MEN IN BLACK
Who’s Really Behind the Mystery Group That Busted Into North Korea’s Madrid Embassy?
No one has claimed credit for the raid that seized a trove of intel just before the Trump-Kim summit. CIA? North Korean exiles? Rogue South Korean spooks? Or all of the above?
SEOUL—The 10 men in dark suits who raided the North Korean embassy in Madrid last month had one goal in mind, it would seem: to overthrow the regime of Kim Jong Un.
Although the scene of the Feb. 22 crime in Spain was many thousands of miles from the DMZ, analysts view the 10 involved as the cutting edge of a North Korean dissident group that’s now named Jayu Joseon, “Free [North] Korea.” It allegedly has the backing of some wealthy Koreans and foreigners as well as ties inside the North—apparently the first organization to have set up an operational challenge to the leadership in Pyongyang.
The immediate purpose of the break-in was to seize computers and cellphones on which intelligence analysts could find top-secret message traffic to the former North Korean ambassador to Spain, Kim Hyok Chol.
He was expelled by Madrid in September 2017 after the United Nations imposed new sanctions on the North for its nuclear and missile tests. But at the time of the raid last month he had a much more sensitive position: Pyongyang's envoy to the nuclear talks with Washington and Seoul.
The group busted into the embassy just five days before the summit in Hanoi between U.S. President Donald Trump and North Korean leader Kim Jong Un, which would have made any intelligence it picked up useful—but has also been cited by analysts as a reason it was not sanctioned by the Americans. The timing would seem to be too provocative and the risk of scuttling the summit too high.
In any event, for a multitude of reasons anticipated long before the Madrid incident, the Hanoi summit was a failure.
Initial reports in Spain after the break-in did not mention Jayu Joseon (formerly named Cheollima Civil Defense), but did mention suspicions among unnamed Spanish authorities that two of the men who took part had unspecified connections to the U.S. Central Intelligence Agency.
Subsequent reports in The Washington Post and elsewhere have suggested Jayu Joseon operates entirely on its own. But the very long record of exile/underground movements around the world suggests they almost always have at least some support from foreign powers, and may also receive direction from them.
Yet another sign of the extreme sensitivity of the Madrid operation is that Spanish authorities have not released any information on their investigation aside from the basic facts that the 10 men entered the embassy, beat up and tied eight people inside, and remained there for several hours.
Jayu Joseon has yet to comment on the Madrid raid. Indeed, it might not have been publicized at all had a police vehicle not shown up at the embassy after a woman freed herself and appeared at a window shouting for help.
When a police officer knocked on the door, a man opened it up and said there was no problem. The police, respecting the embassy’s diplomatic status, did not attempt to enter and see for themselves.
Finally ,the 10 fled in two luxury vehicles that sped through the opened gates of the embassy drive. The cars veered crazily through traffic before they were abandoned and the men disappeared without a trace—at least as far as public information is concerned.
Compounding the mystery is the fact that North Koreans are not commenting on an episode that had to have embarrassed them by revealing the weakness of their own security and the loss of potentially valuable information known only at the highest levels.
Even when Spanish police first leaked word that two of the 10 had links to the CIA, it was evident Madrid authorities knew a lot more. Surely they would have searched and traced the vehicles to their owners, and they would have been expected to track down at least some of the 10 rather than let all escape so cleanly, in broad daylight, leaving no clues as to who they were or who was behind them.
(In that respect, the operation is reminiscent of the sloppy CIA kidnapping of a jihadi off the street in Milan in February 2003, which eventually exposed the cooperation of local intelligence services as well.)
“That’s why many believe the CIA did that,” said Kim Tae-woo. “That explains the silence of the the Spanish government.”
Jayu Joseon, or Cheollima, did not appear out of nowhere. It previously promoted Kim Jong Nam, Kim Jong Un’s rather more mellow, fun-loving and quite talkative older half-brother, to overthrow and replace him.
Kim Jong Nam was murdered in February 2017 when VX nerve agent, which is part of North Korea’s chem-bio warfare arsenal, was smeared on his face at Kuala Lumpur’s airport.
After the murder, presumed to have been orchestrated by Kim Jong Un’s agents, Jayu Joseon took credit for spiriting Kim Jong Nam’s son, Kim Han Sol, along with his mother and sister, out of their home in Macao and taking them to a foreign country, widely thought to be Finland since Han Sol broadcast a sorrowful message on Finnish TV.
The Madrid 10 are assumed to have transferred the computers and mobile phones to a foreign intelligence agency. An auction to the highest bidder would not be unprecedented in such matters, but most of the suspicion is focused on the CIA, which, if it could access the encrypted material in time, could have found information potentially useful for the Hanoi summit and afterward.
“They can see the North Korean strategy and goals,” said Kim Tae-woo, former director of the Korea Institute of National Unification here.
Money for that possible treasure trove of information would have been only one motive for the raid. Patriotism and power are the core incentives for the group, said to be spearheaded by defectors from North Korea and what appear to be foreigners with a stake in their activities.
One strong sign of foreign involvement, says Kim Tae-woo, is that Korean-language statements on their website are written awkwardly, reflecting authorship by one whose Korean is less than perfect.
Adding to the suspected CIA connection are reports that the late Kim Jong Nam, before he left his hotel in Kuala Lumpur for the airport, had been seen talking to an American. Then, after he was murdered by the two women who smeared the VX agent on his face, $124,000 in $100 bills reportedly was found in his bag, leading to speculation that he had been paid off for services to the Americans or to promote Jayu Joseon or both.
Suspicions that Kim Jong Nam might have wanted to seize power no doubt spurred Kim Jong Un to want to get him out of the way.
