Research Report BRUCE W. BENNETT, KANG CHOI, GREGORY S. JONES, DU-HYEOGN CHA, JIYOUNG PARK, SCOTT W. HAROLD, MYONG-HYUN GO, YUN KANG Characterizing the Risks of North Korean Chemical and Biological Weapons, Electromagnetic Pulse, and Cyber Threats Sponsored by the Asan Institute RAND NATIONAL SECURITY RESEARCH DIVISION Published by the RAND Corporation, Santa Monica, Calif. © 2022 RAND Corporation ISBN: 978-1-9774-0981-2 In this report, we describe a combined research effort from the RAND Corporation and the Asan Institute for Policy Studies focused on the North Korean chemical and biological weapon, electromagnetic pulse, and cyber threats. It is a follow-on to a report on the North Korean nuclear weapon threat issued in 2021. Because North Korea denies most information on its capabilities in these areas, we estimate the North's apparent capabilities based only upon open information. We note that these capabilities serve the key North Korean objectives. We describe how these capabilities might be employed to serve the North Korean objectives, and the impacts that employment might have. We then propose actions that the Republic of Korea (ROK) and the United States can take to deter and, if necessary, counter these uses. As such, we intend to provide policymakers, including national-level military and civilian leadership, with possible courses of action to counter these North Korean threats along with open information they can use to explain their policy choices to the general population. In addition, we intend to provide information on these North Korean threats to general civil society stakeholders and influencers. RAND National Security Research Division This research was sponsored by the Asan Institute for Policy Studies and conducted within the International Security and Defense Policy Center of the RAND National Security Research Division (NSRD). NSRD conducts research and analysis for the Office of the Secretary of Defense, the U.S. Intelligence Community, the U.S. State Department, allied foreign governments, and foundations. Asan Institute Collaboration The Asan Institute is an independent, nonpartisan ROK think tank dedicated to undertaking policy-relevant research to foster domestic, regional, and international environments conducive to peace and stability on the Korean Peninsula. RAND and Asan analysts have collaborated on many conferences and other Korean security activities over the years. Chapters 2–6 of this report were each initially drafted by one RAND analyst and one Asan analyst. In 2021, the RAND Corporation and the Asan Institute produced a report on "Countering the Risks of North Korean Nuclear Weapons." Nuclear weapons are but one type of weapon of mass destruction (WMD). The other types are chemical, biological, and electromagnetic pulse (EMP) weapons, referred to herein as other WMD (OWMD). This report is a follow-on joint effort that characterizes the North Korean OWMD and cyber threats. Issue The North Korean regime perceived decades ago that it needed to field powerful military weapons to secure the survival of the regime and to position it to dominate the Republic of Korea (ROK, or South Korea) and impose unification on the ROK. Initially denied access to nuclear weapons by the Soviet Union, North Korea pursued chemical and biological weapons. More recently, it has also pursued EMP and cyber capabilities. But in the last two decades, North Korea has acquired significant nuclear weapon capabilities, as described in our 2021 report. Despite fielding many nuclear weapons, North Korea retains OWMD capabilities and is actively using its cyber capabilities. How does the North use these weapons to affect the peacetime and prepare for a major war with the ROK that could differ significantly from a conflict with just conventional weapons that is normally expected? We have sought to describe these activities based on open literature, while recognizing the serious uncertainties in each of these areas because of North Korean information denial. We also propose options that the ROK-U.S. could take to defend themselves against these weapons. We ultimately hope that stronger ROK-U.S. defenses will help deter North Korean aggression. Approach This report compiles information on North Korean OWMD and cyber capabilities from a wide range of open sources. The authors then employ their military expertise, knowledge of North Korea, and the history of North Korean OWMD and cyber usage to identify how these capabilities are and could be used in peacetime and to postulate how they might be used in crises or wartime. The basic theory of deterrence is presented with an explanation of how the ROK-U.S. could use that theory to support deterrence of North Korean attacks. Simple estimates of the potential areas affected by OWMD and the population densities in the ROK were used to estimate potential