The Detonation Detectives

On the morning of March 6th, local time, at least four missiles were prepped for launch in North Korea. The missiles were transported to a field, and hefted upright in truck-mounted canisters. Lined up in a row against a backdrop of mountains, the engines fired and the missiles took off almost but not quite simultaneously, trailing skirts of flames behind them. They flew about 620 miles to splash down in the Sea of Japan — some of them falling less than 200 miles from Japan’s northwest shore.

The test launch escalated rising military tensions already heightened by ongoing US and South Korean military exercises. On Monday evening, the US started its deployment of the Terminal High Altitude Area Defense (THAAD) missile defense battery in South Korea — angering both North Korea and China; North Korea threatened to retaliate with nuclear weapons if either the US or South Korea fires even “a single flame” inside its borders. And Chinese news media warned that deploying THAAD in South Korea could ignite an arms race.

The test launch also kicked off a much quieter flurry of activity thousands of miles away in the idyllic coastal town of Monterey, California. Famous for its world-class aquarium, Monterey is also home to an organization of arms control analysts devoted to studying the apocalypse. The James Martin Center for Nonproliferation Studies, or CNS — a nonprofit research group that specializes in weapons of mass destruction — is headquartered between Victorian houses on a quiet street marked by fog-fed cypress trees. CNS’s mission is ambitious: “To combat the spread of weapons of mass destruction (WMD) by training the next generation of nonproliferation specialists and disseminating timely information and analysis.”

Three of CNS’s arms control analysts are based here in Monterey: Melissa Hanham, Dave Schmerler, and Jeffrey Lewis. The trio uses unclassified, and often publicly available, data, photographs, video, and satellite images to investigate missile tests and nuclear programs across the world. They even work with other experts on social media to pick apart the details of a launch. “In a way we’re kind of like detectives,” Hanham says.

Affiliated with the Middlebury Institute of International Studies at Monterey, CNS is funded by private philanthropies as well as several governments, and also has offices in Washington, DC, and in Vienna, Austria. The analysts at CNS study WMD of all kinds, including chemical, biological, and, of course, nuclear weapons. They teach students at the Middlebury Institute of International Studies, publish their analyses online, and speak to journalists at The New York Times, The Washington Post, CNN, and, of course, The Verge. Lewis runs a blog and a podcast, both called Arms Control Wonk. David Wright, co-director of the global security program for the Union of Concerned Scientists, calls this team “as good as it gets.”

Over the last decade, North Korea has conducted at least five nuclear weapons tests. In the last few days, North Korea vowed to accelerate this work, Reuters reports. “We are knee-deep in the arms race,” Lewis told The Verge over the phone. “I think we have to admit there’s an enormous wave of missile proliferation happening.”

That makes CNS’s work more vital than ever. It typically takes the CNS team several days to reconstruct the who, what, when, where, and why of a missile test. Following the March 6th launch, I rode along to chronicle their open-source investigation.

Day 0 – Sunday, March 5th

“Everything starts on Twitter,” Hanham says. Sometimes, she added, when there’s been an underground nuclear test she’ll get a buzz from the US Geological Survey alerting her to the seismic waves. “But usually it's still Twitter — because tweets actually travel faster than the waves of an earthquake.”

On Sunday, March 5th, at 3:08PM PT, South Korean news agency Yonhap sent out a tweet announcing that a North Korean missile launch had been detected.

The big question was whether this was a flight test of an intercontinental ballistic missile (ICBM) — a missile capable of flying thousands of miles to the US. Lewis, Hanham, and Schmerler kept a close watch on Twitter, paying particularly close attention to what government officials in the US, South Korea, and Japan said about the missile’s launch location, the height it reached, and the distance it traveled. That would help them figure out whether the missile was one they’d seen before, or something new.

Articles published Sunday evening reported that North Korea had fired not one, but four missiles from somewhere around the northwest city of Tongchang-ri, home to the Sohae Satellite Launching Station. That location led some observers to suspect that at least one of the missiles tested was an ICBM, Hanham says.

