South Korea Says an Official Leaked a Classified Spy Roster to China

An official at South Korea’s top military intelligence agency leaked classified data, including a list of undercover operatives, to a suspected Chinese intelligence agent for years in exchange for cash, defense officials said Friday.

The 49-year-old civilian employee at the Korea Defense Intelligence Command was arrested last month and formally indicted Tuesday on charges including bribery and handing over sensitive data, via documents or voice messages, 30 times since 2019.

The leaked information included a list of undercover agents from the command who were operating in China, Russia and other countries, military prosecutors said at a briefing this week, according to the defense ministry. The command specializes in spying on North Korea, a heavily militarized country that often threatens ​its southern neighbor.

The leak has raised awkward questions for South Korea because it comes at a time when the country is expanding military intelligence sharing with the United States and Japan to help guard against North Korea and China. South Korea and the United States have depended on each other to spy on North Korea, combining resources such as satellites, cyber intelligence and human agents, like those working for the command.

The leak, first uncovered in June, has prompted the Defense Intelligence Command, one of South Korea’s most secretive government agencies, to recall undercover agents based overseas back home.

Undercover agents have been active in China, where they have tried to recruit spies and collect intelligence among North Koreans who traveled there or among ethnic Koreans in China who often traveled to North Korea. But their undercover identities were sometimes exposed and they became targets of the authorities in China as well as undercover North Korean counterintelligence agents operating there.

Investigators are still assessing the scale of damage done to South Korea’s decades-old intelligence war against North Korea, as South Korean lawmakers and media have voiced suspicions that the data may have eventually gone to Pyongyang.

The indicted official, whose identity was not revealed by prosecutors, was secretly detained and blackmailed into working for the suspected Chinese agent in Yanji in northeastern China, in April 2017, according to military prosecutors. He was in the city, near the North Korean border, to check on his intelligence-gathering network there, they said.

He printed documents, and took memos or screenshots of classified documents, as well as taking cellphone pictures of them. He smuggled them out and sent them through China-based, password-protected cloud services or through a voice-messaging function within an online gaming app. In return, he has received at least $120,000 from his Chinese contact, military prosecutors said.

“Check the file I have sent,” the official was quoted as saying in a message to his Chinese contact. “If you pay me more, I will share more.”

Criminal charges brought against the official included taking bribes and violating laws on protecting military intelligence. Prosecutors said they were still investigating whether the suspected Chinese agent was linked to North Korea.

The South Korean intelligence authorities first learned of a possible leak at the command after their hacker discovered a list of South Korean undercover agents while snooping on North Korean computer networks, according to the office of Kim Min-seok, a senior lawmaker at South Korea’s main opposition Democratic Party, which first alerted media to the breach.

The last time a major leak was reported at the command was in 2018, when an affiliated active-duty military officer was found to have sold classified information to foreign agents in China and Japan through a retired South Korean intelligence officer. The information he sold reportedly included data on the command’s agents in China and on North Korean weaponry.

“The latest case raises serious questions about the ethics of an agent — this kind of leak threatened the lives of other South Korean agents abroad — and about the system that has failed to catch him for so long,” said Yoo Dong-ryul, a security analyst and head of the Korea Institute of Liberal Democracy who has been studying the intelligence war between the two Koreas.

It was still unclear how extensive the latest leak was. Investigators did not cite any of the exposed agents or informants as operating inside North Korea. The leak did include information on the command’s structure and operational methods, they said.

Kim Yong-hyun, who was appointed as defense minister earlier this month, vowed to take “extraordinary measures” to address any problems discovered during the investigation.

The Defense Intelligence Command’s undercover agents did some of South Korea’s most dangerous spy work. Unlike other agents who operated with diplomatic immunity, many of them did not carry diplomatic visas, and posed as businessmen, which left them vulnerable to arrests, threats and blackmail in countries like China.

One such agent helped the manager of a North Korean restaurant in China defect to South Korea with a dozen waitresses in 2016.

But in 1998, a lieutenant colonel at the command who was working undercover in Dandong, a Chinese city near its border with North Korea, was kidnapped to North Korea. After he was released six months later, he revealed during his debriefing that North Korean interrogators tortured and blackmailed him with threats to kill his family in the South.

The officer was released only after he identified other South Korean undercover agents in northeastern China and promised to work as a double agent for the North, according to “Covert Operations,” a 2018 book about the undercover agents.