Cybersecurity researchers caught playing StarCraft for 90 hours on the clock

Employees at a government-funded research institute responsible for national cybersecurity were caught repeatedly connecting to the StarCraft game server during work hours. One employee's cumulative session time exceeded 90 hours, and another logged nearly nine hours in a single day.

According to materials submitted to Democratic Party of Korea lawmaker Hwang Jeong-a of the National Assembly's Science, Technology, Information, Broadcasting and Communications Committee, five employees at the Cyber Security Training Center of the National Security Research Institute (NSRI) — an affiliate of the Electronics and Telecommunications Research Institute (ETRI) — repeatedly connected to Battle.net, the StarCraft game server, during work hours between September and December 2024.

The longest cumulative connection time among the five exceeded 90 hours. One employee was connected to the game server for up to 8 hours and 53 minutes in a single day; another recorded a single-day maximum of 7 hours and 21 minutes. In effect, some employees spent most of their working day connected to the game server.

The employees exploited periods when their manager was away on leave or on a business trip. An investigation found they took advantage of the fact that the Cyber Security Training Center is housed in a separate building from the main institute and that the external internet line used for training purposes did not block access to game servers.

Some employees were even found to have connected to the game server through the internal local network after the experimental internet line was blocked in December 2024.

The misconduct came to light after a colleague at the same center filed a report through ETRI's internal whistleblower channel.

The employees told investigators they had connected to the game to unwind after a major event. They added, however, that they were not actively playing the game for the entire duration of their connections.

NSRI convened a disciplinary committee and issued a reprimand — the lightest available penalty — to all five employees.

The committee had determined that a pay cut was warranted for the employee with the longest game server connection time, who had also been flagged for other violations including improper use of parental leave. The penalty was nonetheless reduced to a reprimand on the grounds that the employee had previously received a commendation from the chairman of the National Research Council of Science and Technology.

Despite confirmed evidence of prolonged game server access during work hours, all five employees ultimately received the lowest level of disciplinary action available.

NSRI deducted annual paid leave equivalent to the time each employee spent connected to the game server. For employees who had insufficient leave remaining, the corresponding hours were deducted from their pay.

The institute said it has since consolidated its educational internet lines under centralized management, begun monitoring usage logs, and blocked access to game sites and other websites unrelated to work.

"It is a serious breach of discipline for employees tasked with protecting national cybersecurity to have repeatedly accessed a game server whenever their manager was away," Hwang said. She criticized the decision to reduce the penalty to a reprimand on the basis of a past commendation despite a finding that a pay cut was necessary, calling it "a slap-on-the-wrist punishment that falls short of public expectations."

Hwang added that the institute must not only enforce strict attendance management and hold those responsible firmly accountable, but also review its protection mechanisms to ensure that internal whistleblowers do not face retaliation.