Illustrated by Chosun Design Lab, Midjourney

The South Korean military prosecution filed an arrest warrant on July 29 for a civilian employee of the Korea Defense Intelligence Command (KDIC), identified as A, who is suspected of leaking personal information about “black agents.” The Defense Counterintelligence Command (DCC), which is investigating the case, also obtained a warrant to detain A.

According to military sources on July 29, the prosecution approved the DCC’s request and charged A with violating the Military Secret Protection Act. The employee is accused of transferring multiple military secrets, including the real names, ages, and operational countries of undercover agents working under false identities, to foreign nationals, including Chinese, in early June.

Military authorities suspect that the recipient of this information was an ethnic Korean in China. They are also considering the possibility that this individual might be an agent of North Korea’s Reconnaissance General Bureau, raising concerns that North Korea may have acquired the confidential information. If the list of black agents—who operate undercover and are known only to a few within the military—were compromised, it could severely damage South Korea’s military intelligence network overseas. Reports indicate that some black agents stationed in China urgently returned to South Korea after the leak was discovered. However, the DCC has not yet charged A under the National Security Act, as there is no direct evidence linking the case to North Korea.

At the end of June, the DCC conducted a search and seizure operation at A’s residence, seizing his laptop, mobile phone, and other items. During the investigation, it was revealed that A had printed hard copies of military secrets and reprocessed them into files before passing them on to an ethnic Korean Chinese. Authorities also obtained records of A’s travels to China. Despite the allegations, A has consistently claimed that the incident was due to a “hacking operation by North Korea.”

A, a former military officer rehired as a civilian employee at the KDIC after discharge, was reportedly working in a foreign operations department. Some have questioned why A continued to work at the KDIC office near the capital for nearly a month after being implicated in the investigation. According to officials, the DCC has been thoroughly investigating whether A had any internal accomplices within the KDIC and the full extent of the information leak. Given that A did not have authorized access to the confidential information, there is suspicion that there might have been an internal accomplice. The arrest warrant was reportedly sought after A was suspected of attempting to tamper with evidence by leaking information about the ongoing military investigation into a North Korean hacking incident on YouTube.