"A public-private joint investigation team should conduct a full-scale review as a rule. When corporations investigate on their own and make their own announcements, it is difficult for outsiders to verify the integrity of the investigation process or the reliability of the analysis, and it inevitably has a structural limitation of relying on suspect confessions. In the end, 'self-investigation' is structurally bound to be controversial."
Kim Seung-joo, a professor at the Graduate School of Information Security at Korea University, said this on the 6th at a National Assembly forum on "the Coupang hacking and personal information breach incident" held at the National Assembly Members' Office Building in Yeouido, Seoul, regarding Coupang's large-scale personal information leak. As the forum was held right after the Personal Information Protection Commission (PIPC) said that "Coupang reported a total of 165,000 personal information leaks" the day before, the validity of Coupang's self-investigation method emerged as the key issue.
The forum was hosted by People Power Party lawmakers on the Science. ICT. Broadcasting. and Communications Committee. Kim served as presenter and moderator. Choi Woo-hyuk, Director General for Network Policy at the Ministry of Science and ICT, Lee Dong-geun, head of the Digital Threat Response Headquarters at the Korea Internet & Security Agency (KISA), and Park Se-jun, CEO of Theori Inc., also attended. However, Min Byung-gi, vice president of Coupang's Policy Cooperation Office (in charge of government affairs), did not attend. The reason given was that Coupang would not attend National Assembly schedules until the public-private joint investigation team's findings on the Coupang personal information leak are released.
Participants first questioned whether Coupang's self-investigation was appropriate. Rep. Choi Hyung-du of the People Power Party said, "On Dec. 25 last year, they said only 3,000 cases were leaked, but yesterday (the 5th) they said 165,000 cases were leaked," adding, "It is hard to trust corporations' self-announcements as they are." Choi continued, "Before government investigation results come out, corporations' announcements are repeated. On what basis are people supposed to judge?"
In the process, Choi raised U.S.-South Korea diplomatic and trade issues, saying, "If at Amazon the personal information of Americans had leaked on a large scale and flowed to China, would the U.S. government and Congress have stayed quiet? The leak of people's sensitive information overseas is not a matter for corporations but one directly tied to national security." Choi added, "The United States has systems that restrict foreigners' access to citizens' core information, but Korea has no such legal mechanism," stressing the need to improve laws and systems.
The day before, the Personal Information Protection Commission (PIPC) said it had received a report from Coupang that "a total of 165,000 cases of personal information were leaked externally." On Dec. 25 last year, Coupang said in its own investigation that "only 3,000 cases actually leaked externally, and the 34 million items of personal information were merely stored on the computer of a former developer of Chinese nationality, with no external leak." But as the reported scale grew to more than 160,000 in just over a month, the credibility of the self-investigation results at the time inevitably took a hit. The PIPC is currently conducting additional investigations into the exact breach route and the adequacy of management and protection measures.
Government officials at the forum also stressed uniformity and fairness in the investigation process. Deputy Minister Choi Woo-hyuk of the Ministry of Science and ICT said, "In the SKT and KT personal information leaks, too, results were disclosed after months of detailed investigation," adding, "Coupang is being investigated under the same standards and procedures without distinguishing between domestic and foreign corporations."
The repercussions surrounding Coupang's large-scale personal information leak are spreading beyond the government, the National Assembly and the judiciary to overseas. On the morning of the day, Harold Rogers, Coupang's interim head for Korea, was summoned by police for questioning on suspicion of perjury in National Assembly testimony. The day before, Rogers was said to have asked employees by email to cooperate with the investigation, including submitting materials and sitting for in-person interviews, saying, "Please faithfully participate in the government's investigation procedures so the situation can be resolved quickly."
The political response to the Coupang situation is also shifting. The Democratic Party of Korea initially said it would launch the "Set Coupang Right task force (TF)" on the 27th of last month but postponed it to the 2nd of this month, then recently put the launch on hold as the Coupang situation began to morph into U.S.-South Korea diplomatic and trade tensions.
The U.S. Congress is also closely watching the Coupang situation. The House Judiciary Committee has launched a formal investigation to determine whether the Korean government's probe and sanctions on Coupang constitute discriminatory regulation of U.S. tech corporations. The Judiciary Committee has issued a subpoena requesting testimony from Rogers and has requested records of communications with the Korean government.
This is the first time the U.S. Congress has directly targeted the Coupang situation and the Korean government with investigative procedures. However, the Korean government maintains that "U.S. tariff hikes and other U.S.-South Korea diplomatic and trade frictions are unrelated to the Coupang situation." The Personal Information Protection Commission (PIPC) and the public-private joint investigation team are investigating the exact breach route, information access method, and adequacy of management and protection measures based on Coupang's additional leak reports.