundreds, although one Japanese Twitter account has a relatively high 4056 followers.

There are signs of only extremely limited efforts to promote the network’s output.

“One of the main red flags is that it seems like they churn out a lot of original content and most of it gets barely any traction but they don’t seem to care,” said a Seoul-based North Korea human rights activist about the network’s online footprint.

“They throw a bunch of stuff up on Blogspot and YouTube, Vimeo etc, and churn out tweets, but they are getting no views and they don’t really engage with an audience.”

“It’s almost like they’re filling a content quota and don’t care what happens afterwards,” the source continued, requesting anonymity due to the sensitivity of the issue.

But while little effort is made to proactively promote sharing of the cartoons and graphics, some of the usernames that form part of the network inter-post the anti-North content among content fitting certain themes that have broader popularity online.

For example, a Russian language username mixes the North Korea human rights messages among a consistent stream of erotic manga-style images.

A Chinese language username posts stock photos of cats and dogs around the North Korea content.

And an English language username mixes the exact same selection of human rights cartoons among copy-pasted photos of food and city sights.

Meanwhile, accounts like @Kpop Lover on Twitter appear to be bots that do nothing but automatically retweet everything @FHRNK posts alongside a stream of photos of young female K-pop artists.

The effort, it appears, is designed to project the anti-North Korea material on a canvas that lends itself better to attracting mainstream social media consumption in the English, Chinese, and Russian speaking world.

And just like the accounts which in contrast post only North Korea-specific content, usernames in the network share the same characteristic of adding off-subject hashtag identifiers to many of the pictures.

“I believe the goal of this art campaign is to produce a viral meme and/or test an image’s share-ability,” said Pence, the North Korea cartoonist.

“(While) these are not ‘network influencers’ who have carefully cultivated an online following over a period of years, the images are sufficiently timely, artistic, provocative, and ‘global’ that they could, potentially, go viral if (online) stars align.”

As such, he said, “the image ‘tags’ are not pertinent to the images themselves, but chosen merely for the purpose of gleaning likes/shares.”

But while almost none of the posts uploaded by accounts in the network ever attract more than a few dozen likes or upvotes on social media, users of the FunnyJunk.com website noticed a number of usernames were uploading nothing but anti-North Korea materials from as early as 2016.

“What’s with all the anti NK content, peterkim?” senseiweasel asked in June that year. “It’s like you’re desperately trying to convince everone (sic) that NK is bad, which seems a little weird because everyone knows it’s a hellhole.”

Not long after users noticed the peterkim username to almost exclusively post anti-North Korea content, several other usernames popped up to do the same, including FHRNK, but all with their profiles set to hide their post histories and block all private messages.

“Is it a bot network posting all this anti-nk propaganda with broken english and mediocre design?” giraffeffarig said in December 2017, responding to one of the network’s newer Funnyjunk accounts.

It’s persistent spamming of online forums like this that can often lead to problems for posters, an issue that has already led to the suspension of the network’s Chinese-facing “@bianjingpost” Twitter username and there having been recent limitations placed on the “@enara13579” username.

More relevant to policy, the network also promoted an official White House petition – “US House lawmakers should relist North Korea as a state sponsor of terrorism” – added to the WhiteHouse.gov website originally by a user listed as ‘S.W.’

But while the petition was promoted by the network via a number of purpose-designed cartoons and designs, it was shut down by the White House website “because it did not meet the signature requirements.”

While WhiteHouse.gov does not detail what that reason means, precedence strongly suggests fake votes in the petition were to blame.

“Is it a bot network posting all this anti-nk propaganda with broken english and mediocre design?”

For example, a similar petition to relist Pakistan as a state sponsor of terror was shut down for the same reason, multiple media reported in October 2016, with unnamed White House sources telling journalists the decision was made due to signatures being gathered fraudulently.

Other petitions posted by the network calling for the end of all North Korean trade with Russia (Change.org, Russian Presidential petition site), for the U.S. and EU to “stop North Korea develop nuclear weapons,” and to stop Russia repatriating a North Korean defector were not, however, banned, but did feature extremely low levels of support.

WHO IS BEHIND IT?

Multiple NK News attempts to communicate with usernames, email addresses and website contacts associated with the network over a three month period returned only one result: replies from a Spanish translator affiliated to the FHRNK website.

J.D. Juan, who translates articles and papers into Spanish for his Corde Del Norte Libre blog and volunteers for human rights NGOs like the Washington-based HRNK, told NK News he first heard about FHRNK and its “owner David John” on Twitter and initially helped them translate from there.

“I don’t know exactly when he started the blog, but I received some email from David John and he said ‘Can’t you join my blog and you can translate all this news… we want to translate it into the Spanish language’,” Juan said.

But despite agreeing to volunteer and translate a weekly FHRNK post into Spanish, Juan said he’s had almost no communication with the organization.

“I don’t know really from where exactly they are,” he said. “I don’t know who is doing this.”

“I do this just because I want to help but I don’t know them – I don’t talk by phone with them, only emails,” he said.

When Juan told David John that NK News was interested in speaking to FHRNK, John simply replied: “Thank you for your kindness. But, I don’t like interview. Cuz, it’s burdensome. Sorry for not being able to help. Have a nice day~”.

And the 14 professionals working on North Korea human rights issues in South Korea, Europe and North America all told NK News they were unfamiliar with David John and his organization, FHRNK.

