Headaches and Cigarettes: Conviction of Pyongyang Spies Reveals Their Playbook of Codes, Signals

Yomiuri Shimbun

18-05-2025

Shunpei Takeuchi / The Yomiuri Shimbun
A statue in Hanoi, used as a place to rendezvous by North Korean spies, is seen on in January
SEOUL — Last November, South Korea's Suwon District Court sentenced three men to between five and 15 years in prison for spying in South Korea under the instructions of the North Korean intelligence agency. They were members of a spy network formed secretly in South Korea.
The Yomiuri Shimbun obtained details of the investigation and viewed the directives that were admitted as evidence in the ruling. Revealed were glimpses of the information warfare raging between the two countries.
In August 2019, a man was standing at a 'meeting place' in Hanoi, carefully observing his surroundings. A month before, North Korea had sent a directive to the spy network inside its southern neighbor, instructing the man in how to confirm the identity of Pyongyang's agent using signs.
'Branch manager: Open a plastic water bottle and take a sip at 10 o'clock,' read the directive.
'Headquarters member: Once you have seen this gesture, wipe your sunglasses with a handkerchief several times at a spot seven to eight meters away from [the manager].'
'Headquarters' refers to the Cultural Exchange Bureau, or North Korea's intelligence agency, and 'branch manager' refers to the man who was waiting to meet someone in Hanoi. This man headed the spy ring in South Korea, and he was sentenced to 15 years in prison in November.
The ringleader was set to meet an agent next to a statue by Hoan Kiem Lake, a popular tourist spot at the heart of the Vietnamese capital. Should they fail to link up there, a large supermarket nearby was designated as a backup location to meet an hour later.
'Check carefully,' the directive warned the spy leader, 'to see if you are being followed, during the entire time from when you are leaving the country [South Korea] until the meeting [after the rendezvous].'
If he did notice someone was tailing him, the man was to use the codeword 'headache' to inform the intelligence agency via smartphone.
'If the headquarters member lights a cigarette while showing you the way, that's a signal that you are being followed. Move away from the member, find the pursuer and throw him off the track,' the directive said.
However, investigators at the South Korean National Intelligence Service (NIS) were keeping tabs on the spy leader after he arrived in Vietnam and the North Korean agent, starting two days before the pair's rendezvous. The investigators photographed the two walking around near the statue and keeping a lookout. They also took photos of another network member meeting with a North Korean agent the following day.
According to the ruling, members of the South Korean spy network and North Korean agents also met in Phnom Penh in September 2017 and in Guangzhou, China's Guangdong Province, in September 2018. A photo presented at court showed the ringleader getting into a tuk-tuk with a North Korean agent in Phnom Penh.
The man in his 50s who led the spy network was a senior member of the Korean Confederation of Trade Unions, one of South Korea's largest labor unions, and was able to supervise the union's affiliated organizations. He was also charged with violating the National Security Law for collecting information on U.S. military bases.
At the trial, a former North Korean spy who had been caught on duty in South Korea testified about Pyongyang's agent photographed in Cambodia. 'We were in the same group. I lived with this man for 24 hours a day,' the ex-spy said. 'He is an agent who received the title of Hero of the Republic. He has lost a lot of hair and put on a bit of weight [in this picture].'
The ruling allowed such testimony and photographs as evidence, and said the covert meetings overseas were conducted in order 'to receive specific instructions from North Korea and discuss ways to carry out their aim.'
The trial revealed 102 messages between the North and the spy network, with 89 from Pyongyang and 13 from the network. These included instructions to incite anti-Japanese acts over Japan's decision in April 2021 to release treated water from the Fukushima No. 1 nuclear power plant.
Signals in YouTube comments
Kazuki Koike / The Yomiuri Shimbun
People gather in front of the Suwon District Court in South Korea on Nov. 6 ahead of a ruling on three men who were subsequently given prison time for espionage.
The North Korean spy agency sent its instructions to the South Korean network online using steganography, a method of encryption in which data is hidden inside images or messages. Besides emails, they also made use of the comments section on YouTube.
'If you post a pseudonym or text that includes 'Tommy Hall' in the YouTube comments, we will understand that you can go on a trip and will prepare for it.'
This instruction from North Korea in August 2022 was asking a spy in South Korea if it was possible for him to take a trip, in other words to make contact, and it came with a YouTube link attached. The spy was to use the codeword 'Tommy Hall' in the comments if it was possible, or 'uphill road' if it was not.
It's believed YouTube was used as a way to quickly respond to questions from North Korea.
'North Korea makes use of everything, including social media and cutting-edge technology,' said a former North Korean agent.
After conservative Yoon Suk Yeol, who took a tough stance on Pyongyang, was elected president of South Korea in March 2022, the North Korean agency called for increased vigilance.
A directive issued immediately after the election ordered: 'The public security authorities are likely to become more active. Don't leave any physical evidence. USBs should be physically destroyed and burned.'
The evidence from the ruling showed that South Korea's NIS had been aware of the spies' activities since at least September 2017, and it likely surveilled their movements for over five years, up to January 2023.
The last directive from North Korea that was used as evidence was dated December 2022, a month before authorities raided the South Korean network for engaging in espionage.
The message showed concern about a delay in reports from South Korea: 'It's been over two months since we heard from you. We are worried and frustrated, and we miss you.
'You could have sent a short text saying you're fine and describing the situation you're in now. I haven't forgotten the days we spent talking, grasping each other's hands firmly and embracing each other warmly, sharing the love of family.'
At this point, South Korea's investigative authorities seemed to have already tightened the noose around the spy network.