Two young women, one from Indonesia, the other from Vietnam, actually smeared the poison on on Kim Jong Nam’s face in the crowded airport, but four North Koreans were caught on camera watching the whole episode. They had convinced the women this was a harmless prank for which they paid them a small sum. The four, listed as wanted by Malaysian police, quickly checked onto flights out of the country.
The Indonesian was freed by the court last week after prosecutors dropped the case against her, but the Vietnamese woman has been ordered to stand trial.
Early the morning of the court hearings, someone spray-painted on the walls of the North Korean embassy in Kuala Lumpur, in Korean Hangul script, “Free North Korea” (Jayu Joseon), and “Down with Kim Jong Un.”
“North Korea sends important messages to every embassy every month or so,” said Ken Eom, who defected to South Korea 10 years ago. But Jayu Joseon is believed to have selected the North Korean embassy in Spain rather than the much larger North Korean embassy in Stockholm, Sweden, the center of North Korean operations in Europe, for two reasons. First, the installation in Madrid, without the ambassador there, was not so tightly guarded as other embassies. And, second, Kim Hyok Chol while he was there would have been privy to the highest level of messages.
Whatever the planning, the raid exposes what is evidently the first sign of armed opposition by a North Korean dissident group against Kim Jong Un and his oppressive regime.
“We can be 99.9 percent sure that Cheollima [Jayu Joseon] carried out the raid,” says Lee Sung-yoon, professor at the Fletcher School of Law and Diplomacy at Tufts University. “They had all the incentive.”
As noted, Ambassador Kim Hyok Chol, after his expulsion, emerged as the North’s chief negotiator in the very difficult pre-summit dialogue with the U.S. envoy on North Korea, Stephen Biegun, and some of the message traffic since his departure from Spain was presumed to concern those talks. The messages may have kept on coming for some time through the embassy in Spain even though he would see them elsewhere. Or at least that may have been the assumption of the Madrid 10.
The organization appears to have gone quiet after the Kim Jong Nam incident two years ago, with the Madrid incident marking a spectacular comeback.
It should be noted that South Korean President Moon Jae-in was elected in May 2017 and almost certainly would not tolerate covert action against North Korea by South Korea’s National Intelligence Service (NIS).
“The NIS under Moon would definitely not be involved,” said David Straub, former senior diplomat at the U.S. embassy in Seoul. “The Moon administration’s policy involves appeasement of Pyongyang; this action is the opposite of that.”
Many NIS operatives reportedly have been laid off under Moon, however, and just as retired South Korean military officers are often quite critical of what they see as the government’s current soft line against North Korea, so out-of-work NIS people speak derisively of the trend to ignore or silence them.
Malcontents have reason to criticize the government’s policies. “So many have been ousted, they’re very upset,” says Kim Tae-woo. But might a few want to consider supporting an armed movement against the North? “Theoretically it’s possible, but there is no evidence.”
For the record, both the U.S. and South Korea officially profess complete ignorance of the whole affair beyond what they’ve seen in the media. “I have nothing to share at this time,” said a U.S. embassy spokesman here. “We have nothing to confirm,” echoed a voice at the South Korean foreign ministry.”
Jayu Joseon on its website, in correct English, gives the cruelty of the North Korean regime as the reason it cannot identify its members, much less where they are.
“Do not forget how merciless the regime is,” says the message on the site. “Identification of one person may reveal the identity of another member.” The website says “compatriots and relatives have lost their lives in the hands of the regime” and those who are imprisoned “will be put to death if it is revealed that they have dissenters in their families.”
Jayu Joseon “established credibility by acting quickly and getting Kim Han Sol, the son of Kim Jong Nam, to safety within days of his father's gruesome assassination on Feb 13, 2017,” said Lee Sung-yoon.
“An aura of mystery was created,” said Lee. “Mystique and aura create expectations of more dazzling feats to come. But for the next two years the group was silent. Then the raid on the DPRK Embassy in Madrid came just five days shy of the Trump-Kim Jong Un summit in Hanoi.”
Lee is among those who believe the Cheollima organization, short of funds, may have hoped to use these CIA connections to unload all these computers and phones for a fat fee. “Approaching the U.S. government with the assets retrieved in Madrid would possibly secure the group some protection and even support behind the scenes,” he said.
Lee questions, however, whether the CIA would have planned the operation, reasoning, “For the CIA to commit such a brazen act—and almost get caught in the middle of it—and undermine Trump's leverage would have been tantamount to treason.”
Analysts say Jayu Joseon is angling for support inside North Korea as well despite the obvious dangers of exposure and execution of anyone caught by Kim Jong Un’s security apparatus. “Senior defectors say these guys have to have contacts,” said Kim Sung-bak, Hanyang University expert on North Korea. “They try to establish themselves as the legal government.”
Chances of success are not good. “It's hard to imagine any opposition group outside North Korea having ties and support inside the DPRK,” said a retired U.S. official who asked that his name not be used. “The risks are just too high and the internal security in the North is just too tight and pervasive.”
Be that as it may, the shadowy figures behind the participants in the raid promise a long struggle.
“Please do not forget the kind of ruthless regime we are up against,” says a message on the website. “They have no respect for international norms. The struggle we are engaged in with the incumbent regime is not a political race between equals, but a small revolutionary group, fighting and resisting a totalitarian regime that maintains concentration camps, keeps its people enslaved, and regularly kills its opponents and their families.”
The inference was clear. They intend to be heard from again. The rescue of Kim Jong Nam’s son and the raid in Madrid are not likely to be the end of the story. In Kuala Lumpur, the writing was on the wall.
Itxu Díaz in Madrid also contributed reporting to this story.