North Korean Non-kinetic Attacks: A Problem for Incheon Airport
North Korea has recently engaged in “non-kinetic” forms of provocations against South Korea. These operations include waste-laden balloons, GPS spoofing, electronic jamming and cyberattacks. It has sometimes been difficult for South Korea to identify appropriate countermeasures for these non-kinetic provocations because the Rules of Engagement—set by the United Nations Command, which has monitored and managed crises between the two Koreas since the Armistice Agreement of 1953—have not kept pace with these evolving threats.
Recently, the Democratic People’s Republic of Korea (DPRK or North Korea) destroyed the northern sections of the unused road and rail routes linking it with South Korea, seen as a symbolic protest of the hardline policies of the Republic of Korea’s (ROK or South Korea) President Yoon Suk Yeol. On October 31, North Korea launched a new type of intercontinental ballistic missile, dubbed Hwasong-19, from a new 24-wheel mobile launcher. North Korean leader Kim Jong Un declared it was in reaction to the 56th US-ROK Security Consultative Meeting, held in Washington the day before. The ROK intelligence agency said that North Korea may have obtained some critical technical assistance from Russia as a quid pro quo for North Korean involvement in the Ukraine War.
These actions have symbolic and political implications both for the ROK and the US, with North Korea aiming to demonstrate that it still poses an intractable threat to the ROK. In recent years, larger physical (kinetic) conflicts have become rare, the most recent being the Yeonpyeong Island naval skirmishes of 1999 and 2002, which also included a North Korean artillery bombardment of the island and then the sinking of ROK Navy (ROKN) corvette, the Cheonan, in 2010. North Korea’s continued psychological warfare, however, increases tensions and is probably a tactic of “escalate to de-escalate” to acquire leverage for later negotiations with South Korea. The situation is also exacerbating South Korean political polarization over North Korea policy, which the regime of Kim Jong Un presumably sees as a win.
While some sectors of South Korea’s defense infrastructure are prepared to respond to non-kinetic threats, Incheon Airport—a vital hub for the ROK’s economy and international connectivity—is especially vulnerable. North Korea’s shift toward non-kinetic provocations underscores the need for modernizing security systems and coordination efforts at critical sites such as Incheon Airport.
Recent Non-kinetic Attacks
Since May 2024, North Korea has been sending hundreds of waste-laden balloons, typically containing plastic bottles and paper, across the Demilitarized Zone (DMZ). In response, since July 21, the ROK Armed Forces have reinstated an operation in which fixed speakers regularly broadcast messages across the DMZ. Waste balloons have been released at least 20 times and have been found in more than 5,500 locations nationwide.
One balloon caught fire after bursting on the rooftop of a residential building in Gyeonggi Province, where Incheon International Airport, South Korea’s main aerial gateway, is located. Just in this province, waste balloons have been discovered in more than 2,000 locations in recent days. The airport has been directly affected by North Korean waste balloons: runway operations have been halted 12 times for a total of 265 minutes.
Besides the balloons, North Korea has also increasingly been jamming civil aircraft using Incheon Airport. Broadcasting of false signals, deliberately intended to confuse GPS systems, has been reported 578 times between January and August this year, compared to 39 last year and only 26 in the three years before that. Most of these cases have been traced back to North Korea. Such cyberattacks are becoming more sophisticated and are potentially effective against unmanned aerial vehicles operated by US Forces Korea stationed in the South.
No major aviation incidents have resulted to date, but GPS interference can endanger commercial airlines flying in poor visibility, and it is a violation of international conventions on navigational safety. Most of the jamming occurred between May 29 and June 2, when hundreds of civilian aircraft and ships reported suspected GPS jamming near the de facto inter-Korean sea border in the West Sea, the Northern Limit Line. The GPS interference sometimes lasted a few minutes and sometimes several hours.
The Vulnerability of Incheon Airport
Every year, Incheon Airport carries 56 million people and 3.6 million tons of cargo, but it is less than 100 kilometers from North Korea and, therefore, very vulnerable to trash balloons, electronic jamming, and other cyberattacks on flight control systems.
