It’s late March in a coastal town in Mozambique, and a group of militants is on the attack. Thousands of civilians flee as their town is left burning behind them. This isn’t the first time scenes like this have played out here, but it’s the first time we’ve seen them captured in such detail. A crisis has been unfolding as local insurgents who’ve pledged allegiance to the Islamic State, execute the largest land grab by an ISIS-linked group in years. And this has created one of the world’s most severe humanitarian crises. Hundreds of thousands of people have been displaced. And now, over the course of about a week, the insurgents are attacking Palma, a strategic port town with massive global investment. In one scene, hundreds shelter in a hotel while a battle rages outside. The question they’re asking … … is the Mozambique government going to save them? It isn’t. The government exaggerated its response in the days after the attack. But we found that government forces weren’t able to defend Palma, leaving its citizens to mostly fend for themselves against the insurgents. Evacuations that did happen had to be hastily organized by private companies. For years, the government has heavily censored media coverage of the conflict, obscuring much of what’s happening. But we can still discover clues about the situation by examining what is aired by local media … … like state-run broadcaster, TVM, and by Sky News, which went to Palma after the attack. Combining this footage with visual evidence from survivors, satellite analysis and ship-tracking data allows us to build a fuller picture of an attack which many felt was not a question of if it would happen, but when. The insurgency is known locally as Al-Shabaab, and it first emerged in the province of Cabo Delgado in 2017. Al-Shabaab’s recruitment is mostly local, and draws on grievances over extreme poverty and corruption. The group has pledged allegiance to the Islamic State … … but how close these ties really are is hotly debated. The government, however, tries to maintain the illusion of safety and calm for international investors. But insurgent activity and control have escalated over time, overwhelming Mozambique’s severely under-resourced government forces. Now in March 2021, those forces are tested again. The insurgents’ target, the town of Palma, lies here. Just South of Palma is the site of Africa’s largest foreign direct investment, a liquefied natural gas project where the primary investor is French oil and gas company Total. The project is hailed as a massive new revenue source that could transform the country, but it’s also controversial, in part, because its construction displaced many local villages. In the months before the attack, insurgents were getting closer to Palma, prompting Total to strike a deal with the Mozambican government for better security at the multibillion dollar gas site. We analyzed satellite imagery which shows at least nine recently constructed military outposts at key positions around the site. It’s clear that the natural gas project, and not the town, is the most secure place when insurgents move in. Now we come to March 24, the day Al-Shabaab advances on Palma. They quickly take control of parts of the coast and all key roads leading into the town — to the southwest, cutting off a key crossroads for military reinforcements. West on this road, and to the north on this road alongside the town’s airstrip. Video obtained and verified by The Times shows a plane trying to land there coming under fire. In it we get a rare glimpse of the insurgents. Multiple eyewitnesses told us that the government forces inside Palma retreated quickly after some pockets tried and failed to fight off the insurgents. We were also told that around 750 soldiers stationed at the gas site stay inside the facility instead of rushing to the city as backup. There’s little footage of the insurgents from during the attack. But Islamic State media did release this footage claiming to show the fighters preparing, along with claims that they targeted a good deal of the town’s infrastructure. The Times confirmed damage to two banks, government offices, the town’s business park, and military and police buildings. The roads are cut off, and the only ways help can now arrive are by sea and air. Three government helicopters are moved from at least 85 miles away to the airstrip of the natural gas site. But multiple eyewitnesses told us that the helicopters only attempt to fly into Palma once and quickly retreat under fire. Other helicopters do come to the rescue, but they’re not government helicopters. They belong to the Dyck Advisory Group, or DAG, a South African military contractor hired by Mozambique to help fight the insurgency. Their presence is controversial. Recently, Amnesty International accused them of war crimes, claims which they deny. DAG is one of the only actors capable of conducting rescues. Its executives told The Times that they intervened on their own without any clear instruction from the government. DAG heads here to the Amarula Hotel. Its guests are mostly foreign. Now they’re joined by over 100 others from around Palma trying to flee. “We’re going to Amarula, bro.” But who should be rescued first and why? With no government oversight, there’s no plan. It falls to people like the hotel’s manager to come up with one. He’s speaking publicly here for the first time. DAG ultimately makes four rescue flights, but their helicopters can’t hold much. And just a little over 20 people make it out. Those left wonder if the military will send in the larger helicopters we showed you before, one of which can carry upwards of 30 people. With no help coming, they developed their own evacuation plan using vehicles from the hotel’s parking lot to drive outside the town. Some take this route to a quarry, where they believe they’ll be rescued. As people are loading into the cars, the hotel’s owner arranges a last-ditch helicopter rescue. It carries members of her staff and her two dogs. She denies the dogs took up space that could have been used by people. The flight is made by a private company that the hotel often chartered for tourist excursions. As for the DAG helicopters, because they have weapons, they provide air cover for