Cloak and Dagger

Anatomy of a North Korean Assassination

Put aside for a moment the geopolitical implications. How did the assassins evidently sent by North Korea’s Kim Jong Un to murder his half brother get the job done?

BANGKOK—One by one, on different flights at different times, four men from North Korea flew into Malaysia over the course of a fortnight in February, coming together finally in a condo apartment on Kuchai Lama Street in a bustling middle-class suburb on the edge of the country’s sprawling capital, Kuala Lumpur. According to multiple reports, after the murder and at the height of the scandal, they huddled frequently with Ri Jong Chol, a 47-year-old North Korean who holds a science degree and who moved to Malaysia in August 2016.

Ri worked for an outfit called Tombo Enterprises. According to its website it makes anti-cancer supplements and emphasizes “wholesome treatment” built around herbal medicines. But Ri may have been more useful to the new arrivals for a particular set of skills: handling and combining the binary components of the deadly nerve agent VX, the weapon of mass destruction that would be used to kill Kim Jong Nam, estranged older half-brother of North Korean dictator Kim Jong Un.

VX, which is outlawed around the world by signatories of the Chemical Weapons Convention, is a slightly yellow liquid with no smell and no taste. When it’s dispersed as an aerosol, victims do not know they have been affected until they begin to die, quickly and horribly, more or less like flies zapped with bug spray, choking, twisting, and kicking as their nervous system shuts down. In one infamous incident at the Dugway Proving Grounds in Utah in 1968 more than 4,000 sheep were killed by accident some 30 miles from the test site.

But how do you handle such dangerous stuff, using it to kill one man instead of a whole crowd, especially if your best shot at that man is likely to be in a public place?

John Robertson, a poisons expert, has told the publication of Britain’s Royal Society of Chemistry that one plausible technique would be to mix the two components of VX on the face of the victim.

That would require two hands at a minimum, or better yet, two people. Then the question would be, who could approach the pudgy playboy Kim Jong Nam while raising the least suspicion?


It’s not clear how the four men on Kuchai Lama Street hooked up with two young women called Siti Aisyah and Doan Thi Huong, both of whom have been arrested, both of whom have said they are innocent, and both of whom face the death penalty if convicted.

Siti, an Indonesian in her twenties, had been working as a masseuse and nightclub hostess, and reportedly was out partying with friends the night before the slaying. Doan, 28, is a Vietnamese who flew into Kuala Lumpur from Hanoi on Feb. 4. She also had been working as a hostess. On her Facebook page she posted under the name Ruby Ruby.

But the more details are revealed about their backgrounds, the murkier those become.

Citing travel documents she was carrying when arrested, Malaysian police identified the Indonesian as Siti Aisyah, of Serang, the capital of Indonesia’s Banten province. But Indonesian-language websites suggest she is from the village of Angke, near Jakarta, and that there are two listings for her there: One indeed identifies her as “entrepreneur” Siti Aisyah, 25; the other says she is “housewife” Siti Aisah and that she is 27.

Indonesians do not typically have two ID documents.

Get The Beast In Your Inbox!

Daily Digest

Start and finish your day with the top stories from The Daily Beast.

Cheat Sheet

A speedy, smart summary of all the news you need to know (and nothing you don't).

By clicking “Subscribe,” you agree to have read the Terms of Use and Privacy Policy
Thank You!
You are now subscribed to the Daily Digest and Cheat Sheet. We will not share your email with anyone for any reason.

One site says Siti is divorced from an Indonesian man and has a 7-year-old son she rarely sees. She was married when she moved to Malaysia in 2013, one site said, but subsequently split from her husband.

She reportedly met the man, or men, who hired her for the Kim Jong Nam hit at a nightclub where she works in Kuala Lumpur. Local reports say she told police the men she met looked “Korean or Japanese.”

Broadcast reports say Doan Thi Huong is an aspiring singer who competed on Vietnam Idol, her country’s version of the global “Idol” franchise. A video of the program shows a woman apparently auditioning who looks remarkably like Doan. She sings for just a few seconds before one of the three judges interrupts her and says, “OK,” a dismissal. She also says “OK,” and bows demurely. But the contestant’s name that’s flashed on the screen is Dinh Thi Khuyen, not Doan Thi Huong.

