Codex Lexpressia · An interactive walkthrough

Walled gardens

A mouse at a piano, lit by a single candle, before a sheet headed 'Verify you are human'.

Illustration, not photography. A composed scene made for this deck; the machine asking who counts as a person is the joke, and the subject.

Two national networks, walked through from the inside. The first is a single app that quietly runs as two different systems depending on one field at registration. The second is a network that was never connected to the world at all; its operating system gets a module of its own, down to how you read the clock on its screens. About twenty-five minutes, and every claim is sourced.

← Back to Codex Lexpressia

Why practise behind the wall

Physical immersion works because it forces you to navigate systems designed by and for native users, not systems translated for outsiders. The same logic applies to screens. A learner who has only ever used an Australian-facing internet has not met the structural logic of a Chinese or North Korean digital environment; they have met a foreign-facing simulacrum of it. The navigation challenges here practise two things at once: the target language as it actually appears in interfaces, notifications and payments, and the information-control architecture that decides what a native user can see, share and say.

This is not a substitute for travel; it is a distinct and complementary literacy, closer to what digital anthropologists call platform ethnography than to a vocabulary app. For a traveller, it front-loads the operational and cultural adjustment that would otherwise happen, expensively, in the first week on the ground. And for the network no traveller can visit, it teaches something else: how open-source research about a closed society actually gets made.

Module 01

One app, two countries

Myth we'll unpick: "It's the same app with an English button."

Weixin (微信) and WeChat are one product, owned by Tencent, split in 2013 by a single mechanism: the phone number you register with. A mainland Chinese number creates a Weixin account under Chinese data and content law; any other number creates a WeChat account under the international terms. Same login screen, two sets of rules.

The branch point

9:41–

W

›

Simulation · 模拟

Educational mockup · no real registration

What just changed

Inspect the screen

Click a diamond marker on the phone to read the annotation behind that part of the screen.

Outside the wall is not outside the system

In 2020, Citizen Lab tested what happens to documents and images shared entirely between international WeChat accounts; no mainland account anywhere in the conversation. The content was still put under surveillance, and the results were used to train the censorship system applied to China-registered users. An account outside the wall is not beyond the machine; it is one of the machine's inputs.

Citizen Lab, "We Chat, They Watch", Research Report No. 127, May 2020 (Knockel, Parsons, Ruan, Xiong, Crandall and Deibert). The lab's director, Ron Deibert, described it as "essentially undertaking political surveillance on one segment of users". Their earlier report, "One App, Two Systems" (2016), gave this module its name.

Rules are one thing. Money is another. Next: what each account's wallet is allowed to do.

Two wallets

What this wallet is for

The feed, inspected

朋友圈Moments · the social feed

Educational mockup · simulated posts

What the machinery does with each post

Click a post to see the mechanism that runs over it. The posts are fictional; the mechanisms are documented.

Why this matters

If you travel, your account type was decided the moment you typed your number; it is not a setting you can change later. Your wallet buys but cannot send. Your posts are moderated lightly but read closely. None of this is visible in the interface, which is precisely why it is worth fifteen minutes of your attention now rather than a confusing first week on the ground.

Standard Australian government travel advice for China (Smartraveller) separately recommends assuming no privacy on hotel or public Wi-Fi and taking care with social media in tense periods; ordinary published precautions, worth reading before departure.

Sources used in this module: Citizen Lab, "One App, Two Systems" (2016); Citizen Lab, "We Chat, They Watch", Research Report No. 127 (May 2020); Beijing Municipal Government English portal, foreign bank card guidance (28 May 2025); China Briefing, foreign-wallet transaction limits; Cybersecurity Law of the People's Republic of China, Article 24 (2017); Measures on the Management of the National Network Identity Authentication Public Service, in force 15 July 2025 (via China Law Translate and the Library of Congress); Smartraveller China travel advice. Full detail in the project's verified-sources report.

Codex Lexpressia The languages hub

Module 02 · A contrast case, not a travel guide

The walled garden made physical

Myth we'll unpick: "It's just a stricter version of the same internet."

A darkened room; a desk with a keyboard and monitor by a window looking out over Pyongyang, the Taedong river and a slogan banner in the sky.

