11th Dec. 2012 D-8
8 days before the Korean presidential election The National Election Commission (NEC) personnels and the police rushed to a studio apartment in Gangnam They were dispatched upon the report from the opposition party that a National Intelligence Service (NIS) staff was doing an illegal on-line campaigning for the ruling party candidate. The female staff refused to come out of the apartment for 2 days. A few days later, police released an interim investigation report clearing her of the allegation. It was only 3 days before the election. “We have not found any postings for or against any of the candidates, Dec 19, 2012 D DAY
The incumbent party has won the election. However, about 40 days later police has found that the NIS staff had uploaded hundreds of writings in an Internet community. Among them were writings supporting the President and attacking the opposition candidate. NIS explained that it was a psychological warfare against North Korea. Days after, the chief investigation officer got transferred for unknown reasons. Mar 15. 2013, 4 months later. Newstapa reporters started an independent investigation on the presumption that NIS might have been doing the same thing in SNS sites. And they were right. Tens of Twitter accounts posting almost exactly the same writings were found. This graph shows their twitter activities by day. Starting around Aug. 20, last year, they have been very active, and on Dec. 11, suddenly all of them stopped twitting. Aug. 20 is the day when Park Geun-hye was officially nominated as presidential candidate, and Dec. 11 is the day when the illegal campaigning of NIS was discovered. On the first round of the investigation we spotted 65 suspicious Twitter accounts. They have things in common – no real name in profiles and posting semi-nude photos to attract attention. Their SNS messages were mainly about praising the achievements of President Lee Myung-bak and bitterly criticizing North Korea. No private talk at all.
It was hard to take them as normal. The female NIS staff and the suspicious Twitter account holders were found to have been spreading exactly the same messages on the Internet and Twitter. When several hub accounts tweeted, they were retweeted by followers. “If a tweet is recommended by someone reliable, the message gets believable independent of the credibility of the original source. This is similar to how a rumor spreads itself out.” But, the day after Newstapa reported on the existence of these twitter accounts suspicious of being associated with NIS…. Tens of the accounts that had been dormant since Dec. 11, 2012 have been completely deleted. As it happens, all of their user IDs had been disclosed by Newstapa. But there has been neither complaint nor explanation by those account users for being suspected of NIS operators. Our follow-up investigation tracked down more than 660 of such suspicious twitter accounts. 3 days after the report….Newstapa obtained a document from the Democratic Party Rep. Sun-mi Jin that contains the directions by Sei-hoon Won, then-NIS director to NIS executives. It is a hand-written copy of the directions posted on the intranet of NIS, leaked by an NIS staff. The document contains the Director’s directions for political intervention, and what role NIS should play in the elections, and how to influence public opinion on the Internet. He also condemned anti-government parties as ‘North Korean sympathizers’, urging the NIS to take actions in response. We searched Twitter for the terms and phrases in the directions. As expected, piles of the tweets having the same messages were found. On Nov. 23, 2012, Mr. Won instructed, at an NIS meeting, an active PR campaigns for the remarks by Director General of the IAEA that Korea, a resource-poor country, is wise to have nuclear power plants and keep a good maintenance. On Nov. 27, a Twitter account with a user ID ‘TAESAN4’ posted a writing, exactly the same as the Director had instructed. However, there was no media report around that time that the Director General of the IAEA had made such remarks. Actually, the remarks were made not by the Director General of the IAEA, but by the Director General of the IEA (International Energy Agency). Mr. Won’s instructions were tweeted verbatim or in the exact words. This proves that the Director’s instructions have been implemented to influence public opinion on Twitter. It is no difference in businesses as well. When the top end of the communications says something, the down end is supposed to repeat the message in the exact same words. It must have been the case. Without a top-down arrangement, such messages wouldn’t have been out there from the first place. TAESAN4 is one of the hundreds of suspicious accounts that Newstapa has identified. This account has spread a huge number of messages criticizing the opposition candidate. There was no explanation at all by NIS. What do you say about the NIS director’s instructions tweeted on Twitter? We have nothing to say. You are not denying the fact? we collected tweets from over 660 NIS-suspected accounts, out of login websites where their cash remained. Whatever it has to do with us, anyway,
we do not feel the need to explain. This is a tweet by TAESAN4 about the 48th overseas tour of Mr. Lee Myung-bak. It has been re-tweeted as many as 637 times.
