With its bold red paintwork, bright signage and blue Korean unification flag on prominent display, the Koryo restaurant in the northern Vietnamese city of Hanoi does little to hide its North Korean ties.
Inside, waitresses meander about serving cold noodles and kimchi to customers. However, online records show the restaurant could also be a cover for a company selling high-tech facial recognition software.
Two prominent US think tanks say the sales could be a possible violation of United Nations sanctions imposed in 2017, which had intended to clamp down on businesses generating cash to support leader Kim Jong Un’s regime.
“Our understanding is that programmers who are working overseas generate as much as hundreds of thousands of US dollars for the regime every year, so they have a disproportionate capacity to raise funds overseas,” said Jason Arterburn, an analyst specializing in North Korea and China at the Center for Advanced Defense Studies, which is better known by its acronym C4ADS.
Furthermore, experts warn that North Korean software designers who create and sell these products online could be building hidden back doors for Pyongyang’s well-trained hackers to exploit.
Profits through software
North Korea is barred from selling weapons abroad — though the UN alleges that the country is still attempting to do so — but it’s not clear if high-tech software that isn’t used for military purposes is subject to that arms embargo. The UN Panel of Experts on North Korea, the body charged with monitoring sanctions enforcement, did not respond to an email seeking comment.
Facial recognition software could provide a loophole in existing sanctions that seek to limit Pyongyang’s ability to make money overseas.
“(Information technology) services aren’t covered by the United Nations sanctions,” said Cameron Trainer, an analyst studying North Korean illicit finance at the James Martin Center for Nonproliferation Studies (CNS). “It’s still a way North Korea can procure currency that is then funneled to its nuclear program.”
The UN Panel of Experts’ annual report alleges that North Korea’s operations abroad are meant to evade sanctions and earn money for the country to contribute to North Korea’s bottom line. Those funds undercut the effect of UN sanctions levied against the country in response to its nuclear weapons development.
Experts say the Hanoi restaurant’s alleged software sales raise concerns that other North Korean restaurants around Asia could also be used to sidestep sanctions. Police and investigators usually detect sanction evasions at points of entry, like harbors. Customs officials from countries in the region do not track online software sales, said George Lopez, a former member of the UN panel charged with investigating North Korean sanctions enforcement and efficacy.
“The irony that these operate in such plain sight make it more difficult to discover what exactly they are contributing to sanction evasion, other than wages being sent back,” Lopez said.
“And that, I think, is the scary part to people who are really nervous about this.”
The ‘Future Tech Group’
The link between the restaurant in Hanoi and sales of high-tech software was detailed in a report by Arterburn at C4ADS.
Both C4ADS and CNS found that a software company called Future Tech Group had ties to both the restaurant and a mysterious Malaysian company called Glocom, which the UN has long said North Korea uses to conduct illicit weapons sales.
A domain search shows Glocom’s website shares its IP address — the unique identifier assigned to a specific connection to a network — with Future Tech Group’s.
Future Tech Group appears to have removed its website, but a cached version shows the company advertised facial recognition products and design calculation technology, among other types of software.
That’s how Future Tech Group and Glocom appear to be connected. However, Future Tech Group’s connection to the restaurant in Hanoi is a little more complex.
Vietnamese business records list a North Korean national named Kim Jong Gil as the owner of a catering and restaurant company in Vietnam called Mudo Vina. It happens to have the identical street address as Koryo restaurant in Hanoi.
Kim is tied to Future Tech Group through a series of online profiles for software experts, Arterburn explains. The profiles appear on various freelancer websites, where the users advertise themselves as software developers and facial recognition software experts. The profiles used variations of the username kjg197318. Kim Jong Gil was born on 01/08/1973, according to Mudo Vina’s Vietnamese business filings. Some of the freelance profiles also included work samples that were found on Future Tech Group’s cached website, Arterburn said.
“Essentially, what we see is that the owners of companies registered at the address of the restaurant also appear associated with freelance profiles used to sell advanced facial recognition technology to clients around the world,” Arterburn said.
“We feel with pretty high confidence we were looking at agents within the same network engaged in an array of commercial activities, including both North Korean restaurants (in Vietnam) and high-tech technology sales.”
CNN visited the Koryo restaurant in March and an employee confirmed that Mudo Vina owned the restaurant. The employee would not say whether Kim Jong Gil worked there.
There was no indication that software was being sold on the premises, but that did not mean it was not happening, Trainer of CNS said.
“Software doesn’t have to be physically handed over, it can be produced in remote locations and you wouldn’t really know it,” he said.
‘The most visible part of a larger, syndicated structure’
On the surface, it doesn’t make sense to house a restaurant and a facial recognition technology company under the same roof.
But analysts say the move fits North Korea’s tendency of grouping multiple businesses together. Arterburn said it was helpful to understand such restaurants as “overseas commercial outposts” rather than just places to eat.
“It makes economic sense that they would house a number of commercial activities in the same location,” he said.
UN sanctions imposed in 2017 are supposed to effectively shutter these restaurants. Countries were supposed to bar North Koreans from working abroad and banned North Korean “joint ventures or cooperative entities” from operating in foreign countries, but the Koryo restaurant in Hanoi remains open. Vietnam’s Ministry of Foreign Affairs did not respond to an email seeking comment.
North Korean restaurants are some of the country’s best-known exports abroad, especially in China and Southeast Asia, despite the sanctions. There are dozens throughout Asia, with the majority in China, according to experts.
They’re popular with tourists because they provide a rare opportunity for people to interact with North Koreans, as the vast majority of people inside the country are barred from leaving.
Most of the waitresses at the restaurants are women who are trained performers and musicians. They’re selected for their talent, looks and regime loyalty, according to many North Korean defectors.
But these establishments pose legal and ethical dilemmas for the countries that allow them on their soil — and the customers that dine there.
Pyongyang has been accused of treating its overseas workers like slaves, restricting their freedom of movement and keeping most of their wages to fund regime priorities, like nuclear weapons development.
Many defectors, however, say the waitresses abroad have better lives than they would back home. Their employment overseas offers them an opportunity to see the world outside of North Korea and make more money for their families than they could at home.
But the fact that the Hanoi restaurant remains open highlights the limitations of the UN’s control over North Korea’s assets around the world. The UN does not have its own international police force so relies on individual countries to enforce its rulings.
Lopez, the former UN investigator, said regulators were concerned about what he called “the law of numbers.”
One North Korean restaurant may not make that much money, even if it could be a front for more lucrative — and potentially illegal — dealings. But scores of them?
“This is … the most visible part of a larger, syndicated structure in which not only citizens are repatriating money, but the enterprise that they’re part of also has other tentacles and is helping (to) evade sanctions,” Lopez said.
“If this is the only part of this you see, you better cut this off right away and see where the other parts are, because it’s a growing monster.”
Reporting by Joshua Berlinger, CNN