this final helicopter rescue. As the ground convoy prepares to make the risky escape over land, there’s still confusion over whether they will receive air support too. But the aerial resources are stretched too thin, and the cars won’t all make it. Photographs showed that several of the vehicles were ambushed and forced off the road. Only a few safely reached this quarry and spend the night hiding. DAG rescues them the next day and dozens more civilians from elsewhere. The government help never comes. With limited air evacuations, thousands of people throughout the area are forced to flee on their own. The man who shot this video told us what happened. Tens of thousands go on foot or by bus across the province toward other cities and towns. Many more people line up at the natural gas site run by Total, where at least some government security is present. Sources tell us that civilians were often denied entrance. As the crowd at the site grows, Total decides to organize a rescue, mostly for its own staff. It charters this ferry, seen here docked at the natural gas site. The Total employees appear to be protected by this ship, known as an Ocean Eagle 43, a patrol and surveillance vessel run by the Mozambican government. It’s one of the few signs of government intervention during the attack on Palma. Ship-tracking data shows they flee south alongside this convoy of mostly private boats. The ferry arrives in the provincial capital of Pemba with over 1,300 passengers, most of them employees. And it makes a second rescue out of Palma a few days later, this time with more locals on board. After the weeklong attack, repercussions were immediately felt — because of the violence, Total has suspended its natural gas operations indefinitely, raising serious concerns about Mozambique’s economic future and the people it left behind. Dozens of Total’s contractors and subcontractors still remain in Palma. Some told The Times that the company hasn’t checked on their safety. Total didn’t respond to our request for comment. Based on our tally of evacuations, only a small number of Palma’s population were rescued during the attack. Roughly 95 percent of the population was left behind. Mozambique’s defense ministry didn’t respond to our questions about their operations in Palma. But after the attack, the country’s president downplayed the severity of violence in the city. His forces have since re-entered the town, assuring people that it’s safe to return. It’s not. A month after the attack, this thermal image reveals large fires burning in Palma, and satellite imagery confirms at least 50 buildings, some of which are seen here, have burn damage. There are near-daily reports of gunfire here. Civilians hoping to escape this threat are forced to rely on a volunteer group working with private companies to organize flights and barges. The cycle of violence plaguing Mozambique for three years continues. Even now, residents must flee on their own, unable to trust in their government to save them.
On an overcast day in May 2020, a satellite captures this image over the sea near Taiwan. At first it appears to just show clouds, until you look closer and enhance the image. What you see here is a transfer of oil to a ship that will end up in North Korea in a possible violation of international sanctions. Covert oil deliveries are crucial to North Korea’s economy and its ballistic and nuclear weapons program. Our investigation focuses on one way oil is getting to North Korea. We followed the movements of a single tanker and the opaque corporate structures that surround it. We spent months unraveling the story of the ship. It’s called the Diamond 8, and it’s been identified by the United Nations multiple times for its illicit trips to North Korea. We visited businesses, ports, and tracked tankers at sea, all to find out who was behind these voyages. What we discovered were elaborate networks, many that connect to the Singapore-headquartered oil trader the Winson Group, primarily through its Taiwan operation Winson Shipping. “Catering to your needs. Winson Group.” Our investigation, which includes findings from a new report by the research groups RUSI and C4ADS, reveals for the first time how the Winson Group plays a role in North Korea’s bid to get oil. The path from a single tanker to Kim Jong-un’s regime is convoluted. When we laid it all out in a flow chart, it looks like this — so we’re going to simplify it by focusing on the Diamond 8. And we’ll also look at two tankers that transport oil to it — the Ever Grandeur and the Superstar. These ships are connected by more than just their meet-ups at sea. They have ties to a handful of people who on the surface seem unconnected, but when we looked deeper, we found that most of the key individuals are linked to the same village in China’s Fujian Province. And they all have connections to both Winson Shipping and the Winson Group. Let’s first look at how the oil gets to North Korea. We analyzed photos and past videos of the Diamond 8, matched them with satellite imagery and took measurements to create a visual fingerprint. This allowed us to follow the Diamond 8’s movements last year. We confirmed our findings with experts who track oil tankers in North Korean ports. We’re going to show you two of its trips to North Korea. The first one, in February 2020, starts here, idling empty in the waters off of Fujian province, a region where oil smuggling has historically been rampant. It heads out and picks up oil from the Ever Grandeur near Taiwan and goes straight to North Korea. That trip is pretty direct. The one we uncovered in May 2020, not so much. But here’s what we know. The Diamond 8 sets off down Taiwan’s coast. It passes a port on April 30, where a second, much larger red tanker is loading up oil. That tanker, called Superstar at the time, follows the Diamond 8 to international waters, according to the ship’s transmissions. Cloudy skies that day appear to shield the operation from satellites, but as we saw, a hole in the clouds reveals the oil transfer. For three weeks, the Diamond 8 doesn’t enter any ports. It’s mostly just lingering in open waters. Then it sails north. Its required transmission signal disappears for eight days, but we found it during