Internal Security and IC Changes

Two major organizational changes to North Korea’s (DPRK) intelligence community and internal security agencies have either begun or in an early phase.   The Ministry of State Security has been renamed the National Intelligence Agency (a/k/a State Intelligence Agency).  Kim Jong Un has announced his intention to establish a police force in the Ministry of Public Security (MPS).   These could very well turn out to be cosmetic alterations to the fabric of North Korean intelligence and law enforcement work—institutional name changes along with new uniforms and patches for relevant personnel.  However, the NIA and MPS organizational changes are most likely major institutional adjustments which reorient regime security missions and functions—NIA downgrades its domestic secret police function and a new MPS police force takes on some political security functions.   

This represents a dual‑driver strategic reorientation of the North Korean Intelligence Community (NKIC) and the internal security apparatus. The normative driver is Kim Jong Un’s long‑term aspiration to transform the DPRK into a more routinized, legible, and “normal” authoritarian state — often described as normalization. His revival of party congresses, the regularization of Central Committee plena, and the re‑centering of domestic policy in the Cabinet all reflect this broader state‑building vision. From that perspective, structural changes to intelligence and internal security agencies were an inevitable next step: a foreign‑focused intelligence service and a professional police force are institutional features of a normalized authoritarian system.

The functional driver is distinct. The establishment of a police force and the conversion of State Security into the NIA, with an expanded foreign‑intelligence mandate, respond to concrete process, legal, and policy changes. These include the need for clearer bureaucratic lanes, modernized surveillance and counterintelligence procedures, and a more coherent division between domestic coercive functions and external intelligence operations.

Together, these two drivers — one normative, one functional — intersect but remain analytically separate, producing the current reorganization.  Because the functional driver is based on policy, legal and process changes rather than political signals the reorganization will unfold in incremental fashion (possibly the five years of  party congress and SPA terms), rather than one or two decisive events or announcements.   

By the time the 9th Party Congress and the 15th Supreme People’s Assembly convened, North Korea’s internal security and intelligence system had already begun to shift. A series of signals, bureaucratic adjustments, and institutional anomalies accumulated through 2025, laying the incremental groundwork for the reorganization that followed. These developments fall into several analytically distinct categories.

On 18 November 2025, Kim Jong Un conducted an extraordinary sequence of #1 Events at the Supreme Prosecutor’s Office, the DPRK Court, the Ministry of Public Security, and the former Ministry of State Security.

• These visits were nominally tied to institutional foundation anniversaries, though several dates were retroactively constructed — a form of creative historiography often used to justify political timing

• The density and sequencing of these events were unprecedented outside crisis conditions. The last comparable pattern occurred during the 2009 currency redenomination, when internal security organs were mobilized to manage public unrest.

• In 2025, no such crisis existed. In retrospect, the November events were preparatory signaling: a controlled, elite‑level rollout of forthcoming institutional changes.

Several adjustments to the Workers’ Party of Korea’s external‑affairs machinery preceded the Congress and SPA session starting at the end of 2024.   

• Under the two‑state policy, the United Front Department was downgraded to a Central Committee bureau (“Bureau 10”).

• This downgrade triggered a bureaucratic migration: diaspora‑engagement functions remained with the new bureau, while analytical and clandestine units were absorbed into other intelligence bodies.

• Front‑facing political entities — the Committee for the Peaceful Reunification of the Fatherland and Korea Today — were disbanded entirely.

These moves signaled a shift away from inter‑Korean political theater toward a more conventional foreign‑intelligence posture.

The Ministry of Public Security experienced extraordinary leadership churn: six ministers in roughly five years.

• Historically, the MPS is a longer tenure position, and such rapid turnover is anomalous.

• This instability suggests persistent dysfunction, political dissatisfaction, or both, inside the country’s primary internal security institution.

• The churn likely weakened institutional coherence and created pressure for structural solutions.

Operational demands on the security services expanded during this period.

• The 20×10 industrial plan opened — or planned to open — new factories and production units across the country.

• Each new industrial site required expanded protection zones, additional civil‑defense personnel, and broader MPS/NIA coverage.

