Police to refer financial sector hacking cases to serious crimes agency, add charges

Police have decided to notify the Serious Crimes Investigation Agency of a series of recent hacking cases targeting financial institutions. The agency will have seven days to decide whether to take over the investigation.

The Korean National Police Agency's National Investigation Headquarters said Tuesday it plans to add violations of the Electronic Financial Transactions Act to existing charges of violating the Act on Promotion of Information and Communications Network Utilization and Information Protection, and notify the Serious Crimes Investigation Agency accordingly.

The headquarters said it reached the decision after comprehensively reviewing the progress of the investigation, legal analysis, an official interpretation from the Financial Services Commission and opinions from the affected financial firms.

The hacking cases currently under police investigation are expected to be transferred to the agency as a result. Under the law governing the Serious Crimes Investigation Agency and its enforcement decree, police must notify the agency immediately upon recognizing a serious crime. If they first give notice by phone or other means, they must follow up with written notification within three days of that recognition.

The agency is in principle required to respond within seven days of receiving written notification, indicating whether it will open an investigation. The response period may be extended if there are unavoidable circumstances, such as the need to gather additional materials.

Cyber crimes subject to notification include violations of the network law arising from hacking of critical national infrastructure, and violations of the Electronic Financial Transactions Act arising from hacking of electronic financial infrastructure.

Police had earlier determined that the systems of the hacked financial firms did not qualify as critical national infrastructure. However, they concluded that whether the systems constituted electronic financial infrastructure required an interpretation from financial regulators, and requested an official ruling from the FSC. A key question was whether the systems — many of which were internal back-office systems targeted in the attacks — could be considered facilities used for electronic financial transactions.

The FSC recently responded to the National Investigation Headquarters with an official interpretation indicating that the systems in question could potentially qualify as electronic financial infrastructure under the Electronic Financial Transactions Act.

Police formally opened an investigation into the financial sector hacking cases on Oct. 6 on charges of violating the network law. They designated the Cyber Terror Investigation Unit as the dedicated investigative team, appointing the head of the Cyber Terror Response Division as team leader, and assigned a total of 43 investigators across four teams.

"We will continue to investigate thoroughly in accordance with legally prescribed procedures to ensure there are no gaps in the investigation," the National Investigation Headquarters said.