In Feb. 2017, North Korean leader Kim Jong Un’s half brother was waiting at Kuala Lumpur International Airport when two women smothered him with lethal chemicals that left him dead in under 20 minutes. Police swiftly arrested a North Korean man in connection with the murder, copying his phone and other devices in the process.

That man is Ri Jong Chol, and he was never charged with the murder. But Ri is still part of a much bigger story: He is one of the hundreds of North Korean agents who help their home country survive tough economic sanctions by running elaborate international networks that procure the government’s material needs. In the process, these agents abroad abuse diplomatic privileges and hide behind layers of Chinese shell companies to run transactions right under the noses of international investigators.

Now, a new Royal United Services Institute (RUSI) report reveals that the North Korean contacts in Ri’s devices were openly violating sanctions using shell companies opened in China’s national company register. And these contacts may still be active today.

“One of the most striking findings I think is that [Ri Jong Chol’s] network of contacts and counterparts … represented North Korean interests in so many fields,” Gary Somerville, one of the report’s authors, told NK Pro.

“He had direct connections with North Korean diplomats, sanctioned bank representatives, nuclear and ballistic missile related procurement agents, military colleagues, insurance brokers — and, ultimately, the agents who watched over the assassination of Kim Jong Un’s half-brother.”

WHO IS RI JONG CHOL?

If it were not for the assassination of Kim Jong Un’s half-brother, Ri Jong Chol may have continued to look like a man with a quiet life, exporting goods like palm oil, soap and illegal luxury Italian wine from Malaysia to the DPRK.

From the outside, Ri probably looked like an ordinary family man. When he moved to Malaysia, he also managed to swing visas for his wife and daughter — an uncommon case, since most North Koreans who go abroad do so alone. The Ri family lived in an apartment complex in a middle-class area of Kuala Lumpur. Text message data shows that his wife would chide him not to drink too much when he went out at night.

Ri’s most-called number was a contact written as his “darling daughter,” Ri Yu Gyong. While attending Kuala Lumpur’s private Help University, she served as Ri’s translator in business meetings and often corresponded with prospective businessmen independently because of her superior English skills.

But beyond the surface, Ri Jong Chol was partaking in risky activity: Phone data and a recent U.S. government indictment show that Ri laundered U.S. dollars and scouted for used industrial cranes favored by North Korea’s missile program.

Ri and his daughter’s digital trails showed an “I’ll talk to anyone” kind of ambition, which turned out to be a lot of talk and little action. Ri’s devices showed half-baked plans for joint rice farming investments and a scheme to sell pirated versions of hacked medical imaging software.

But Ri is unreachable, and most of what NK Pro has learned about him is through a Malaysian man named Chong Ah Kow. Chong is the one who gave Ri and his family work visas to live in Malaysia, which he says he did as a favor for his North Korean business partner, who was is apparently Ri’s uncle — a doctor named Mun Ho.

Ri approached Chong for the visas, and Chong agreed to lie and say they were working for his company. After all, Chong made money selling a patented cancer-fighting extract developed by Ri’s uncle. (And Chong says he’s still selling that extract today, flashing a bottle before the camera and taking a pill while on a video call with NK Pro).

In interviews with other media outlets, Chong said he didn’t know how Ri actually made his living. He also told NK Pro that he really only spoke with Ri in the context of communicating with Ri’s uncle.

Chong told NK Pro that, since Ri’s deportation, he communicates with Ri’s uncle through diplomats at the DPRK Embassy in Kuala Lumpur. Chong said that he has traveled to North Korea at least 15 times from 1992 to 2015, starting with professional harmonica performances and later branching out to tours and business visits.

SNEAKING GOODS FOR NORTH KOREA

According to data from Ri’s devices, Ri mainly worked on behalf of two companies: Korea Singwang Economic and Trading Corporation and Korea Ponghwa General Trading Corporation. But Ri also closely coordinated with North Korean diplomats in Malaysia and had extensive relationships with North Korean collaborators, Chinese collaborators and others throughout Asia.

In the latest RUSI report, researchers took the Korean names from the contact lists of Ri’s devices and dug deep. Other than his daughter, Ri Jong Chol registered the most calls with a North Korean diplomat stationed in Malaysia, who shares his first name: Kim Jong Chol. Despite some speculation that they are the same person, a review of Ri’s data shows him closely communicating with Kim, who appeared in one email as an official of Korea Ponghwa General Trading Corporation.

Kim, among other tasks, conducted business for Korea Ponghwa General Trading Corp while under the safety of diplomatic privilege. Meanwhile, Ri — who also worked for the corporation — had less public attention but also took on more risk and a bigger portfolio of deals.

Ri and his daughter appeared to make up the Malaysian branch of Korea Singwang, a company that was implicated as a part of North Korea’s Ministry of People’s Armed Forces (MPAF) when it was sanctioned by the U.S. in 2016 and the U.N. in 2017.

“These [kinds of] companies and individuals have been moving billions of dollars through the international financial system, in many cases ultimately on behalf of entities responsible for the [DPRK]’s nuclear and ballistic missile programmes,” Somerville, the RUSI report’s co-author, said.

Ri became the only North Korean suspect to be detained throughout the investigation, while others hid in the embassy before their own deportations.

SMUGGLING TACTICS AND WEAPONS PROGRAMS

As part of their investigation, researchers at RUSI took the Korean company and individual names from Ri’s contacts list and translated them into Chinese. Then they cross-referenced the Chinese versions of these names with China’s national corporate registry.

RUSI researchers were able to match at least eight of Ri’s contacts to firms and company directors listed in official Chinese company registry documents.

For example, Ri was in contact with a North Korean man named Kim Mun Chol (김문철) who was sanctioned by the U.S. and the U.N. in 2017. Kim was a representative of the Korea United Development Bank (KUDB) in Pyongyang, which was sanctioned a year earlier, in 2016.

But Ri’s entry for Kim shows just how well North Korean operatives are able to establish and maintain Chinese shell companies to hide their sanctions-violating activity. Ri’s entry for Kim listed him as the branch manager of “Kyongun Co Dandong.” This matches Chinese corporate records for a Jin Wen Zhe/Kim Mun Chol, who is head of Korea Kyongun Trading Company’s branch in Dandong, China. According to the U.N.’s own sources, Kim was still active in China as of late 2018, despite his designation.

The example also underscores that North Koreans are fraudulently using Chinese bank accounts for shell companies registered in China — and, by extension, U.S. correspondent banks to process U.S. dollar transactions.

In one case study, the report replays how Ri Jong Chol worked with North Korean and Chinese partners in the PRC to move U.S. dollar transactions to at least two Chinese bank accounts. This paid for Chinese shipping services, which would forward Ri’s Malaysian goods through China and then onto North Korean ports.

In another case, Ri worked with an ethnic Korean Chinese employee of a Chinese state-owned shipping company, Complant International Transportation (Dalian), to move soap precursors to North Korea. The U.N. already identified this company as a shipper of luxury goods to North Korea. In 2010, South Africa further implicated this company in two shipments in 2009 involving North Korean weapons bound for the Republic of the Congo.

“Once again, the evidence shows the indispensable role that Chinese nationals and entities play in supporting and facilitating the activities of these networks,” said Somerville, the report’s co-author.

“These findings are a wake-up call for financial institutions and regulators,” he said.

Edited by Kelly Kasulis