• The cumulative effect was a widening security footprint without a corresponding modernization of bureaucratic lanes.

The SPA enacted a series of language, culture, and expression laws that criminalized new categories of behavior.

• Unauthorized foreign‑media consumption, linguistic deviations, and certain forms of expression were moved into the criminal‑statute space.

• This shift placed enforcement responsibility squarely on law‑enforcement institutions rather than party‑disciplinary bodies.

• The legal changes increased the operational load on MPS and required clearer delineation between police, counterintelligence, and ideological enforcement.

North Korea’s external engagement widened in two directions.

• The regime expanded foreign relationships and opened new tourist zones.

• One vector involved the outflow of North Korean citizens abroad; the other anticipated an inflow of foreign nationals into the DPRK.

• Both developments required more sophisticated border control, counterintelligence, and police functions — capacities that the existing MSS/MPS division was poorly structured to handle.

These cumulative developments framed the political announcements that followed.

• At the 9th Party Congress, Kim Jong Un formalized the disbanding of the UFD and emphasized enhanced coordination across party organizations.

• At the 15th SPA, he called for revamping the inminban neighborhood‑unit system and establishing a national police force — a clear indication that internal‑security restructuring was already underway.

Taken together, these developments created the preconditions for the dual‑driver reorientation of the intelligence and internal‑security apparatus. Leadership signaling, bureaucratic drift, legal changes, operational expansion, and institutional instability all converged to make the existing system untenable. These pressures set the stage for the NIA-MPS restructuring and shaped the incremental implementation trajectory that followed.

To understand how the dual‑driver reorganization will be implemented, the remainder of this product analyzes the mission shifts and organizational structures of the NIA and MPS. The NIA transition into a foreign‑intelligence service and the MPS’s construction of a police force are the institutional arenas where normative and functional pressures converge, and where the incremental character of the reorganization becomes most visible.

State Security Becomes State Intelligence

The Ministry of State Security (MSS), formally stood up in 1973, has changed its name to the National Intelligence Agency (SIA).   According to Daily NK, the name change filtered down to the local level when a North Korean citizen noticed his local MSS branch office took on the NIA moniker.   This name change at the local level may prove temporary until North Korea stands up its new police force.

A post-SPA session report by INSS posits a major notional change from MSS to NIA, becoming a civilian staffed foreign intelligence service (FIS).    INSS’ cites the 2024 roll-out of the “two state” policy which repurposes ROK-focused intelligence personnel focused on adversaries.    We might expand the INSS analysis further and assume that NIA will split its mission between foreign adversary targets—South Korea, the US and Japan.  Redefining external targets, NIA also adds to state security’s traditional counterintelligence (CI) and counterespionage (CE) missions, given increasing foreign engagement including the expansion of tourist zones and an expanded nuclear weapons inventory and defense industrial production base.   

At last check there were not any reports of NIA or MSS recruiting new employees for a revamped intelligence agency.  New intelligence personnel at NIA are drawn from the former UFD.  Starting in 2024, UFD was downgraded to a Central Committee bureau while it was gradually disbanded.  This dissolution and migration process also displaced UFD’s sizable intelligence operations and analysts.   It is probable some analysts went over to the FM and some operators and technicians went to the Reconnaissance General Bureau (RGB).   The majority of UFD’s intelligence operations and assets have most likely migrated to NIA.  This would include collections and analysis personnel to stand up NIA-focused adversarial tasks.

Most notably, UFD’s Cultural Exchange Bureau (CEB) would be right at home in SIA.  The CEB recruits political cadres in the WPK for clandestine operations and building operative networks in foreign countries.   CEB linked to RGB for infiltration/exfiltration tasks.  NIA (based on prior MSS’ capabilities) has built-in capacity for foreign presence and operations.  The former MSS also had Room #312 which was focused on ROK intelligence missions.  Via trading companies and shopfront commercial businesses, UFD had a modest overseas presence.    With the CEB migration to NIA, the DPRK now has a consolidated civilian national clandestine service with an overseas footprint for collections, in situ analysis and special purpose operations.

