On February 22, the North Korean embassy in Spain — located in rather quiet part of Madrid — suffered a break-in.

Somehow, roughly ten attackers entered the embassy, where they tied up and gagged the eight North Koreans who they found inside.

According to some reports, the staff were subject to brutal interrogation which was accompanied by beatings — so bad that two of them later required medical help.

Simultaneously, the assailants stole computers, papers, and other documents. The unknown men remained in full control of the embassy for four hours.

Then, the unexpected happened: one of the prisoners managed to escape through a second floor window. She alerted the neighbors, who immediately called the police.

Luck smiled on the attackers. When police promptly arrived at the embassy gate, officers were greeted by an Asian man — reportedly sporting a Kim Il Sung-Kim Jong Il badge — who told the officers that everything was fine.

Obviously, police could not enter the embassy, but in a few minutes the gates opened and two expensive cars with diplomatic number plates sped out.

The cars were not pursued by police, and were soon found abandoned nearby. Obviously, they had been used as escape vehicles by the attackers.

The forced takeover of a foreign embassy is a rare event

To make matters even more unusual, the North Koreans have reportedly not lodged any formal complaint, even though the Spanish police are investigating the incident.

Several things are important to note about this case.

First, the forced takeover of a foreign embassy is a rare event. While it is an open secret that intelligence services across the globe are enthusiastic about stealing confidential material from foreign embassies, or installing listening devices, such an open and violent takeover is rather unusual.

Some of the best known examples are the takeover of the U.S. embassy in Iran in February 1979 by local pro-government militants, and the takeover of the Japanese embassy in Peru in December 1996 by leftist guerrillas.

There were some other cases, largely forgotten – like, say, the violent takeover of the Egyptian embassy in Turkey in 1979 (by Palestinian militants) or the takeover of the West German embassy in Sweden in 1975 (by German radicals). However, such events are rare, especially in recent decades.

Second, the incident happened just a few days before Donald Trump and Kim Jong Un were set to meet in Hanoi – and almost definitely was related to that summit which, as we now know, went ahead according to plan but brought no results.

The incident attracted surprisingly little attention at first

Third, until late 2017 the North Korean embassy in Spain was headed by Kim Hyok Chol, a North Korean diplomat who since early 2019 has been in charge of negotiations with the U.S. on the nuclear issues — serving, essentially, as a counterpart to Stephen Biegun.

It is a safe bet that some of the computers and papers taken from the embassy do contain some information related to this diplomat, whose background and personality, until recently, was not widely known.

The incident attracted surprisingly little attention at first, even in South Korea, where all news related to Pyongyang is usually reported in great detail. However, recent weeks have seen leaks – deliberate or otherwise – begin to appear in the Spanish press.

According to reports by El Pais and El Confidencial, two Spanish news outlets, local police have come to suspect that the embassy attack was somehow linked to the CIA.

According to those reports, two of the identified attackers are known to the Spanish counter-intelligence service as people connected to the “agency.”

On the other hand, on March 15, the Washington Post claimed that it had learned, from some unidentified sources, that the violent attack was actually carried out by a militant group, presumably consisting of North Korean defectors, which calls itself “Cheollima Civil Defense” and is challenging the Kim family regime.

This group has also claimed that it has arranged the clandestine escape of Kim Han Sol, the son of Kim Jong Nam, Kim Jong Un’s half-brother who was assassinated by North Korean operatives in Malaysia in 2017.

Nonetheless, not much is known about the group – apart from the somewhat curious fact that it is now selling visas for as yet non-existent future “Free Choseon” – obviously an unusual fund-raising trick.

So, what can we surmise? Who is behind the Madrid incident?

Let’s begin with the idea that the attack was initiated, planned, and executed by “Cheollima Civil Defense” – or, for that matter, any other independent group of a revolutionary/terrorist character (the line has been always blurred, and largely depends on one’s personal sympathies).

This is a romantic idea, but not particularly plausible. To begin with, there are only a handful North Korean defectors who have the skills with guns and the militant tendencies to carry out such an attack — most refugees (well over half) are poorly-educated middle-aged women from the provinces.

Those few defectors who have both the conviction and the skills to fight are likely known to the interested intelligence services, and constantly watched.

They are both potential assets (to be used to do certain things which regular spies would rather avoid) and a potential threat, since their strongly-held convictions might inspire them to do things that are adventurous and destabilizing.

There is little doubt that if such people began seriously talking about creating a clandestine group, they would be watched even more carefully, that such a group would be infiltrated from the very beginning, and that it would remain under round-the-clock surveillance.

To complicate things further, one should remember that these North Korean militants normally speak little or no English and have only a limited experience of operating outside East Asia.

Furthermore, clandestine operations tend to cost a considerable amount of money: the average defector is poor, and few affluent individuals would support their case.

So one cannot completely rule out that some revolutionary resistance group of North Korean exiles might plan an overseas operation, but the shortage of funds and local expertise ensures that things would go wrong without experienced outside assistance.

Of course, it is equally possible that “Cheollima Civil Defense” is nothing but a front for some other force

It is inconceivable to imagine how such an operation could be planned and successfully executed without the prior knowledge of those government agencies whose job is to watch for exactly these types of activities.