Besides electronic jamming of aircraft navigation systems, other forms of cyberattacks are suspected: during the last decade, Incheon Airport has experienced several technical problems that have affected aircraft navigation and air traffic control. Incheon Airport is an important hub connecting East Asia with North America, so many parties could conceivably be responsible, but it is difficult to see how any of them have an interest in disrupting regular flight schedules, except for North Korea.
The ROK’s intelligence community has verified that North Korea has conducted frequent cyberattacks and electronic jamming directed against Incheon Airport, and they are seriously concerned about the potential impact on domestic and international aircraft. The unexplained disappearance of Malaysia Airlines Flight 370 (MH370/MAS370) on March 8, 2014 offers a grim warning of what could happen: the cause remains mysterious, but a cyberattack has not been excluded. Certainly, if a similar unexplained disappearance should occur with an Incheon flight, then a North Korean cyberattack would top the list of possible causes to be investigated.
The environment of Incheon Airport is also unusually challenging for search and rescue (SAR) operations, being situated on a muddy island, Yeongjong-do, with a tidal range exceeding 10 meters. This makes it difficult for traditional surface vessels to operate, so the ROK Coast Guard (KCG) and the ROKN have deployed specialized platforms and other equipment. KCG has a number of hovercraft capable of amphibious operations, which can provide an immediate response to any emergency in the vicinity.[1] ROKN also possesses some hydrofoils, which are deployed to Incheon Defense Command, based in Incheon.[2] These are available to support SAR operations in coastal areas near Incheon International Airport, and some joint SAR exercises have been conducted with KCG to build operational experience.
Policy Recommendations
Such SAR cooperation is essential for an effective response to an aircraft accident near Incheon International Airport, especially now that the recent escalation in North Korean non-kinetic attacks threatens the safety and security of South Korean airspace. KCG is well prepared, but ROKN could improve its monitoring, for example with unmanned aerial vehicles and unmanned surface vessels. It is also essential to coordinate systems and technology between the ROK’s SAR center, the KCG, the ROKN, and various other authorities, including local governments. Given the complexity of this situation, it is recommended that a procedural manual should be created for joint SAR operations near Incheon Airport. A standard operational manual between ROKN and KCG should be established first, which can then be expanded to become the Chungmu emergency plan, encompassing other government and civic organizations. The recent escalation in North Korean electromagnetic jamming and cyberattacks needs to be countered more effectively. The ROK is bidding to host an international cybersecurity conference with representatives from the militaries of 24 countries in the Indo-Pacific region, and collaborative cybersecurity exercises would also be useful.
Following the announcement of the ROK’s cybersecurity strategy in February, the ROK National Security Council has drawn up the National Cybersecurity Basic Plan after consulting with 14 government agencies. This plan seeks to secure the ROK’s industrial infrastructure and other facilities against cyber threats, using both defensive and offensive measures. The ROK Ministry of National Defense is working together with various countries to coordinate cybersecurity responses and has joined international partnerships such as Cyber Alliance and Cyber Flag drill.
Conclusion
North Korean balloons, GPS spoofing, and other non-kinetic attacks have the potential to seriously compromise the safety of Incheon Airport. The worst-case scenario is an airliner crashing in muddy littoral areas where timely SAR operations and cybersecurity would be very challenging. The complexity of the threat from North Korean non-kinetic operations requires whole-of-government measures. Besides South Korean military and security organizations, civil organizations are also working to deal with these challenges, notably the International Civil Aviation Organization and the International Maritime Organization.
Existing SAR capabilities are not adequate to protect Incheon International Airport from North Korean non-kinetic operations. Multilateral cybersecurity protocols are needed, and the ROK is well-placed to take the lead in developing them.
- [1]
ROK Korea Coast Guard, Korea Coast Guard White Paper, 2022 (ROK: Korea Coast Guard, 2022).
- [2]
Sukjoon Yoon, “Establishing a Maritime Security Joint-Force Partnership Between the Republic of Korea Navy and the Korea Coast Guard,” in Ian Bowers and Swee Lean Collin Koh, Grey and White Hulls: An International Analysis of the Navy-Coastguard Nexus (Singapore: Palgrave Macmillan, 2019), 55-69.