North Korean Resistance Group Was Reportedly Behind Mysterious Embassy Raid In Spain

A little-known group actively seeking to undermine North Korean Premier Kim Jong Un and his regime, known as Cheollima Civil Defense, was responsible for a bizarre break in at the country’s embassy in Spain, according to a new report. Four weeks after the incident, there are still few hard facts about what exactly happened at the compound in Madrid.

The Washington Post, citing “people familiar with the planning and execution of the mission,” was first to report the connection to Cheollima Civil Defense, also known as Free Joseon, a reference to the last dynastic kingdom on the Korean Peninsula, on Mar. 15, 2019. This comes two days after a separate story in the Spanish newspaper El Pais, citing unnamed Spanish government sources, alleging that two of the attackers had connections to the U.S. Central Intelligence Agency (CIA).

Spanish, North Korean, and American authorities declined to comment when The Post asked whether Cheollima Civil Defense or the CIA were involved in the raid. The newspaper’s sources also reportedly told them that there had been no coordination with any intelligence agencies.

The incident itself occurred on Feb. 22, 2019. Around 10 unidentified masked individuals briefly took control of the North Korean Embassy before fleeing the scene in two cars after reportedly tying up and interrogating members of the staff and stealing cell phones and computers. The Post’s report did not ascribe a particular motive to the hostage taking and robbery.

The logo from Cheollima Civil Defense’s official website with the words “Free Joseon.” Other versions of this logo have “Cheollima Civil Defense” instead., Cheollima Civil Defense

The details that the Spanish government had given so far only add to the mystery. Spain’s authorities are investigating, but nearly a week afterward there was reportedly still no official complaint from the North Koreans.

The assailants were in the embassy for approximately four hours. During that time, one of the staff escaped and alerted police, who went to check on the situation. A man wearing the North Korean standard pin bearing the likenesses of Kim Jong Un and his father, the country’s previous leader, Kim Jong Il, told them everything was “normal” and they left.

The front door of North Korea’s Embassy in Madrid., AP

Soon after, the attackers left in a pair of cars at high speed, according to Spain’s El Confidencial newspaper, which was first to report that anything had happened at all. “Basically, the information that El Confidencial describes is how the events unfolded,” Reuters subsequently reported, citing an unnamed Spanish Foreign Ministry source.

The raid in Spain occurred just days before U.S. President Donald Trump joined Kim for talks in Vietnam and it briefly threatened to upend those meetings. That summit subsequently collapsed due to the inability of both parties to find common ground in the negotiations over various topics, including sanctions against Pyongyang and North Korea’s nuclear weapons and ballistic missile programs.

US President Donald Trump speaks to the press after the breakdown in talks in Hanoi on Feb. 28, 2019., The Yomiuri Shimbun via AP Images

If Cheollima is responsible, it would be the highest profile act the group has carried out since it came into the public eye in 2017. Early that year, operatives from the group reportedly spirited North Korean princeling Kim Han Sol out of the Chinese city of Macau and into hiding, where he remains.

Kim Han Sol is son of Kim Jong Nam, who was a son of former North Korean leader Kim Jong Il and was Kim Jong Un’s half-brother. Foreign diplomatic and intelligence officials had pegged Kim Jong Nam as the heir apparent in North Korea until he fell from grace in 2001 after trying to use fake documents to visit Disneyland Japan.

Kim Jong Nam subsequently went into exile, sometimes publicly criticizing the North Korean government. On Feb. 13, 2017, two assassins, under the orders of North Korea’s security services, killed him in Malaysia with VX nerve agent.

Kim Jong Nam seen here swarmed by reporters after arriving in Beijing, China, in 2007., Kyodo News via AP

Kim Han Sol had himself challenged the North Korean state narrative publicly on multiple occasions. This included an interview with Finnish television network Yle in 2012, seen below, where he not only said he hoped for eventual Korean unification, but did not dispute the characterization of his uncle and grandfather as dictators.

Cheollima Civil Defense released a video of Kim Han Sol in March 2017, in which he said he was with his mother and sister and that “we hope this gets better soon.” The group said the young Kim had been in danger and that they had been able to get him to safety with Chinese, American, and Dutch authorities, according to a story The Wall Street Journal published on Oct. 1, 2017. South Korean newspaper JoongAng Ilbo reported that Chinese officials had arrested two members of North Korea’s Reconnaissance General Bureau in connection with an assassination plot on Oct. 31, 2017.

It is possible that the raid in Spain was connected in some way with helping another North Korean national escape to safety. In January 2019, North Korea’s acting Ambassador to Italy, Jo Song Gil disappeared and reportedly went into hiding with wife, according to a South Korean lawmaker. Jo had been on the job since Italy declared his predecessor Mun Jong Nam persona non grata in protest of North Korea’s sixth nuclear test and its test launches of increasingly capable ballistic missiles.

