Experts call for clearer authority and faster coordination, warning against another layer of bureaucracy
President Lee Jae Myung has called for a powerful national cybersecurity coordinator following a wave of cyberattacks on major companies and financial institutions, raising questions about what a new authority could accomplish beyond South Korea's existing security agencies.
At a Cabinet meeting Tuesday, Lee said existing security systems focused on inspections and responses after attacks had shown "clear limitations" as hacking techniques grow more sophisticated. He instructed officials to consider a "powerful and effective cybersecurity czar" to coordinate security functions across public and private sectors, with greater emphasis on early detection and prevention.
Lee cited the Oct. 29 theft of $6.3 billion from cryptocurrency exchange Binance, which the FBI attributed to North Korean hackers. The attack prompted Korean financial regulators to conduct emergency security checks on domestic crypto exchanges Monday.
Korea has suffered major breaches at SK Telecom and Coupang since last year, followed by a wave of intrusions targeting banks and other financial institutions since late September.
The government already has a joint National Cyber Crisis Management Group, established in May 2023, to coordinate responses involving government agencies and private-sector experts. But responsibility for cybersecurity remains divided among intelligence, military and civilian authorities.
Other countries have dedicated agencies with clearer powers to coordinate responses across industries. Singapore's Cyber Security Agency, for example, can enforce security needs and require operators to report certain cyber incidents under its Cybersecurity Act.
"We bring them together and we can respond regardless of which sector, rather than expecting each of them to do it themselves," CSA chief Gwenda Fong told The Korea Herald last month, referring to critical infrastructure operators and relevant government agencies.
Britain's National Cyber Security Centre said Tuesday it had supported responses to 337 cyber incidents over the past year and warned 8,500 organizations of suspected breaches. In the US, the Cybersecurity and Infrastructure Security Agency works with civilian infrastructure operators, alongside separate intelligence and military authorities.
"When a financial institution suffers a cyberattack in Korea, financial, cybersecurity and privacy regulators each launch investigations under different laws," said Hwang Seok-jin, a professor specializing in digital forensics and financial crime at Dongguk University.
He said companies can spend valuable time dealing with overlapping reporting requirements when authorities should be sharing threat intelligence and coordinating their initial response.
"Forcing military, government and civilian cybersecurity under one massive control tower may sound ideal, but it risks becoming another layer of bureaucracy," a cybersecurity industry official who previously worked at a South Korean cybersecurity agency said.
The official suggested establishing a dedicated agency for civilian critical infrastructure, including telecommunications, finance and manufacturing, modeled partly on the US agency, with its own legal authority and specialist personnel.
Lee has not specified whether the proposed coordinator would operate within the existing government structure or require a separate agency.
mjh@heraldcorp.com
