SEOUL • On Wednesday, Malaysian police arrested 47-year-old Ri Jong Chol, a North Korean who had a Malaysian work visa and lived in Kuala Lumpur with his wife and two children.
The use of North Koreans based overseas like Ri has the hallmarks of an operation by elite spy-training unit Office 35, said Mr Jang Jin Sung, a defector who had worked in the United Front Department of North Korea's ruling Workers' Party.
The department, along with Office 35, is an espionage unit within the party.
"They produce people with real jobs and skills, and send them abroad with family to live," said Mr Jang. "When an urgent opportunity arises, like this one on Kim Jong Nam, those people are tapped into operation, so they would be planted way beforehand."
South Korea has said that it believes North Korea was behind the Feb 13 killing of Mr Kim Jong Nam, the estranged half-brother of North Korean leader Kim Jong Un, and that it was coordinated by a shadowy North Korean agency called the Reconnaissance General Bureau (RGB), which formally falls under the military.
The RGB is North Korea's "premier intelligence organisation", according to the United Nations, which sanctioned it in March last year for its role in North Korea's arms trade.
Mr Michael Madden, an expert on the North Korean leadership, said that some North Korean operatives were "free agents", used as and when the need arose.
Given the high profile of Mr Kim, his murder could have been a joint operation between different agencies, he said.
North Korea also stations at least one member of its State Security Department, or bowibu, at its larger overseas missions, Mr Thae Yong Ho, North Korea's former deputy ambassador to Britain, who defected to Seoul last year, told Reuters this month.
That security official usually has a direct line to Pyongyang and takes orders from the Central Committee of the Workers' Party, as well as the State Security Department.
Malaysian police identified a senior official in the North Korean Embassy on Wednesday as a suspect in the murder.
Mr Madden said that today's North Korean spies are the "second and third generation of those founding fathers of the North Korean intelligence community".
But the use of foreign proxies, such as the Vietnamese and Indonesian women suspected of carrying out the assassination of Mr Kim, is a break from typical North Korean operations.
The two young women were what South Korean intelligence called "lizards' tails", expendable assets to be cast off after an operation.
The women had practised the attack at two malls, said Malaysian police chief Khalid Abu Bakar.
The police say four North Korean conspirators watched the attack unfold. Soon after, they passed through immigration, had their passports stamped and left the country before the authorities realised Mr Kim had been murdered.
All are now believed to be in North Korea.