LOL: The Art of Assassination

On the morning of 14 February 2017, a grainy closed circuit television video shows a middle-aged Korean man striding casually into the Low Cost Carrier Terminal (LCCT) of Kuala Lumpur International Airport. He is approached from behind by a young woman in a white t-shirt and blue skirt and in a flash she throws a cloth over his face to administer a lethal dose of a colorless, odorless liquid. The victim, Kim Jong Nam, is the estranged half-brother of North Korean leader Kim Jong Un. He did not yet realize he was already doomed; assassinated by unknown assailants wielding an unidentified chemical weapon. The ongoing international manhunt that followed revealed the greatest strengths of the storied Royal Malaysian Police Special Branch and the brutality and skill of the North Korean intelligence service. The incident also strained relations between Pyongyang and one of the few countries in the world with which it enjoys normal relations.

The brazen murder also captivated millions and brought a shadowy underworld briefly to the surface. What is not apparent to most is that last week’s dramatic events were not a lucky strike by clever opportunists, they were the end result of a sophisticated intelligence operation – actually several separate operations – spanning multiple countries and likely involving dozens of intelligence officers and their agents. (In the professional jargon of the intelligence community, an agent is someone recruited by an intelligence officer.) Coordinating their activities to achieve the final spectacular, and previously impossible result is the real art behind the assassination.

The Cat and the Mouse

Once considered a likely successor to his father, Kim Jong Il, Kim Jong Nam was passed-over following a careless indiscretion and went quickly into exile while his younger sibling thrashed about in the tense early days of his rule. Despite great doubt about his ability to muster the ruthlessness required to retain power over the isolated country, Kim Jong Un quickly consolidated his hold using imprisonment and death to control anyone presenting the slightest political threat. In an environment where even kinship was less important than loyalty, Kim Jong Nam was bound to be targeted even if he had not made statements questioning the stability of his brother’s regime.

Nam Assassination
Before his fortunes faded, Kim Jong Nam (left) was the presumptive heir to North Korean leader Kim Jong Il. Now his half-brother, Kim Jong Un (right), leads the country. Photo credit: http://www.telegraph.co.uk/news/2017/02/15/exclusive-two-female-secret-agents-behind-murder-kim-jong-unsbrother/

The elder Kim withdrew deeper into a dark exile after his father’s death in 2012. In China and Macau he was assumed to be under state protection and travelled under numerous aliases. He had already survived at least two attempts on his life and reportedly begged his half-brother to spare his life and that of his family. His final minutes in Kuala Lumpur were a bizarre drama. After being assaulted by the woman in white, he was initially treated at an airport clinic before being evacuated by ambulance to a local hospital. He died en route, just as police were beginning their hunt for his alleged attackers, an Indonesian girl – Siti Aisyah – and a Vietnamese national, Doan Thi Huong, the now infamous woman wearing the coldly ironic “LOL” t-shirt.

After her attack on Kim Jong Nam, CCTV footage shows Doan calmly leaving the scene and catching a taxi outside. Despite having just administered a lethal dose of an unknown chemical, she displayed no concern for her own safety and wore no obvious protective equipment. She had clearly practiced the sequence. Both Doan and Siti Aisyah later told police separately they believed they were taking part in a made for television prank. But Doan’s actions in the 48 hours prior to the attack suggest she had received some training in tradecraft. During that time she stayed in three hotels in the immediate vicinity of the airport and paid cash for her lodging. At one point she borrowed a pair of scissors and cut her hair, leaving the remnants in the trash can in her room. Her activities during the day are just coming to light but are now known to have included numerous rehearsals and examinations of the target area; possibly in conjunction with Siti Aisyah. These are classic, if clumsy techniques to avoid detection and rehearse the operation. They certainly signal a nefarious intent.

