South Korean Intelligence: History, Structure, and the Headlines

South Korea lives next to one of the most closed, heavily armed, and intelligence-driven states on earth, and almost everything its government knows about North Korea’s missiles, purges, and troop movements reaches the public through its own intelligence service. That same service was, for much of its history, the main instrument of domestic political control. It kidnapped an opposition leader, and its own director assassinated the president who created it. Two former presidents and several former intelligence chiefs have since been convicted in cases that involved the services.

This page is a working overview of South Korea’s civilian and military intelligence services: their history, how they are organized today, and the cases that have put them in the news. It relies on court rulings, government announcements, National Assembly testimony, and named reporting by Korean and international outlets. Where a claim comes from a prosecutor, a defendant, or a party with a stake in the outcome, the text says so, and it gives the legal status of each case as of October 2026.

South Korean intelligence at a glance

• Main intelligence service: the National Intelligence Service (NIS, Gukga Jeongbowon), descended from the Korean Central Intelligence Agency (KCIA) of 1961 and the Agency for National Security Planning of 1981. It took its current name on January 22, 1999 (Federation of American Scientists).
• Head: Lee Jong-seok, a former unification minister under President Roh Moo-hyun. President Lee Jae-myung nominated him on June 4, 2025 (Korea Herald), and he took office on June 25, 2025 (Asia Economy).
• Previous head: Cho Tae-yong, appointed by President Yoon Suk Yeol. In August 2026 an appeals court sentenced him to two and a half years in prison in a case arising from the December 2024 martial law (Korea JoongAng Daily).
• Military intelligence and counterintelligence: the Korea Defense Intelligence Command, which runs human intelligence abroad, and, since August 3, 2026, a new Defense Counterintelligence Headquarters, a Defense Security Support Group, and a security investigation division in the Defense Ministry. These replaced the Defense Counterintelligence Command, which was dissolved on July 31, 2026 (Kyunghyang Shinmun).
• Oversight and reporting line: the NIS director reports directly to the president. The National Assembly holds a confirmation hearing, but the president can appoint the director without the Assembly’s endorsement (Korea Times). The Assembly’s Intelligence Committee, set up under a 1994 revision of the agency’s law, receives regular closed briefings.
• Relationship with the United States: close and long-standing, as treaty allies. In October 2026 Korean newspapers reported that the NIS had been excluded from a June meeting with the United States and Japan on North Korean cyber threats. The NIS said “there is no misunderstanding” between the two countries’ intelligence authorities (Korea Times).

History: from the KCIA to the National Intelligence Service

General Park Chung-hee seized power in a coup on May 16, 1961, and within weeks created the Korean Central Intelligence Agency. Its first director, Kim Jong-pil, built it from the Army’s Counter-Intelligence Corps into an organization of about 3,000 people, directly accountable to the country’s ruler (Federation of American Scientists). A study for the Middle East Institute says the KCIA rarely upheld political neutrality and was involved in torture, murder, and the kidnapping of opposition leaders (Middle East Institute).

On October 26, 1979, its director, Kim Jae-gyu, killed President Park and the head of his security service, Cha Ji-cheol, at a private dinner. Kim was sentenced to death and executed in May 1980. In February 2025, the Seoul High Court ordered a retrial after finding that investigators had tortured and assaulted him during the original investigation (Korea Times). At closing arguments in September 2026, the defense argued there was no proof of intent to subvert the constitutional order, and prosecutors asked the court to uphold the conviction; the verdict is scheduled for December 16, 2026 (Kyunghyang Shinmun).

The general who took control after Park’s death, Chun Doo-hwan, also took control of the KCIA and in 1981 renamed it the Agency for National Security Planning (Middle East Institute). Its domestic political role continued under Chun and his successor, Roh Tae-woo. In 1994 a negotiated revision of the agency’s law created an intelligence committee in the National Assembly. On January 22, 1999, under President Kim Dae-jung, who had once been the agency’s kidnapping victim, it became the National Intelligence Service (Federation of American Scientists). Several NIS directors under Kim Dae-jung and Roh Moo-hyun were prosecuted over illegal wiretapping or leaks (Middle East Institute), and the agency’s role in the 2012 election, described below, led to the first wave of modern reform.