But the missile trajectories ruled out ICMBs as a possibility, Lewis tweeted that night. The Union of Concerned Scientist’s David Wright agreed in an article he published the next day: the missiles flew too low, and landed too soon — about 620 miles away from where they started.

Had they been ICBMs, the missiles would have needed to be aimed almost straight up to land so nearby. The fact that multiple missiles had been fired at the same time — called a salvo — also punched holes in the ICBM theory. North Korea has not flight tested an ICBM yet, and it’s unlikely the country would launch four unproven missiles simultaneously.

Based on that data, Schmerler and Hanham told The Verge that they felt confident the missiles were not ICBMs. The intent of the test wasn’t to try out some new feature or capability, but to practice for war, Hanham said. “In addition to physically having the technology, they need to be able to have a unit of people actually deploy it in a military scenario,” Hanham says. It’s a simulation of firing multiple missiles under battlefield conditions.

Lewis put it even more succinctly when I visited CNS a week and a half later: “So we practice striking them, and they practice nuking us,” he said. “Good times on the Korean peninsula.”

Based on the trajectory, Lewis, working in parallel with the Union of Concerned Scientists’ David Wright, narrowed down the missiles to two candidates: the Nodong (also called a Rodong), and an extended-range Scud, alternately called an ER Scud or Scud-ER. Both can carry chemical, biological, high-explosive, or even nuclear payloads — provided the warhead is small enough.

The Nodong is a 52-foot-tall missile that can travel nearly 1,000 miles. First successfully flight tested in 1993, the Nuclear Threat Initiative estimates that there are about 200 deployed by North Korea — and still more are exported. The ER Scud is slighter and smaller than the Nodong, and three ER Scuds appear to have been fired in a similar salvo in September 2016. Still, Lewis tweeted on Sunday night that he wasn’t ready to say yet what the missiles were solely based on the trajectory: “I'd really like more data before pronouncing a missile-type. YMMV!” he wrote. (Your mileage may vary.)

Day 1 – Monday, March 6th

Fitting together trajectories and the history of a country’s arsenal helps experts home in on likely suspects. But details in photographs and video provide the biggest clues regarding the location of a launch. On Monday morning, the CNS’s resident photo expert Dave Schmerler was still waiting for the North Korean Central News Agency (KCNA) to release photos of the test.

The fact that four missiles landed in the Sea of Japan told Schmerler that the test was at least mostly successful, which made him think that the photos were likely coming soon — and he had an idea of what they’d depict. “We’re probably going to get images of Kim Jong Un sitting in front of a desk with an ashtray,” Schmerler says. “He’s going to be chain smoking the whole entire time, watching the missiles flying through the air, and smiling.”

By Monday afternoon, KCNA released the photos; Kim Jong Un was smiling.

Schmerler set to work, looking past the subject of the image and identifying landmarks like mountains, trees, hills, and buildings, trying to envision what these features would look like from above. Then he flew over the launch region identified in media reports using Google Earth. “Because that’s what I do for fun, which is weird,” he jokes. “I’ll try to match the jigsaw puzzle piece to what I created in my head.”

Then, he says, he creates little proofs using other photos of the launch, to check himself: if he’s looking north and sees a certain building in a different photo, he knows he’s on the right track.

Locating the test site isn’t as simple as identifying the right missile silo. The ER Scuds, for example, are road-mobile missiles, Hanham says, which means they’re launched from the back of trucks. To confuse attempts at a preemptive strike, these trucks drive continuously around the country, from tunnels to caves to warehouses to bunkers hidden inside hills. That makes figuring out where the missiles are located like a high-stakes shell game.

“If the moment comes and we’re at war, the US and South Korea and Japan want to know exactly where these missiles are and neutralize them,” Hanham says. “The more times we can locate either where they’re based or how they plan on deploying them, the better we will be at not being caught by surprise.”

On Monday night, open-source intelligence analyst Nathan Hunt of Strategic Sentinel was the first to ID the field where the missile test took place and tweeted out his findings.

The field was a flat area close to, but not at, the Sohae Satellite Launch Station. After triangulating the mountain ridges, the railroad tracks, and the road, Schmerler said that Hunt was right: “You can see the mountains in the back. And just like a fingerprint, mountains are very unique,” Schmerler says.

