hankyoreh

By Lee Jeong-yeon, staff reporter

“Don’t get nervous. Be bold and do your job.”

Won Sei-hoon, 62, former director of the National Intelligence Service (NIS), was speaking at a meeting of the spy agency’s psychological warfare division around Aug. 2012. He was giving a pep talk to the division, which had been making political posts and comments online. According to the South Korean constitution, the agency is barred from any political activity.

But despite Won’s remarks, the agents took all kinds of measures to ensure that their identities and the activities remain secret. The police department in Suseo, Seoul, and the prosecutors who have taken on the case face an uphill battle as they try to track down what the NIS did. The chase is made even more difficult by the NIS’s refusal to cooperate with the investigation, offering “national security” as an excuse.

Part of this exhausting investigation was revealed on Aug. 26 in a hearing at Seoul Central District Court, criminal division No. 21 (Justice Lee Beom-gyun presiding). The court was reviewing the documentary evidence in the first hearing into charges that Won violated the Public Official Election Act and NIS Act.

The police found that a man surnamed Lee, 42, a private contractor assisting NIS agent Kim Ha-young, 29, used an IP switching program when he was doing online work. In order to use the program, it was necessary to sign up on the website of company SmartSN, which provides the program.

When the police reviewed the information that was submitted when the user signed up on the site, they found that the user was not the civilian Lee, but rather someone surnamed Lim. Lim turned out to be the brother-in-law of another person surnamed Lee, who is in charge of the third security team in the psychological warfare division.

As head of the team, Lee signed up for the site using his brother-in-law’s name so that both NIS agents and their private contractors could use the program. This is how the existence of the third security team was confirmed.

Members of the NIS’s psychological warfare team and their private sector assistants used IP switching programs to avoid being tracked. But as it happened, this program provided the clue that led to the uncovering of their identities.

Nor was it easy to track down the IDs that the NIS agents used during their online activity. The police found 66 IDs in a text file that they recovered from Kim Ha-young’s computer. Kim testified during police questioning that she had only used 11 of the 66 IDs herself.

However, the police discovered that 17 of the IDs that Kim had denied using were closely connected with each other. When the presiding judge asked on what grounds the police based their assertion that the IDs were connected, the police explained that they had found that Kim used a specific email address when verifying her registration at internet sites. In addition, the police said, the number 11 was found in multiple IDs that she used, and the passwords were often identical. They also noted that the IP was the same as well.

The police also found records that another NIS agent surnamed Lee had connected to the website Today’s Humor under the nickname “starlightmoonlightsunlight.” The IP that was used to access the website was traced back to NIS headquarters.

“Based on these findings, we have confirmed that this was not the activity of one agent but was carried out by the organization,” the prosecutors said.

After verifying and tracking down 539 IPs that appear to have been used by NIS agents, the police searched and seized information from 91 websites.

“Over a long period of time, and with great difficulty, the police searched for the IDs of the NIS agents who exercised their right to remain silent,” the prosecutors said.

The NIS agents concealed their identities using other people’s names not only when with getting mobile phones and signing up for websites, but also when setting up bank accounts.

When the prosecutors tracked down the account where the private contractor surnamed Lee had been paid for his services and the account from which the money had been sent, they learned that the account was listed under the name of Lee’s older sister.

Please direct questions or comments to [english@hani.co.kr]