Who is Backing Free Joseon?
It seems that the Washington Post has been receiving press releases from the Cheollima Civil Defense Group. The Washington Post quoted sources familiar with the planning and execution of the 22 February raid who attributed the raid to Cheollima. Now, the Post is quoting sources “familiar with the meeting” in an article claiming that the Cheollima Group has shared information with the FBI. As expected, the FBI and the CIA refused to comment on these claims. Although we have limited information about the group, widespread reporting of their alleged activities leads us to question: who is backing Free Joseon and what are their motivations?
Who is Free Joseon?
I first wrote about the group following their 3.1 announcement declaring a provisional government of Free Joseon. Prior to that, the group was somewhat known for their alleged aid in evacuating Kim Han Sol (Kim Jong Nam’s son) and his family from Macau following the assassination of KJN in Malaysia in 2017. However, it is important to note that there is no evidence available at this time connecting the Cheollima Group to Kim Han Sol or his evacuation. Further, there is no evidence of Kim Han Sol’s whereabouts suggesting he is either in hiding, or is in North Korea. This leads me to conclude two possible identities for the Cheollima Group: Individuals loyal to the DPRK, or a group of defectors.
The 3.1 announcement video shows a woman reading the declaration at the pavilion in Tapgol Park in Jongno, Seoul. This is the same location where the original 3.1 Declaration of Independence was read starting the 3.1 Independence Movement. Unfortunately, we cannot ascertain much information from this video other than the fact that one woman and one man’s identities are blurred. However, the video shows that the Cheollima Group does have members either living in or having access to the ROK. But, this does not definitively answer the question of whether the group is made up of defectors or North Korean agents. While the proclamation at Tapgol Park is significant for Koreans, this defiant act is only available to South Koreans and was likely not aimed at them to begin with.
The most current post on the group’s website at the time of this writing states
“Our organization currently only utilizes this website, and our YouTube page. Any other accounts on any other platforms are unauthorized and do not represent us.” But open source information about the website provides us with no clearer picture as to who the group is.
Whois information for the domain reveals that the domain is registered through NameCheap by Fedor Nikolov in Saratov, Russia. 252 other domains are associated with the name Fedor Nikolov indicating that this is an anonymous register for domain names, mostly located in Russia. The domain was registered on 4 March 2017 and Cheollimacivildefense.com was registered four days later on 8 March 2017. However, Cheollimacivildefense.com redirects to a Gangnam, Seoul based cybersecurity firm and was likely registered as a means of driving traffic to their business. The group also uses Proton Mail for both of their published email addresses which cannot be used for open source identification. Additionally, the IP information for the domain is owned by the US-based DNS/hosting company CloudFlare. Thus, the domain is hosted on servers that also host hundreds of other websites not associated with the group. Consequently, open source examination of the group’s website and email addresses does not reveal the identities of the group.
The group has also posted a Bitcoin address for independent donations.
Tracking the Bitcoin transfers and the price of Bitcoin on the date of the transfers indicates that the group has raised roughly $35,000 USD since 14 March 2017. This is not a substantial amount of money for a group purported to be rising up in defiance of the DPRK. We know that 10 people were involved in the 22 February raid in Spain and significant mission planning and training must have preceded that operation. Moreover, the group has claimed responsibility for smuggling Kim Han Sol and others to safety. Thus, we must assess that the group is receiving funding from another source external to their Bitcoin fundraising. Or, the group is not responsible for the actions that have been attributed to it.
Who is Backing Free Joseon?
Assuming that the group is indeed responsible for moving Kim Han Sol from Macau and keeping him hidden, as well as the 22 February raid, then we must ask who is backing the group?
This video claims to show a person smashing the portraits of Kim Il Sung and Kim Jong Il “on our homeland’s soil.” It is probable that this was filmed during the 22 February raid at the DPRK embassy in Spain. Interestingly, at the end of the video the group writes “김일성 김정일 김정은 신격화를 타도 한다. Down with Kim family rule!” This message was echoed in the 11 March defacing of the DPRK embassy to Malaysia on the day that the trial of the two women accused of killing KJN was set to resume.
Logically, it would be inconsistent for the group to be aiming for placing Kim Han Sol as head of state after denouncing the religious dynasty of the Kim family. One possible explanation for the group’s origins is a faction within the North that is against the current regime, but wishes to maintain a Socialist society headed by the younger Kim. Perhaps their denouncement of the Kim family is meant for foreign observers in an effort to drum support for this coup. This would make sense considering North Koreans are probably not aware of nor consuming the media being released by the group. Thus, the group is free to overstate their aims knowing that it will not undermine their true goals domestically. Moreover, this would explain the resources (both funding, logistics, and personnel) that are apparently available to the group.
In light of the information available at this time, I no longer believe that the group is a counter-intelligence operation run by the state apparatus of the DPRK. However, I am not convinced that the group is made up of dissidents aiming to establish a truly Free Joseon. As far as I can tell, the possibility that the group is simply a faction aiming to replace one dictatorship with another remains high. However, it is still worthwhile to explore the possibility that this is truly a pro-democracy group.
Other Dissident Groups
If Free Joseon is a dissident group, they may have contacts to other dissident groups like The North Korean Freedom Coalition, the North Korean People’s Liberation Front, and Free North Korea Radio. Examining the open source information related to the latter groups’ websites show that they are hosted on the same server and registered to the same person (Kim Seong Min). The North Korean People’s Liberation Front, founded by Choi Jung Hoon, is a group made up of former members of the KPA who have stated their goal of overthrowing the North Korean government since 2010. All of this is open source information publicly available on the groups’ websites.
Assuming that the Free Joseon group is working in tandem with these other groups, or is made up of these groups, then the Free Joseon group would have access to former RGB members with IT/hacking, military and intelligence, and finance experience. Furthermore, a number of defectors since Jang Song Thaek’s execution in 2013 have been involved in DPRK trade and finance, including Yun Tae Hyong (former senior DPRK banking official). If any of these officials are working with the Cheollima Group, then the group would have access to a wealth of information related to DPRK activities as well as hidden funds to carry out their operations. Additionally, the 22 February raid would have added to the group’s information cache possibly revealing other hidden funds, contacts, and encryption keys.
The US Angle
As I wrote before, El Pais reported the claim that at least two of the 10 individuals involved in the 22 February raid have ties to the CIA. I highly doubt that the CIA would have received approval to conduct a direct action operation against a diplomatic site in the days preceding the Hanoi summit. However, I do not doubt that the US Intelligence Community would want to make contact with the group following these high profile incidents. In fact, the high profile nature of these incidents suggests that the IC was not a part of the mission planning or execution, rather the operations were publicized in an attempt to demonstrate capabilities to the IC. But, I still don’t know what the motivations of this group are.
Word of Caution
The IC is made up of highly trained individuals who put out exceptional intelligence products. However, intelligence has been manipulated for political reasons in the past. Notably, Rafid Ahmed Alwan admitted to lying about the Iraqi weapons program leading to the toppling of Saddam Hussein’s regime by the US-led coalition. Some Pyongyang watchers have expressed excitement over the supposed Free Joseon group — and I must admit that the prospect of a resistance movement is one I welcome — but we should really temper our expectations. As I’ve demonstrated in this post, we simply do not have enough evidence at this time to believe that the Cheollima group’s claims are real, no matter how much we wish they were.
