On the morning of 14 February 2017, a grainy closed circuit television video shows a middle-aged Korean man striding casually into the Low Cost Carrier Terminal (LCCT) of Kuala Lumpur International Airport. He is approached from behind by a young woman in a white t-shirt and blue skirt and in a flash she throws a cloth over his face to administer a lethal dose of a colorless, odorless liquid. The victim, Kim Jong Nam, is the estranged half-brother of North Korean leader Kim Jong Un. He did not yet realize he was already doomed; assassinated by unknown assailants wielding an unidentified chemical weapon. The ongoing international manhunt that followed revealed the greatest strengths of the storied Royal Malaysian Police Special Branch and the brutality and skill of the North Korean intelligence service. The incident also strained relations between Pyongyang and one of the few countries in the world with which it enjoys normal relations.

The brazen murder also captivated millions and brought a shadowy underworld briefly to the surface. What is not apparent to most is that last week’s dramatic events were not a lucky strike by clever opportunists, they were the end result of a sophisticated intelligence operation – actually several separate operations – spanning multiple countries and likely involving dozens of intelligence officers and their agents. (In the professional jargon of the intelligence community, an agent is someone recruited by an intelligence officer.) Coordinating their activities to achieve the final spectacular, and previously impossible result is the real art behind the assassination.

The Cat and the Mouse

Once considered a likely successor to his father, Kim Jong Il, Kim Jong Nam was passed-over following a careless indiscretion and went quickly into exile while his younger sibling thrashed about in the tense early days of his rule. Despite great doubt about his ability to muster the ruthlessness required to retain power over the isolated country, Kim Jong Un quickly consolidated his hold using imprisonment and death to control anyone presenting the slightest political threat. In an environment where even kinship was less important than loyalty, Kim Jong Nam was bound to be targeted even if he had not made statements questioning the stability of his brother’s regime.

The elder Kim withdrew deeper into a dark exile after his father’s death in 2012. In China and Macau he was assumed to be under state protection and travelled under numerous aliases. He had already survived at least two attempts on his life and reportedly begged his half-brother to spare his life and that of his family. His final minutes in Kuala Lumpur were a bizarre drama. After being assaulted by the woman in white, he was initially treated at an airport clinic before being evacuated by ambulance to a local hospital. He died en route, just as police were beginning their hunt for his alleged attackers, an Indonesian girl – Siti Aisyah – and a Vietnamese national, Doan Thi Huong, the now infamous woman wearing the coldly ironic “LOL” t-shirt.

After her attack on Kim Jong Nam, CCTV footage shows Doan calmly leaving the scene and catching a taxi outside. Despite having just administered a lethal dose of an unknown chemical, she displayed no concern for her own safety and wore no obvious protective equipment. She had clearly practiced the sequence. Both Doan and Siti Aisyah later told police separately they believed they were taking part in a made for television prank. But Doan’s actions in the 48 hours prior to the attack suggest she had received some training in tradecraft. During that time she stayed in three hotels in the immediate vicinity of the airport and paid cash for her lodging. At one point she borrowed a pair of scissors and cut her hair, leaving the remnants in the trash can in her room. Her activities during the day are just coming to light but are now known to have included numerous rehearsals and examinations of the target area; possibly in conjunction with Siti Aisyah. These are classic, if clumsy techniques to avoid detection and rehearse the operation. They certainly signal a nefarious intent.

The Art of Assassination

To the casual observer, Kim Jong Nam’s death may seem like the handiwork of a couple clever and highly trained operatives. The reality is that intelligence operations of this kind are highly choreographed, involve dozens of actors, and are compartmented for security. Assassinating Kim Jong Nam required at least five, and as many as seven separate operations managed by seven or more intelligence officers with perhaps dozens of agents in Macau, China, Malaysia, Vietnam, and Indonesia. The overall operation likely consisted of the following supporting operations:

