Google wins 5th straight cybersecurity award despite blank disclosures

Google has been designated an "outstanding information security investor" by the South Korean government for five consecutive years — even though the tech giant has not disclosed the staffing levels or investment figures that sit at the heart of the country's information security disclosure regime.

After a string of cyberattacks last year, the government pledged to significantly tighten information security disclosure requirements starting this year. The outcome has been the opposite. Critics say the ministry missed its window to act despite receiving the same warning a year earlier, effectively enabling what the industry calls "hollow disclosures."

The Ministry of Science and ICT, the agency responsible for the regime, attributed the situation to administrative delays, but the IT industry pushed back, calling it "reverse discrimination" against domestic companies.

According to a review of the disclosure portal, Google has received the outstanding investor designation every year since the information security disclosure system was introduced.

The information security disclosure regime requires certain companies to publish their security investments and staffing to protect users' right to information and encourage corporate investment in cybersecurity. Google, which operates active cloud computing and AI businesses in South Korea, is subject to mandatory disclosure as a cloud computing service provider under the enforcement decree of the Cloud Computing Act.

The problem is that Google — along with other global big tech firms including Tencent Korea — has received the outstanding investor designation while leaving the core disclosure fields blank. These companies have either left the fields for IT investment (A), information security investment (B), and major investment items empty, or substituted a note reading "our investment is managed at a global level — please refer to the special remarks below." Staffing fields are similarly blank, with total headcount, IT division staff (C), and dedicated information security personnel (D) all left unfilled.

The Ministry of Science and ICT said the issue stems from delays in revising Article 7 of the ministerial notice on information security disclosure, which governs the designation of outstanding investors. Under the current notice, companies that obtain ISMS (Information Security Management System) certification are automatically designated as outstanding investors.

Because the notice — written before mandatory disclosure requirements took effect — was never revised, global big tech firms have continued to benefit from the automatic designation through this year.

Frustration has been building in the IT industry. Domestic companies are required to report their staffing and investment figures in detail under the disclosure standards. Industry officials say the tightened disclosure requirements introduced after last year's cyberattacks have placed a significant burden on Korean companies, while global big tech firms remain exempt — a disparity they describe as fundamentally unfair.

A Ministry of Science and ICT official said the agency "needed to go through the notice revision process but was delayed in doing so," adding that companies failing to meet the standards "will no longer be designated as outstanding investors starting next year."

An industry official said the purpose of the information security disclosure regime is "to transparently publish companies' actual security investments and capabilities so that users' right to information is protected," and called for urgent reforms "so that domestic and foreign companies alike can be assessed on equal, comparable terms."