NIA has most likely  revised and repurposed MSS’ traditional CI and CE missions.   MSS had a dedicated CI/CE Bureau.  NIA has probably split CI/CE missions between those focused on North Korean citizens working and/or living outside the country and Dprk citizens and foreign. nationals in the country.

A foreign-focused SIA CI/CE Bureau would monitor North Korean citizens residing outside the country, but still claiming DPRK citizenship.   NIA most certainly has holdover MSS missions monitoring DPRK citizens working on labor contracts in foreign countries.  Sanctions on North Korea have attempted to target labor contract populations, but host country compliance and sanctions’ effectiveness have, at best, mixed results.   Thousands of North Koreans are dispatched to developing world countries, China and Russia as workers in factories, construction and health care.  NIA will continue to assign at least one officer to monitor and shepherd these worker groups.  NIA’s presence at North Korean embassies and foreign missions might increase, in addition to its traditional split with MPS in protection and security at these locales. An expanded NIA presence would likely combine standard intelligence missions with CI surveillance.  Heightened NIA surveillance presence at embassies will prevent diplomatic personnel defections or diplomatic personnel providing information or serving as “well wishers” to foreign intelligence services.  

Another major DPRK population living abroad are individuals working at foreign trading companies.   This most likely represents the largest population under NIA CI/CE scrutiny.   This cohort exercises a number of bulk purchases for the regime.  It discharges sensitive acquisition and purchase missions for top elites.  It interfaces with a diverse and interesting number of individuals and entities.   Individuals in this cohort routinely travel in and out of North Korea and have direct and secondary knowledge about the regime’s affairs and current priorities.

Due to the diversity of its transactions and interactions, the foreign trading cohort is engaged in behavior which might warrant the attention of foreign law enforcement which might opt to exert leverage on DPRK traders in order to build reliable intelligence sources that can provide information about the regime’s overseas activities. NIA may very well term this a high priority population for surveillance. This could assume the form of electronic eavesdropping and the placement or recruitment of sources within DPRK foreign trading operations.

Of course, NIA’s CI/CE activities are not limited to outside North Korean sovereign territory.   If we step back to our Daily NK report and the individual concerned about the under-the-cover-of-night name change between MSS and NIA, we might empathize with their fear whereby “political security” get redefined as more of a counterintelligence mission with a mere name change.  Disrupting social order or political security seems a more minor concern than cooperating with a foreign intelligence service against the regime.    

However, NIA targets, over the short- and medium-term are unlikely to be one or two people blasting Blackpink into a headset or listening to foreign weather reports.  With MSS assuming a new name and the proposed establishment of a police force, NIA’s target populations are probably shifting away from low-level, small-scale offenses to more significant targets.  

It is highly probable NIA split its CI/CE missions between those outside North Korea and individuals within the country’s borders.  NIA will start closely watching foreign nationals entering the DPRK for official purposes—foreign delegations and individuals traveling to the country under state-to-state auspices.  NIA inherits this mission from state security.   But, what if North Korea builds up its foreign relations and, with that, populations of foreign nationals visit the country?    Under that scenario, NIA places foreign populations and North Korean citizens with whom they are interacting under close surveillance.  

The DPRK has expanded the number of tourist zones.  Despite current, small in-bound groups, the regime probably anticipates larger tourist groups.   This expands the population NIA surveils and watches.  Conversely, NIA will be tasked to monitor the North Korean population interacting with foreign citizens.   NIA will also monitor cohorts who routinely travel into North Korea.   This could include tourists, but also foreign nationals involved in foreign direct investment (FDI) and Korean diaspora groups visiting the country.   This underscores a fundamental point for the DPRK undertaking major adjustments to the internal security and intelligence communities; there is an eye toward an influx of FDI, casual visitors and foreign personnel entering the country.

Domestic CI/CE missions are likely to concentrate on North Korean citizens who will routinely interact with foreign nationals.  The DPRK won’t be closed forever.   There is likely to be a major influx of foreign nationals either working in or regularly traveling to the DPRK during the next five years.   NIA’s domestic CI/CE element will probably be watching the foreign population closely.  It will likely engage North Korean citizens interacting with foreigners through direct inquiries and mandatory reporting from North Korean enterprises and entities where foreign are present.