How South Korean intelligence is organized today

South Korea publishes the laws governing its services but not their budgets or full organizational charts. The public record shows one dominant civilian agency and a military side rebuilt in 2026.

• The National Intelligence Service collects foreign and North Korean intelligence, runs counterintelligence and counterterrorism, and protects government information and networks through its national cyber security center. Since January 1, 2024, it has had no power to open criminal investigations into National Security Act cases. It can still collect and share information on those crimes with the police (Human Rights Watch).
• The Korean National Police Agency, through its National Office of Investigation, now leads investigations into espionage and pro-North Korean activity that the NIS used to run (Korea JoongAng Daily).
• The Korea Defense Intelligence Command runs military human intelligence, including undercover officers abroad, sometimes called “black agents” (Korea Times).
• The Defense Counterintelligence Headquarters, launched on August 3, 2026, handles military counterintelligence, defense-industry security, and cyber threats. A separate Defense Security Support Group runs security audits, and a security investigation division in the Defense Ministry’s investigation headquarters handles espionage and leak cases (Kyunghyang Shinmun).

Two features stand out. First, almost everything the public learns from the NIS arrives secondhand: the director briefs the Assembly’s Intelligence Committee behind closed doors, and one lawmaker from each major party then tells reporters what was said. Second, the services’ powers have swung with each change of government. Progressive administrations have cut back domestic and investigative functions, and conservative ones have tried to restore them.

From the KCIA’s shadow to reform

The modern reform cycle began with the 2012 election scandal. In November 2017, the NIS announced that investigating “pro-Communist activities and North Korea’s attempts to overthrow the South Korean government” would be dropped from its duties (Korea JoongAng Daily). The National Assembly, then controlled by President Moon Jae-in’s Democratic Party, passed the resulting amendments to the NIS Act on December 13, 2020, after a 61-hour opposition filibuster. The amendments removed the agency’s criminal investigation powers from January 1, 2024, banned illegal wiretapping and location tracking, and required political neutrality. Human Rights Watch warned that a broad definition of “counter-intelligence” could still allow domestic surveillance (Human Rights Watch).

Conservatives took the opposite view. In March 2024, the People Power Party’s interim leader, Han Dong-hoon, pledged to “restore the National Intelligence Service’s (NIS) right to investigate pro-communist activities” if his party won that April’s general election (Korea JoongAng Daily). The party lost, and the transfer stood. Some experts argue that the police cannot quickly replace the NIS’s overseas networks.

The military side followed the same cycle. The Defense Security Command, founded in 1977, was downgraded to the Defense Security Support Command under Moon in 2018. In 2022, under Yoon, it had its powers restored and was renamed the Defense Counterintelligence Command (Korea Herald via Asia News Network). After its commander was charged over the 2024 martial law, a Defense Ministry committee recommended dismantling it. The ministry dissolved the command in July 2026 and announced an external inspector general, a civilian compliance committee, and regular reporting to the Assembly (Korea Times). Defense Minister Ahn Gyu-back said the change ended a past in which such bodies were “abused as tools of power.” Critics warned that it concentrated investigative power in the ministry’s new investigation headquarters (Kyunghyang Shinmun).

The current director, Lee Jong-seok, helped design Kim Dae-jung’s Sunshine Policy of engagement with Pyongyang and has visited North Korea 13 times. At his June 2025 confirmation hearing, conservative critics called him pro-North Korean. He replied, “I don’t quite understand why my past remarks would be considered pro-North Korea,” and said, “I’ve never belonged to either camp” (Korea Times).

South Korean intelligence in the news

Most public knowledge of how South Korea’s services operate comes from seven cases. Some have final judgments; others are still on appeal.

The Kim Dae-jung abduction (1973–2007)

On August 8, 1973, Kim Dae-jung, a leading opposition politician and critic of Park Chung-hee, was seized from the Grand Palace Hotel in Tokyo. He was released near his Seoul home on the night of August 13 (Korea Herald). In 2007, a fact-finding panel set up by the NIS itself concluded that the KCIA was behind the abduction and named its then director, Lee Hu-rak, as the planner. The panel said there was “physical evidence to support the possibility” that it began as an assassination plan, and it found that Park “at least gave a passive approval,” though it could not prove he ordered it. According to Al Jazeera’s account, a U.S. aircraft caught the agents in the act and Kim’s life was spared (Al Jazeera).

