Hacking National Audit

A term referring to the phenomenon in which hacking and cyber breach incidents and information protection systems become major issues in the National Assembly audit.

Hacking National Audit

Overview

Hacking National Audit (해킹 국감) is a term collectively referring to the phase in which hacking and cyber breach incidents, personal information leaks, and vulnerabilities in information protection systems emerge as core issues during the National Assembly’s audit of government affairs. Rather than referring to a single specific incident, it encompasses the security incidents at state agencies, public institutions, and private companies that repeatedly appear each audit season, as well as the political disputes over responsibility for responding to them. Recently, as the issues have expanded to include crimes exploiting AI, supply chain attacks, and state-sponsored hacking, the scope addressed by each standing committee is also broadening.

Key Details

Concept and Background

The National Assembly audit is a constitutional mechanism through which the National Assembly verifies the work of the executive branch and public institutions. As cyberspace becomes the foundation of administration, finance, national defense, and elections, hacking incidents are treated not as mere technical accidents but as matters of national security and citizens’ rights. Accordingly, the scale of damage, causes of incidents, appropriateness of reporting systems, and measures to prevent recurrence become major subjects of audit questioning.

Relevant Standing Committees

Science, ICT, Broadcasting and Communications Committee: Addresses information protection policies and breaches at telecommunications companies and platforms, with the Ministry of Science and ICT, the Korea Internet & Security Agency (KISA), and the Korea Communications Commission as subjects.
Intelligence Committee: Often reviews the National Intelligence Service’s cyber response system and activities responding to state-sponsored hacking behind closed doors.
National Defense Committee: The Military Cyber Command, leaks of weapons systems and defense industry technology, and defense network security are major issues.
Political Affairs Committee and Public Administration and Security Committee: Examine hacking in the financial sector, e-government systems, and resident data management systems.
National Assembly Steering Committee, etc.: Election management systems and the National Assembly’s own information security system are also subjects.

Recurring Issues

1. State-sponsored hacking: Suspected cases of cyberattacks by external actors such as North Korea and the effectiveness of responses.

2. Breaches of public and private infrastructure: Large-scale leak incidents at telecommunications companies, financial firms, hospitals, and platform companies.

3. Personal information protection: The management status across the entire process of collection, storage, and destruction, and the appropriateness of fines and sanctions.

4. Security of election and administrative infrastructure: Vulnerabilities in voting and vote-counting systems and e-government services.

5. Security budgets and organizations: Shortages of information protection personnel, budget allocation priorities, and the absence of a control tower.

6. Incident reporting systems: Suspicions of cover-up and downplaying, delayed reporting, and communication problems with stakeholders.

Procedure and Ripple Effects

The Hacking National Audit is conducted in formats such as questions on current issues, requests for witnesses and references to appear, submission of institutional data, and reports on investigation results by the Board of Audit and Inspection and the prosecution. Facts revealed during questioning often lead to follow-up legislation. The Information and Communications Network Act, the Personal Information Protection Act, cybersecurity-related legislation, and provisions on the legal basis for the National Intelligence Service’s cyber activities are representative follow-up legislative agendas. The paradox that internal materials disclosed at the audit are again exposed to the risk of secondary leaks is also repeatedly pointed out.

Latest Trends

In the 2024 National Assembly audit, deepfake sexual crimes exploiting generative AI, ransomware response, software supply chain attacks, and breach incidents in the medical and financial sectors were intensively addressed. In 2025, discussions on enacting a Framework Act on Cybersecurity, implementation checks of the national cybersecurity strategy, AI security and post-quantum cryptography transition, and expansion of the scope of designating critical information and communications infrastructure emerged as new topics for questioning. In addition, the security management of National Assembly audit materials themselves, the scope of disclosure of meeting minutes, and personal information exposure during witness questioning have also become issues. Experts point out that, compared with the pace of technological change, the audit’s questioning framework remains centered on incident response, and they argue that review from the perspective of prevention and governance is needed.