Protests have continued for almost a year about the snowballing allegations that South Korean government bodies were engaged in an orchestrated effort to manipulate last year's presidential election. The very latest revelation alleges [ko] that there were an additional 20 million tweets written by the National Intelligence Service (NIS) to either smear the opposition candidates or praise the current President Park Geun-hye. This number easily surpasses last month’s count: 1.2 million tweets by the National Intelligence Service and 23 million tweets [ko] by the Defense Ministry's Cyberwarfare Command.
Twitter user Zaro's profile photo, used with permission. It is a photo of his young daughter holding a candle, a reference to the candlelight vigils staged in protest of the South Korean government's manipulation of public opinon ahead of last year's elections.
There is an ordinary individual who worked behind the scenes for a year to make this groundbreaking revelation possible – a 40-year-old net user who goes by the pennameZaro (@zarodream) [ko]. Zaro, who introduced himself as a full-time office worker who neither has a background in technology nor any political affiliations, kindly answered questions asked by Global Voices Korean editor via email.
Global Voices (GV): Many net users call you by your famed nickname “The Netizen Investigator”. When did you start using your nickname, and what does this nickname entail?
제가 ‘네티즌 수사대'라고 스스로를 자처하게 된 것은 국정원 트위터의 흔적을 본격적으로 추적하면서부터 입니다. 사실 처음에는 직접 나서는 것이 부담스러워서 여러 언론사에 제가 발견한 내용들을 제보하는 것으로 출발했습니다. 그런데 대부분의 언론사에서는 제가 제보한 내용들을 무시하더군요. 그리고 보도를 하더라도 제한적인 폭에 그치더군요. 그래서 제가 직접 ‘네티즌 수사대'라는 이름을 내걸고 직접 공개하기 시작한 것입니다. 그러자 오히려 언론에서 저에게 더 많은 관심을 보이며 제가 만든 자료들을 보도하기 시작하더군요[...] 사안에 따라서는, 특히 증거인멸의 가능성이 있는 경우에는 언론사나 수사기관에 직접 따로 제보하는 경우도 많습니다[...] 때로는 수사기관에서 어떤 방식으로 수사를 진행하면 좋을지에 대한 방법을 제안하기도 합니다. 실제로 검찰이 제 글을 읽었는지는 모르겠지만 검찰이 수사결과를 발표할 때 보면 제가 제안한 방식을 그대로 적용하고 있는 경우가 많더군요.
Zaro (ZA): As I dedicated myself to tracking the NIS’ trail on Twitter, I started calling myself ‘The Netizen Investigator’. Since there is a lot of pressure that comes with publishing revelations under my name, at first, I merely passed along my findings to media outlets. However, most media companies ignored my reports. And even if some did report, they ended up using only small portions of my findings. That is why I decided to directly publish my findings. Once I did that, then the media showed a sudden interest in me and started reporting my findings [...] In some cases where my (premature) posting of information could lead to the destruction of evidence, then I contact media and investigative agencies directly and report them my findings [...] Sometimes, I suggest to investigative agencies specific ways of how to execute the investigations. Although no one can verify whether prosecutors have read my writings or not, I noticed that they followed some of the ways I suggested.
GV: You also run a personal blog. Are there other sites that you usually go to? What do you usually write about?
블로그와 트위터 외에도 저는 ‘Daum 아고라', ‘오늘의 유머', ‘MLB파크'에서도 활발하게 활동하고 있습니다. 그런데 참으로 안타까운 것은 이 세곳 모두 국정원의 여론조작과 종북몰이로부터 자유롭지 않다는 것입니다. ‘Daum 아고라'의 경우 국정원 뿐만 아니라 탈북자 단체인 NK지식인연대가 조직적으로 여론조작을 벌인 곳입니다. ‘오늘의 유머'의 경우 국정원이 다수의 아이디로 추천-반대 조작을 한것도 모자라서 아예 종북 사이트로 낙인을 찍어버렸고, 이 사이트의 운영자인 이호철씨는 국정원으로부터 고소당한 상태입니다.