The 2012 election comments and Won Sei-hoon (2012–2021)

During the 2012 presidential race, NIS officials hired hundreds of civilians and former agency employees to post online comments against Moon Jae-in, the liberal opponent of the eventual winner, Park Geun-hye. After several rounds of trials, the Supreme Court on April 19, 2018, confirmed a four-year prison term for the NIS director at the time, Won Sei-hoon, for election meddling (Korea Times). In a separate retrial in September 2021, the Seoul High Court sentenced him to nine years. It found that he had diverted about 11 billion won of agency funds to manipulate online opinion and had paid about 200 million won from the agency’s secret fund to former President Lee Myung-bak and his brother. The court called his conduct “interference in politics in violation of political neutrality” (Korea Times).

Special activity funds and the Blue House (2013–2021)

From May 2013 to September 2016, three of Park Geun-hye’s NIS directors, Nam Jae-joon, Lee Byung-kee, and Lee Byung-ho, sent a total of 3.65 billion won from the agency’s special activity budget to her office. In July 2021 the Supreme Court finalized prison terms of 18 months for Nam, three years for Lee Byung-kee, and three and a half years for Lee Byung-ho. for loss of state funds and, in part, bribery (Asia Economy). Park’s conviction over the funds was merged with her other cases, and on January 14, 2021, the Supreme Court upheld a combined 20-year term. Park refused to attend her trials from October 2017 and described herself as a victim of political revenge (AFP via Dawn). She was pardoned in December 2021 and released on December 31 of that year (Asia Economy).

The KCTU espionage case (2023–2025)

In January 2023, the NIS and the National Police Agency raided offices of members of the Korean Confederation of Trade Unions, one of the country’s two main labor federations. Prosecutors later accused four current and former union officials of violating the National Security Act. The main defendant, a senior KCTU official surnamed Seok, was accused of meeting North Korean agents in Guangzhou, Hanoi, and Phnom Penh and taking instructions from Pyongyang (Korea JoongAng Daily). The defendants denied the charges and argued that the NIS gathered evidence abroad without following international judicial-cooperation procedures. In November 2024 the Suwon District Court rejected that argument and sentenced Seok to 15 years (Asia Economy). In May 2025 the Suwon High Court reduced his sentence to nine and a half years. It found insufficient evidence of an organized underground cell inside the union or that state secrets had actually reached North Korea, and it acquitted two co-defendants (Korea JoongAng Daily). The Supreme Court upheld the appellate ruling in September 2025 (Asia Economy).

The “black agents” leak (2017–2026)

In August 2024, military prosecutors indicted a civilian employee of the Korea Defense Intelligence Command. They charged that he had passed classified material, including personal details of undercover officers posted abroad, to a person believed to be a Chinese intelligence officer. Prosecutors said the contact began after he was detained at a Chinese airport in 2017; he initially denied the charges and later confessed (Korea JoongAng Daily). In January 2025 a court-martial sentenced him to 20 years and rejected his claim that he had acted under threats against his family. (Korea Times). The Supreme Court finalized the 20-year term in January 2026, with the fine reduced on appeal to 1 billion won (Financial News).

North Korean troops in Russia (2024–2025)

On October 18, 2024, the NIS publicly stated that Russian navy ships had carried about 1,500 North Korean special forces troops to Vladivostok between October 8 and 13, publishing satellite imagery as support. The Kremlin had earlier called such reports “another piece of fake news” (Al Jazeera). The NIS assessment held up. By April 30, 2025, it was telling lawmakers that about 15,000 North Korean troops had been deployed and that about 4,700 had been killed or wounded, including roughly 600 deaths. (Korea JoongAng Daily). North Korea acknowledged the deployment in April 2025, and in September 2025 a lawmaker briefed by the NIS said about 2,000 North Korean soldiers were believed to have been killed (The Moscow Times).