As for the missiles themselves, the early round of photos released on Monday afternoon made Schmerler suspect that they were indeed extended-range scuds.

The nose cone that looks like one cone stacked on top of another — called a biconic cone — had been seen on ER scuds before. But, Schmerler added in an email, he wanted to get better pictures before making the final call.

Day 2 – Tuesday, March 7th

Jeffrey Lewis wakes up very, very early in the morning. And when he woke up on Tuesday, he realized that while Hunt had identified the launch site, no one had bothered to locate where Kim Jong Un watched it from. There were two buildings on the most likely hilltop, and Lewis noticed a tree growing through the viewing platform in one of the photos. He matched up the tree, and characteristics of the rooftop on Google Earth. The authors of an analysis on the website 38 North, run by the School of Advanced International Studies at Johns Hopkins University, came to the same conclusions.

Schmerler says you never know which detail will confirm or refute the story that North Korea’s government-run media machine is spinning: “In order to better understand the truth behind the actual events, you have to take the media they give you and look deeper to see if there are any inconsistencies with the story they told you.”

One of those inconsistencies might have been the number of missiles, Schmerler discovered. Early Tuesday morning, CNN published a story quoting an anonymous US official that said North Korea might have actually launched five missiles, not four — and one of them failed. Captain Jeff Davis, a Pentagon spokesperson, was quoted by Reuters saying, "There were four that landed. There may be a higher number of launches that we're not commenting on.” But Schmerler isn’t one to trust government claims without verifying them himself.

More photos had been released since Monday, and a few included a map that clearly showed four missile arcs.

But in the background of a couple of the photos was a computer monitor with a map, a time stamp, and five cells that contained green arcs — which Schmerler thought might have been the anticipated trajectories of the missiles. In the clearest photo, the fifth cell was obscured by Kim Jong Un’s hand, pointing at the screen. But there was another photo where the cell was visible in the distant background. Schmerler cut it out, blew it up, and spliced together the images of the monitors. The fifth cell looked just like the other four — he thought it was plausible there had been a fifth missile that didn’t launch, or that exploded on the launchpad.

Nick Hansen, a retired Army imagery analyst and affiliate with Stanford University’s Center for International Security and Cooperation, isn’t as certain that there was a fifth missile in the lineup that morning. “If it didn’t go, and it blew up, that’d be obvious. If it didn’t go and they dragged it back to the barn, if you will, that’ll be tougher, and if it wasn’t there at all,” he said, that would be even harder to determine.

The map also revealed the target of the simulation. Schmerler flipped the map right-side up and zoomed in, revealing an arc that traveled down the map from where the four missiles landed toward a US Marine Corps Air Station at Iwakuni. That’s where the squadron of F-35B stealth fighter planes participating in joint US–South Korea military exercises are based. Had the missiles been aimed further south, they they would have landed on the US base, The Japan Times reports based on Schmerler’s analysis. The test launch was a shot across the bow.

The new photos also confirmed the team’s designation of the missiles: the size of the trucks, the shape of the nose cone, the serial number on one of the missiles, and the color of the engine exhaust all screamed ER Scud.

Day 3 – Wednesday, March 8th

The problem with relying on North Korean propaganda photos for verification is that they’re commonly doctored. Often, these touch-ups are cosmetic, Hanham says. Photos might be altered to tweak the sky, shine up the medals on a general’s chest, or to erase Kim Jong Un’s ever-present cigarette. His ear is also frequently photoshopped, Hanham says, although she doesn’t know what they’re trying to hide. Schmerler thinks a cyst.

“When it comes to hiding evidence of a failure or creating the illusion of a success, that’s when it becomes really interesting to us,” Hanham says.

If a photo has been digitally retouched, sharpened, or repainted, our eyes might not be able to spot it, Hanham explains. But, as long as the photo isn’t, say, a screenshot from a video, a computer can see the alterations to the data represented by the colored pixels. She and her colleagues use software called Tungstene made by a French company called Exo Makina to look for these mathematical anomalies.

Normally, the visual static, or noise, of a photograph should be uniform across each part of an image. So one of the Tungstene algorithms pinpoints areas with suspicious variations, which could be because an object is particularly reflective — or because something was retouched. But it can’t tell her why.

