Treasury sanctions, DOJ indicts Chinese for violating N. Korea sanctions

As of yesterday, and for the first time ever, the U.S. Treasury Department has frozen the assets of Chinese entities for violating North Korea sanctions, and the Justice Department has indicted them for sanctions violations, conspiracy, and money laundering. The company in question is the Liaoning Hongxiang Group of companies, of which Dandong Hongxiang Industrial Development Company Limited, or DHID, is the largest component. The individuals are Hong Jinhua, Luo Chuanxu, Zhou Jianshu, and Ma Xiaohong, the CEO of the Liaoning Hongxiang Group.

All were first implicated by the remarkable investigative work of the Center for Advanced Defense Studies and the Asan Institute, which is wonderful and also troubling, in that it should not have been left to a small nonprofit research group with funding from a South Korean think tank to do the work that the Treasury and Justice Departments should have done — protecting such core U.S. security interests as global nonproliferation, the integrity of the financial system, and freedom of speech in our own towns and neighborhoods. It is wonderful and disturbing that two very young and very bright people with a tiny budget and no security clearances have now done more damage to the financial networks that sustain His Corpulency’s misrule than the Obama administration did on its own in eight years. (Full disclosure: I met with C4ADS a few times since they started work last fall, to help them focus and target their investigation.) Here is how they did it.

To map these growing overseas networks, this report used open source databases, including corporate registries; court filings; Equasis maritime database records; customs and trade data provided by Panjiva, a customs trade data aggregator; and real time data on ship activities provided by Windward, a maritime data and analytics platform. The compiled information was consolidated using Palantir’s Gotham network analysis platform.

In Part I, we focused on building bulk datasets on companies, individuals, and ships. By using corporate and tax registries in East Asian countries, we were able to identify significant points of convergence across seemingly disparate networks and identify 562 ships, companies, and individuals within one degree of separation from known DPRK illicit and regime entities.

In Part II, we identified key nodes from our expanded dataset for a more in depth investigation. We focused, in particular, on one Chinese trading conglomerate that has conducted over $500 million of trade with the DPRK in the past five years. Within this network, we were able to identify its subsidiary and affiliated entities that have transacted an additional $300 million with sanctioned Burmese and North Korean entities, helped maintain the cyber infrastructure of the DPRK, and traded in various goods and services that raise serious non-proliferation concerns. [C4ADS]

The researchers also pulled and read court filings in China, Japan, and Hong Kong to uncover what appear to be significant pieces of North Korea’s overseas financial support and shipping networks. Typically for criminal networks, the North Koreans mix legal and illegal business to conceal their illicit activity and disguise the origin of their profits. The result is that some businesses “are likely to be inadvertently facilitating North Korean illicit activity,” while others, like DHID, do so willingly. I won’t try to do justice to C4ADS’s report here; just read the whole thing. Among its findings —

• The report uncovered 248 companies, mostly registered in Hong Kong, that operate North Korea’s shipping fleet, much of it concealed behind shell companies and flags of convenience.
• Liaoning Hongxiang Group is directly responsible for operating 10 of those ships, which import North Korean coal and help Pyongyang get around the “livelihood” loophole in UNSCR 2270.
• DHID’s parent company, the Liaoning Hongxiang Group, helped to run the Cambodian ship registry, which Cambodia is currently in the process of nationalizing. C4ADS found that Cambodia in the principal registrar of reflagged North Korean ships. UNSCR 2270 prohibits the reflagging of ships owned, controlled, or crewed by North Korea.
• DHID’s annual trade volume with North Korea was more than twice that of the Kaesong Industrial Complex, and more than enough to fund North Korea’s nuclear program.
• DHID may have facilitated North Korean exports to the United States, which would violate Executive Order 13570.
• DHID has an equity stake the Bank of Dandong, which has previously been implicated in handling money transfers to North Korea, in violation of U.N. sanctions.
• The Liaoning Hongxiang Group’s Vice Chairman had dealings with a sanctioned Burmese tycoon, Tay Za, who also bought a nuclear reactor from North Korea.
• DHID entered into a joint venture with the Korea National Insurance Corporation, which defector Kim Kwang-jin has accused of insurance fraud, and which has been designated by the EU for the freezing of its assets for proliferation-related activities.