Based on old MSS practices, NIA almost certainly retains decisionmaking functions at the DPRK border.  This includes the DPRK-PRC border, the DPRK-Russia border (and its requisite expansions) and ports of entry into North Korea (airports and railways).   

North Korean borders and entry points are patrolled by the Border Security Command (BSC) under the Ministry of Public Security.  When we arrive in North Korea, maybe it’s the Pyongyang airport or railway station in Sinu’iju, the boys who inspect the visa and the passport are BSG and Public Security.   But they took their instructions from State Security, now NIA.  It decides who and what gets into the DPRK.  It is all but certain this will include CQI controls (custom, quarantine, inspection) along with entry and exit.    In 2020, when North Korea’s border and international entry points shut down, in addition to the 2022 declared COVID-19 pandemic, the regime contended with unauthorized cross-export activities under elite sponsorship.   In 2021, it addressed safety concerns with shipments coming into the country.   In the transition from MSS to NIA, it is likely the regime has assumed a “lessons learned” approach and expanded border-focused personnel and NIA’s administrative footprint.   Although not directly tied to the border, NIA has probably continued to expand MSS’ large presence in China to facilitate the repatriation of DPRK nationals who have migrated to the PRC.

One aspect to NIA’s border and entry/exit mission is whether it will start (or expand) life cycling visitors to the DPRK.   There is a very good probability that the North has acquired or will acquire through state to state transfer, favorable pricing or via private transactions better technological capabilities to monitor foreign citizens traveling in and out of the DPRK.   This would include travel dates, locales visited or worked at and interactions with the local population.  From a CI/CE perspective greater focus would most likely be on populations regularly traveling and out of the country with business or social ties to DPRK citizens, with a secondary focus on tourists particularly return visitors.

NIA has inherited MSS’ old mission of investigating and disrupting clandestine foreign networks engaging with DPRK populations.  The lengthy border closures have tamped down on unsanctioned access into the country.   However, as North Korea opens up again, nongovernmental and other private organizations might resume domestic outreach and activities in the country.  NIA might use a combination of surveillance operations outside the DPRK, record keeping and life cycling at the border.

SIA also inherits state security’s Defense Industry Bureau (DIB), responsible for surveillance and protection of personnel and locales involved in the development and production of weapons and military supplies.   Given the legal and constitutional codification of North Korea’s nuclear weapons forces, munitions exports abroad and expanded defense industrial activity, DIB may have boosted its personnel at the expense of local-level enforcement efforts.   DIB may have also stood up and established security units tasked with storing and/or transporting nuclear devices.   On the other hand NIA might be parked into CI/CE and domestic surveillance operations and a greater role in defense industry security assigned to the Military Security Command (MSC).

The biggest question in the MSS to NIA transition is its role in domestic investigations and surveillance.   If SIA reorients its missions and tasks to foreign-focused intelligence and CI/CE, it is highly probable that NIA will incrementally downsize its personnel footprint in North Korean communities.  This would involve NIA conducting political security missions through greater analytical trend reporting on the DPRK population and technical surveillance assets for local level political security rather than human intelligence networks.   Rather than completely exiting the domestic security space, NIA might reorient its resources.   

Does NIA Shift More Political Security to MPS and the budding Police Forces?

If NIA adjusts its missions to other targets, it could well leave a gap in more localized surveillance and security.    NIA is probably exiting some of the local political security and surveillance space it once inhabited.  However, NIA retains a variety of investigative and surveillance authority and technological assets.   It is highly probable NIA will surveil and analyze broader trends and behavior among North Korean citizens using a combination of electronic surveillance and human intelligence networks.

According to one report, NIA has already commenced a survey of provincial and local officials for their compliance with party directives and policy mandates.   Monitoring broader trends, especially those targeting North Korea’s outer elite, is likely to consume NIA investigative resources.  NIA will  probably retain MSS’ investigation and enforcement apparatus.   Investigative units, case management, secret tribunals and detention facilities remain in place.  