A Facebook page attributed to Doan, which includes a couple of dozen Korean-sounding names among her “friends,” shows several photos of a woman with dyed reddish hair dressed provocatively. In one she wears a very fitted cheongsam, the classic one-piece Chinese dress, and in another she’s sporting a red one-piece swimsuit. She is also pictured wearing a white, long-sleeved T-shirt emblazoned with the letters LOL.


Malaysian authorities say that prior to the incident at the airport, Siti and Doan staged a couple of practice runs, moving in on hapless “victims” at shopping malls with what presumably were benign chemicals or none at all.

On the morning of Feb. 13, police say, Siti and Doan entered Kuala Lumpur International Airport Terminal 2, known as KLIA2. It’s the home base of Air Asia, one of the world’s most successful low-cost carriers, and at any given time it’s likely to be full of holidaymakers and business people on a budget. It would have been teeming with backpackers, tour groups, and adventure seekers, the departure area full of people waiting to board flights.

What grainy CCTV video shows from Feb. 13 is a portly man subsequently identified as Kim Jong Nam wearing a light blue suit and carrying a medium-sized bag on one shoulder. Suddenly, a woman rushes up behind him and forcefully throws both arms around his neck as if to restrain him. Then a second woman comes up to him from the front and puts something—perhaps a rag or tissue paper—in his face. It all happens very quickly, and there appears to be little commotion around the heavy-set “tourist” and the women, who briskly walk away after attacking him.

One of the women, apparently the one who approached from behind, was wearing a white long-sleeved T-shirt. Another surveillance camera caught a clearer picture of her. The letters LOL were emblazoned across the front of the shirt.


The 45-year-old Kim Jong Nam has known for years that his 33-year-old half-brother, Kim Jong Un, the world’s most dangerous nuclear-armed dictator, wanted him dead. Jong Nam had questioned the right of his family to heredity rule, and there was a reported attempt on is life in 2011. But for years Jong Nam has lived in Macau under the protection of the Chinese, who may have deemed it wise to hold him in reserve as an alternative or at least an implied threat to their impetuous young client in Pyongyang.

Jong Nam has always been restless. He once famously got caught trying to visit Disneyland Japan using fake papers. In Kuala Lumpur, he was traveling on a passport under the name Kim Chol and posing as a businessman. He apparently believed that by traveling incognito on a low-cost carrier he could dispense with a phalanx of bodyguards.

Almost immediately after the LOL woman and her accomplice carried out their attack, police said, Jong Nam rushed toward employees at a nearby help desk, gesturing at his face, telling them he could not breathe well. First-aid workers soon placed him on a stretcher, police said, and as Jong Nam began to choke, the emergency crew left with the stricken victim, heading toward a nearby hospital. But he died in agony on the way, less than 20 minutes after he first ingested the poison.


At a news conference, Malaysian Health Minister Subramaniam Sathasivam said, “VX only requires 10 milligrams to be absorbed into the system to be lethal, so I presume that the amount of dose that went in is more than that.” If he inhaled the substance, or it went in through his tear ducts, a smaller quantity might have sufficed. But in any case, “The doses were so high and it did it so fast and all over the body,” said the minister. “So it would have affected his heart, it would have affected his lungs, it would have affected everything.”

Malaysia promptly launched an investigation, ordering an autopsy of Jong Nam—over the objections of North Korea, which demanded the body’s immediate release, and accused the police of desecrating the remains of a citizen of the so-called Democratic People’s Republic of Korea.

Kang Chol, the country’s ambassador to Malaysia, declared that the North had nothing to do with the death of that citizen—to whom he doggedly referred as Kim Chol.

South Korean acting-President Hwang Kyo-ahn decried the killing as “an intolerable crime against humanity and terrorist act.” In Seoul, government elements told reporters they believed the plot was hatched and carried out by North Korea’s foreign and security ministries.

Malaysia accused the plotters of endangering the lives of thousands of passengers by exposing them to a weapon of mass destruction. Luckily, a hazmat sweep found no evidence of VX contamination at the airport, which quickly went back into service.