Martial law and the NIS deputy director (2024–present)

On the night of December 3, 2024, President Yoon Suk Yeol declared emergency martial law. Three days later, the NIS first deputy director, Hong Jang-won, told lawmakers that Yoon had phoned him that night and ordered the arrest of leading politicians from both major parties. The names reportedly included Lee Jae-myung, then opposition leader, and Han Dong-hoon, head of Yoon’s own party. Hong said he passed the instruction to the counterintelligence commander, Yeo In-hyung. NIS Director Cho Tae-yong said he had received no order from Yoon to arrest anyone (Korea Times). At the Constitutional Court in February 2025, Hong testified that Yoon told him to “round them all up and clean everything out.” Yoon said the call concerned support for the counterintelligence command, and his lawyer said the targets were “spies” (Korea Herald). Cho and Yoon’s lawyers challenged Hong’s account of when and where he wrote the list; Hong admitted a “slight error” in his memory but stood by the memo (Korea Herald via Asia News Network).

The Constitutional Court removed Yoon from office by an 8–0 vote on April 4, 2025. On February 19, 2026, the Seoul Central District Court sentenced him to life in prison for leading an insurrection (Korea JoongAng Daily). In the same ruling, former Defense Minister Kim Yong-hyun received 30 years and the former Defense Intelligence Command chief Noh Sang-won 18 years, while two other defendants were acquitted (Korea JoongAng Daily). Yoon has denied the charges and says the declaration was meant to protect liberal democracy (Reuters via The Star). His appeal is before the Seoul High Court. On October 29, 2026, the special counsel again asked for the death penalty, and Yoon’s lawyers argued that he meant only to warn an opposition-controlled parliament. Yoon is due to give his final statement on November 5 (Al Jazeera).

Related verdicts have followed. In June 2026, a court found that Yoon had ordered drone flights over Pyongyang in October 2024 to provoke the North and create a pretext for martial law. It sentenced him and Kim Yong-hyun to 30 years each for aiding the enemy and abuse of power, and gave Yeo In-hyung 15 years (Korea JoongAng Daily). Yoon’s lawyers said the flights were a response to North Korean trash balloons (AP via Michigan Public). On September 21, 2026, Yeo received 18 years in his insurrection trial, and the former Defense Intelligence Command chief Moon Sang-ho received 12. The court found that Yeo’s memo planning the detention of 14 key figures closely matched what happened that night (iNews24). Cho Tae-yong was convicted in May 2026 of lying about whether he had received martial law documents but acquitted of most other charges. The court said it could not conclude that Hong had fully briefed him on the arrest order (Korea Herald). The appeals court raised his sentence to two and a half years in August 2026 (Korea JoongAng Daily). Further appeals are open in most of these cases.

How to read coverage of South Korean intelligence

South Korea’s press is free and competitive, but its newspapers line up by politics. The Chosun Ilbo, JoongAng Ilbo, and Dong-A Ilbo lean conservative. The Hankyoreh and Kyunghyang Shinmun lean progressive. Yonhap is the national news agency. Stories about NIS politics or North Korean spy cases often break in one camp’s papers and are disputed by the other’s.

NIS assessments usually reach the public through lawmakers who attended closed briefings, and a conservative and a progressive member can summarize the same briefing differently. The discipline is the one taught in our guides to trend analysis and evaluating forecasts: climb toward primary records. For Korea, that means court rulings, the text of the NIS Act and its enforcement decrees, Constitutional Court transcripts, and, for Korean government and corporate lobbying in Washington, the U.S. Justice Department’s database of registered foreign agents (FARA eFile). Treat a single lawmaker’s summary of a closed briefing as a lead, not a finding, until the agency or a second attendee confirms it.

Frequently asked questions

Related reading

• Qatari Intelligence: History, Structure, and the Headlines
• Trend Analysis: How to Tell a Real Trend From Media Hype
• How to Evaluate a Forecast
• Cognitive Bias: A Field Guide for Leaders

Competitive Futures briefs companies and governments on intelligence services, foreign influence, and Northeast Asia; details are on the services page.