On February 22, 2019 a group of unidentified individuals attacked the Embassy of the Democratic People’s Republic of Korea (DPRK) in Madrid. A few days after the incident, the Reuters News Agency and Spanish online newspaper El Confidencial published reports, citing sources in Spain’s Ministry for Home Affairs, that said the attackers had burst into the embassy, tied up its staff and spent approximately four hours in the premises. One of the female employees managed to escape and call for help. When the police arrived at the scene, a man who looked like a member of the embassy staff came out and told the authorities that everything was in order. Some time later, two cars drove out of the embassy gates at high speed and escaped in an unidentified direction. The attackers took computers and mobile phones of the staff with them.
On March 10, El Confidencial pointed out that investigators had still not been able to identify the attackers. Various theories have been put forward about the incident, including a hypothesis that the attack on the diplomatic mission had been organized by the CIA.
On March 13, Spanish newspaper El Pais cited unnamed Spanish government sources in its report saying that evidence had emerged indicating “two of the attackers had connections to the U.S. Central Intelligence Agency (CIA).” Later on there were claims that the attackers spoke Korean and appeared to be of Asian descent. The fact that North Koreans did not officially enlist the help of the police was also highlighted.
On March 15, The Washington Post, citing anonymous sources, reported that the attack had been organized and staged by a secret organization of dissidents, called the Cheollima Civil Defense, which carried out the raid without any assistance from any of the intelligence agencies. However, officials from the governments of North Korea, the United States and Spain refused to comment on this.
Then Spanish newspaper El Pais wrote that once the authorities had analyzed video recordings, interviewed hostages and checked embassy vehicles, used by the intruders to escape, they were able to identify some of the attackers. Most of them were Koreans, but, according to Spain’s intelligence agencies, at least two of them admittedly had ties with the CIA. Evidence pointing to CIA involvement was considered to be so convincing that the Spanish authorities contacted the CIA but failed to receive satisfactory answers from the organization.
On March 27, news agency France-Presse, citing Spain’s General Council of the Judiciary (Poder Judicial Espana) as a source, reported that a key figure in the investigation was Adrian Hong Chang (a Mexican citizen residing in the USA), who is a known activist in the anti-North Korean movement. A Spanish court issued an arrest warrant for him.
That same day, the Cheollima Civil Defense, which was re-named after the incident to Free Joseon, claimed responsibility for the raid on the embassy. The group’s comments on the event were as follows “This was not an attack. We responded to an urgent situation in the Madrid embassy. We were invited into the embassy, and contrary to reports, no one was gagged or beaten. All occupants in the embassy were treated with dignity and necessary caution.” The group also stated that the North Korea–United States Summit in Hanoi had nothing to do with the operation, and, in general, Free Joseon did not collaborate with any of the governments or intelligence agencies of any countries, as their single aim was to topple Kim Jong-un. In addition, they said that the DPRK government was an enormous criminal enterprise and North Korean embassies were used to traffic drugs and weapons. Therefore, these diplomatic missions should not have diplomatic immunity.
Free Joseon also confirmed that it “shared certain information of enormous potential value with the FBI in the United States, under mutually agreed terms of confidentiality.”
However, court reports about the investigation in Spain, which mass media outlets have been citing, indicate that the group offered to share materials and video data with federal agents on its own initiative.
On March 31, DPRK issued its first comments about the attack on its embassy. The Korean Central News Agency (KCNA) published a statement, made by a spokesperson of the Ministry of Foreign Affairs, calling the raid “a grave terrorist attack”. This document alleged that the assailants “bound, beat and tortured” the DPRK Embassy staff in Madrid and “extorted the communication apparatus”. The statement also said “An illegal intrusion into and occupation of diplomatic mission and act of extortion are a grave breach of the state sovereignty and a flagrant violation of international law, and this kind of act should never be tolerated over the globe.”
The Foreign Affairs Ministry of DPRK also urged for an investigation into the attack and highlighted that North Korea was diligently following “the rumors of all hues now in the air that FBI of the United States and the small fry of anti-DPRK ‘body’ were involved in the terror incident.” The ministry also expressed hope that “the authorities concerned in Spain, a place of incident, carry out an investigation into the incident to the last in a responsible manner in order to bring the terrorists and their wire-pullers to justice in conformity with the relevant international law,” and said North Korea would patiently wait for an outcome.
All in all, the most accurate description of the attack on the embassy (data obtained by El Pais from the report released by Judge Jose de la Mata is as follows. Adrian Hong Chang was the leader of the raid, and the group of assailants included citizens of South Korea (at least one, identified as Ram Lee) and of the United States (someone named Sam Ryu, most likely a Korean American).
Approximately 10 attackers were armed with gas pistols, a machete, knives, replicas of handguns and metal rods. They all had cameras that broadcast a live feed. Once the assailants were inside, they began to beat embassy staff members, and then tied them up with handcuffs, restraints and cable ties to immobilize them. For the next four hours, the attackers were in complete control of the embassy.
Several embassy employees were subject to harsh interrogations, which involved the use of force. The questioning was so violent that afterwards, two of the staff members required medical assistance, and one sustained a serious injury to his face. In addition, portraits of DPRK leaders were smashed against the floor for show. Shortly afterwards a video, showing these actions, was uploaded to the group’s website, and portrayed as an example of actions, taken by an anonymous resistance movement against the DPRK regime somewhere in North Korea.