civilian casualties caused by OWMD employment, while the effects on facilities and equipment were drawn from various sources. The authors then compiled options for countering these threats, adding some innovative proposals of their own. Key Findings: • North Korea has apparently amassed a substantial inventory of chemical weapons (reportedly 2,500 to 5,000 tons), but an unknown quantity of biological weapons. It likely has sufficient nuclear weapons to execute nuclear EMP attacks, but an unknown capability to execute conventional EMP attacks. North Korea has created a very active cyber hacker force, though its ability to penetrate cyber defenses around key ROK-U.S. infrastructure is not known (but they likely have some successes over time). • North Korea primarily uses its nuclear weapons rather than OWMD for peacetime deterrence, coercion, and influence. North Korea has apparently avoided employment of OWMD except for reportedly testing chemical and biological weapons on people and carrying out some assassinations with chemical weapons. North Korea's peacetime restraint has probably been due to its fear of a retaliation that could jeopardize regime survival. • North Korea has actively employed its cyber capabilities in peacetime to collect information, steal money, and cause damage (e.g., the Sony Pictures hack). • North Korean provocations in peacetime have many purposes, but internally, a key purpose is demonstrating North Korean regime empowerment to counteract the regime's many failings. Externally, Kim Jong-un seeks to demonstrate North Korean superiority over the ROK, as well as his claim that North Korea is a peer of the United States. • North Korea seeks to exercise influence over South Korea as well as the United States through provocations. North Korean peacetime provocations pose a risk of escalation to war, which could include WMD use. And North Korean provocations such as missile and nuclear weapon tests also facilitate the growth in the North Korean WMD threats—something the ROK-U.S. want to prevent. • North Korea may in the future more aggressively employ its OWMD and cyber capabilities in peacetime, anticipating that its nuclear "shadow" would deter many ROK-U.S. responses. • In wartime, North Korea would likely employ all of its WMD and cyber capabilities, including nuclear weapons, hoping to win the conflict and avoid suffering regime destruction. These weapons would substantially transform the nature of a major war in Korea and cause immense damage to ROK-U.S. military capabilities and civil society. Failure to adequately prepare for such a conflict could be a disaster for the ROK-U.S. Recommendations: • Countering limited OWMD/cyberattacks: Enhance ROK-U.S. detection and attribution. Maintain posture for early conventional counterforce response if attacks indicate major invasion. • Countering major OWMD/cyberattacks: Build integrated defense, counterforce, passive defense, consequence management, and establish a "strategic deterrence and warfighting group". • Deterring conflict: Convey clear costs for provocations, counter illicit ship transfers, enforce sanctions, and flood outside information into North Korea. • Counter claims of hostility & Breaking negotiation impasse: Rebut propaganda and implement proactive "carrot and stick" diplomatic proposals. North Korea is transforming its threats in Northeast Asia, seriously pursuing weapons of mass destruction (WMD) and sophisticated cyber capabilities. In April 2021, the RAND Corporation and the Asan Institute for Policy Studies released a study on Countering the Risks of North Korean Nuclear Weapons. But North Korea continues to pursue other WMD (OWMD)—chemical and biological weapons (CW and BW) and electromagnetic pulse (EMP) weapons—as well as expanding cyber threats. Methodology & Strategic Context: Drawing from extensive wargaming, defectors' accounts, and unclassified sources, the study evaluates the North Korean regime's overarching objective: regime survival and sustained control, alongside long-term aims of coercing the ROK into unification on Pyongyang's terms while resisting foreign domination. Under the concept of a "nuclear shadow," North Korea may feel emboldened to engage in conventional, asymmetric, or OWMD provocations, believing U.S. and ROK fear of nuclear escalation will deter significant retaliation. North Korea is one of four countries that have not joined the Chemical Weapons Convention (CWC). It is estimated to possess between 2,500 and 5,000 metric tons of chemical warfare agents (CWAs), including nerve agents (sarin, soman, VX), blister agents (mustard gas), blood agents (cyanide), and choking agents (chlorine, phosgene). Delivery options encompass artillery shells, multiple rocket launchers (MRLs), ballistic missiles, aerial bombs, drones, and special operation forces. Key Vulnerabilities and Defense