DHID’s parent company is a key facilitator of North Korea’s cyber architecture, which North Korea used in cyberattacks against SWIFT; against South Korean banks, nuclear power plants, and news media organizations; and against Sony Pictures. The empty brackets are for Chinese characters that WordPress can’t read:

Companies associated with the Liaoning Hongxiang Group provide services that are critical to the underlying cyber architecture of the DPRK, including the country’s primary email relay service, facilities from which hackers are alleged to operate, and IT firms producing software with possible military and regime applicability as will be discussed in this section. The Chilbosan Hotel [ ] in Shenyang, one of Liaoning Hongxiang’s joint ventures with the DPRK,117 is alleged to be the staging area for Bureau 121, a group of North Korean hackers.118 119 The source of the allegations is a North Korean defector, Kim Heun Kwang, a former computer science professor in Pyongyang, who escaped from North Korea in 2004 and gave detailed testimony on Bureau 121, a group that began large-scale operations in China in 2005.120 The group is reported to be comprised of about 1800 “cyber-warriors” and is considered the “elite of the military.”121 It has been widely reported that Bureau 121 may have been responsible for the 2014 Sony hack.122 The Chilbosan Hotel is majority owned by the North Korean Pyongyang Economic Exchange Society [ ], 123 which controls a 70% share of the company.124 The remaining 30% is owned by Liaoning Hongxiang Group member Dandong Hongxiang Industrial Development Co. Ltd.

The Chilbosan Hotel also shares a physical address with a company called Silibank.127 128 Silibank is an email relay service that charges for sending and receiving email through servers that connect from the DPRK, through China, and then to the outside world. Established in September 2001, Silibank is reportedly the DPRK’s first ISP provider,129 charging for its service in USD for each kilobyte sent.130 The company’s domain, silibank.com, is currently registered to a Chinese company called Liaoning Zhongtian Real Estate Development Co. [ ].

And finally, C4ADS found a link between DHID and North Korea’s WMD-related procurement operations:

Information found on Dandong Hongxiang Industrial Development Group shows that in several online classified ads and databases, Dandong Hongxiang sold products that could qualify as potential military and nuclear dual use products under the U.S. Department of Commerce Bureau of Industry and Security export restrictions.105 These goods included at least four dual use products: 99.7% pure aluminum ingots,106 aluminum oxide (Al2O3), ammonium paratungstate (APT), and tungsten trioxide (WO3).107 Information discovered using Panjiva customs records shows that Dandong Hongxiang Industrial Development Group sent two shipments of aluminum oxide worth a total of $253,219 to the DPRK as recently as September 2015.108 Classified ads posted by Shenyang Hongyang Fine Cermaics Co., which according to the Chinese business registry is owned by a Chinese national named Ma Xiaohong ???, listed “industrial spaceship” as a potential application for aluminum oxide (further investigation is required to confirm if they are the same individual).109 110

We cannot definitively identify the end-user of such goods, but there are clear dual use applications for the products listed. According to a leaked government cable, North Korea has sought to aquire aluminum ingots in the past. The cable further states that “these commodities have dual-use applications for the products listed. According to a leaked government cable, North Korea has sought to aquire aluminum ingots in the past. The cable further states that “these commodities have dual-use applications and could possibly be linked to the North Korean nuclear program.”111 Ammonium paratungstate and tungsten trioxide are byproducts of separating tungsten from its ore.112 A U.S. patent filed in 2010 states that tungsten trioxide is one of several oxidizing agents appropriate for use in a missile design with increased aerodynamic stability.113 According to the U.S. Nuclear Regulatory Commission, aluminum oxide is a component used to resist corrosion in gas centrifuges during uranium enrichment.114 In April 2013, a British company discovered that a firm they had been sending aluminum oxide to had links to the Iranian government’s nuclear program and immediately “ceased transactions. The article stated that “Aluminium oxide is an important material in gas centrifuges used to enrich uranium.”115 [C4ADS]

~   ~   ~

Strictly speaking, the Treasury and Justice Departments sanctioned and prosecuted almost none of this conduct. Let’s turn to the Treasury Department designations first. The “NPWMD” means the assets were frozen under Executive Order 13382, which makes any transaction that facilitates North Korea’s WMD procurement not only sanctionable, but punishable with criminal penalties under section 206 of the International Emergency Economic Powers Act, or IEEPA.

“Today’s action exposes a key illicit network supporting North Korea’s weapons proliferation,” said Adam J. Szubin, acting Under Secretary for Terrorism and Financial Intelligence at the U.S. Department of the Treasury. “DHID and its employees sought to evade U.S. and UN sanctions, facilitating access to the U.S. financial system by a designated entity. Treasury will take forceful action to pressure North Korea’s proliferation network and to protect the U.S. financial system from abuse.”

