North Korean 'kp' websites hit by outage lasting more than a day, cause unconfirmed
In short
From about 11:00 on 20 October, around 40 North Korean websites on the 'kp' domain, including those of the Foreign Ministry and KCNA, became unreachable or unstable. The disruption continued into 21 October, and Newsis, citing NK News, reported that nearly all North Korean websites had been inaccessible for more than a day. The cause has not been confirmed and no concrete sign of a hacking attack has been detected.
Read the full story 3 min read
North Korean websites on the 'kp' domain, including those of the Foreign Ministry and Korean Central News Agency (KCNA), were hit by a mass access failure on 20 October, Yonhap reported. About 40 sites, among them Minju Joson and Naenara, were unreachable or unstable from about 11:00 until at least 17:00. Telecom Observer, a site that specialises in monitoring communication networks, observed instability in North Korea's internet routing system that day. [ 1 , 2 ]
Yonhap said the cause was not confirmed, though a large-scale hacking attack was mentioned as a possibility. It added that no concrete sign of hacking aimed at North Korea had been detected. Hankook Ilbo reported the same and said access was normal again when it published, after about 8 hours of disruption. Asia Economy put the outage at about 8 hours until around 19:00, while Dong-A Ilbo said the sites recovered around 20:00 and went down again three hours later. [ 1 , 2 , 3 , 5 ]
Hankook Ilbo cited the South Korean security firm Stealien, which said the problem was probably an attack or fault on a specific communication line, not a traffic flood. Stealien explained that the servers managing North Korean web addresses are all concentrated in one band of a Chinese communication line, so a problem there can take many sites down together. Dong-A Ilbo said South Korean security industry analysis of routing data and the domain name system found that the top-level name server responded while the lower name servers for individual sites did not work properly, which pointed to a possible line or network equipment problem. [ 2 , 5 ]
The disruption continued on 21 October. Yonhap and Dong-A Ilbo reported the second day of failures; Dong-A Ilbo said 42 major sites, including those of the Foreign Ministry, KCNA, Minju Joson and Naenara, were unreachable or unstable at 17:00, and that even when access worked it dropped at intervals of one to two minutes. Asia Economy said Rodong Sinmun was also affected. [ 3 , 4 , 5 ]
Newsis, citing the US outlet NK News, reported that almost all North Korean websites had been inaccessible for more than a day. According to monitoring service Pingdom, the KCNA site was unreachable for 19 of the 24 hours after the first failure, while other sites were accessible for only about 10 minutes in total on the morning of 21 October. NK News said the problem appeared connected to the Ryugyong-dong network. It judged a deliberate shutdown unlikely because KCNA kept sending reports through its telegraph network. It also judged an overload from outside traffic unlikely because nearly all sites were affected, and said an outside attack had been raised given past incidents. [ 6 ]
Asia Economy noted that the outage coincided with rumours abroad that Kim Jong Un had died after a cerebral haemorrhage, spread through a post by Chinese dissident Xie Wanjun, who gave no concrete evidence. It said no link between the outage and the rumours was confirmed. Asia Economy said North Korean media had published photos and video of Kim visiting a clothing and footwear exhibition in Pyongyang on 19 October, without directly addressing the rumours. [ 3 ]
Why it matters
The documents say outside readers lost access to information published by North Korean authorities online, although KCNA kept sending reports over its telegraph network. The outage overlapped with death rumours about Kim Jong Un, but the outlets say no link to the outage has been confirmed.
Key facts
- About 40 North Korean websites using the 'kp' domain, including the Foreign Ministry, KCNA, Minju Joson and Naenara, were unreachable or unstable from about 11:00 on 20 October. [ 1 , 2 , 3 , 5 ]
- Telecom Observer, a site that monitors communication networks, observed instability in North Korea's internet routing system on 20 October. [ 1 , 2 , 3 ]
- Yonhap and Hankook Ilbo said no concrete sign of hacking aimed at North Korea had been detected. [ 1 , 2 ]
- The disruption continued on 21 October; Dong-A Ilbo said 42 major sites were unreachable or unstable at 17:00 that day. [ 3 , 4 , 5 ]
- Newsis, citing NK News, reported on 22 October that almost all North Korean websites had been inaccessible for more than a day. [ 6 ]
- Security firm Stealien said the problem may be an attack or fault on a specific communication line, not a traffic flood. [ 2 ]
Confirmed by several sources
- North Korean websites on the 'kp' domain, including the Foreign Ministry and KCNA, suffered a mass outage starting around 11:00 on 20 October. [ 1 , 2 , 3 , 5 , 6 ]
- Telecom Observer recorded instability in North Korea's internet routing system on 20 October. [ 1 , 2 , 3 ]
- No concrete hacking attempt aimed at North Korea had been detected, according to Yonhap and Hankook Ilbo. [ 1 , 2 ]
- The access problems were still occurring on 21 October. [ 3 , 4 , 5 , 6 ]
Still unclear
- The cause of the outage Yonhap said the cause was not confirmed and a large-scale hacking attack was mentioned as a possibility. Dong-A Ilbo said a line or network equipment fault and a cyberattack were both raised, and Newsis listed an external attack, infrastructure maintenance and a traffic surge as possibilities.
- Whether the outage is linked to the rumours of Kim Jong Un's death Asia Economy said the outage overlapped with the rumours but no link between the cause and the rumours was confirmed. Newsis said attempts to check news of Kim's visit to an exhibition might have caused the problem, but it judged overload unlikely because nearly all sites were affected.
- When the first outage ended Hankook Ilbo said access was normal when it published and the outage lasted about 8 hours. Asia Economy said it lasted until about 19:00 and Dong-A Ilbo said sites recovered at about 20:00, with Dong-A Ilbo reporting outages again three hours later. Newsis said sites were largely unreachable.
- Whether the North Korean authorities closed the sites deliberately Newsis, citing NK News, said this was unlikely because KCNA kept sending reports over its telegraph network.
What local media are saying
Timeline, local time
- On 20 October, North Korean 'kp' websites begin to be unreachable or unstable. [ 1 , 2 , 3 , 5 , 6 ]
- On 20 October, Yonhap says about 40 sites are still unreachable or unstable. [ 1 ]
- On 20 October, Asia Economy says the roughly 8-hour outage ends around this time; Dong-A Ilbo puts the recovery at about 20:00 and says it failed again three hours later. [ 3 , 5 ]
- On 21 October, Newsis says sites become intermittently accessible from about this time. [ 6 ]
- On 21 October, Dong-A Ilbo says 42 major sites are unreachable or unstable. [ 5 ]