Written evidence submitted by the Ministry of Defence
The North Korean armed forces’ key strength is their mass (including some 1.2 million regular personnel and 3500 tanks) but their capability, is in many cases, limited by ageing equipment. The Korean People’s Army (KPA) ground forces are stationed mostly along the Demilitarised Zone (DMZ) and to the south of Pyongyang and are configured defensively to repel an attack from the South. The KPA have a high number of artillery systems in protected positions along the line of the DMZ, many capable of hitting Seoul. The KPA’s large Special Operations Forces are probably its most proficient fighting force and pose a significant threat to South Korea well beyond the DMZ. The Navy is a coastal defence force, although with a large submarine fleet it could be employed in a more offensive role. The Air and Air Defence Force is far inferior to those of other regional powers and we assess is primarily for the defence of North Korean air space, but North Korean air defences remain significant.
North Korea understands that whilst its conventional forces could inflict significant damage, they would ultimately be no match for those of the United States and South Korea. It continues to develop ballistic missiles, including inter-continental systems, as a nuclear delivery means. In this, it appears to focus increasingly on the capability of mobile launch systems in the belief that mobile missile systems are less detectable and thus more likely to provide a survivable second-strike deterrent capability. We judge it highly likely that North Korea has a capability to target South Korea and Japan with short-range nuclear armed missiles. We base this judgement on the maturity of the ballistic missile programmes and the relatively undemanding warhead integration challenges for such systems. It is a realistic possibility that the regime has also developed the warheads for a longer-range system capable of targeting Guam.
We judge North Korea to have a relatively low threshold for use of offensive cyber capabilities. For the most part, North Korean cyber attacks have targeted South Korea. But as international sanctions tighten, the country may place more emphasis on the money-making opportunities that these capabilities afford, thereby subverting sanctions. Any actions of governments (including the UK) or corporate entities perceived by the regime to be insulting to the regime could lead to the use of offensive cyber.
North Korea continues to be a proliferator of weapons-related technologies to generate revenue for the regime and for the continued development of its domestic weapons programmes. It has few qualms about who it sells to and the end-use of the goods and technology it supplies. Many of these can and do filter into conflict zones and areas of instability. As North Korea’s own weapons capabilities improve, it is likely to be seen as a more valued supplier by potential customers. This could affect UK interests.
The UN Security Council has repeatedly identified North Korea’s pursuit of nuclear weapons and the means to deliver them at ever longer range as a threat to international peace and security. North Korea’s actions threaten the Nuclear Non-proliferation Treaty (NPT) and the global consensus against the proliferation of nuclear weapons that is crucial both for global security and the interests of the UK. North Korea’s continuing development of nuclear, ballistic missile, conventional and cyber capabilities poses a serious risk of regional instability in North East Asia, including over time the likelihood of increased military build-up and renewed debate in Japan and South Korea about the development of their own independent nuclear capabilities.
Overall, we judge that North Korea’s military capabilities, including its current nuclear capabilities, are postured to ensure preservation of the regime. North Korea has stated repeatedly that it does not want conflict but will respond if it is attacked. It has, however, variously described the imposition of sanctions, US statements and the threat of maritime interdiction operations as “acts of war”. There is the potential for tensions to escalate to conflict as a result of miscalculation.
We do not judge that North Korea's nuclear programme and other military capabilities are directed at the UK. North Korea has stated on several occasions that it does not consider the UK to be its enemy. It cites our official state relationship as evidence of this, and continues to reiterate that its capability development is in response to the US “hostile policy” against it. However, substantial numbers of UK citizens live in and travel to North East Asia and the UK has significant economic interests in the region. Any major conflict in the region or significantly heightened instability would directly affect our nationals and our interests.
It is highly likely that the regime is more suspicious of UK motivations now than it was three years ago. This is a result of increased UK participation in US/South Korean joint exercises, condemnation of the regime and its nuclear programme, the 2016 deployment of RAF fast jets to the region, BBC World Service broadcasts, UK support for sanctions and the Government’s decision to cease bilateral aid. Many of these actions have been conducted as part of the internationally supported maximum pressure strategy on North Korea to enter negotiations aimed at securing denuclearisation.
Is the UK adequately prepared to defend against cyber and other emerging threats from North Korea?
The Ministry of Defence takes the cyber threat very seriously, and we are strengthening our defences against increasingly sophisticated attacks. Our approach to cyber defence includes a wide range of technical, operational and administrative measures. The aim is to ensure that the UK Armed Forces are able to project power in cyberspace, assist during significant cyber incidents, and respond to cyber threats as they would to any other kind of attack, using whichever capability is most appropriate.
The key tools we use to protect ourselves and ensure resilience are as follows.
- Boundary measures for core networks: although it is vital for the people who use our networks to practice good cyber security and hygiene, we take additional technical steps to protect our networks and our people, including the use of advanced anti-virus software in filtering incoming communications.
- Network Activity Monitoring: members of the Joint Cyber Unit (JCU) who form part of our Global Operations Security Control Centre (GOSCC) monitor defence’s core networks for unusual activity, including through the use of Network Visualisation Tools.