• Recruit the assassins. Siti Aisyah was recruited in Indonesia. Doan may have been recruited in Vietnam.
• Determine Kim Jong Nam’s travel plans. Doan was aware of Kim Jong Nam’s travel plans at least 48 hours prior to the attack. She used this time to rehearse and to complete her reconnaissance. Information gleaned from his social media feed is not reliable enough for this purpose and had to be corroborated with direct knowledge from intercepted communications or recruited agents in a position to provide assured access to his itinerary.
• Report Kim Jong Nam’s movements. The attack required very precise information about his flight, his mode of transportation, his likely arrival time at the terminal, the gate/check-in counter for his flight, what he was wearing, etc.; all of which had to be communicated to the assassins in a timely manner. A botched operation would have been far too damaging to leave this to chance. This could have been as simple as a phone warning from his hotel but doing this reliably requires layers of mobile and static surveillance at the hotel, the airport, and his many residences.
• Deliver the chemical. The chemical used to kill Kim Jong Nam was smuggled into Malaysia or manufactured locally. It likely required special skill to make and specific equipment to store and administer. For Security, Doan would have received the chemical secretly and been trained in its use at the last possible moment raising the risk it could have killed bystanders or the assassins themselves.
• Kill Kim Jong Nam. There is a possibility Doan and Siti Aisyah may have been employed separately to ensure redundancy. They may even have been unaware of each other’s activities. The leaked CCTV footage of the attack supports this conclusion, though there is new information that they rehearsed the attack together.
• Observe and report the outcome. Though this could have been conducted overtly through North Korean diplomats and/or monitoring of the press, it is a critical piece. At a minimum, Doan needed to report her task complete or a separate observer had to be in place at the scene to do so. Emerging information suggests this was the task of the four North Korean nationals still sought by Malaysian police.
• Exfiltrate the assets. The four remaining fugitives all left Malaysia within a few hours of the operation. They took circuitous routes back to North Korea via Indonesia, Dubai, Russia, and elsewhere. Their roles are not certain but probably also included passing intelligence and issuing final orders. One, Ri Jong Chol, remained in Kuala Lumpur and was apprehended Monday. Doan and Siti Aisyah seemed to lack viable escape plans. It is possible they were left as a diversion to throw investigators off the trail of fleeing North Korean intelligence officers.

Though it was possible to conduct some of the supporting operations above clandestinely, meaning the operations themselves remain hidden, the politically explosive death of Kim Jong Un’s half-brother could never be kept secret and therefore had to be done covertly, meaning the sponsor’s hand remains hidden. A covert operation is much more difficult to execute than a clandestine one and requires layers of separation between intelligence officers and their agents that are typically not highly trained operatives. Agents are deniable and sometimes coerced. Occasionally they do not know whom they are working for or even that they are working for someone at all.

As an additional security measure, the supporting operations would be kept completely separate. The risk of detection is highest when these operations come together through communications or physical contact, meaning the moment of greatest vulnerability was during the attack itself when all the pieces were brought together in time and space. At that point, all the complicated designs of the North Korean regime rested on the element of surprise and the skill and demeanor of half-trained agents.

Ultimately, the assassination of Kim Jong Nam was a well-planned and skillfully executed intelligence operation, but the Royal Malaysian Police Special Branch is untangling the knot with great efficiency. With its roots in the long, difficult fight against Communist insurgency, Special Branch is a tough adversary in the ongoing spy game. Known locally as SB, Special Branch serves as both the internal and external intelligence service of the Malaysian state. They enjoy good relationships with counterparts in the region and are receiving excellent mutual support from Malaysia’s Foreign Ministry which is aggressively setting the conditions for international cooperation in the investigation. Though culpability for Kim Jong Nam’s death may never be fully proven, SB has managed to minimize political damage to Malaysia and imposed a high cost on North Korea. With the dust still settling, only Kim Jong Un himself can say if his brother’s murder was worth the resultant damage to relations with Malaysia and the increased suspicion that the operation has inspired around the world.

---

Lino Miani is a retired US Army Special Forces officer, author of The Sulu Arms Market, and CEO of Navisio Global LLC. He provided expertise in special and intelligence operations to NATO from 2013-2016. Read about one of his encounters with the North Koreans in Kuala Lumpur.