that window in this port in North Korea. The dimensions and features match the Diamond 8, a finding confirmed by experts. When we spot it again, its signal is back on and it’s back near Taiwan, meeting up with the Superstar to get more oil. We wanted to know who was behind the Ever Grandeur and Superstar, the two ships that supplied the oil to the Diamond 8, so we looked at shipping records to examine their history and management. Let’s start with the Ever Grandeur. We actually went and filmed it while it sat idle in the port of Kaohsiung in Taiwan. Only five miles away is the company that controls the ship. It’s called Glory Sparkling. Chien Yuan Ju, a Winson Shipping executive, told us they didn’t set up Glory Sparkling. But we found clues the companies are interconnected. Glory Sparkling’s address was on floors owned by Winson Shipping. Its address changed only after we started asking questions. And Glory Sparkling’s website, it was registered with the name of a Winson Shipping employee. We also have evidence showing that a high-ranking Winson Shipping manager named Zuo Fasheng, seen here with the Winson Group’s founder, Tony Tung, has also worked for Glory Sparkling. We found his signature on documents for both companies, including on paperwork for the Ever Grandeur. Officials from Panama, where the Ever Grandeur is registered, told us their records show Zuo Fasheng is currently listed as the operator of the ship. Now let’s take a closer look at the Superstar, the second ship supplying oil to the Diamond 8. It’s actually much more straightforward. Winson Shipping owns it, and they confirmed the May 2020 transfer to us, but told us the ship was leased to someone else when the operation took place. But they haven’t said who. Together, these details indicate how Winson Shipping is connected to both ships that provided oil to the Diamond 8, even after the ship had been publicly outed by the UN for illicitly delivering oil to North Korea. So let’s look at the Diamond 8 itself. Winson Shipping actually owned it until 2016. And from then until 2018, every company linked to it listed their addresses and office space as owned by Winson Shipping. When we talked to their shipping manager, he said that Winson Shipping sold the ship years ago, but he also made a bold statement: It’s “ten thousand percent impossible” that it ever went to North Korea. That’s not true. Our investigation and U.N. reports show the Diamond 8 has been to North Korea at least four times since late 2019. So finding out exactly who is behind the Diamond 8 is not straightforward or easy. To learn more, we had to look to Indonesia. The registered owner of the ship is Tan Jeok Nam, a 62-year-old retiree who lives here in a modest neighborhood. He told us that he was simply a sailor who couldn’t afford to buy the $1.4 million vessel. Something clearly doesn’t add up. So we set out to find who sold him the ship — at least on paper. When we reviewed the bill of sale, we noticed the seller appears to be the daughter of Hong Kong-based businessman Tsoi Ming Chi. Tsoi is also linked to the company that manages the Diamond 8. When we visited that company in Indonesia, there was no sign of a shipping business. It’s another dead end. So back to the retired Indonesian sailor, Tan. There’s one more thing you need to know about him. He actually used to work on oil tankers. One of the tankers belonged to a Hong Kong company owned by the late Wong Tin Chuk. Wong, Tsoi — these two businessmen have something else in common. They both have links to Winson companies, including through a leased office space, mortgages, and have exchanged ships with each other, according to a report by research groups RUSI and C4ADS. And there’s a personal nexus, too. Wong and Tsoi are tied to the Winson Group’s founder, Tony Tung, through the same village in China’s Fujian region, population 2,600. In fact, all three belonged to the village’s hometown club and the alumni association of the same middle school. Two of them have been accused of smuggling in the past. Take Tony Tung, for example. He’s faced multiple smuggling and bribery investigations. His only conviction was later overturned. Soon after he founded the Winson Group in the 1990s, Tung and his brothers were accused of smuggling cigarettes and oil into China, according to court documents and state media. One of Tung’s brothers was sentenced to life in prison. He served three years and was later pardoned. At the time of the trial, Tung had already left China. Over the last five years, Tung has stepped down from executive positions at the Winson Group and handed over the reins to his daughter, Crystal Tung. In a statement to The Times, she said, “The allegations against Winson Group are unfounded and false. Winson Group did not take any actions in violation of applicable sanctions against North Korea or any sanctioned countries.” After The Times asked questions about the company’s involvement in oil deliveries to North Korea, Winson Shipping Taiwan changed its name to Zheng Yu Shipping. Chien Yuan Ju, the executive who spoke to The Times, was also replaced as the official representative of the company. The mysterious retired sailor, the oil trader, the maze of companies — taken together, they expose an elaborate system that conceals one way oil is getting to North Korea despite some of the strongest sanctions in history, and how Kim Jong-un continues to defy the international community. As for the Diamond 8, it’s back in Fujian, China, awaiting its next orders. Its operators are now using a new trick: transmitting a fake ship name to hide its true identity. “Hey, this is Christoph, one of the reporters on this story. We spent months investigating who is providing oil to a sanctions-busting tanker that is delivering oil to North Korea. We looked at a lot of satellite images, reviewed corporate records and interviewed key players. It was a massive team effort involving reporters in four countries. What you’ve just watched is only a small part of our reporting, and you can find more details at nytimes.com/ visualinvestigations. If you have any other info on this story, we’d love to hear from you. And, of course, if you like what you’re seeing, subscribe to The New York Times. Thanks.”