It’s persistent spamming of online forums like this that can often lead to problems

In addition, even journalists and North Korea watchers that follow the FHRNK account on Twitter told NK News they didn’t know who is behind the organization.

Who, then, is David John?

For what reason is the network he plays a major role in investing so much time into producing anti-North Korea graphics, cartoons, petitions and blogs?

And where is the network really based?

LEENARA13579

While someone called David John is listed as co-author of North Korean defector Hyeonseo Lee’s autobiography, “The Girl with Seven Names: A North Korean Defector’s Story,” the connection appears to stop there.

“It is the same name but I believe it’s a totally different person or he on purpose used my co author’s name,” Hyeonseo Lee told NK News.

But upon closer inspection David John’s Google Plus account is linked to email address “[email protected],” which is subsequently linked through the “Comic-book About North Korea” website to “[email protected]” – another alias used to publish the same cartoons on Pinterest.

While Lee Na-ra (이나라) is a name sometimes used for women in South Korea, it also translates to English as “This Country.”

But despite portraying FHRNK as a U.S.-based organization and the broader network not producing any Korean language videos, graphics or cartoons, multiple pieces of circumstantial evidence point to South Korea as being the source of the campaign.

Email headers seen by NK News showed correspondence sent by ‘David John’ to be recorded by the local sending server as being dispatched in the +9 GMT time zone used for South Korea and using a keyboard set that supports Korean character input.

The same +9 GMT  time zone could also be found in Windows Adobe Photoshop CS6 creation data on numerous graphics and cartoons posted by the network of usernames from 2015-2018, even when the art style and language was completely different.

While multiple IPs linked to the network were all traced by NK News technical staff to ibVPN – a service which hides a users location through “Military Grade Encryption” – a small handful of edits to the FHRNK organization’s Wikipedia page were exposed and came from a Korea Telecom IP in Gyeonggi-do, South Korea.

Multiple pieces of circumstantial evidence point to South Korea as being the source of the campaign

And contents posted by all of the Twitter accounts analyzed by NK News was published daily in a window ranging from 1.00-5.00pm Korean local time, while the link-sharing service used by both artists and accounts within the network is called Durl.Me – a service launched in May 2011 by South Korean web portal Daum.

“It feels very much like the work of South Koreans, even though they make weak attempts to appear to be western,” said the human rights activist.

GOVERNMENT CONNECTION?

Observers familiar with North Korea issues and the human rights activist community pointed to two potential sources for the campaign: government and not-for-profit.

“It looks like an NIS false flag operation,” said Dr. Andrei Lankov, a long-time North Korea watcher, referring to South Korea’s spy agency the National Intelligence Service.

“The NIS is known to spread some rumors about North Korea and when they do it they always use false flags,” he said.

However, the NIS told NK News on Monday that it had “no relationship” with the FHRNK organization, but refrained from answering specific questions about the network.

South Korea’s Ministry of Unification said it had no connection to the organization, while the Blue House didn’t respond in time for the article’s publication.

But Daniel Pinkston, who authored an in-depth report about the NIS for the International Crisis Group (ICG) in 2014, said evidence led him to “strongly suspect these products and the dispersion efforts are government supported.”

“It very well could be the NIS, but (also) an inter-agency task force behind it,” he speculated.

“The NIS could be the lead agency with support or input from the MOU and the Defense Psychological Operation Group (국군심리전단), for example.”

And if this were the case, Pinkston said it is unlikely the ROK government “would be doing this in cooperation with the U.S, because the products seem quite crude in terms of their English quality, and the South Koreans have a strong preference for maintaining complete control over such projects.”

But why might parts of the South Korean government be involved in such a campaign?

“Due to some reasons, they still feel like engaging in the dirtiest tricks of the Cold War,” Lankov explained of the NIS’s modus operandi.

“They are still fighting in an ideological competition with the North Koreans, even though they have actually won this competition decades ago.”

“It looks like an NIS false flag operation,” said Dr. Andrei Lankov

“However, it doesn’t always make sense to admit you’ve won a war, not least because after victory budget of a victorious army is still likely to be cut,” he speculated. “It’s applicable to ideological and propaganda wars too, I would imagine.”

“Personally, I consider it completely unnecessary and a waste of money, but of course I could be wrong,” Lankov said about the cartoon campaign he speculated being backed by NIS.

“As a Russian I can tell you one thing: it’s better to wage no propaganda than bad propaganda.”

However, the human rights activist who commented on condition of anonymity raised doubts about the potential source of backing for the campaign.

“Given their secrecy and level of resources one may suspect the NIS, but we can’t rule out non-traditional non-governmental operatives who could have received funds – from government or elsewhere -– and are pumping out content to hit quotas but with little oversight over their messaging,” the activist said.

“Given that the NIS was badly burned by the scandal around pro-Park online influence efforts, and that the operation spans changes in leadership through the Park and Moon administrations with seemingly no change in tack, I think raises doubt on the idea this may be a close-hold in-house NIS operation.”

And the source said that “if it was NIS it would be better produced, and have fewer English spelling mistakes at the very least.”

“One thing’s for sure, as a South Korean taxpayer, if any tax won are going to funding these shoddy shenanigans, it will be a crying shame!”

Know anything about this campaign? Please contact us anonymously with further leads using this link

Jennifer Dodgson contributed to this report

Main picture: enara13579 Twitter account