When we checked the re-tweeting accounts, 461 of them were found to belong to NIS. It proves that it was a systematic act by NIS. It is a blatant political intervention, isn’t it? In old days, they used to mobilize community leaders to speak for them; nowadays the Internet and SNS have replaced them. In order to probe how they worked, Analysis of RT(Re-Tweet) structure over 280,000 tweets has given us a network map of their activities. In an overview, it is a simple structure of core accounts that tweet and auxiliary accounts that retweet. Centering on the core accounts, a total of 10 groups were identified. A large number of auxiliary accounts retweeted the messages from the core accounts, using Twitter RT bots. It is unprecedented that we have traced back the accounts that had vanished from twitter, then discovered a RT network by analyzing SNS network with technology. People in SNS business say that it was more than obvious that a group of people was trying to manipulate public opinion during the presidential election but unidentifiable. At first glance, I felt what the hell these guys are doing… manipulating public opinion? But what can you do now? She became president. We analyzed the collected tweets with 50 keywords. The most tweeted messages, of around 41% of them are anti-North Korea propaganda, followed by domestic politics of 30%, praising Lee Myung-bak’s achievements of 8.8%. And tweets about the presidential election are more than 36,000, accounting for 15% of all. Our investigative reporting got much attention in the National Assembly of Korea as well. Shocking so much. However, until that time we were only assuming that this Twitter group had something to do with NIS, but had no verification. We had to find who opened the accounts. We guessed they might have possibly logged into some portal sites with the same IDs. We tried to sing up for the 3 biggest portal sites of Korea with the same IDs of those 660 plus suspicious accounts. It was to check whether the IDs already existed or had once existed in the site. This way we were able to find that about 160 IDs matches the suspicious ones. We figured out that it was also likely that the same email addresses would have been used when they had signed up for Twitter. By searching around with these email addresses we have obtained the real names of about 60 people. Among them, 30 had unconventional user IDs, having high possibility to match their twitter IDs. They included 2 core account IDs such as ‘nunlenunle’, which was very much likely to be an NIS staff. This Twitter account ‘nunlenunle’ was opened
by a person named Lee 00. Lee introduced he is a Captain of Korea Airlines. But Korea Airlines said it has no man with that name. We have tracked down to the personal homepage of nudlenudle, and found out his age, and his real identity from someone well-acquainted with NIS. Our finding was that Lee 00 with a user ID of ‘nudlenudle’ is a 43 years old, ex- psychological warfare officer in NIS. NIS, again, declined to comment. We cannot tell you under the National Intelligence Service Act. More than 660 accounts… and 10 groups… core accounts…. The fact that one of them belonged to a NIS psychological warfare officer indicates that the network was in fact operated by NIS. After months of investigation on the suspicion of the NIS meddling with the presidential election, Newstapa have first unearthed the corroboration that an NIS staff had actually been involved. If NIS’s involvement in the Twitter activities is confirmed, it is easy to say Todayhumor.co.kr is just a tip of an iceberg, leading to the conclusion that NIS has systematically intervened in the politics and the presidential election. NIS wiped out their online traces as much as possible as soon as the scandal broke out. However, Newstapa pointed out that Big Data companies would be useful for gathering evidences for the Twitter activities. Businesses, making use of Big Data, save everything from Twitter. In such case, even though the user has deleted the original,
the copies may have remained in Big Data companies. Reluctant at first to investigate citing the Twitter server is located in USA, the prosecutors started an investigation after the Newstapa reporting. They searched and seized Big Data companies, and requested international judicial assistance to Twitter in USA in order to receive user data. The prosecution has found out that the NIS psychological warfare group consists of more than 70 people in 4 teams, and the 4th team was created in February, 2012,
to work on SNS and Twitter. Also they have secured over 400 Twitter accounts that NIS had used to influence public opinion, and 70% of which matched with those discovered by Newstapa. Was our report helpful? Yes, it was. I mean we took it into account,
particularly the Investigation method, and stuff. The prosecution has accused Sei-hoon Won, former Director of NIS and Yong-Pan Kim, the former Commissioner of the Seoul Metropolitan Police Agency of violating Public Official Election Act. Yong-Pan Kim is under suspicion of ordering a cover-up during the police investigation. “Mr. Won has repeatedly given unlawful orders beyond the scope of authority of NIS, thus was prosecuted without detention.” Apart from the prosecution, National Assembly conducted a separate inquiry for a month. A footage captured on CCTV made public that the cyber crime investigation unit in Seoul Metropolitan Police Agency had covered up, in the early stage of investigation, a multitude of their findings on NIS manipulating online public opinion. “Once this comes out, we’re all dead.” “Then we’re all dead. Real dead.” However, 3 days before the presidential election, the police announced that NIS was cleared of suspicion, and the ruling party candidate was elected. Newstapa uncovered a large-scale intervention by NIS into the presidential election, which would have been kept secret for ever, through SNS data analysis and a 4-month long explorative coverage. As the trial for the NIS intervention case continues, more evidences of NIS intervention and police cover-up are being found. Meanwhile, the Public Prosecutor General, in the process of prosecuting the heads of NIS and Seoul police agency, suddenly resigned after 6 months in office. He was under attack by conservative media for his private life and was about to be inspected by the Ministry of Justice at a tacit order of the president. As the NIS scandal, which took the nation by surprise, is still unfolding, democracy in Korea stands at a crossroad once again.