Provoking to Avoid War: North Korea’s Hybrid Security Strategies

So-called ‘hybrid’ security strategies, sometimes also labelled ‘hybrid warfare’, are much discussed among military and security experts in recent years. Russia is often mentioned as employing such hybrid security strategies, yet there are more states that use them successfully, and, in some cases, for many decades already. North Korea is one of those examples. If one defines a hybrid security strategy as the integrated deployment by states of various means and actors in order to influence or coerce other states with the aim of achieving strategic objectives while avoiding actual armed conflict, North Korea offers an interesting example of how successful such strategies can be in the longer term.

This article concisely analyses the North Korean experience with hybrid security strategies. First, the aims of the North Korean strategy will be discussed. Next, the evolving set of policy tools being used will be described, as well as some special characteristics. The article will conclude with a few general observations and lessons that could be learned from the North Korean case. 

Foreign policy and domestic aims

North Korea embarked on a strategy of low-level, asymmetric, or hybrid security strategies after the Korean War of 1950–1953 in which it attempted in vain to unify both Koreas by military means. After the armistice (not an official peace agreement) that ended the war, North Korea had no other choice but to acknowledge that it would not be able to win a traditional military conflict against South Korea, given its alliance with  the United States. The regime in Pyongyang thus decided to focus on a strategy of asymmetric security policies in order to achieve important aims towards South Korea and the United States, while avoiding full-scale conflict. The aims of North Korea’s hybrid security strategies, in various formats applied between the 1950s and today, can be divided into two categories: foreign policy aims and domestic aims.

On the foreign policy level, the main goal is deterrence. The regime in Pyongyang sincerely fears regime-change efforts from abroad; not only from South Korea and the United States, but more in the background also from other neighbouring powers such as China and Russia (Lankov 2013: 183-184). To deter such efforts, North Korea continuously presents itself as a powerful military actor, an unpredictable and dangerous player. To reach this aim, hybrid methods are used alongside more usual deterrent policies such as massive investments in the armed forces, including the development of Weapons of Mass Destruction. Provocations, both military and non-military, are meant to signal that North Korea is so powerful that any attempt to threaten it will fail and end in bloody retaliation (Roehrig 2006). In other words: provocations are considered necessary to avoid actual war.

Alongside the aim of deterrence, hybrid security operations are meant to weaken North Korea’s enemies. The strategy is that any action that hurts the United States or ‘US-occupied’ South Korea implies increased strength for North Korea. Especially in the 1960s, Pyongyang hoped that hybrid activities might destabilize South Korea and spark a communist revolution there, in turn leading to the unification of both Koreas. This hope was lost quite early, however, when South Korea’s anti-communist sentiments proved to be very strong (Lankov 2013: 27-32). Since the 1970s, attempts at destabilisation have intended to hurt and weaken South Korean security in order to increase North Korea’s relative strength.

Moreover, North Korea’s hybrid security strategy is deemed to create room for manoeuvre for the regime in its foreign policy. Its hybrid security activities signal that international rules and norms of state behaviour cannot be enforced upon North Korea, and that other states will have to accept that the North Korean regime may act as it wishes. An example of precisely this is the massive illicit trade by the regime to circumvent economic sanctions, which is not only beneficial for the North Korean economy and the luxury life of the elite, but also signals that international sanctions cannot damage North Korea.

The domestic policy aims behind the hybrid security strategies are equally significant. North Korea’s regime actively uses the image of a dangerous enemy from abroad to maintain the support of its population. The enduring message to the population is: support this regime, because only these powerful leaders are able to prevent foreign invasion and oppression. Creating continuing tensions with ‘enemies’ abroad and showing the population the regime’s military successes to counter these enemies are necessary propaganda tools for this domestic aim (Byman & Lind 2010: 53-54). Meanwhile, however, these tensions and military successes should not cause actual war, which the regime realises it would lose for sure.