OFAC designated China-based DHID for acting for or on behalf of North Korean-based KKBC. Specifically, DHID used an illicit network of front companies, financial facilitators, and trade representatives to facilitate transactions on behalf of KKBC. Ma Xiaohong, Zhou Jianshu, Hong Jinhua, and Luo Chuanxu were designated for acting for or on behalf of DHID.

KKBC was designated by OFAC under E.O. 13382 and the UN pursuant to UN Security Council Resolution (UNSCR) 2270 for providing financial services in support of the previously designated entities Tanchon Commercial Bank and the Korea Hyoksin Trading Corporation. Both of those entities were designated pursuant to E.O. 13382 and UNSCR 1718 for their roles in North Korea’s WMD and missile programs. [Treasury Department press release]

As a result of Treasury’s designations, all dollar-denominated assets of the five targets are frozen, and U.S. persons are prohibited from doing business with them.

Not to be outdone, the Justice Department has unwrapped an early Christmas present by unsealing an indictment of Hong, Luo, Ma, and Zhou, and DHID for conspiracy, money laundering, and IEEPA violations, for helping a sanctioned North Korean entity circumvent sanctions. That’s about as much as you’ll see about proliferation in these indictments; the only link to proliferation is the money DHID moved for a North Korean bank that had been sanctioned for proliferation.  The Justice Department also filed a civil forfeiture action against 25 bank accounts belonging to DHID, deposited in a who’s-who of Chinese banks. Want to know the names of the Chinese banks? You know you do.

• China Merchants Bank
• Shanghai Pudong Development Bank
• Agricultural Bank of China
• Bank of Communications Co. of China
• Bank of Dandong (as predicted)
• China Construction Bank
• Guangdong Development Bank
• Industrial & Commercial Bank of China
• Bank of Dalian
• Bank of Jinzhou
• Hua Xia Bank
• China Minsheng Banking Corporation

Contrary to what some news reports have written, a forfeiture action does not freeze assets; if effectively confiscates them. The ownership interest of the person who thought he owned the assets is legally extinguished if the government proves that assets are “involved in” illicit activity.

The banks themselves have no standing to challenge the forfeiture unless they can prove that they’d already closed the accounts. Typically, the feds will use 18 U.S.C. 981(k) to take an equivalent amount to the asset right out of the foreign bank’s U.S.-based correspondent account. It’s up to the foreign bank to make itself whole by taking an equivalent sum from the account holder, something that account holders usually agree to in the fine print of their account-holder agreements.

The actions are venued in the District of New Jersey because the Chinese banks that serviced DHID and the numerous shell companies it set up used Standard Chartered Bank and Deutsche Bank as their U.S. correspondent banks, and both banks based their dollar-clearing operations in New Jersey. I’ve explained how this works a few times before, but DOJ explained it well in its forfeiture complaint.

32. An interbank, also known as a correspondent bank, is a financial institution that provides services on behalf of another financial institution. It can facilitate wire transfers, conduct business transactions, accept deposits and gather documents on behalf of another financial institution. Correspondent banks are able to support international wire transfers for their customers in a currency that their customers normally do not hold on reserve. Correspondent banks in the U.S. facilitate these wire transfers by allowing foreign banks, located exclusively overseas, to maintain accounts at the correspondent bank in the U.S.

33. To obtain goods and services in the international market place, as North Korea must, it needs access to U.S. dollars as some international vendors require purchases to be made in U.S. dollars. As a result, North Korean entities, including designated entities such as KKBC, need access to the U.S. financial system.

The New Jersey venue is interesting, in that most correspondent banks operate in New York. (I wonder if that means we can expect to see another indictment in the Southern District of New York one day soon.)

~   ~   ~

Although news reports have said that the indictment was for aiding North Korea’s WMD programs, that’s only indirectly true. The crux of the government’s case is that after August 2009, when Treasury designated Korea Kwangsong Banking Corporation (KKBC) for WMD proliferation and blocked its access to the dollar system, DHID stepped in to serve as KKBC’s workaround and to launder its money. (Broadly defined, money laundering means moving or spending money that is “involved in” certain specified unlawful activity, whether as proceeds or as an instrumentality.) I’m often asked at this juncture why the North Koreans don’t just use Renminbi. I’ll let the Justice Department answer that.

