A ranking officer in one of North Korea’s elite military cyberwarfare units is being held in an undisclosed location in far eastern Russia after Moscow’s agents thwarted his attempt to defect, according to sources familiar with the matter and documents obtained by VOA’s Korean Service.
Major Choe Kum Chol, a top information technology (IT) specialist in the North Korean People’s Army (KPA), has been held by North Korea’s consulate general in Vladivostok since September after being arrested by Russian police in Razdolnoe, a city about an hour by car from the Pacific Ocean port city. Choe, 33, had been hiding in Razdolnoe to avoid North Korean authorities who had been hunting for him since July when he left his post in Vladivostok after deciding to seek asylum from the Moscow office of the United Nations High Commissioner for Refugees (UNHCR), according to multiple sources in Russia who knew Choe.
VOA’s Korean Service has verified the credibility of sources who provided information on Choe and has been in touch with them for several months. To protect their identities, the service cannot provide further information about them. The sources approached VOA hoping to generate international interest in Choe’s case. They provided a copy of Choe’s passport, screenshots of text messages Choe exchanged with several of them, and other documents.
Vladivostok has long maintained Russia’s connections with North Korea. Despite United Nations prohibitions on employing North Koreans, many still work in the area and send home their ruble wages to a regime starved for hard currency. And, according to Japan’s Kyodo News, a group of North Korean IT experts moved from Hong Kong to Vladivostok to evade United Nations Security Council (UNSC) Resolution 2397 passed in December 2017, prohibiting countries from authorizing work permits to North Korean workers and requiring their departure from overseas jobs by December 2019.
VOA’s Korean Service contacted the UNHCR’s Moscow and Europe regional bureaus as well as the Russian Foreign Ministry and asked if they were aware of Choe’s attempts to seek asylum. Only the Moscow UNHCR office replied, saying Tuesday, “Please note that UNHCR does not provide comments on individual cases.”
Elite education and career
North Korean leader Kim Jong Un said in 2013 that cyberwarfare, along with nuclear weapons and missiles, are an “all-purpose sword” that guarantees the military’s strike capabilities.
The regime selects young students to train them as hackers, according to a report by South Korea's public media outlet, KBS.
According to Choe's credentials obtained by VOA’s Korean Service, he was among those selected for elite training. He received his education in Pyongyang, attending the prestigious Geumseong School for middle and high school and Kim Chaek University of Technology for undergraduate and graduate school. North Korea combines middle and high school education in a six-year program.
Most Kim Chaek graduates are assigned to cyberwarfare units to work as hackers.
But even though Choe was an elite member of an elite force, like any other North Korean working overseas, he was under constant surveillance by Pyongyang, first in China and then in Russia.
The computer encryption specialist was assigned to Vladivostok in May 2019, according to VOA’s Korean Service sources, where he worked in a cyberwarfare unit tasked with undertaking intelligence missions while obtaining much-needed hard currency.
The North Korean won is largely worthless on international markets, and international sanctions have reduced Pyongyang’s access to trade that once provided foreign currency.
North Korea has increasingly resorted to attacks conducted by its cyberintelligence units to steal cryptocurrencies to support development of its nuclear and missile programs to replace income lost due to sanctions, according to a confidential U.N. report obtained by Reuters on Saturday.
According to the report, “DPRK cyberactors stole more than $50 million between 2020 and mid-2021 from at least three cryptocurrency exchanges in North America, Europe and Asia." North Korea, formally known as the Democratic People's Republic of Korea (DPRK), also uses its hackers to steal technical information.
Shattered dream
According to sources and documents obtained by VOA’s Korean Service, Choe made the decision to defect after losing hope for his future.
North Korea is one of the of the most repressive countries in the world, according to a Human Rights Watch report. Under Kim, the third leader of a nearly 75-year dynasty, the totalitarian government maintains “fearful obedience using threats of execution, imprisonment, enforced disappearance, and forced labor.” During the pandemic, the country has become even more isolated, according to the report.
A source told VOA’s Korean Service that Choe “would see [while working overseas] that nothing in North Korea changed.”