On the outskirts of Kuala Lumpur, the hit squad abandoned the safe house on Feb. 13. At least three of the men fled to neighboring Indonesia: Hong Song Hac, Ri Ji Hyon, and Ri Jae Nam boarded Emirates Flight EK0359 at 10:20 p.m. local time bound for Dubai. No one knows how the fourth, O Jong Gil, got out of Malaysia, but it appears he is gone, too. All are said to have returned to Pyongyang on Feb. 17, presumably to the huzzahs of the increasingly paranoid, erratic, and murderous Kim Jong Un, who recently ordered the execution—by anti-aircraft guns—of five senior officials who made supposedly false reports that enraged the young tyrant.

Not all members of the black op got away in the initial police roundup. In addition to the women, police held Ri Jong Chol, the medicine-manufacturer employee, but subsequently released him. He gave a press statement in front of the North Korean embassy in China protesting his innocence.

Malaysian authorities believe at least seven North Koreans were involved in the attack. One person they want to question is North Korean embassy Second Secretary Hyon Kwang Song, who some believe ran the operation from his office. Because of diplomatic immunity, Hyon would have to consent to an interrogation—which isn’t going to happen.

Police also would like to interview Kim Uk Il, an employee of the North’s flag carrier Air Koryo, who apparently was at the airport when Jong Nam was killed—and also is believed to be hiding out in the embassy.

One of the women, Siti, has told authorities her recruiters told her she would be playing a practical joke on a businessman for a TV show, claiming she was paid $90 for tossing some “baby oil” on the man’s face. But National Police Chief Khalid Abu Bakar has said the woman seen on video daubing VX on Jong Nam’s face clearly knew she was carrying out an attack, not some reality TV stunt. And the women’s claims don’t explain why they rushed to wash their hands after the incident. Nor why they’re still alive.

Siti vomited after she was nabbed by police, but both women should have been severely injured—if not killed—through close contact with the VX. That they were not has led police to question whether their handlers gave them atropine, an antidote for the WMD.

Did the four men smuggle VX or its components into Malaysia? Did their local contact help mix it right there in Kuala Lumpur, or show the women how to combine the elements on Jong Nam’s face? Was it brought in through North Korean official channels, perhaps in diplomatic mail that is not subject to normal customs procedures? And was the whole affair coordinated by North Korea’s shadowy spy agency the RGB (Reconnaissance General Bureau)?

“It is very likely that the VX was smuggled into Malaysia either in person or as cargo,” says Rohan Gunaratna, head of the International Centre for Political Violence and Terrorism Research in Singapore. “There is also a possibility that the North Korean embassy smuggled it in by diplomatic pouch.”

A few days after the murder, Pyongyang sent a high-level delegation to Malaysia for talks aimed at claiming the body of Kim Jong Nam/Kim Chol, and springing Ri Jong Chol. Group spokesman Ri Tong Il told reporters the envoys also wanted to further develop “friendly relations” between the two governments. The two countries had enjoyed reciprocal visa-free travel, although mutual trade amounts to less than $10 million. Pyongyang had seen Malaysia mostly as an entry point into Southeast Asia—a region the North wants to be friends with as a means of countering Seoul.

But improved relations now seem unlikely, even impossible. Both countries have been lobbing angry accusations at each other, including a blast from Pyongyang that KL’s investigation has been awash in “weak points” and “contradictions.” The Malaysians recalled their ambassador from Pyongyang, and are said to be even more suspicious since someone apparently tried to break into the morgue where Jong Nam’s body was held.

Pyongyang was not getting any love from China either. China is unlikely to abandon its protégé any time soon, but there’s no question Beijing’s patience is wearing thin as his behavior gets weirder.

A video surfaced earlier this week in which a young man who says he is Kim Jong Nam’s son tells the camera he is with his mother and sister and concludes, “We hope this gets better soon.”

Siti and Doan will next appear on April 13, when prosecutors will ask that they be tried jointly in a higher court. At the request of defense lawyers, the judge slapped a gag order on the case, the better to protect the women’s rights and their prospects for a fair trial. Expect frequent leakage.


with additional reporting by Christopher Dickey