Then one of the female hostages managed to escape from a second-story window. She alerted the neighbors, who immediately called the police. According to another version of the story, a passer-by was the one who called for help.
When the police arrived at the gates of the embassy quickly, Adrian Hong Chang, dressed in a suit adorned by a pin depicting Kim Il-sung and Kim Jong-il, met the officers and told them that everything was in order inside.
The police remained near the building to monitor developments. Soon afterwards the embassy gates opened and two luxury cars with diplomatic license plates left the premises. The cars were not followed by the police and were soon found abandoned nearby. The assailants stole two computers, two hard drives, thumb drives and a cellphone.
Then attackers split up into four small groups and traveled to Lisbon, from where they flew to Newark. On February 27, Adrian Hong Chang handed information connected to the embassy incident, including audio and video recordings, over to the FBI.
What could have been the goal of the raid, from the author’s point of view? There are several theories.
- The attack was clearly meant to serve as propaganda. For the first time, the group, portraying itself as an anti-Pyongyang movement, showed its true capabilities, and did not simply resort to photographs of anti-Kim Jong-un posters, taken by unknown individuals in an unidentified location at an unspecified time. Sung-Yoon Lee, a specialist on North Korea at Tufts University, said the attack made the group newsworthy.
- The stolen computers are very valuable, especially if we choose to believe a theory that encryption equipment was also part of the “booty”. Hwang Jang-yop, a former diplomat and, at present, a defector, is in favor of this hypothesis. If the FBI is in possession of a computer with special encryption software for decoding secret messages, exchanged by Pyongyang and its embassies, North Korea has to immediately reorganize its entire system of communication with its foreign offices.
In addition, in Sung-Yoon Lee’s opinion, the stolen information could include “contacts and documents related to North Korea’s efforts to bypass sanctions and import luxury goods from Europe“. Attorney Joshua Stanton, who helped the U.S. House of Representatives draft sanctions against Pyongyang, wrote in his blog, One Free Korea, that “those computers and phones will contain contacts to recruit and exploit, emails to read and post online, and bank accounts to drain.” In his opinion, the “booty” contains potentially incriminating material on business partners, secret bankers and DPRK spies, which “could provide invaluable leads for law enforcement.”
Finally the raid, which occurred only a few days before Donald Trump and Kim Jong-un were scheduled to meet in Hanoi, could have led to a disruption of the Summit between the U.S. and DPRK leaders. Sue Mi Terry, a former Korea analyst at the CIA, highlighted that any indication of U.S. involvement in the raid on the embassy could have derailed the talks between the two parties. However, it was noticeable that neither side mentioned the incident in question while examining the reasons why the summit was unsuccessful.
- We would also like to remind our readers that Kim Hyok-chol, currently a key figure in the negotiations with the United States, was the Ambassador to Spain earlier on. In September 2017, Kim Hyok-chol was declared persona non grata and expelled from the country after North Korea conducted yet another nuclear test. But up until recently, he was not a widely known figure with little information about his past. Any data about Kim Hyok-chol’s past activities will be useful to quite a few people.
One way or the other, an attack on and occupation of a foreign embassy is a rare occurrence. It is reminiscent of events that took place in February 1979 in Iran and in December 1996 in Peru.
A number of experts are not convinced that the raid was carried out by an “independent group” comprising defectors and freedom fighters. In their opinion, there are very few defectors with such skills, and they are all working for or with one intelligence service or other. If defectors had begun engaging in such activities, they would have immediately ended up being controlled by special services. In addition, defectors either do not speak much English or not at all, and have only limited experience working outside of East Asia. Plus secret operations of this nature cost a lot of money.
The author notes that if we view the assailants as people with different backgrounds, who were not all defectors, some of the doubts, expressed by experts, are dispelled. Protestant Sects that view the destruction of DPRK as their “sacred mission” are sufficiently wealthy, and their members have various useful ties and connections. In addition, a fairly small diplomatic mission, which is not guarded around the clock from the outside (otherwise the police would have noticed the attackers when they forced themselves inside), is an appropriate target for such a raid.
Media outlets affirm that Spanish intelligence services have solid evidence proving that members of the group at least twice met with CIA representatives. However, “unwilling to risk destabilizing Spain’s relations with the U.S. over the issue,” this proof was not cited in the official court account. Soon afterwards, Spanish investigators leaked information about the alleged connection between the group and the CIA to local media outlets, including El Pais, as far back as mid-March.
Currently, Madrid is planning on securing an extradition of the ten suspects from the United States, the group includes Adrian Hong Chang and also citizens of the USA and South Korea. Names of the other assailants will also soon be released, as the court cannot simply demand to have unidentified individuals to be extradited from the United States. All the suspects face 28-year prison sentences.
This is all the information about the investigation to date, but the story about the Cheollima Civil Defense and what hides behind its mask is a tale for another time.
Konstantin Asmolov, Ph.D. in History, leading research fellow at the Center for Korean Studies of the Institute of the Far East at the Russian Academy of Sciences, exclusively for the online magazine “New Eastern Outlook.”