An evolving set of policy tools

The North Korean ‘policy tools’ of its hybrid security strategy have evolved over the decades. Some tools are no longer used, some are rather new, and some seem to be ever-continuing. The main hybrid security tools that have been employed by North Korea between the 1950s and today will be discussed here.

Terrorist attacks have been regularly used by North Korea in the past, while they have not been conducted since the 1990s. This is probably due to the changed international perception of terrorism, which was more common globally in the 1970s and 1980s, but, especially after the Lockerbie bombing in 1988, the tide turned and state-sponsored terrorism was much quicker to be condemned and retaliated against. North Korea immediately recognised this changing environment and ceased this kind of activity. A few examples of North Korean terrorist attacks to hurt its enemies while remaining under the level of formal war are: the attack on the South Korean presidential residence in 1968; the attack on the South Korean President in 1974, in which his wife was killed; the bomb attack during a South Korean state visit to Burma in 1983, which killed, among many others, four South Korean ministers; and the bombing of a South Korean airliner in 1987, killing all 115 people aboard (Armstrong 2013: 235-239).

The many kidnappings of South Korean and Japanese citizens in the 1970s and 1980s, often by using small submarines, are a complicated issue in this context, because the objectives of the kidnappings varied: some abductees had to train spies; others were kidnapped so that North Korean infiltrators could take over their identity; and in a few cases movie directors and actors were kidnapped to give a boost to the North Korean film industry (Armstrong 2013: 237-238).

Murdering North Korean defectors and exiles abroad, for example Kim Jong Un’s half-brother Kim Jong Nam who was killed with the extraordinary VX nerve gas in Malaysia in 2017, is meant to deter both former and current members of the North Korean elite from even thinking of opposing the regime (Ellis-Petersen & Haas 2019).

Military surprise attacks are also being used regularly. Some of them are relatively large, such as the shelling of a South Korean island in 2010 and the torpedoing of a South Korean naval vessel in the same year (Lankov 2013: 179). Other surprise attacks are smaller but not less shocking to the ‘enemy’, such as the axe killing of two US soldiers in 1976 or the incidents in 2015 in which North Korean military hid landmines along South Korean border patrol walking routes. The deliberate explosion of the liaison office with South Korea in 2020 was also meant to show how forceful and ‘dangerous’ North Korea can be (Shin & Smith 2020).

There is a thin line between provocative attacks and mere bullying. North Korea has made provocative bullying a hybrid security tool as well. Examples include the opening of dams at border rivers, resulting in sudden floods that kill people on the South Korean side of the border, but also the regular jamming of Global Positioning System (GPS) signals, affecting air and naval traffic in South Korea (Mizokami 2016).

A rather new tool is cyber-warfare. Since the 2000s, North Korea has been accused of various cyber-attacks aimed at South Korean organisations, including banks and media organisations, with seemingly no aim other than destabilising South Korean society for a brief moment. Cyber espionage and cyber theft of (security-related) information and money are regularly used as well, not only targeting South Korea and the United States, but used globally. An example is the digital bank robbery of 81 million US Dollar from the Central Bank of Bangladesh in 2017. This kind of financial cyber criminality is meant to circumvent economic sanctions and thus showing the invulnerability of North Korea as well (Baezner 2018).

Clever calculating

North Korea carefully conducts its hybrid activities within certain limits, cleverly calculating traditional South Korean restraint from escalating any response to prevent actual war. South Korea realises that eventually it would win such a war, but not after suffering enormous numbers of casualties and damage. Holding the millions of inhabitants of Seoul (only 60 kilometres from the border) as hostages with its massive artillery has proven a useful tool for North Korea and created room for manoeuvre since the 1950s. It also reassures North Korea that South Korea will not only avert escalation itself but will actively lobby its ally the United States as well to prevent any escalation towards actual warfare (Barnett 2020).

An integral part of any hybrid security strategy is dividing other actors by causing doubt about the responsibility for the perpetrated activities and thus limiting international responses to some extent. North Korea combines its hybrid activities with the tactic of denial as well. Even when there is hardly any doubt about the perpetrator, North Korea still denies any involvement. For example, even after an international investigation team concluded that a North Korean torpedo had hit a South Korean naval vessel in 2010, North Korea persisted that it was innocent.