Measures: • Impact: Severe military degradation due to required MOPP gear, overwhelming medical triage with casualties and "worried-well", operational exclusion at critical airbases/ports, and high potential civilian casualties in urban areas like Seoul. • Countermeasures: Left-of-launch preemptive counterforce targeting storage sites and launchers; active missile/artillery defense systems (e.g., Iron Dome adaptations, directed energy); passive defense (individual/collective protective gear, airfield dispersal); consequence management and medical treatment; and robust deterrence through credible threats of regime-ending retaliation. Biological warfare agents (BWAs) possess potency orders of magnitude greater than nerve agents. North Korea is assessed to possess offensive BW capabilities dating back decades, potentially including 14 different pathogens and toxins—most notably anthrax, Korean hemorrhagic fever (KHF), plague, smallpox, tularemia, botulinum toxin, and SEB. Key Attributes and Scenarios: • Anthrax endospores are extraordinarily hardy, persist in the environment, cause lethal inhalational disease, and can be produced "on demand" in facilities disguised as dual-use biopesticide plants. • KHF (Hantaan virus) is endemic to Korea, lacks an FDA-approved cure, and presents severe attribution challenges. • Delivery: Aerosol sprays via drones, SOF infiltrations, or modified munitions, targeting command centers, reception ports (e.g., Busan), and logistics hubs. • Counters: Advanced real-time biosurveillance/detection systems (e.g., JUPITR, CENTAUR), widespread vaccination of military personnel, antibiotic stockpiling, and asymmetric deterrence posture. Electromagnetic Pulse (EMP) threats encompass High-Altitude Electromagnetic Pulse (HEMP) generated by high-altitude nuclear detonations (30–500 km) and nonnuclear directed radio-frequency weapons. Threat Profile: • Nuclear EMP produces E1 (fast pulse destroying solid-state electronics), E2 (lightning-like), and E3 (geomagnetically induced long-duration currents destroying extra-high-voltage grid transformers). • Strategic calculus: A nuclear EMP detonated over South Korea would also damage parts of North Korea and China, though nonnuclear EMP weapons or targeted high-altitude bursts could disable ROK/U.S. C4I, radar, and electric power infrastructure while attempting to remain below the threshold of direct nuclear retaliation. • Countermeasures: Hardening critical infrastructure and military C2 using Faraday cages, surge arrestors, waveguide protection, backup analog systems, and integrated missile defenses. North Korea views its cyber toolkit as an "all-purpose sword," actively running a force of roughly 6,800 or more hackers trained through specialized schools and top institutions (e.g., Mirim University) and operated under the Reconnaissance General Bureau (RGB). Operations and Strategic Utility: • Peacetime: Espionage, theft of war plans, massive financial theft/cryptocurrency heists (over $2 billion stolen to fund weapons programs), and disruptive malware (e.g., Sony Pictures attack, WannaCry ransomware). • Wartime: Mass cyberattacks disrupting ROK air traffic control, electrical grids, military logistics, missile defense coordination, and private-sector support networks. • Response Strategy: Layered cyber hygiene, deterrence by denial, active network hunt operations, international sanctions against host-nation commercial fronts and talent brokers, and offensive cyber/kinetic counter-strike options. In a major conflict, North Korea would likely employ combined, synergistic operations integrating nuclear, chemical, biological, EMP, and cyber weapons with conventional forces to achieve operational surprise, shatter allied C4I, cause civilian chaos, disrupt U.S. reinforcement flows, and secure regime survival. Strategic Policy Recommendations: 1. Establish clear, credible minimum redlines against provocations. 2. Form a bilateral ROK-U.S. Strategic Deterrence and Warfighting Group. 3. Implement proactive deterrence and left-of-launch counterforce capabilities. 4. Execute comprehensive peacetime counter-information campaigns transmitting uncensored media and news into North Korea. 5. Pursue proactive diplomatic initiatives using structured 'carrot and stick' packages to shift negotiation pressure onto Pyongyang. 6. Prepare robust wartime reconstitution, passive defense, and medical response capabilities across the alliance. Appendix: Technical Description of Nuclear Electromagnetic Pulse detailing waveform characteristics of E1, E2, E3A, and E3B components, field strengths (up to 50–100 kV/m), and propagation dynamics. Key Source Reference List includes official documents from the ROK Ministry of National Defense, U.S. Department of Defense, USAMRIID, DNI Annual Threat Assessments, CDC, NATO AMedP-7.5 guidelines, and relevant scholarly analyses.