The Art of Assassination

To the casual observer, Kim Jong Nam’s death may seem like the handiwork of a couple clever and highly trained operatives. The reality is that intelligence operations of this kind are highly choreographed, involve dozens of actors, and are compartmented for security. Assassinating Kim Jong Nam required at least five, and as many as seven separate operations managed by seven or more intelligence officers with perhaps dozens of agents in Macau, China, Malaysia, Vietnam, and Indonesia. The overall operation likely consisted of the following supporting operations:

  • Recruit the assassins. Siti Aisyah was recruited in Indonesia. Doan may have been recruited in Vietnam.
  • Determine Kim Jong Nam’s travel plans. Doan was aware of Kim Jong Nam’s travel plans at least 48 hours prior to the attack. She used this time to rehearse and to complete her reconnaissance. Information gleaned from his social media feed is not reliable enough for this purpose and had to be corroborated with direct knowledge from intercepted communications or recruited agents in a position to provide assured access to his itinerary.
  • Report Kim Jong Nam’s movements. The attack required very precise information about his flight, his mode of transportation, his likely arrival time at the terminal, the gate/check-in counter for his flight, what he was wearing, etc.; all of which had to be communicated to the assassins in a timely manner. A botched operation would have been far too damaging to leave this to chance. This could have been as simple as a phone warning from his hotel but doing this reliably requires layers of mobile and static surveillance at the hotel, the airport, and his many residences.
  • Deliver the chemical. The chemical used to kill Kim Jong Nam was smuggled into Malaysia or manufactured locally. It likely required special skill to make and specific equipment to store and administer. For Security, Doan would have received the chemical secretly and been trained in its use at the last possible moment raising the risk it could have killed bystanders or the assassins themselves.
  • Kill Kim Jong Nam. There is a possibility Doan and Siti Aisyah may have been employed separately to ensure redundancy. They may even have been unaware of each other’s activities. The leaked CCTV footage of the attack supports this conclusion, though there is new information that they rehearsed the attack together.
  • Observe and report the outcome. Though this could have been conducted overtly through North Korean diplomats and/or monitoring of the press, it is a critical piece. At a minimum, Doan needed to report her task complete or a separate observer had to be in place at the scene to do so. Emerging information suggests this was the task of the four North Korean nationals still sought by Malaysian police.
  • Exfiltrate the assets. The four remaining fugitives all left Malaysia within a few hours of the operation. They took circuitous routes back to North Korea via Indonesia, Dubai, Russia, and elsewhere. Their roles are not certain but probably also included passing intelligence and issuing final orders. One, Ri Jong Chol, remained in Kuala Lumpur and was apprehended Monday. Doan and Siti Aisyah seemed to lack viable escape plans. It is possible they were left as a diversion to throw investigators off the trail of fleeing North Korean intelligence officers.
assassination malaysia
Deputy National Police Chief of Malaysia Noor Rashid Ibrahim, left, speaks as Selangor Police Chief Abdul Samah Mat listens during a press conference at the Bukit Aman national police headquarters in Kuala Lumpur, Malaysia, Sunday, Feb. 19, 2017. Photo credit: AP Photo/Vincent Thian, http://time.com/4676018/kim-jong-nam-death-north-korea-suspects/

Though it was possible to conduct some of the supporting operations above clandestinely, meaning the operations themselves remain hidden, the politically explosive death of Kim Jong Un’s half-brother could never be kept secret and therefore had to be done covertly, meaning the sponsor’s hand remains hidden. A covert operation is much more difficult to execute than a clandestine one and requires layers of separation between intelligence officers and their agents that are typically not highly trained operatives. Agents are deniable and sometimes coerced. Occasionally they do not know whom they are working for or even that they are working for someone at all.

As an additional security measure, the supporting operations would be kept completely separate. The risk of detection is highest when these operations come together through communications or physical contact, meaning the moment of greatest vulnerability was during the attack itself when all the pieces were brought together in time and space. At that point, all the complicated designs of the North Korean regime rested on the element of surprise and the skill and demeanor of half-trained agents.

