Passports of presidential travel party leaked — and the cybercrime division chief's post sits vacant

Cybersecurity incidents are piling up in South Korea — and now the personal data of the presidential travel delegation has been exposed. The cases, suspected to involve hacking and information leaks, are drawing police scrutiny one after another. As AI-assisted hacking rattles the financial sector, concerns are growing that investigative agencies lack the capacity to respond, still finding their footing after a sweeping overhaul of the criminal justice system centered on the abolition of the prosecution service.

An official at the Seoul Metropolitan Serious Crimes Investigation Agency said Tuesday that the agency was monitoring the situation surrounding the leak of personal data belonging to the presidential travel party. "It is difficult to determine whether this constitutes a serious crime," the official said, adding that the agency was watching how police handle the investigation.

An Excel file containing the personal information of passengers aboard Air Force One — the presidential aircraft — had been posted on VirusTotal, a paid malware-scanning website, since June, a fact that only recently came to light. South Korea's Ministry of Foreign Affairs said Tuesday it was "currently leaning toward treating this as a leak" and referred the case to police. The Korean National Police Agency's National Investigation Headquarters cyber-terror unit has since launched a formal investigation.

Under the law governing the Serious Crimes Investigation Agency, other investigative bodies that uncover a serious crime falling within the agency's jurisdiction during their own investigations are required to notify it. Among cybercrimes, the agency's jurisdiction covers violations of the Act on Promotion of Information and Communications Network Utilization and Information Protection arising from hacking of national critical infrastructure, and violations of the Electronic Financial Transactions Act arising from hacking of electronic financial infrastructure.

"National critical infrastructure" is defined under the Framework Act on the Management of Disasters and Safety as facilities, IT systems and assets that could have a significant impact on the national economy, public safety and health, and core government functions — including energy, information and communications, transportation, and healthcare. "Electronic financial infrastructure" refers to information processing systems and communications networks used for electronic financial transactions under the Electronic Financial Transactions Act. If the presidential delegation data leak turns out not to have been caused by hacking, the case would fall outside the agency's jurisdiction.

Yet doubts persist in legal circles over whether the agency — more than a month since its launch and still building its human and physical infrastructure — is actually equipped to handle investigations into hacking of national critical infrastructure or violations of the Electronic Financial Transactions Act.

In the recent AI-assisted banking hack case, police received an authoritative interpretation from the Financial Services Commission (FSC) that the affected financial firms' systems could qualify as electronic financial infrastructure, and notified the Serious Crimes Investigation Agency on Oct. 21. Two days later, on Oct. 23, the Seoul agency responded that it had reviewed the case details and the progress of the investigation and concluded that, given police had begun the probe before the agency's inauguration, the investigation was already well advanced and international cooperation with overseas agencies was underway — and that it was therefore appropriate for police to continue. The agency issued a formal notice declining to take up the case. In an investigation where every hour counts, the episode amounted to a time-wasting game of ping-pong. Legal insiders suspect the agency sent the case back simply because it was in no position to handle a hacking investigation at this stage.

There are also concerns that the sweeping restructuring of the criminal justice system — which saw the prosecution service abolished and replaced by the Serious Crimes Investigation Agency and a new public prosecution office — has weakened the country's capacity to respond to the string of cybersecurity incidents. The longer it takes the agency to find its footing, the argument goes, the longer the gap in investigative capability will persist.

Questions are also being raised about whether the investigative expertise built up under the old prosecution service has carried over intact. The Seoul agency's advanced investigations bureau currently has a cyber intelligence investigation division, organized into four teams of five, including a team leader. The division chief's post, however, is vacant, with Oh Gwang-il, head of the defense procurement and industrial technology investigation division, serving in an acting capacity. When a cybercrime investigation unit was established at the Seoul Eastern District Prosecutors Office — now the Seoul Eastern District Public Prosecution Office — in 2018, it was staffed with 15 IT specialist investigators.

"Prevention is paramount when it comes to security incidents, but after the fact, it is the job of investigative agencies to catch those responsible," said a lawyer and former senior prosecutor. "It is crucial that investigative agencies have the capacity to respond." The Serious Crimes Investigation Agency said it plans to expand its workforce in the near future through a recruitment process targeting specialists.