NIS Expands 'Spy Ring Investigation'... "More Violations of National Security Law Found"

NIS Detects 'Spy Charges' Against Democratic Labor Union Affiliates
Following Jeju and Changwon Spy Cases, Nationwide Investigation Expansion Underway
Democratic Labor Union: "Color Attacks and Labor Oppression... July General Strike"

[Asia Economy Reporter Jang Hee-jun] The National Intelligence Service (NIS) has launched a forced investigation targeting current and former executives of the Korean Confederation of Trade Unions (KCTU), aiming to root out a spy underground organization. It is known that there are additional cases under investigation for violations of the National Security Act, leading to expectations that the 'spy ring investigation' will expand comprehensively.

According to the NIS on the 19th, the NIS and the National Police Agency's National Investigation Headquarters conducted searches and seizures at about 10 locations, including the KCTU headquarters, to secure evidence related to suspected violations of the National Security Act by four individuals: A, the KCTU Organization Director; B, the Health and Medical Workers' Union Organization Director; C, former Vice Chairman of the Metal Workers' Union; and D, the representative of Jeju Peace Shelter, known to be from the Metal Workers' Union.

The NIS reportedly secured about 40 items such as laptops, external hard drives, USBs, and tablet PCs from the KCTU headquarters the previous day. While focusing on analyzing the seized items, additional searches are planned at residences and vehicles of A and others, as well as other locations where evidence might be hidden. However, the NIS emphasizes that the investigation targets individuals, not the KCTU as an organization.

An intelligence official stated, "Besides the Jeju and Changwon spy ring cases and the searches involving KCTU officials, we understand there are more ongoing investigations related to violations of the National Security Act. We have been investigating clues to espionage activities for several years, and since these series of searches have been made public, the risk of evidence destruction has increased, prompting us to accelerate the investigation."

Did KCTU Affiliates Contact North Korean Operatives Overseas?

North Korean Flag

An NIS official explained, "These are matters that have been under internal investigation for years, and we secured related evidence necessary for the searches. We obtained search warrants based on the judgment that forced investigation was necessary." The suspected violations of the National Security Act detected by the NIS involve attempts to establish an underground organization for anti-government struggle domestically under orders from North Korean operatives abroad.

Counterintelligence authorities believe that A received orders from North Korea while overseas, including Southeast Asia, and then attempted to form an underground anti-government organization domestically through B and others. In particular, A, who holds an executive position at the KCTU headquarters, is suspected of being recruited by North Korea first and then influencing the union's policies and activities according to North Korean directives by mobilizing the other three internally.

A, considered the key figure in this case, is known to have contacted personnel from North Korea's cultural exchange department, a division responsible for operations against South Korea, at least three times: in August 2016 in Beijing, China; September 2017 in Phnom Penh, Cambodia; and August 2019 in Hanoi, Vietnam.

When A met with operatives in Phnom Penh in September 2017, B and D were also staying at the same hotel and are understood to have separately met with North Korean personnel at different times. C, affiliated with Kia Motors' Gwangju plant, reportedly accompanied A during the Hanoi visit in August 2019 and met with North Korean operatives.

From Jeju and Changwon to KCTU... Spy Ring Investigation Expands

On the 18th, when the National Intelligence Service conducted a search and seizure of the headquarters office of the Korean Confederation of Trade Unions (KCTU), an NIS employee was moving in front of the KCTU headquarters in Jung-gu, Seoul. Photo by Jinhyung Kang aymsdream@

The NIS's spy ring investigation, which began with underground organizations in Jeju and Changwon, appears to be expanding nationwide.

The NIS conducted searches twice in November and December last year at the homes of former executives of progressive parties in Jeju, including K. This was part of investigations related to the 'ㅎㄱㅎ (Hangilhohoe)' case centered on progressive figures in Jeju and the People's Front for National Reunification based in Changwon.

K, notably, is a figure who held pro-North activities such as screening North Korean films in Jeju. He is known to have met with operatives from North Korea's cultural exchange department in mid-2017 in Cambodia. At that time, he was trained in using encryption programs and received orders from the North to build 'sector organizations.' Later, in September last year, he formed Hangilhohoe, which is interpreted as meaning 'to walk the one path toward national reunification.'

Although the NIS draws a line between the recent searches and the Jeju and Changwon spy ring cases, some speculate that clues related to the charges against current and former KCTU executives were uncovered during earlier forced investigations. Especially since both cases involve attempts to build underground organizations under North Korean orders overseas and share similar communication and connection methods with North Korea, some assess that the two cases share a common root.

NIS Struggles with New Communication Methods... 'Cyber Dvoke'

NIS and Police Attempt to Search Headquarters of the Korean Confederation of Trade Unions on Charges of Violating the National Security Act
[Image Source=Yonhap News]

The biggest challenge for counterintelligence authorities is the new communication methods. The former progressive party executive who established the underground organization 'ㅎㄱㅎ' in Jeju is known to have maintained communication with operatives while evading surveillance from mid-2017 in Cambodia until recently. This was possible by using methods such as steganography and 'Cyber Dvoke.'

Steganography is an encryption technique that hides confidential information within media files such as images, audio, or text. Although it appears ordinary on the surface, encrypted orders are embedded inside and can only be revealed using specific programs. In the 2021 People's Front for National Reunification case, where three people were arrested for espionage activities, it was revealed that steganography was used to exchange orders with North Korea.

Cyber Dvoke refers to sharing email accounts to exchange orders. 'Dvoke' means a place where spies hide items necessary for their operations. In the past, spies would leave orders at specific locations and check them after some time; this method has now moved to cyberspace. Recently, spies upload encrypted documents to cloud systems based on overseas servers, including Google, which are difficult for domestic investigative agencies to track, to exchange information.

A, the KCTU Organization Director, is also known to have communicated with North Korea for years using Cyber Dvoke and similar methods.

KCTU: "Does Public Anti-Communist Investigation Make Sense?" ...Labor Oppression

KCTU 'Stop Political Repression' [Image Source=Yonhap News]

Meanwhile, the KCTU strongly opposes the NIS's comprehensive expansion of the spy investigation, calling it a 'revival of security rule.' They have announced plans for a general rally on Labor Day and a general strike in July, triggered by the recent searches.

Yang Kyung-soo, KCTU Chairman, said at the KCTU Education Center in Jeong-dong, Seoul, "About 1,000 police officers were mobilized to search a single person's desk," and claimed, "This is a color attack to silence the KCTU, which continues to speak out against the government."

Jeong Ki-ho, head of the KCTU Legal Office, stated, "This search is not intended to clarify the suspect's guilt but to achieve political objectives," adding, "There is no precedent for conducting anti-communist investigations, which require confidentiality and secrecy, in a public manner."