Kim Jong-nam: Who in North Korea could organise a VX murder?

North Korea's military and government have several units overseeing security and surveillance

The mysterious killing of Kim Jong-nam has raised questions about who exactly could have orchestrated his murder. North Korea expert Michael Madden sheds light on the various shadowy organisations operating within the state.

Kim Jong-nam had not been in the running for the North Korean leadership for years, so it was a surprise to some when he was killed in such mysterious circumstances.

But now his death has been conclusively linked to the VX nerve agent.

Most experts agree that the presence of VX means there is likely to be some kind of state connection to this killing. And North Korea does have institutions with the wherewithal to carry out such an attack.

North Korea has fiercely denied this, holding Malaysia responsible in an angry outburst on state media.

But VX is highly unlikely to have been manufactured in Malaysia. It is much more likely it was brought into Kuala Lumpur in minuscule quantities from another state.

Inside North Korea, there are several organisations that have the ability to direct such an attack, provide personnel and supply deadly toxins.

The most elite of them all

The Guard Command is the most exclusive security organisation in North Korea, which is also known as the Democratic People's Republic of Korea (DPRK). It is tasked with the close protection of leader Kim Jong-un, his family members and core DPRK officials.

It has an estimated 100,000 personnel, recruited from families identified as politically reliable or who have close ties to North Korea's elite families.

This 2012 satellite photo shows the Guard Command headquarters in Pyongyang

It is also the only security organisation which can interact with all other DPRK armed forces and security organisations (which are highly compartmentalised in their communications and control) to fulfil its missions.

Most crucial of all, the Guard Command possesses a cache of chemical weapons.

Monitoring North Koreans at home and abroad

The State Security Department (SSD), officially known as the Ministry of State Security, is effectively North Korea's political police and is tasked with ensuring that the DPRK's domestic population remains loyal to the regime and free of "decadent" foreign influence.

Kim Jong-nam, seen here in a file picture, lived abroad in exile for many years, mostly in Macau

It is also engaged in counter-intelligence missions to ensure that North Korean citizens working or living abroad do not defect to other countries or communicate with foreign intelligence agencies.

More on Kim Jong-nam's killing:

• How deadly VX could have killed Kim Jong-nam

• Main players in mystery death

• Who was Kim Jong-nam and what led to his demise?

• North Korea's history of foreign assassinations

Training foreign operatives

The Reconnaissance General Bureau (RGB) is the North's primary military and foreign intelligence agency. It is involved in the collection and analysis of intelligence with a main focus on South Korea and Japan.

It was formed between 2009 and 2010 when much of the North's intelligence community was consolidated. During that process it absorbed units previously involved in other violent and terrorist activities in foreign countries, such as the 1987 KAL bombing and the attempted assassination of South Korean President Park Chung-hee.

Critical to the assassination of Kim Jong-nam is that the RGB absorbed the office through which the North recruits and trains foreign nationals to assist with special operations and intelligence collection missions in foreign countries.

The group that spies for North Korea's leader

The Third Floor might seem an obscure name but it is genuinely the label applied to a series of North Korean government networks involved in collecting intelligence, conducting discreet surveillance, purchasing goods, earning money and operating businesses (some legitimate, some illicit) for the top leadership of the DPRK.

The Third Floor has operatives and managers who work for other DPRK government and security organisations, but they all report and take instructions from the office of the leader. They are based in and operate out of dozens of countries around the world.

The term derives from the location where these personnel originally started their work during the 1970s - the third floor of the Workers Party of Korea Central Committee headquarters in Pyongyang.

Kim Jong-nam is believed to have worked for elements of the group on his father's behalf.

Ri Jae Nam (an alias) - who was present at Kuala Lumpur airport the day of the murder, according to pictures released by the Malaysians - had previously operated in other countries in Asia as a manager in the Third Floor network.

The weapons-makers

The Second Economic Committee (SEC) is responsible for the production and manufacturing of all convention munitions, military equipment and weapons of mass destruction in the DPRK.

So given the possible involvement of these different units, how could the attack have been co-ordinated?

The Guard Command is probably the only organisation that could order or second personnel from the RGB, as well as deploy VX in an overseas location.

It is also able to access North Korean intelligence reports through its own channels and have access to external intelligence networks.

But there are two other critical components: first, the Guard Command is believed to possess VX and other chemical weapons.

Second, it can act with absolute secrecy as it reports directly to Kim Jong-un and his closest aides.

Kim Jong-un is the half-brother of Kim Jong-nam

If one of the other North Korean organisations had been used, each stage of the planning for such an attack would have been subject to North Korea's routine bureaucratic reporting channels. And that would have run the risk of somebody tipping off a target.

There may also be an element of competition between the organisations.

Under former leader Kim Jong-il, the Guard Command was the premier internal security organisation in the country.

While it still has that status by dint of its writ and mission, under Kim Jong-un the Military Security Command, which polices the armed forces, has been vested with greater prestige and political power, carrying out the youthful leader's purges. It has nearly eclipsed the status of the Guard Command.

The Guard Command's director, Gen Yun Jong Rin, has been subject to temporary military demotion. He was a personal friend of Kim Jong-un's uncle Chang Song-thaek - who was executed for treachery in 2013 - and his brother Vice Marshal Chang Song-u.

Chang Song-thaek (far left) and Yun Jong Rin (second from left) are seen here in this 2011 photo with Kim Jong-il (centre) and Kim Jong-un (far right)

Senior Guard Command commanders and managers can operate with a wide degree of autonomy and latitude. If they were indeed responsible for the attack, it is possible that a group such as this could have carried out the mission without informing Kim Jong-un.

What is clear is that it is very unlikely any possible direct links to the North Korean leader will ever be proven.

Michael Madden is a visiting scholar at the US-Korea Institute at the School of Advanced International Studies at Johns Hopkins University.