Ultimately, the assassination of Kim Jong Nam was a well-planned and skillfully executed intelligence operation, but the Royal Malaysian Police Special Branch is untangling the knot with great efficiency. With its roots in the long, difficult fight against Communist insurgency, Special Branch is a tough adversary in the ongoing spy game. Known locally as SB, Special Branch serves as both the internal and external intelligence service of the Malaysian state. They enjoy good relationships with counterparts in the region and are receiving excellent mutual support from Malaysia’s Foreign Ministry which is aggressively setting the conditions for international cooperation in the investigation. Though culpability for Kim Jong Nam’s death may never be fully proven, SB has managed to minimize political damage to Malaysia and imposed a high cost on North Korea. With the dust still settling, only Kim Jong Un himself can say if his brother’s murder was worth the resultant damage to relations with Malaysia and the increased suspicion that the operation has inspired around the world.


Lino Miani

Lino Miani is a retired US Army Special Forces officer, author of The Sulu Arms Market, and CEO of Navisio Global LLC. He provided expertise in special and intelligence operations to NATO from 2013-2016. Read about one of his encounters with the North Koreans in Kuala Lumpur.

10 thoughts on “LOL: The Art of Assassination”

  1. Lino, thanks very much for providing insight into these kind of ops. Interesting and worrying at the same time.

    1. Jaap,

      Thanks for reading. It is worrying but it’s also not the first time North Korea has done something like this. In 1983 they tried to kill the President of South Korea with a bomb in Rangoon. They failed but managed to kill the Foreign Minister and the Deputy Prime Minister instead.

      Let’s hope the increased security measures implemented as a result of this latest incident make these kinds of incidents less likely.

      -Lino

  2. Great article, Lino. Clearly this kind of operation required significant planning and entailed the highest kinds of risks. Although the secret is out, they accomplished their primary objective, and proved willing to commit the highest of crimes in defense of their regime.

  3. Great article, Lino. One more point though. NK operatives are absolutely ruthless, totally mission-oriented and anticipated to die on operations. Witness Kim, Hyun-Hui when her male partner committed suicide and her attempt failed. Failing that, she attempted to bite off her own tongue. NK operatives still conduct operations inside South Korea with little concern for Seoul or the world’s opinions.

    1. Mr. H,

      Thank you for your observation. DPRK intelligence officers have been known to commit suicide rather than be captured so I initially considered it odd that Doan and Siti Aisyah allowed themselves to be apprehended. I was reminded however that the duo are not intelligence officers of the North Korean state but rather agents. This begs the question why the DPRK didn’t attempt to eliminate them as loose ends? These questions are the reason I suggest they may be a diversion to distract attention away from the intelligence officers involved.

      -Lino

  4. Perhaps domestic media in DPRK would provide some insight into the reason the agents were left to Malay authorities. (If news of the assassination has permeated or been covered intentionally). The state could assign scapegoats and use the death of Kim Jong Un’s brother to keep public focus on external threats to regime survival. If it has not been covered in DPRK news/propaganda, that reveals something as well.

    1. Ms. Fletcher,

      You make an excellent point about DPRK media and I think your scapegoat theory may be viable.

      Until now however, the Korean Central News Agency (mouthpiece of the North Korean state) has remained silent on the story. The KCNA Watch website (https://kcnawatch.co/) which aggregates the KCNA feed, doesn’t record a single mention of Kim Jong Nam between 17 February and today.

      It will be very interesting indeed to see how they portray the event when the finally do begin discussing it.

      -Lino

      1. Lino, I should have reviewed KCNA before posing such a theory. The lack of mention would immediately make it invalid. This would further indicate that the agents were left to authorities either to sow disinformation (perhaps even unwittingly) or because there was insufficient time to neutralize them. Best, Julia

Leave a Reply

Your email address will not be published. Required fields are marked *