By Daniel Pinkston, Contributing Writer

February 23, 2017 - As the investigation into the murder of Kim Jong-nam, the elder half-brother of North Korean leader Kim Jong-un, enters its second week, the evidence indicates that the North Korean government almost certainly is responsible. South Korea’s National Intelligence Service (NIS) was quick to blame the North, which was the most likely culprit even though other scenarios could not be ruled out pending the investigation by Malaysian authorities.

Kim was attacked by two young women in the departure area of Kuala Lumpur International Airport on 13 February, and the North Korean embassy demanded immediate custody of Kim’s body. The embassy also has refused to accept the results of the autopsy, which so far are inconclusive, and suggested that Malaysia was collaborating with external forces (South Korea) to distort the investigation. The accusations brought a swift rebuke from Malaysia’s prime minister and the foreign ministry. The North Korean ambassador was called into the Malaysian Foreign Ministry, and the Malaysian ambassador was recalled from Pyongyang. The future diplomatic fallout is uncertain, but Malaysia might sever diplomatic ties just as Burma did following the 1983 North Korean terrorist bombing in Rangoon. If Malaysia does sever ties, the decision would be appropriate.

The two female suspects accused of killing Kim told police that they had been duped, and had believed they were pulling an innocent prank for a television program. However, their story quickly collapsed under the weight of too much contradictory and circumstantial evidence. For example, the video footage showed two women quickly walking away, heading in separate directions; according to police, they immediately went to the restroom to wash the poison off their hands. They were clearly informed about what was afoot: if they had pulled a stunt for a comedy show, they almost certainly would have stayed on the scene and took pictures while laughing with Kim about the joke.

There are several other bits of suspicious information about the women suspects. Doan Thi Huong is Vietnamese and arrived from Vietnam on 4 February, and Siti Aisyah is Indonesian and arrived from Indonesia on 2 February, suggesting that their visits to Malaysia were timed. Doan reportedly received some training or education in pharmacology about 10 years ago, and Siti is known to speak English and Korean. Both women reportedly are somewhat estranged from their families; their parents seem unaware about the details of their jobs or living arrangements. Siti also has two identities. One identity card lists her name as “Siti Aisyah,” and entrepreneur born on 11 February 1992; her name on the second identity card is “Siti Aisah,” a housewife born 1 November 1989.

Malaysian authorities have detained one North Korean male national, Ri Jong-chol, who had been in Malaysia since August 2016 and has lived in the country for three years. Ri is said to have a background in chemistry and had a work permit to do IT work with a Malaysian company, but he never showed up to the firm and he never received any salary from the firm. These facts at least suggest that he was engaged in illicit activities.

Four North Korean men flew out of Kuala Lumpur immediately after the attack and Malaysian authorities believe they are now in Pyongyang. They flew through Dubai and Vladivostok before reaching Pyongyang, leading to speculation that they transited through the Middle East to cover their tracks. The police also have named two other suspects—a second secretary at the North Korean embassy and an employee of North Korea’s Koryo Airlines—who are believed to be in Malaysia. The authorities have asked for Pyongyang’s cooperation in gaining access to these individuals, but that is unlikely. However, if their exit is blocked and they are in the country they still might be apprehended, with a looming issue of how Malaysia will handle the invocation of diplomatic immunity.

Fratricide in struggles for the throne has existed for centuries in past empires, and deadly purges have been part of the DPRK since it was founded. Kim Jong-un repeatedly has demonstrated his ruthlessness in purging challengers—real or perceived—and even had his uncle executed. Kim Jong-nam reportedly had a price on his head since 2012, so his murder should come as no surprise. But questions remain: Why now? Was this a long standing order that finally was carried out when an opportunity emerged? Or was something happening inside North Korea that made Kim Jong-nam’s elimination urgent?

Media have reported that Kim Jong-nam expressed no political ambitions and that he was opposed to the third generation of succession, essentially eliminating himself as a potential North Korean leader. However, media often have reported that China has protected him in exile as a possible replacement to be installed through Chinese intervention if Kim Jong-un were ever deposed. That is an unlikely scenario, but the South Korean press also has reported that Kim had considered defecting to the South, and that North Korean defectors in Europe contacted Kim over the last couple of years asking him to be the leader of a North Korean government in exile, but he declined. This idea is farfetched because South Korea and its Ministry of Unification already have plans to install a new government under the Committee for the Five Northern Korean Provinces, a “government in exile” with provincial governors in their Seoul offices.