Illustration, not photography. A composed scene made for this deck; the view is a Pyongyang-style skyline, not a documentary image of a real room.

North Korea's Kwangmyong (광명) is not a filtered internet. It is a separate network that was never connected to the world to begin with; the wall is not software, it is the topology itself. Module 01 showed control built into an app; this shows control built into the wires. You cannot visit Kwangmyong from outside the country, which makes how we know anything about it part of the lesson.

The operating system that watches its own files

At the 2015 Chaos Communication Congress, German researchers Florian Grunow and Niklaus Schiess presented the first deep analysis of Red Star OS, North Korea's home-built operating system. It is styled to look like macOS but is a modified Linux underneath; it stamps an identifying watermark into files, including those passed hand to hand on USB sticks, so the spread of unauthorised media can be traced; and it protects itself, with an integrity system that can reboot the machine if its core files are altered.

Grunow and Schiess, Chaos Communication Congress, Hamburg, 2015. Researcher Will Scott, who taught in Pyongyang and has handled the system in country, offers a counterpoint worth carrying alongside: the watermarking should be read in the context of a strictly internal, offline system, not as outward-facing spyware. The latest confirmed version is Red Star 4.0, which has never publicly leaked.

That is the terminal. Now the network it connects to.

What grows inside

Everything on this list is reconstructed from defector accounts, leaked builds, and the small number of foreigners who have used the network in country. There is no live source a learner could browse; treat the names as documented sightings, not a directory.

Naenara내나라 · "my country"The portal and its browser: a modified Firefox built by the state's Korea Computer Center, with forced automatic updates that researchers flag as a plausible monitoring channel.

Manbang만방 · IPTVA state streaming service; on-demand television over the intranet, one of the network's most visible consumer faces.

Domestic e-commerce상점 · shopping sitesOnline shopping grew inside the wall too; roughly twenty-two shopping sites were counted by 2021, per specialist reporting.

E-wallets삼흥 · 나래Competing payment apps, Samhung and Narae, covering buses, the metro, taxis and shops; balances shown in both won and a virtual "foreign-exchange won".

The mandatory app광명 앱Since 2022, smartphones must carry a state "Kwangmyong app" as a prerequisite for intranet access; it also enables location tracking and device monitoring. The garden's gate is on the phone itself.

Not a smaller internet; a different organism, grown for propagation and payment, not connection.

How we know any of this

Nothing in this module came from browsing Kwangmyong, because nobody outside the country can. It came from leaked operating-system builds, defector interviews, tour-operator photographs and satellite-watching specialists, cross-checked against each other. That is the real lesson of the contrast case: open-source research about a closed society is an assembled mosaic, and knowing how the tiles were sourced tells you exactly how far to trust the picture.

Sources used in this module: 38 North / NK TechLab (Martyn Williams), including "More Than Smartphones" (July 2026) and the 2025 reporting on Red Star deployments; PSCORE, "Digital Hostages: Internet Freedom in North Korea" (June 2023); Grunow and Schiess, Chaos Communication Congress (2015); Will Scott, "Contextualizing RedStar OS" (2016); Radio Free Asia on the mandatory smartphone app (July 2022). Full detail in the project's verified-sources report.

Codex Lexpressia

Module 03

Red Star, up close

Myth we'll unpick: "It's just a Linux skin that looks like a Mac."

Module 02 told you what researchers found. Now stand at the machine. First a simulated desktop shows where each documented mechanism lives; then archival Red Star screenshots and a photograph of version 4.0, annotated so you can learn to read the menus and navigate the environment; then the two things every one of these screens assumes: the clock, the date, and the two number systems Korean runs at once.

The desktop that watches

파일편집보기

보안 ⛨갱신 ↻15:04

문서 · Documents

보고서_초안.doc42 KB

사진_모음.zip18 MB

영화_한편.avi (USB)1.2 GB

갱신 준비됨

Update ready. The software on this machine reports home; not to a vendor abroad, but to servers inside the country.

Simulation · 모의

Educational mockup · a generic desktop, not Red Star's actual interface

Inspect the machine

Click a diamond marker to see which documented mechanism lives behind that part of the screen. The desktop is a generic mockup; the mechanisms are from the 2015 analysis of leaked builds. The next screen shows the real thing.

