State audit finds lax security at government research institutes; retiree took 60,000-plus files

A state audit has exposed serious lapses in information security at government-funded research institutes responsible for the country's core research and development work.

The Board of Audit and Inspection released its audit report on public network security management Tuesday.

The audit examined information security practices at six government-funded research institutes under the Ministry of Science and ICT and the Korea AeroSpace Administration (KASA), and identified 27 areas requiring improvement — including hard drive security management and vulnerability checks. The board called for 25 notifications and two Caution-level measures.

The six institutes audited were the Korea Institute of Science and Technology, the Korea Research Institute of Bioscience and Biotechnology, the Electronics and Telecommunications Research Institute (ETRI), the Korea Atomic Energy Research Institute, the Korea Institute of Science and Technology Information and the Korea Aerospace Research Institute.

The audit found that, unlike laptops and external storage devices, hard drives installed inside desktop computers had been left entirely to each institute's discretion, with no separate procedures or standards governing their removal or tracking.

All six institutes failed to maintain even basic records of hard drive usage, making it impossible to verify how many were in use or whether any had been taken off-site.

An analysis of hard drive removal at five of the institutes over the past year — from October 2024 to September 2025 — found that 690 hard drives had been detached in total. Of 39 drives previously used by former employees, 12 could not be located or were found to be outside the institutes.

At the Korea Aerospace Research Institute, a former employee who moved to a university used a hard drive without authorization, then removed and took it off-site without deleting 60,956 research files — including materials from four classified security projects.

In response, the board notified the Ministry of Science and ICT and KASA to establish security measures, including banning unauthorized hard drives and setting up formal procedures for their removal and return.

"Science and technology research institutes carrying out core national R&D work continue to experience information leaks caused by external hacking and internal staff," the board said. "We confirmed that institute employees have removed hard drives to leak research data, and that vulnerability checks on servers and follow-up actions on security advisories to guard against hacking have been inadequate."