The shadowy group Cheollima, also known as Free Joseon, has admitted in a lengthy statement on its website that it carried out a break-in at the North Korean embassy in Madrid just prior to last month’s North Korea-US summit in Hanoi.

The statement, posted on March 26, appeared in response to reports in Spanish newspapers about the case that had been published hours earlier, citing official investigations and judicial developments. It rejected some of the Spanish statements and appeared to be a justification of its actions.

The latest information sheds new light on a case that has intrigued and puzzled experts across the world as to who carried out the raid, what their motives were, and who their backers may be.

The new information indicates that the group broke into the embassy believing – mistakenly – that an embassy member sought to defect, stole data, then fled the country. Subsequently, they passed information on to the FBI at the latter organization’s request, but following leaks to US media, it now appears that group members fear for their lives.

The raid also appears to have been carried out by the group – which has declared itself, perhaps prematurely, a provisional government of North Korea – rather than by, or with personnel from Western intelligence agencies. However, there are hints of possible South Korean involvement.

Perpetrator unmasked

On a post at the top of its website, Cheollima said it carried out the raid, but that their operation “was not an attack” as “we responded to an urgent situation in the Madrid embassy.” The group said: “We were invited into the embassy,” that there were “no other governments involved with or aware of our activity until after the event,” and that “the Hanoi Summit had no relation to this operation.”

The statement followed the release by Spanish authorities of further information on the case, naming a key suspect who fled to the United States after the raid, and noted that arrest warrants were being sought.

The person who led the break-in was naturalized American Mexican Adrian Hong Chang, as well as “five South Koreans,” Spanish daily El Mundo said, citing investigation reports. Adrian Hong Chang, or Adrian Hong, is a known activist on North Korean issues. He co-founded civic group LINK, Liberty in North Korea, which assists North Koreans escaping the country and relocating to South Korea.

LINK, in a statement released in Seoul today, said Hong “has had no involvement with [LINK] for over 10 years,” adding “we have no knowledge of his recent activities”.

Hong may be the leader of Cheollima, as well as leader of the embassy attack, sources in Seoul had speculated to Asia Times previously.

Rescue mission or attack?

Spanish Judge José de la Mata, who is directing the Spanish investigation, approved two international arrest warrants for two of the suspects, according to El Mundo. The paper called Hong “the ringleader” and said that he had acquired weapons, including machetes and replica firearms, prior to the break-in. During the break-in, according to the report, staffers were bound and beaten.

However, the group, in its website statement, said that no weapons had been used, the situation had “not been an attack” and that no staffers were gagged or beaten.

The Spanish reports indicate that the group had tried to convince an embassy staffer to defect, unsuccessfully. This appears to confirm – at least partly – the group’s statement that it was “invited into the embassy,” or believed it was invited into the embassy. El Mundo identified the staffer as Charge d’Affaires Yun Suk So, who, the paper said, Hong had previously met.

With So apparently declining to defect, the group stole two USBs, two computers, two hard drives and a mobile phone from the embassy, the El Mundo report said, before fleeing in a rental car.

After the raid, Hong fled to the US, where he handed over materials from the embassy to the FBI, the Spanish reports said. As the Cheollima statement noted, North Korean embassies are fronts for various illicit activities. This makes the data stolen from the Madrid embassy of high interest to intelligence and law enforcement agencies.

Leaks and risks

The Cheollima statement lambasted sources – presumably in the FBI – who leaked the news that Cheollima had carried out the break-in to The Washington Post.

“The organization shared certain information of enormous potential value with the FBI in the United States, under mutually agreed terms of confidentiality… Those terms appear to have been broken,” Cheollima said in its statement, calling the leak, “a profound betrayal of trust.”

Members of the group, particularly Hong, now face a dual risk. One is extradition to Spain, where they face possible prison terms of 28 years. The other is possible assassination or even rendition to North Korea by its highly capable and ruthless spy agencies.

The Cheollima statement noted: “Freedom has already been paid with the blood of families and colleagues. Some of us will be imprisoned, tortured or killed in the course of this fight…. Parties seeking to ‘out’ those in Madrid… have chosen to side with Pyongyang’s criminal, totalitarian rulers.”

Experts agreed.

“They, and their family members and close associates could be in danger,” said Daniel Pinkston, a North Korea watcher with Troy University in Seoul. “The North Koreans have retaliated in the past.”

Moreover, Hong’s apparent status as a Mexican, rather than American, might deprive him of US protection – even if it was an official US agency that blew his cover. “If the guy is a long-term legal resident alien or green-card resident alien, the legal protections are different,” Pinkston said. “You can be deported or your status can be cancelled.”

Questions answered

The latest revelations appear to have answered the biggest questions hanging over the Madrid incident: The players, their motives, and the fact it was not linked to the Hanoi summit, despite the fact a key North Korean negotiator had previously been based at the Madrid embassy.

They also shed light on Cheollima/Free Joseon. (Cheollima refers to a famed flying horse of Chinese legend, while Joseon is the name of the last Korean feudal dynasty, and also what North Koreans call their own country). The group had two prior claims to fame. It had declared itself “a government in exile,” and offered assistance to the family of Kim Jong Nam, the half brother of North Korean leader Kim Jong Un. Kim Jong Nam was assassinated with a nerve agent in Kuala Lumpur airport in 2017 and his family has been in hiding.

However, the latest information suggests Cheollima may be largely or even entirely composed of Korean-Americans and/or assisted by South Koreans, rather than North Korean defectors.

Backing up this analysis, sources previously told the Asia Times that the quality of the Korean script on the group’s website is stilted, suggesting it was not written by a native speaker – either from the North or South.

Moreover, the revelations appear to absolve Western agencies, who were widely speculated to have been somehow behind the Madrid embassy raid.

“There has been speculation that this was a covert op, but I don’t see the lawyers signing off on this,” said Pinkston, citing the sensitivity of any such an operation. “Breaking into an embassy is setting a bad precedent.”