While it is not implausible that the Spanish attack was carried out by some North Korean militants, these people’s plans at least must have been known beforehand to the intelligence services which are watching/hosting/assisting them.

More likely, however, is that these plans were approved of and/or initiated by such “supervisors.”

And, of course, it is equally possible that “Cheollima Civil Defense” is nothing but a front for some other force, a completely fictional organization, created by some government agencies.

So, if the “Cheollima Civil Defense” is a front for some agencies or, at least, act under their control, which agencies are we talking about here?

Two intelligence services are the most likely suspects – the CIA of the U.S. and NIS of South Korea. Both watch the North Korean opposition carefully and have multiple informers and willing collaborators within North Korean refugee groups, and both have a great deal of interest in Pyongyang’s secrets.

Of these two, the CIA seems to be a far more likely candidate. The South Korean government has valid reasons to be nice to Pyongyang, and to do everything possible to keep negotiations between U.S. and North Korea going.

One cannot imagine how President Moon, who is working hard to project an optimistic vision of North Korea’s intentions, would authorize anything even remotely like this.

On the other hand, the North Korean opposition in the current political climate would likely not trust the NIS either, and would perhaps prefer to interact with the CIA.

There are some other indicators of possible CIA (or, at least, some ‘English-speaking forces’) involvement with “Cheollima Civil Defense.”

This author showed the official pronouncements of the group to two well-educated native speakers of Korean who, independently, came to the same conclusion: the documents in questions were initially written in English and read like a translation (one of the native speakers said “clearly, a translation” while other said “very like a translation”).

On top of that, they believe that people who translated the text were not fully comfortable in the language – as one of my experts put it: “this text seems to be written by a foreigner who knows Korean very well.”

The texts are peppered with expressions which, while largely understandable, are improper and would never be used by a native speaker.

If this opinion is correct, this hints at, perhaps, a group of Korean-Americans who have good command of language but, since they have never studied at a South Korean college or university, cannot express complicated ideas in a proper stylistic way. One can easily guess which agency might have many such people among its staff.

It is not inconceivable that the Madrid takeover was driven by some internal strife inside the North Korean government

There are, of course, problems with the CIA theory, too. Agency operatives typically try to break into foreign embassies under the cover of night — this is normal and expected by friends, foes, and neutrals alike. This is what spies always do.

However, a violent attack on a foreign embassy in the capital of a friendly country, initiated or (if we believe that some independent operators were indeed involved) approved by the CIA, is beyond the pale.

That said, the recent misadventures of the otherwise-professional Russian military intelligence in the United Kingdom and the Netherlands are another reminder that conventions are often broken in these uncertain times – and not always in a clean and professional manner.

We, then, have three possible candidates behind the Madrid incident: the CIA (least unlikely), the NIS (almost impossible), or some internal revolutionary resistance group (impossible without the approval of some other players).

Do we have any other candidates or plausible scenarios?

There is, perhaps, only one other possibility, and it is not inconceivable that the Madrid takeover was driven by some internal strife inside the North Korean government.

The attack might have been initiated by some faction inside the North Korean elite whose, perhaps, wanted to get compromising material related to Kim Hyok Chol or were looking for some other political gain.

Given how murky high-level North Korean politics is, it is difficult to speculate what exactly they wanted to achieve.

On the other hand, the flawed Korean of the “Cheollima Civil Defense” website makes this idea of elite North Korean involvement less likely – these people surely know how to write proper Korean, and would never compose their original texts in English.

So, in this author’s humble opinion, there are four potential suspects. The CIA leads the pack, followed by some revolutionaries (acting under control of a third party, most likely the CIA), then the NIS and, finally and, least likely, by some North Korean elite faction.

Whoever did it, this still leaves us with one question: “why?” Ostensibly, computers and papers were taken, and this must be an intelligence bonanza for the attackers and/or their paymasters  — whoever they are.

However, the timing of the attack looks very suspicious: the raid took place days before Hanoi summit. Whoever did it, then, might have wanted to ruin that summit — which many in U.S. government circles feared would see President Trump agree to a “bad deal” with North Korea.

No doubt, such worries were shared by conservative officials in the NIS and many better-informed émigré activists. Virtually all groups listed above might have had reasons to provoke a scandal at the right moment, just before a summit they were afraid would turn disastrous.

The timing of the attack looks very suspicious

The scheme did not work, however: the Madrid raid initially attracted surprisingly little attention, and the summit ended without any result, disastrous or otherwise.

What should we expect now?

Typically, such incidents remain a mystery for decades. But this time, if recent leaks are correct, Spanish police might come out with some results soon – and it the rumors are confirmed, they might be devastating.

Let’s wait and see.

Edited by Oliver Hotham

Featured image: File photo

On February 22, the North Korean embassy in Spain — located in rather quiet part of Madrid — suffered a break-in. Somehow, roughly ten attackers entered the embassy, where they tied up and gagged the eight North Koreans who they found inside. According to some reports, the staff were subject to brutal interrogation which was accompanied