In the spring of 2015, North Korea released photos of a submarine-launched ballistic missile test with the missile speeding up to the sky from the water. Hanham ran the photo through Tungstene, and the program highlighted two areas of the photo that seemed off. One was Kim Jong Un’s hand — which, she suspects, was edited to erase his cigarette. “That’s not enormously important from a WMD perspective, but it does mean that this photo has been changed,” she says.

The other anomalies surrounded the missile. When Hanham applied another filter that tracks how light waves emanate from their source, she realized that the flames underneath the missiles weren’t actually radiating light — something flames typically do.

“There was a small part of the sky that was glowing,” she says. But it wasn’t the plume of the missile. Instead, she thinks the missile was pasted over something else glinting in the sky to create the illusion of a successful test. “We just use our best guess, that they were trying to show a missile launch, when one didn’t actually happen.” (Other analysts have found additional evidence that the photos were doctored, although South Korean officials dispute this claim.)

When she ran the images from the March 6th test through Tungstene, Hanham didn’t see any clear tweaks. She did find, however, that the photo of the missiles in the field had been run through Adobe Photoshop at least once, and that the focus was off-center. It’s possible, she says, that the images had been cropped — or that the photographer used a camera that allows you to change where the camera focuses.

Satellites can tell a more honest story. The team uses images collected by private satellite imaging company Planet to search for concrete and vegetation scorched by the heat of a missile’s engines. Near-infrared sensors on Planet’s satellites are best at picking out the brown burn scars against earth-toned vegetation and dirty pavement. Finding one can confirm the location of a missile test — and maybe even indicate how successful it was.

If a fifth missile had indeed been present in the lineup on March 6th, and exploded on the launchpad, it’s possible that it could have left a burn scar. But neither the CNS team, nor Nick Hansen, could spot one in Planet’s satellite images of the site. So if there really was a fifth missile, it may have simply failed to launch. From the data they can access, it’s unlikely the team will learn more.

The Results

Three days after the test launch, the team was confident enough in its reconstruction that Lewis published his analysis on foreignpolicy.com: “North Korea is Practicing for Nuclear War.” The launch wasn’t to test new technology, he wrote, but to practice firing missiles at US bases in Japan.

Scott Snyder, director of the Program on US–Korea Policy at the Council on Foreign relations, says the findings of the report made sense, and had “a certain shock value.” He added, “People stick to their default analysis of, ‘Oh, well, there the North Koreans go again,’ without realizing maybe there are new capabilities here that should force us to go back and revisit those assumptions.”

Six days later, Schmerler thought there was enough evidence of a fifth missile that failed to launch to share his conclusions on NKNews.com. He wrote that he’ll have to wait for more launches to be sure, “but there is certainly enough to question the official story.”

Hansen says that these kinds of open-source analyses are critical for filling in policy analysts outside government who might not have access to classified intelligence. Without their work, he says, “You’d see a press release from the Air Force or South Korea or Japan that a missile was launched today from North Korea, but you wouldn’t understand the context. You wouldn’t understand why.”

Meanwhile, more tests loom on the horizon. On March 19th, North Korea test fired a rocket engine that could possibly be used in an ICBM. And on Wednesday, March 22nd, the North fired another test that appears to have failed shortly after launch.

A week and a half after North Korea fired the salvo into the Sea of Japan, Hanham, Schmerler, and Lewis sat down in Lewis’ office. Books were shelved, stacked, and piled on most of the surfaces, and two computer monitors covered one of his desks. The window looked out on a sliver of ocean. On its sill was a lopsided bomb vase holding fake flowers, and a framed calligraphy of bomb equations.

“My friends and family always talk about what we would do in service of a post-apocalyptic world,” Hanham said. “And I am not that useful because I'm all about the pre-apocalypse.” Schmerler was more confident about his prospects after the world ends: “I bake bread, so I've got job security,” he said.

Lewis half-joked as his kid played on the floor that he didn’t want to see a post-apocalyptic world: “I want to go in the first wave. I don't want to stick around for all that.”