On 22 February 2019 at the Embassy of North Korea in Madrid, the political group Free Joseon, which is opposed to Kim Jong Un and the current government of North Korea, is alleged by Spanish and American authorities to have attacked the embassy. Free Joseon maintains that they were invited in to facilitate a high-level defection. A group of individuals stole mobile telephones, two USB flash drives and a hard drive from the embassy and handed them over to the Federal Bureau of Investigation (FBI) in the United States. The event took place after the Singapore summit between North Korea (DPRK) and the United States and prior to the Hanoi summit. As of early April 2019, one person had been arrested in connection with the incident and two international arrest warrants had been issued by the Spanish Audiencia Nacional. The suspected perpetrators are citizens of Mexico, the US and South Korea, although the latter two governments denied any connection with the incident.
The incident is alleged to have been violent; the suspected perpetrators purportedly possessed knives and replica guns, and a number of embassy staff were treated for injuries. Another member of the embassy staff injured herself by leaping from an upper window before alerting police. The Spanish authorities' investigations were kept secret for the first month; when they released their findings—including the names of the suspected perpetrators—they were criticised for possibly endangering the named peoples' lives. The Spanish privately briefed the media that they suspected but could not prove Central Intelligence Agency (CIA) involvement because the attack was professional in its precision. One former CIA agent, however, said the timing of the attack and its high-profile nature would have made it impossible for the CIA to have condoned it or taken part. The Government of North Korea described the incident as an act of terrorism and demanded an international investigation; the embassy and its attaché, however, did not report the attack or any injuries sustained by the staff to the Spanish police.
Free Joseon has denied allegations that this incident was a break-in raid of the compound, and accusations of being directed by foreign intelligence services. Rather, the group asserts that it was invited in by some undisclosed number of embassy staffers who wished to defect. In order to protect their family members in North Korea, who would ostensibly be punished for a relative's defection, these embassy staffers reportedly requested a staged kidnapping and physical injuries to absolve themselves of suspicion from the North Korean government. It is alleged that a staffer's panic around the plot being discovered precipitated the botched defection effort.
Background
Free Joseon — also known as Cheollima Civil Defense — the group alleged to have carried out the attack, has been described by The Washington Post as a "secretive dissident organization" and a "shadowy group trying to overthrow Kim Jong Un", whose government they claim to be an "immoral and illegitimate regime". Free Joseon is alleged to be composed primarily of North Korean defectors, and claims to have "hundreds of members across ten countries", says Chestnut Greitens. Two days before the attack the group's website was recruiting field agents, guards and field intelligence agents; the advertisements were tailored towards young people who had previously lived in China and were "willing to devote to the liberation of the North". According to the website, these roles required "insight, intelligence and physical strength". Sung-Yoon Lee of Tufts University said the group "is the first known resistance movement against North Korea, which makes its activities very newsworthy". Greg Scarlatoiu, the executive director of the Committee for Human Rights in North Korea, said "this is the first time we see organized, apparently militant resistance outside of North Korea". The group previously tried to make a name for itself by attempting to provide protection for Kim Jong Un's nephew, Kim Han-sol, whose father had recently been assassinated two years earlier.
The incident took place just before the US President Donald Trump was due to meet Kim Jong Un for further talks on the DPRK's proposed denuclearisation program; a previous summit held in January 2019 in Hanoi, Vietnam, had failed and relations between North Korea and the US had deteriorated further.
The DPRK's embassy in Madrid, located at 43 Darío Aparicio in the quiet, affluent northern suburb of Aravaca, consists of a two-story "luxurious villa" with a swimming pool and is surrounded by pine trees. The compound is in the middle of a patch of open land that has remained undeveloped because it assists natural drainage for the area. According to El País, since the previous ambassador Kim Hyok-chol was expelled in 2017, only one diplomat and two assistants with their immediate families living a relatively "spartan" existence were resident at the time of the attack. Neighbours, however, reported that a few days prior to the incident, a grand party that had attracted local attention had been held at the embassy.
The CIA is known to work closely with defector organisations opposed to regimes unfriendly to the US, although such work "does not, in itself, prove CIA involvement in the Madrid episode".
Perpetrators Adrian Hong Chang, was a resident of the US but a citizen of Mexico. Educated in the US, he was instrumental in the foundation of the US-based human-rights group Liberty in North Korea and also the Joseon Institute. BBC journalist Laura Bicker wrote that Hong Chang was "a well-known North Korean human rights activist [who] has helped defectors flee North Korea in the past"; his "associates", reported the Financial Times, "say he has links to US intelligence agencies". Hong appears to have been arrested in China in 2006 for reportedly helping North Korean defectors there. Another North Korean defector, Kang Chol-hwan, has stated that, whereas Hong previously worked in "mainstream" NGOs, he had recently moved into increasingly "secretive, underground activities" preparing for "imminent, dramatic change". In 2011 he suggested that the Arab Spring uprisings were "a dress rehearsal for North Korea", and had travelled to Libya to research the events more closely. The gang's leader, Christopher Ahn was an ex-US Marine and human rights activist. Another person involved was defector Charles Ryu.
