Cybersecurity News that Matters

Cybersecurity News that Matters

Daily briefing: The spies

Illustration by Daeun Lee, The Readable

by Dain Oh

Nov. 14, 2024
7:06 PM GMT+9

Daily Briefing is a curated listicle made available by The Readable. We select a handful of significant stories worth sharing with our readers and present them in an easy-to-read, accessible format. Dain Oh and Minkyung Shin collaborate in monitoring, selecting, and reviewing the news articles, with Arthur Gregory Willers contributing to improve the overall readability of the briefing.


1. South Korea expands espionage law to cover foreign nations beyond North Korea – South Korea’s Law Times

On Nov. 13, South Korea’s National Assembly Judiciary Committee approved an amendment to the espionage law, broadening its scope from “enemy states” to include any “foreign” nation. Previously, espionage charges applied only to acts benefiting North Korea, leaving activities that aided other countries, such as China, outside its jurisdiction. The amendment aims to close these legal gaps, enabling the prosecution of espionage for any foreign entity with stricter penalties.

The amendment represents a landmark shift, marking the first time such a change has advanced through a subcommittee in South Korea’s legislative history. It now moves to a full committee review and is expected to reach the National Assembly’s plenary session on Nov. 28. If passed, the law would enable broader prosecution of espionage, extending beyond traditional intelligence activities to include industrial espionage conducted by or on behalf of foreign entities.

This legislative change reflects South Korea’s heightened focus on national security amid evolving geopolitical challenges. Supported by key political figures, the amendment underscores an urgent response to modern security risks, bolstering the nation’s ability to counter a wider range of espionage threats.

2. Concerns rise over Chinese nationals photographing Korean military sites with drones – South Korea’s Chosun Ilbo

South Korean authorities recently uncovered that three Chinese students had been photographing military facilities, including a U.S. aircraft carrier, over a period of more than two years. The students, who were studying in Korea, used drones to capture sensitive images around key military bases. In a separate incident on Nov. 9, a Chinese national was apprehended while using a drone to film a National Intelligence Service (NIS) building. Authorities are investigating potential links to Chinese intelligence agencies, as evidence points to a premeditated approach involving careful reconnaissance and planning.

The seized materials include over 500 images of military sites, along with contacts potentially linked to Chinese security forces, all stored on the suspects’ devices. Although the individuals cited curiosity as their motive, evidence shows they began surveillance as early as 2022. With similar cases emerging, South Korea is now investigating whether these incidents are part of a coordinated espionage effort. However, legal constraints complicate espionage charges unless the activities are connected to North Korea, underscoring the need for the recent amendment to broaden prosecutorial reach.

South Korean law limits espionage charges to acts that benefit “enemy” states, specifically North Korea, constraining legal actions against other foreign entities. While other related statutes allow for penalties, they are generally less stringent. In contrast, China’s recent anti-espionage amendments have broadened the scope of such charges, as demonstrated in a recent case involving a South Korean national. This legal discrepancy underscores a gap in South Korea’s ability to address espionage-related activities comprehensively.

3. CIA official charged in leak of classified documents about Israeli military plans – New York Times

CIA official Asif W. Rahman has been charged under the Espionage Act for allegedly leaking classified documents concerning Israel’s potential military response to an Iranian missile attack. Rahman, who held top-secret clearance, was apprehended by the FBI in Cambodia and will face charges in federal court. The documents reportedly include sensitive intelligence on Israel’s anticipated missile and aircraft strategies and disclose U.S. surveillance practices involving even its closest allies.

The leaked materials, produced by the National Geospatial-Intelligence Agency, analyze satellite imagery and provide insights into Israel’s potential responses to Iran. These documents surfaced last month on the Telegram app, sparking a U.S. investigation into their source. Although limited in scope, the contents reveal current U.S. concerns about Israel’s strategies and highlight the extent of American intelligence monitoring of allied nations.

The FBI, in coordination with the Department of Defense and other intelligence agencies, has been leading the investigation, underscoring the Espionage Act’s strict prohibition against unauthorized disclosure of defense-related information that could compromise national security. The CIA has declined to comment further on the case.

4. Chinese hackers target Tibetan websites in malware attack, cybersecurity group says – AP

A hacking group believed to be backed by the Chinese state has compromised two websites associated with the Tibetan community, including the Tibet Post and Gyudmed Tantric University, with the goal of installing malware on visitors’ computers, according to a report by the Insikt Group, a cybersecurity research division of Recorded Future. The attackers, identified as TAG-112, embedded malicious files disguised as security certificates. When downloaded, these files install Cobalt Strike Beacon malware, enabling extensive surveillance on targeted devices.

This attack seems focused on gathering information and monitoring the Tibetan community, consistent with China’s history of cyberattacks targeting ethnic and political groups opposing its government. The malware enables activities such as keylogging and file transfers, likely aimed at identifying individuals and tracking their activities. Insikt Group’s analysis also suggests that TAG-112 may be a subgroup of the Chinese advanced persistent threat (APT) group TAG-102, which has targeted dissidents and human rights organizations for years.

Chinese authorities have denied involvement in state-sponsored hacking, despite documented patterns of cyberattacks targeting groups advocating for Tibetan independence, democracy, and human rights. While the Gyudmed University site has addressed its vulnerability, the Tibet Post remains compromised. This incident underscores China’s ongoing surveillance of Tibetan and other minority communities, often using cyber methods, amid accusations of human rights abuses and efforts to assimilate Tibetan culture.


Editor’s note: The summaries of each article were created by ChatGPT 4o and reviewed by Dain Oh.

Subscription

Subscribe to our newsletter for the latest insights and trends. Tailor your subscription to fit your interests:

By subscribing, you agree to our Privacy Policy. We respect your privacy and are committed to protecting your personal data. Your email address will only be used to send you the information you have requested, and you can unsubscribe at any time through the link provided in our emails.

  • Dain Oh
    : Author

    Dain Oh is a distinguished journalist based in South Korea, recognized for her exceptional contributions to the field. As the founder and editor-in-chief of The Readable, she has demonstrated her expe...

    View all posts
Coauthor:
Stay Ahead with The Readable's Cybersecurity Insights