Cheollima Civil Defense might have also been trying to gather information about Kim Hyok Chol, who had been North Korea’s ambassador to Spain until 2017, when Spanish authorities ejected him for the same reasons Italy had booted Mun. Kim Hyok Chol has subsequently become the country’s top negotiator in talks with the United States and had been a key figure in setting up the Hanoi summit. If this was the case, however, it might indicate direction from a intelligence service, such as the CIA, in spite of the denials from The Post’s sources.

Kim Hyok Chol arrives on Hanoi on Feb. 20, 2019, ahead of Kim’s summit with Trump., Kyodo via AP Images

The group, which takes its name from a flying horse common in East Asian mythology, which the North Korean regime often refers to in its own propaganda, has otherwise not acknowledged any other major operations. On Feb. 28, 2019, it released a manifesto in Korean and English on its spartan website, calling for North Koreans to resist the Kim government in any way possible.

Since then, the site has only had two additional posts, both on Mar. 11, 2019. One announced a new website would be coming in the future and provided a form to sign up for Email updates and another had a simple message of encouragement for resisters. The second post had “Kuala Lumpur” in English in the title and appeared to be in response to the Malaysian government’s surprise decision to drop all charges against one of Kim Yong Nam’s alleged assassins.

Siti Aisyah, at center, an Indonesian national on trial for the assassination of Kim Jong Nam, leaves the courthouse a free woman on Mar. 11, 2019, after prosecutors said they would drop all charges without giving any official reason., Kyodo News via AP

It’s also curious that if the group had been responsible for the embassy raid, for any reason, that they would not have taken credit for it, though. Cheollima Civil Defense’s website has an Email address that anyone can contact and it has not particularly shied away from making anonymous statements – understandable given the reach of North Korea’s security services – to reporters in the past. None of the posts since the break-in have suggested a big reveal is coming, either.

A 2017 piece in The New Yorker that came out after the Kim Han Sol incident also noted that at the least first posts on Cheollima Civil Defense’s website were written in a Korean that was “oddly stilted, as if the statements there had been drafted first in a different language, then translated.” This calls the exact origins of the group into question, as well as who is issuing these statements. The use of unusual and awkward Korean could be a countermeasure to make it more difficult for North Korean intelligence officials to analyze the text, too.

A statue of Cheollima in Pyongyang, meant to symbolize the advance of the Korean people at the winged horse’s lightning speed under the leadership of the Kim dynasty., Nicor via Wikimedia

For its part, North Korea appears to be keeping largely quiet on the incident in Spain. If nothing else, it has to be highly embarrassing that any group could take control of the Embassy for an extended period of time and then just walk out and escape.

Whether there is a CIA connection or not, the North Koreans appear to have hit an impasse in their interactions with the United States, as well. On Mar. 14, 2019, North Korean Vice Foreign Minister Choe Son Hui lambasted the U.S. government for the breakdown in talks in Hanoi and called the American position “gangster-like.” This is a turn of phrase that was common in North Korea’s statements and propaganda missives prior to the warming of relations between Kim and Trump.

“We have no intention to yield to the U.S. demands [presented in Hanoi] in any form, nor are we willing to engage in negotiations of this kind,” Choe told reporters in Pyongyang, referring to American demands for North Korea to give up its nuclear weapons, ballistic missiles, and more in exchange for the possibility of sanctions relief. He did also say that these personal ties between Kim and Trump remained strong and indicated that it would be up to the country’s premier to determine the policy going forward.

It remains to be seen how North Korea might respond to the evolving situation. There has been apparent work to reactivate its space launch facilities at Sohae, which Kim had previously agreed to give up after his first summit with Trump. It is possible that the North Koreans could launch another space launch vehicle rocket to test the American president’s resolve.

Trump has warned that the United States could once again take a tougher stand if North Korea conducts new missile or nuclear weapons tests. North Korea in the past has insisted that space launches are not missile tests, despite the fact they can serve a dual developmental purpose, especially in regards to the crafting of new rocket engines.

North Korea’s stance, as well as that of the United States, will likely become increasingly clear in the near future. Whether we gain any more clarity about what happened at the North Korean Embassy in Spain remains to be seen.

Contact the author:

Joseph Trevithick

Deputy Editor

Joseph has been a member of The War Zone team since early 2017. Prior to that, he was an Associate Editor at War Is Boring, and his byline has appeared in other publications, including Small Arms Review, Small Arms Defense Journal, Reuters, We Are the Mighty, and Task & Purpose.