MSS’ former Bureau #12 has the largest electronic surveillance footprint in the country.  MSC and the Guard Command might have more advanced assets and more personnel designated for real time monitoring.  But Bureau #12 has the largest network of listening posts as well as mobile surveillance squads.

If NIA starts monitoring and analyzing broader trends in the DPRK population, be they among cadres or regular citizens, develops monitoring and analytical products and boosts its use of electronic surveillance (particularly with pattern analysis and AI functionality), it might start to fulfill a major support mission between the internal security services and intelligence community.   This would allow SIA to efficiently exploit and use human resources networks and task investigative personnel.  Prosecutors’ offices under the SPO have already assumed MSS’ decisionmaking authorities on preliminary examination and determining what constitutes a political or a statutory offense.  

NIA might become something of an internal security clearinghouse.  It will vacuum device and telephonic data, then compile monitoring reports.  It may produce analytical products or surveillance assessments.   Minor trends or infractions may get disseminated to neighborhood units or basic party organizations.   More significant trends or incidents might get kicked to Provincial or County Public Security Departments.  That would leave NIA’s investigation bureau to focus on more significant surveillance and/or investigative targets.  

As such, NIA’s internal security mandate and its missions would be migrating away from small-scale pisspot “secret” police surveillance and investigations to larger targets.   Rather than scrutinizing small trespasses in behavior, media consumption, device usage and citizen reactions to contradictory or hypocritical dictums from the central leadership, NIA local or branch offices might collect data and analyze broader trends in population behavior. NIA officers will probably focus on policy resistance, abuse of power, distribution of unsanctioned content and failure to enforce laws and party instructions.

The 2020-2022 Anti-Reactionary Thought and Culture Law and the 2023 Pyongyang Cultural Language Protection Act shift much of the jurisdiction for enforcing these laws to the Ministry of Public Security, media censors and people’s committees.   The Anti-Reactionary Thought and Culture Law does contain language which established State Security jurisdiction, particularly in the context of border and customs inspections.   The Pyongyang Cultural Language Protection Act explicitly outlines the jurisdiction of “law enforcement agencies” such as the Ministry of Public Security and the SPO as well as administrative tribunals in the DPRK court system.   These statutes shift State Security’s old political crime into criminal laws and, thus, domestic law enforcement space of public security, prosecutors and the courts.   This raises the likelihood NIA has already downsized some of its domestic political security work.      

The cops don’t need you and man they expect the same

Kim Jong Un has proposed that the Ministry of Public Security (MPS) establish police force.   By missions and personnel, MPS is North Korea’s largest internal security organization.   In addition to traditional public safety and law enforcement missions, it also patrols land and water borders, has a national guard, issues permits, maintains census records and issues and catalogues vital records (birth and death certificates and marriage licenses).  

MPS is configured and functions more as a gendarmerie, even among personnel discharging traditional policing missions.  This can give way to mission creep in the MPS—personnel tasked one day to enforce market rules, the next day as night watchmen and then nitpicking local populations.    In proposing the establishment of a police force, Kim Jong Un is going to designate specific personnel as police and implement organizational changes to provincial and local Public Security Department (PSD) earmarking a certain number of personnel as wholly police personnel.   

Adding a police force will require restructuring PSD’s at the provincial and local levels.  The most modest adjustment will be establishing either a police force bureau in PSDs and assigning personnel constituting provincial and local police forces.  PSD police forces would then assume routine traditional missions with a Chuch’e twist.   This could include squads on foot patrols in DPRK communities, engaging in incident response and surveillance, and arresting or detaining people.  If NIA has altered some of its political security functions, then the new police force might use patrol and surveillance assignments to increase their contact and coordination with imnibans, local people’s committees and basic party organization—essentially assuming old State Security functions at the local level.   Local coordination might take the form of mandatory routine reports from imniban heads.  