- Emergency Response: The MOD Computer Emergency Response Team (MOD-CERT) leads the emergency response to any suspicious behaviour in MOD-owned or closely related networks and systems. They are on standby to rapidly investigate incidents, isolate, quarantine and remove malware from affected networks and systems.
- Recovery from service disruptions: Building on the capability of the JCU and MODCERT, and following the establishment of our state-of-the-art Defence Cyber School in January 2018, we will deploy a number of cyber Rapid Response Teams. These will be specialist incident responders, trained to isolate, defend and respond to cyber threats. These teams will be prepared to deploy to locations, around the UK or in operational theatres overseas.
More generally, the UK Armed Forces remain capable of responding to, deterring and ultimately defending against a wide variety of conventional and unconventional threats from actors on a global scale. We regard these capabilities as adequate for responding to a North Korean threat to the UK, should one emerge.
The National Cyber Security Centre (NCSC) is the lead across Government and the private sector in supporting organisations to defend themselves against cyber threats. The Ministry of Defence has concluded a ways-of-working agreement with the NCSC which is designed to facilitate a close partnership by providing a clear and positive basis for co-operation between the NCSC and the MOD. Its sets out the high level principles that should guide the relationship and highlights four significant areas for cooperation:
The MOD works with the NCSC to explore best practice for the general public, other Government departments, and the private sector – we advocate strong cyber hygiene, and work with organisations if they are compromised by a cyber threat. To do this, the MOD supports the defensive measures that other Government departments and private companies already have in place.
- National Cyber Security Centre - The NCSC opened in October 2016 following the commitment to establish it in the 2015 SDSR. The NCSC is the UK’s lead agency for cyber incidents, as well as for cyber security advice and expertise. MOD works closely with the NCSC to protect our systems, and provide support to any wider national emergencies.
- Defensive Cyber - The cyber threat is continually changing in scope and complexity. Our £265 million investment in a comprehensive programme of Cyber Vulnerability Investigations represents a step-change in supporting our risk management and investment decisions. The new Cyber Security Operations Capability will transform how we conduct defensive cyber, both in the UK and on operations to deliver a dynamic and adaptable capability to defend the defence enterprise.
- Cyber Specialists - We recognise the importance of cyber specialists in the Armed Forces and are growing the number of dedicated cyber experts, including the Joint Cyber Unit (Reserve) initiative, which is now at 94% of its establishment and comprises world-class experts from industry and academia.
- Cyber Training - Cyber is becoming an essential part of core military training. In January 2018, a dedicated state-of-the-art Defence Cyber School will open at the Defence Academy. This is a joint investment by the MOD and the National Cyber Security Programme to deliver a centre of excellence for cyber training and exercising for defence and wider Government.
- International Engagement - The threats and opportunities presented through cyberspace extend across national and organisational boundaries. We continue to work closely with allies and multinational institutions so that we are able to operate effectively and are aware of common threats. The UK has been labelled as one of the leaders on cyber issues in NATO. In October 2016 the UK hosted the second in a series of international cyber symposia titled “Cyberspace and the Transformation of 21st Century Warfare”.
- National Offensive Cyber Programme - We are actively exploring ways to deter and disrupt hostile action taken against us through the National Offensive Cyber Programme. This partnership between MOD and GCHQ harnesses the skills of both organisations to deliver tools, techniques and tradecraft required to establish world-class offensive cyber capability.
Under Kim Jung-Un’s leadership we have seen considerable emphasis placed on modernisation of the country’s armed forces, with most focus on its missile and nuclear capabilities as the ultimate guarantors of the regime’s survival. Its recent public statements have announced the completion of its nuclear force. To support this narrative it has provided extensive media coverage of missile flight-tests and purported nuclear devices.
It is likely that they will have a nuclear armed intercontinental ballistic missile capability within six to 18 months. North Korea continues to claim that it has developed a thermo-nuclear device. We assess that their most recent nuclear test had a yield of approximately 100 kilotons, which is consistent with such a device.
By contrast, the modernisation of the conventional forces is being held back by the prioritisation of scarce resources to the nuclear and missile programmes. Nevertheless it has made some limited advances in focused areas such as armour, long-range artillery and submarines that they will see as strategically important. Conventional military capabilities ultimately will be constrained by antiquated equipment.
The UK has played a lead supporting role in US-led international efforts to apply ‘maximum pressure’ on the North Korean regime to enter negotiations aimed at securing the denuclearisation of the Korean Peninsula in a comprehensive, verifiable and irreversible manner.
Alongside our EU and other like-minded partners we are actively encouraging the comprehensive enforcement of all UN sanctions by all countries. There is a vital role for China. As neighbours of North Korea and permanent members of the UN Security Council they have a special responsibility for preserving international peace and security.
We are paying close attention to the situation in North East Asia and the implications for the United Kingdom and our interests.
Naturally, given the importance of the region to British interests and our close relationships with the United States, South Korea, Japan and China, we keep contingency plans for our response to any crisis in the region under constant review.
22 December 2017