Kim Hyok-chol The previous DPRK Ambassador to Spain Kim Hyok-chol had been expelled by the Spanish Government in September 2017 in response to North Korea's continued testing of nuclear missiles in defiance of the international community. Although persona non-grata in Spain, Kim returned to the DPRK to become one of the architects of Kim Jong Un's diplomacy with the US, including the failed Vietnam summit. Analyst Andrei Lankov describes Kim Hyok-chol as Stephen Biegun's North Korean counterpart.
Little is known in the West of Kim Hyok-chol's personality or career. It was noted that the computers and telephones that were seized by the attackers would be a "treasure trove" to intelligence services around the world for the information and communications they probably contained, and would be "eagerly sought after". Obtaining private information on Kim Hyok-chol, who has been described as "a natural target" for those interested in the DPRK's nuclear program, and information on North Korea's re-armament program may have been the purpose of the attack.
Tufts University professor Sung-Yoon Lee believed it likely the seized materials could contain valuable information about any recent plans by the DPRK to evade the sanctions against its government, claims that were repeated on Fox News by Gordon G. Chang. Noting that Kim Hyok-chol had been recalled from Spain to lead North Korea's negotiations, Lee suggested any information held on those computers, including information on his activities in Spain, would have helped the US and its allies "to gain an edge in the negotiations" in Hanoi. For the Free Jeoson group, securing such top-secret information would "enhance their own status".
Attack
The group began its operation two weeks in advance, when Hong Chang, using the alias Matthew Chao and posing as managing partner of fictional investment firm "Baron Stone Capital", had a brief meeting with commercial attaché Yun Suk So regarding investment in the DPRK. Around 16:34 CET on Friday, 22 February 2019, Hong Chang asked and was admitted to see Yun on the same matter. Street lights in front of the embassy were dimmed around this time; other security systems around the building were also found to have been neutralised.
Once Hong had been admitted inside the building, the remaining members of the group allegedly burst in after him. Other possibilities include that Hong let them while unattended, that they climbed a perimeter wall, or that embassy staff invited them in. The ten intruders were described as masked, Asian in appearance and Korean-speaking. All but one appeared below the age of 30. The group carried various weapons including replica firearms, balaclavas, a telescopic ladder and 33 rolls of double-sided tape.
At the time, there were eight embassy staff members and guests present including a group of North Korean architecture students; Yun was the embassy's highest-ranking diplomat in residence. It was uncertain the Free Joseon members were aware of the embassy's business that day and may have been surprised by the guests' presence.
The intruders allegedly tied up and hooded all staff and guests present. Then, they allegedly interrogated and assaulted the embassy staff, principally Yun whom they tried to persuade to defect and then assaulted when he refused. Two staff members later required medical attention, mainly as a result of bruising from multiple, heavy blows. A particular topic of interest appeared to be Kim Hyok-Chol, about whom they questioned Yun intensively.
A female Korean staff member, Cho Sun Hi—who lived in the embassy with her husband—hid in a second-floor room and locked the door. Around an hour into the raid (5 pm), she escaped from the compound by jumping from the window, injuring herself. Cho screamed for help, alerting neighbours who called the police. When the police arrived, they had difficulty understanding her, since she spoke no Spanish and had sustained a head injury; initially, police wondered if Cho was mentally ill. They took her to a police station and tried to find an interpreter. Eventually they used a translation app on her phone.
Cho told police that "a group of men have entered the embassy and gagged the staff", spurring the police to return to the embassy and attempt entry. Hong Chang answered the door wearing a Kim Il Sung and Kim Jong Il badge, and assured them there was nothing untoward occurring. As Chang appeared to be a staff member and entry without authorization from the head of the mission would violate the Vienna Convention on Diplomatic Relations, they instead set up a security perimeter outside.
While the police waited outside, additional men entered and were identified by the police. The intruders filmed themselves ransacking the building, and collected most of the embassy's electronic equipment to take with them. Then the embassy gates suddenly opened and embassy vehicles sped away with eight intruders; the police did not follow. These cars were found abandoned a few streets away hours later and removed for forensic examination. Another car with Hong Chang in it apparently left from the rear of the building soon after; it later transpired this was an Uber taxi he had ordered in the name of Oswaldo Trump.