Of course, this does not presuppose the consolidation of some other PSD functions under MPS police.  Kim Jong Un may envision this as part of a larger restructuring of PSD’s whereby the MPS police forces also assume traffic safety, patrolling central markets and guarding major industrial units.  This would delineate the role of personnel within PSD’s.  Back line missions such as criminal investigations, resident and document registration and permit issuance on one side of PSDs and police missions on the other side.   

The most significant organizational question regarding an MPS police force is whether the regime stands it up as a separate institution within the MPS in similar fashion to Public Security Forces and the Border Security Command.  MPS has the bureaucratic heft to accommodate a new large organization.   However, PSF and BSG largely operate on a different chain of command and have different reporting channels from PSD’s where MPS police are assumed to operate.   This raises four potential outcomes.

• The police forces become subordinate PSD units involved in basic policing functions,  possibly combining patrols, traffic and incident response; this consolidates some prior PSD missions under PSD control
• A number of PSD missions (traffic safety, inspections) migrate into the newly-established MPS Police Departments, other missions such as criminal investigations and resident/record registration are based out of separate MPS branch offices.
• An MPS police force is stood up as a national entity similar to PSF and BSC with police forces stovepiped to a national command at MPS HQ, but based out PSDs
• Police forces are stood up with a national command element, but are deployed to PSD’s where they are subject to joint command and control with the respective PSD and the national police command mechanism.   

Of these outcomes, the closest which aligns with a dual driver realignment, and the likeliest for MPS, is a police force commanded at the national level deployed to PSDs.  It preserves MPS’ organizational heft.  It establishes a professionalized police identity within MPS, allowing the center to maintain power without having to dismantle PSDs.   

And we bid you good night

North Korea’s intelligence and internal‑security system is entering a period of incremental but structural transformation, driven by the convergence of two analytically distinct forces: Kim Jong Un’s normalization agenda and functional pressures generated by legal, bureaucratic, and operational change. The renaming of the Ministry of State Security to the National Intelligence Agency and the proposal to establish a police force within the Ministry of Public Security are not isolated gestures. They reflect a deeper reallocation of missions, authorities, and institutional identities across the security apparatus.

The normative driver — Kim’s aspiration for a more routinized, legible authoritarian state — provides the political logic for creating a foreign‑focused intelligence service and a professionalized police force. This is consistent with his revival of party congresses, regularized Central Committee plena, changes in the defense industry and boosting the Cabinet as the center of domestic policymaking. These are the institutional hallmarks of a leadership seeking to stabilize and normalize its political and decisionmaking cultures.

The functional driver is more immediate. Legal changes such as the Anti‑Reactionary Thought and Culture Law and the Pyongyang Cultural Language Protection Act have shifted enforcement burdens onto law‑enforcement and away from political security.

Simultaneously, expanded industrial footprint of the 20 x 10 plan, widened foreign engagement, and the migration of UFD intelligence functions created operational demands that prior MSS–MPS capacity could no longer meet.

The result is a dual‑driver reorientation that will unfold gradually — likely over the five‑year cycles of the Party Congress and SPA terms.

This incrementalism is itself a signal: the leadership is restructuring the system in a deliberative fashion to maintain stability and avoiding the appearance of crisis.  This is responding to prevailing and changing conditions, not pressure points.

The NIA’s emerging profile — a consolidated foreign‑intelligence service with repurposed CI/CE missions, expanded overseas presence, and a reduced domestic footprint — reflects this logic. So does the MPS’s movement toward a police‑force model capable of absorbing low‑level political‑security tasks, enforcing new criminal statutes, and coordinating with imniban and local party bodies. Together, these shifts indicate a redistribution of coercive labor across the system: NIA moves upward and outward; MPS moves downward and inward.

The reorganization is therefore best understood not as a cosmetic renaming, but as a strategic recalibration of the regime’s coercive architecture. It aligns North Korea’s intelligence and internal‑security institutions with the leadership’s long‑term state‑building goals while addressing the practical demands of a changing legal, economic, and external environment. The NIA–MPS realignment is the institutional arena where these pressures converge — and where the future trajectory of the DPRK’s internal‑security system will become most visible.