ZA: Beside my personal blog and Twitter account, I am active on these sites: Daum Agora,TodayHumor, MLB Park [ko] [note: Daum Agora is known to be an online venue where serious political debates are taking place, while TodayHumor is an online community site that hosts discussions on various topics not limited to politics, including fashion, online games, celebrities and users’ personal worries and issues]. Unfortunately, all three of these sites were not free from the NIS’ manipulation of public opinion and their ‘pro-North Korean sympathizer’ rhetoric. In the case of Daum Agora, not only the NIS but the North Korea Intellectuals Solidaritycarried out a systematic manipulation of public opinion. On the TodayHumor site, NIS agents, using multiple net IDs have upvoted and downvoted certain posts (in order to influence the site). They even took it one step further, branding the site as ‘pro-North Korean', and they sued Mr. Lee Ho-chul, who runs the site.
GV: What motivated you to track down NIS’ online activities? How much time have you spent?
지난 4월에 인터넷 독립언론 뉴스타파(KCIJ)는 국정원으로 추정되는 핵심계정 10개를 공개했습니다. 그런데 참 안타까웠던 것은 이 사실에 대해 메이저 언론사들이 외면해버리더군요. 특히 수사를 진행하고 있던 검찰은 국정원 트위터에 대해 수사할 의지 자체를 보여주지 않았습니다. 그래서 제가 뛰어든 겁니다. 저는 비록 검찰처럼 수사권도 없고 첨단 장비도 하나 없지만 일개 네티즌도 마음만 먹으면 이만큼이나 찾아낼 수 있다는 것을 보여주고 싶었습니다[...] 저도 생업이 있는 직장인이기 때문에 대부분의 작업은 밤 늦은 시간부터 새벽까지 이어졌습니다. 하루에 약 3~4시간 정도 작업을 하고 있습니다. 최근에는 軍사이버사령부의 트위터-블로그-게시글 등을 추적하는 일에 많은 시간을 보내고 있습니다[...] 제 예상으로는 아마도 국정원보다 훨씬 광범위한 규모가 될 가능성이 높아보입니다.
ZA: Back in April of this year, independent online news outlet NewsTapa [ko] (Korea Center for Investigative Journalism) revealed the ten key net accounts that belong to the NIS. Sadly, (despite their revelation) South Korean mainstream media outlets totally ignored the report as if nothing had ever happened, and the prosecutor’s office did not show any intention to investigate the NIS’ Twitter accounts. That's when I jumped in. I wanted to prove that an ordinary user such as myself, who neither has the official investigative rights that the prosecutors have nor any decent devices, can reveal this much, when I am so determined. [...] Since I am a (full-time) office worker, most of my investigation started late at night and continued till early in the morning. I spend about 3-4 hours daily. Currently, I spend much more time tracking the Defense Ministry’s Cyber Warfare Command’s activities on Twitter, blogs and their posts (written on online community sites) [...] I expect their online activities would be done on a much bigger scale than those of the NIS.
GV: Could you elaborate on the logistics of your investigation of NIS on Twitter? (Some of Zaro's findings, such as one on net user ID taesan4 [ko] and ID shore0987 [ko] are posted on Daum Agora)
저는 먼저 핵심계정 10개가 직접 작성하거나 RT한 트윗들을 찾는 작업을 진행했습니다. 1차적으로 구글에 핵심 계정을 입력하고 검색을 누르면 다양한 정보들이 쏟아집니다. 특히 구글에는 해당 트윗을 삭제했더라도 그 흔적이 고스란히 남아있는 경우가 많습니다. 또한 핵심계정이 올린 트윗을 누군가가 인용하여 RT를 했다면 원글이 삭제되더라도 그 기록이 고스란히 남아있게 됩니다[...] 그리고 구글에는 검색을 도와주는 여러 명령어가 있는데 이를 적절히 활용하면 작업을 하는데 큰 도움이 됩니다. 예를 들어 'site'라는 명령어를 활용하면 해당 계정에서 사용된 특정 단어가 포함된 트윗들을 찾을 수 있습니다. 그리고 온라인에서 제공되는 여러 트위터 관리 사이트가 제공하는 정보들을 살펴보면 특정 트윗에 대해 누가 RT를 많이 했는지를 볼수 있습니다. 그리고 RT한 내용 중 사진이나 동영상이 포함되어 있는 경우에는 그 흔적을 찾기가 더 용이합니다.