35. Following the KKBC’s designation as an SDN by the U.S. Department of the Treasury in August 2009, DHID began working to find ways to conduct trade on behalf of KKBC despite the U.S. sanctions. One means of doing so was to use Chinese currency rather than U.S. dollars to conduct commodities transactions, so as to avoid sending money through the U.S. in violation of IEEPA. In July 2010, the City of Dandong, China highlighted press reports of a pilot program between DHID and KKBC to allow Chinese Renminbi (RMB) transactions to facilitate trade between China and North Korea.

36. North Korea’s trading needs, however, cannot be met using only Chinese currency. As a result, KKBC has continued to access the U.S. financial system to facilitate the purchase of goods in violation of U.S. sanctions. KKBC has done so by using DHID and its front companies.

In other words, what I said before — North Korea uses the dollar because that’s what sellers want, and also because (as I’ll explain later) Pyongyang is dollarizing to stabilize its economy.

When KKBC wanted to buy something in dollars — in this case, sugar and urea (used for fertilizer and explosives, and also, ewww) — it would place an order with DHID, which then bought the merchandise at a substantial mark-up — as much as 23 percent, through any one of 22 different front companies or shell companies it set up for just that purpose. That’s the kind of premium that, at least according to our friends in the FBI, people only charge to take the risks associated with breaking the law. Ma and DHID were initially well-positioned to charge these commissions due to Ma’s connections with Jang Song-thaek. Only when the guns of Jang’s firing squad fell silent, Ma’s business kept right on booming.

DHID and KKBC kept a ledger where KKBC would credit or debit DHID’s dollar account in KKBC in Pyongyang. The most suspicious transactions — those that involved a North Korean nexus — were all kept off the wires. Instead, DHID set up a whole series of shell companies, mostly registered in the British Virgin Islands or the Seychelles, and listing fictitious addresses in Hong Kong.

And how did DOJ find all of this out? Much of it obviously began with the C4ADS-Asan investigation, but there is much evidence in the indictment and forfeiture complaint that C4ADS didn’t write about. And why sugar and urea instead of, say, aluminum oxide? I can only speculate that those transactions were the easy ones to prove. Prosecutors prefer to charge the conduct that’s easiest to prove, especially if some of the other transactions with more jury appeal might also require proving up a longer, more complex chain of shell companies and beneficial owners.

All of which is our cue for a round of “Panama Papers Bingo,” which will allow you to read fun stuff about the shell companies named in the indictment and their corporate officers. By all means, leave a comment if you find something interesting in there, although I may hold your comment unpublished for a while for legal reasons.

Although the forfeiture action doesn’t say how much money was in the 25 accounts, it describes multiple transactions in the millions of dollars, including one that was for around $11 million. It wouldn’t surprise me if we learned that the total was well over $25 million, the amount that was blocked (but not forfeited) in the case of the Banco Delta Asia action.

Anyway, now you know why we wrote a section on “forfeiture of property” into the NKSPEA. Originally, we tried to create a special fund to pay for North Korea sanctions enforcement, broadcasting, and humanitarian purposes. Because that funding provision ended up on the cutting-room floor, the Justice and Treasury Departments will put the forfeited money into their respective forfeiture funds and use the money to pay for law enforcement operations. Where, as here, DOJ and Treasury worked the case together, they’ll typically work a deal for splitting that money up between them.

~   ~   ~

So what will the impact of all of this be? Financially speaking, DHID and Ma aren’t likely to survive the experience. Because 80% of DHID’s business was North Korea-related, His Porcine Majesty will probably feel a significant impact. DOJ’s indictment quotes a DHID powerpoint presentation that claims that as of 2012, DHID handled 20% of the volume of Sino-North Korean trade, and claims that DHID’s business was growing at 30 percent each year. I have no way of knowing if that’s true or not, but my guess is that these figures are exaggerated for shareholder consumption. After all, DHID was willing to file a false certification with a certain Panama-based law firm — any guesses, kids? — denying that it had any links to North Korea (exhibit 3).

The greater effect may be the in terrorem impact this action will have on companies like the 88 Queensway Group that had dealings with sanctioned North Korean entities and felt untouchable, possibly because they thought their Chinese political connections would protect them from Uncle Sam. Ma herself was a made member of the Chinese Communist Party, and Sam Pa was a former Chinese spy. Equally well-connected figures may feel less invincible today.

The bad news? Not only the fact that no Chinese banks are facing indictments for facilitating Hongxiang’s willful, long-standing money-laundering scheme, but also, the fact that in its press release, the Justice Department said that “[t]here are no allegations of wrongdoing by the U.S. correspondent banks or foreign banks that maintain these accounts.” I’ll discuss that in more detail in tomorrow’s post.