While Kim Jong-nam may have posed a small direct political threat to his younger brother, the Kim brothers could have clashed over the control of assets and financial resources. In the 1990s, Kim Jong-nam reportedly worked for the Ministry of State Security, and he was responsible for managing the financial transactions linked to North Korean arms exports. In dictatorships, it is common for family members to handle state finances, and North Korea is no different. For several years, Kim had lived in Macau, which is the location of Banco Delta Asia (BDA), a money laundering entity that managed some of North Korea’s illicit transactions.

In his personal life, Kim Jong-nam reportedly had two wives, at least one mistress, and children with other women. He had homes in Macau, Beijing, and Singapore. He travelled internationally and sometimes was spotted in casinos “living a playboy lifestyle.” According to Malaysian authorities, Kim Jong-nam was travelling with a valid North Korean passport under the name Kim Chol, and he had two identities. How was he issued two North Korean passports with different names? We can only speculate whether Kim recently had been involved in illicit transactions, but if not, he almost certainly had put away plenty of cash throughout the years to maintain his lifestyle.

One of the main reasons Kim Jong-un purged his uncle Chang Song-t’aek was to seize control of assets from Chang so that Kim could use them to reward his coalition of supporters in exchange for their loyalty. Kim Jong-nam’s fate could be similar to that of his Uncle Chang. The hit team who carried out Kim Jong-nam’s murder had intelligence about his travel itinerary and other personal information. It’s possible that Pyongyang could have retrieved the information needed to access the financial resources under Kim Jong-nam’s control abroad. In that case, a great dictator like Kim Jong-un would have to eliminate his brother before he defected to South Korea or the United States, which he probably would do if he suddenly was out of cash or believed his life was in danger.

Kim Jong-nam is rumored to have discussed his defection with South Korean authorities in the past, but he reportedly declined after they could not agree on the terms. However, if Kim Jong-nam’s money was cut off or about to be cut off, he might have had no choice but to defect in order to survive. A treacherous defection by a Kim from the Paektu hereditary line would have been an unacceptable embarrassment for Kim Jong-un, which could help explain why the regime might have decided to conduct such a risky and immoral operation.

The operation itself raises several questions about motives, capabilities, and training for such attacks and other possible illicit operations abroad. In particular, incorporating the foreign women into the operation introduced risks of failure and discovery. North Korea’s Reconnaissance General Bureau (RGB) is responsible for these types of operations abroad, and the RGB is believed to be ultimately responsible for the operation to kill Kim Jong-nam. The last stage of the operation was not that difficult and the assailants succeeded in their mission. However, many things could have gone wrong. They could have been discovered beforehand or balked at the last moment. Furthermore, they could have contaminated themselves or someone else with the toxin prior to the attack. And if the attack had been botched in progress, Kim Jong-nam could have decided to defect and subsequently cause the very embarrassment Pyongyang wanted to avoid.

These risks, the lack of trust, and general barriers to transactions usually prevent states and non-state actors such as terrorist groups or organized crime gangs from cooperating in the execution of illicit activities. The underworld has no criminal justice system, no courts, and no legitimate third-party enforcer; therefore, the actors can always renege on their promises. For example, if two drug dealers decide to meet in a hotel room to complete a narcotics transaction, one party can just refuse his part of the bargain and use violence to walk out with both the drugs and the cash, and with his counterpart dead in the hotel room.

The same holds true for deals between states and illicit non-state actors. For example, if a terrorist were to show up to buy some nerve agent from a state supplier, the terrorist might not have the diagnostic equipment to verify the authenticity of the agent. And if the material is authentic, the seller could simply kill the potential buyer and walk out with both the cash and the (real or fake) nerve agent. Nevertheless, cooperation is not impossible. Repeated interactions and the possibility of future retaliation can lead to cooperation and successful transactions in the underworld. Narcotics traffickers are able agree on transshipments. And states have been able to cooperate with criminal and terrorist organizations, but thankfully that illicit cooperation is not the norm. In the case of Kim Jong-nam’s murder, the operation appears to have been carried out by North Korean operatives abroad with at least two foreign agents. This raises the question whether Pyongyang has sought or is seeking the employment of other foreign agents to carry out additional illicit operations in deviance of the international community.

In this case, two foreign female assailants did not appear to have an effective escape plan, but four North Korean male suspects were able to flee the country immediately. The North Korean masterminds did not seem to care about the Vietnamese and Indonesian patsies and whether they were apprehended. The suspects had a fabricated alibi, albeit one that quickly fell apart. Certainly the North Koreans knew the assailants could disclose the truth behind the plot, but maybe they wanted the operation to be discovered. Just like a doomsday machine, foreign hit squads are not an effective deterrent against potential North Korean traitors unless they know the hit squads exist.