ZA: The first step was to locate tweets or retweets made by the ten key accounts. When I googled those major accounts, various search results came up since even after they had removed certain tweets. There are still traces of that tweet on Google. When someone mentioned or retweeted certain tweets, a trace of the tweets remains intact even after the original tweet is long gone. [...] On Google, there are several useful commands that people can take advantage of. For example, the command “site” can be used to track tweets that include certain words. And there are many Twitter management sites and tools that enable users to check who retweeted specific tweets. When tweets include images or video clips, it is much easier to track those.
GV: Is there any specific reason you focused on tracking NIS’s Twitter activities insetad of their other online activities?
트위터는 다른 온라인 활동과는 다르게 그 흔적이 고스란히 남습니다. 자신이 작성한 모든 트윗과 계정까지 삭제를 하더라도 구글을 통해 검색이 용이하고 빅데이터업체를 통해 복원이 가능합니다[...] 그리고 중요한 것은 서로가 트윗을 주고받고 RT된 내용들을 분석해보면 하나의 사회관계망이 도출된다는 것입니다.
ZA: Twitter, unlike other online activities, leaves discernible traces. Even after a user removes every tweet he wrote and even his Twitter account, [some of the tweets] are still searchable by Google, and we are able to recover some by getting help from big data companies [...] And most importantly, if you analyze the interactions between certain Twitter accounts, you can figure out the connections between accounts.
GV: It is tricky to match a Twitter ID with one’s real identity. How was this possible?
뉴스타파가 공개한 핵심계정 10개 중에서도 가장 핵심으로 꼽혔던 대장계정은 ‘nudlenudle'이라는 계정입니다[...] 저는 핵심계정 10개와 동일한 계정으로 이메일을 제공하는 대형 포털 사이트인 네이버, 다음, 네이트, 야후 등에 계정이 있을수 있다는 생각이 들었습니다. 저는 회원가입 절차에 나오는 ‘아이디 중복 체크’ 방법을 통해 핵심계정 10개를 확인해봤더니 다수의 아이디가 동일한 계정이 존재한다는 것을 발견했습니다. 이를 바탕으로 뉴스타파는 ‘nudlenudle'이 국정원 심리전담 직원 이모씨 라는 것을 최종 확인하게 된 것입니다.
ZA: One of the most important accounts, even among the NIS’ ten key Twitter accounts revealed by Newstapa, was net ID: ‘nudlenudle’ [...] After thinking that there must be accounts using the same ID on major portal sites, such as Naver, Daum, Nate and Yahoo, I used the user registration pages’ ‘Check for ID availability’. I checked all ten key accounts [on these portal user registration pages] and was able to reach a conclusion that there are accounts using that same ID. Based on my finding, Newstapa was able to confirm that the user ID ‘nudlenudle’ is an account belonging to Ms. Lee who works for the NIS psychological warfare team. [editor's note: Major South Korean portals require users to type in their real names and social security numbers at time of registration, providing the possibility that checking portal sites accounts could lead to the verification of Twitter user's identity]
GV: What led you to suspect that certain content was written by the NIS? Are there any patterns that NIS’ tweets share?
가장 큰 특징은 북한에 대한 내용이 상당히 많다는 것입니다. 그것도 일반인들이 알기는 힘든 차원의 정보가 담긴 내용들이 상당히 많습니다. 그리고 종북몰이에 혈안이 되어 있습니다[...] 문제는 지금까지 드러난 것은 아직 빙산의 일각일 뿐이며, 감춰진 진실을 밝히기 위해서는 꼭 특검이 실시되어야만 합니다.
ZA: The most significant trait of the NIS is that they quoted lots of North Korean-related content. They often contained information that no ordinary citizen could have access to and they were very eager to brand (someone/group) as a ‘pro-North Korean sympathizer’ [...] What has been revealed so far is just the tip of the iceberg. A special prosecutor should be assigned to unearth the hidden truth.
Zaro thanked Newstapa's investigative journalists for their endeavors and humbly added that “he merely reported information and suggested possibilities to them”. He explained the reason for his profile photo above: It is a picture of his young daughter holding a lit candle, meaning that he hopes to see “a society where no candlelight is ever needed”, referring to the candlelight vigils staged in protest to the government's election manipulation, and that “building such a world for his daughter would be Zaro's dream”.