A file can change before you read it

The file you never opened

The document as a reader sees it

meeting-notes.docx

Meeting notes

The meeting begins at three.

Bring the report.

Illustrative document · its visible text stays the same

In ERNW’s 2015 test, a DOCX file changed when its USB drive was attached to Red Star, without the researchers opening the document. Read the original experiment ↗

Read the real screens

Read the marked part

A decade on, the walls got thicker

In mid 2025, offices in Pyongsong began replacing their computers with new machines running Red Star: fingerprint login, no USB or SD support at all, and a security suite called Shield Program. The researchers' decade-old finding that the system watches removable media has been answered, in the newest builds, by removing the media.

Reported by Daily NK and 38 North / NK TechLab (August 2025). Version history: 1.0 in 2008; 2.0 completed June 2009; 3.0 released April 2012 and leaked abroad in 2014; 4.0 confirmed by January 2019 and photographed in 2020, but never publicly leaked; no version 5.0 is confirmed. Windows XP reportedly remains widespread despite the domestic OS push.

The same question follows us from desktop to phone: what does the device remember?

From the desktop to the pocket

What the device remembers

The wall also reaches into files and records of use. Red Star and North Korean Android devices reveal different ways of controlling what travels and what remains.

01

A file acquires a mark

Red Star’s watermarking can leave evidence that a file encountered a particular machine. A device trace is not a complete account of everyone who carried the file.

02

A file must be accepted

On Android devices examined by researchers, signature checks decide whether media can be opened. A watermark and permission to open a file are different mechanisms.

03

Activity becomes a record

Trace Viewer lists screen captures and application activity. The Haeyang 701 stills in the next page let you read an actual log: two tabs, a count, names and timestamps.

The Haeyang 701 uses Android 10; it is not a mobile edition of Red Star. Sources: NK TechLab’s device catalogue; Project Reveal, pp. 9–10.

Read the Haeyang record →

Two number systems, one clock

3:30오후 · afternoon

Native Korean numbers Sino-Korean numbers Unmarked: the counter word

How to read it aloud

The year on the screen

주체 103년

as printed on a document header

The system behind it

Juche year = Gregorian year minus 1911. The calendar counts from 1912, the birth year of Kim Il Sung, and for decades it dated everything: newspapers, documents, screens. In late 2024 it was quietly retired from official use; the 2025 print calendars were the first in a generation without it. Several archived Red Star and Naenara screens carry Juche dates; other devices use Gregorian dates. The calendar must be read from each source, a reminder that every OSINT snapshot is a photograph of a moment, not a live feed. You have already read three of them on the real screens: 주체99(2010)-03-20 on the 1.0 taskbar, 주체99(2010)-02-24 on the games screen, and 주체110.04.03 on the 3.0 network panel.

What you can now read

You have now read menus off archived Red Star screens, met the words the two Koreas split on (내리적재, 탁상화면, 콤퓨터, 회수통), and learned the two number systems every Korean clock runs at once, plus the Juche dates found on several archived screens. Other devices display Gregorian dates, including the 2023–24 phone logs in the next page. You can now interpret a displayed date and read the interface around it. A device clock is evidence to assess, not proof of when or where a screenshot was made.

Sources used in this module: archival screenshots via Wikimedia Commons and the Wikipedia article "Red Star OS" (retrieved 3 August 2026), authors and licences as captioned per image (KCC via archive.org and instiz.net; ItzJezze, own work, CC BY-SA 4.0, 2023; NK Kyongje / NKEconomy, 2020; "Windowing in Red Star Linux", 2011); version dates per the same article; Grunow and Schiess, Chaos Communication Congress (2015); Will Scott, "Contextualizing RedStar OS" (2016); Daily NK and 38 North / NK TechLab on the 2025 Red Star deployment (August 2025); NK News (October 2024), Radio Free Asia (December 2024) and Korea Times (February 2025) on the retirement of the Juche calendar; the North-South vocabulary splits cross-checked against this project's Korean divergence briefing; the hour-and-minute reading rule is standard Korean grammar, taught in full in this site's "Two ways to count" walkthrough.

Next deck: the phone that corrects you → Two ways to count: the full walkthrough Codex Lexpressia