Finally, North Korea’s most infamous provocative tool, its nuclear weapons programme, is being used in a ‘hybrid’ manner as well. While using nuclear weapons as a deterrent is neither novel nor hybrid, the lack of secrecy around the North Korean nuclear programme is surprising. Long before its nuclear weapons were usable at all, the regime was exploiting them already as a tool of provocation. North Korea’s persistent threatening statements to use nuclear weapons, even before they were usable yet, are meant to frighten and thus deter perceived enemies, which in turn gives North Korea more room for manoeuvre in international relations as well (Van der Meer 2018).


The North Korean case offers various insights about hybrid security strategies in general. First, the phenomenon of hybrid security strategies is not new. North Korea has been using these strategies for many decades, although they used to be labelled as ‘asymmetric’ or ‘unconventional’ in the past. Second, the North Korean case shows how effective these strategies are: for decades, North Korea has effectively used hybrid security operations to provoke, hurt and bully its perceived enemies, while at the same time preventing escalation to the level of actual warfare. While most of North Korea’s hybrid operations have focused on its most direct ‘enemies’, the United States and South Korea, some of them, such as illicit trade and cyber operations, are being used on a global level as well.

An important feature of North Korea’s hybrid strategy is that it is continuously adapting to ever-changing circumstances, and as such it has not become outdated. This also shows that countering such hybrid security strategies requires continuous flexibility. The broad variety of ‘hybrid’ policy tools available, in combination with the often-unpredictable character of hybrid surprise attacks, clearly indicate that it is hard to prepare for dealing effectively with an adversary using such a strategy. Finally, the North Korean case shows that hybrid strategies are not only useful for big powers such as Russia. Hybrid strategies can also be effectively used by smaller states facing bigger enemies to deter and provoke, while preventing any undesired escalation to actual armed conflict that cannot be won. North Korea could be recommended as a prime case study as  how to make hybrid security strategies a long-term success and  how difficult it is to counter them effectively.


Armstrong, C.K. 2013. Tyranny of the Weak: North Korea and the World, 1950–1992, Ithaca, NY: Cornell University Press.

Baezner, M. 2018. Cyber Disruption and Cybercrime: Democratic People’s Republic of Korea, Zurich: Center for Security Studies ETH Zurich.

Barnett, D.S, et al. 2020. North Korean Conventional Artillery: A Means to Retaliate, Coerce, Deter, or Terrorize Populations, Santa Monica, CA: RAND Corporation.

Byman, D., and J. Lind. 2010. ‘Pyongyang’s Survival Strategy: Tools of Authoritarian Control in North Korea’, International Security, Vol. 35, No. 1, 44-74.

Ellis-Petersen, H., and Haas, B. 2019. ‘How North Korea Got Away with the Assassination of Kim Jong-Nam’, The Guardian.

Lankov, A.. 2013. The Real North Korea: Life and Politics in the Failed Stalinist Utopia, Oxford: Oxford University Press.

Mizokami, K. 2016. ‘North Korea is Jamming GPS Signals’, Popular Mechanics.

Roehrig, T. 2006. ‘Restraining the Hegemon: North Korea, the US and Asymmetrical Deterrence’, in: Tae-Hwan Kwak and Seung-Ho Joo (Eds), The United States and the Korean Peninsula in the 21st Century, Aldershot: Ashgate, pp. 163–184.

Van der Meer, S. 2018. ‘Why North Korea Will Never Give Up its Nuclear Weapons’, Clingendael Spectator.

Shin, H., and J. Smith. 2020. ‘North Korea Destroys Inter-Korean Liaison Office in “Terrific Explosion”’, Reuters.

Further Reading on E-International Relations

Editorial Credit(s)

Kieran O'Meara

Please Consider Donating





Get our weekly email