The same source said Choe had spoken of why he wanted to defect.
“He was young. He said he didn’t want to sacrifice his life for Kim Jong Un’s regime. It rules with lies and dictatorship. He said his dream was to live happily in a free world,” continued the source.
According to VOA’s Korean Service sources, Choe evaded his minders in Vladivostok in July and hid in Razdolnoe as instructed by a network that helps defectors seek asylum from the Moscow office of the UNHCR.
Plan thwarted
The source who knew of Choe’s decision to defect said he last heard from Choe on Sept. 20, the day he was arrested by Russian police. VOA’s Korean Service could not determine how the police knew where Choe was hiding.
“I received a text message from Choe asking for help. He said five police officers came looking for him,” said the source.
Russian authorities handed him over to the North Korean consulate in Vladivostok.
Russian police have a history of arresting North Korean defectors at the request of Pyongyang. According to the U.S. State Department’s human rights report on Russia released in March 2021, Russian police “committed enforced disappearances and abductions” in 2020.
“The Civic Assistance Committee reported that a North Korean citizen who was seeking asylum in Vladivostok was taken to the Artyom City Police Department by individuals in civilian clothes, where he subsequently disappeared,” the report said.
The Civic Assistance Committee (CAC) is a Moscow-based nonprofit organization comprised of a team of lawyers, doctors, consultants, aid workers and interpreters who help refugees and migrants in Russia.
According to a report by the CAC released in 2020, Russia’s Deputy Head of the Federal Migration Service Nikolay Smorodin signed an agreement with North Korean Deputy Minister of Foreign Affairs Pak Myung Guk in February 2016 to transfer North Koreans who are trying to defect.
“The Russian government legalized the forcible deportation to the DPRK of those Koreans,” said the report.
Svetlana Gannushkina, who heads CAC, told VOA’s Korean Service on Wednesday she had been unaware of Choe’s situation until contacted by the Korean Service.
“We have a lawyer in that city who knows all about Koreans who reside there,” said Gannushkina, referring to Vladivostok. “I’ll try to get more information about (Choe),” she said through an interpreter.
Dangerous decision
The source who last heard from Choe said they and others decided to disclose Choe’s information to VOA’s Korean Service hoping the international community would step in to help.
Suzanne Scholte, president of the Defense Forum Foundation and a leading North Korean human rights activist, said, “It’s extremely dangerous” for North Koreans who are trying to defect and seek asylum.
“The UNHCR is doing the best (it) can trying to facilitate any refugees that are seeking asylum, but it’s such a difficult environment. And I think North Korea is very aggressive at tracking down and trying to force back anybody who’s trying to escape,” said Scholte.
Several sources said Choe might not have been repatriated to North Korea immediately after his arrest due to Pyongyang’s fear that he might bring COVID-19 into the country. North Korea has virtually sealed itself off from the world since January 2020, although last month it partially reopened the borders it shares with China to allow passage by North Korean freight trains, according to commercial satellite images tracked by The Associated Press.
Value of knowledge
According to Choe’s passport, screenshots of text messages Choe exchanged with several sources and other documents obtained by VOA’s Korean Service, Choe was deeply involved in Pyongyang’s overseas cyberoperations handled by its Enemy Collapse Sabotage Bureau.
The bureau is part of the General Staff Department overseen by North Korea’s military. The Enemy Collapse Sabotage Bureau and the Reconnaissance General Bureau are North Korea’s main cyberwarfare units, and the latter harbors known hacking operations such as the Lazarus Group and Hidden Cobra.
Mathew Ha, an analyst at national security research institute Valens Global, said a defection by a North Korean with Choe’s understanding of North Korea’s cyberwarfare landscape would be of “immense” value to countries such as the U.S. and South Korea.
“In terms of being able to attribute attacks back to North Korea,” a high-level defector from its military cyber command provides value “because the North Koreans have consistently denied any sort of claims from the United States or South Korea regarding (its) culpability on any major cyberattacks including (on) Sony” Pictures Entertainment in 2014.
“It (would) be very valuable,” said Ha. A defector like Choe “could potentially provide crucial information that we really want to know” about.
