Legal experts said in unison that Coupang's individual contact with the personal information leak suspect and its arbitrary analysis of the collected evidence to issue a "self-exoneration" was an inappropriate response. They also said Coupang's response was an "act of disrupting public authority," and argued that if evidence was damaged during the internal probe, the Criminal Act charge of instigating destruction of evidence could even apply.
Police are expected to expand their investigation into Coupang's alleged personal information leak to cover the entirety of its internal probe. From Coupang's standpoint, to prove the credibility of its internal findings, it must undergo verification by investigative authorities.
Lee Ung-hyuk, a professor of police studies at Konkuk University, said on the 26th in a phone call with ChosunBiz that Coupang's internal probe could be subject to the charge of instigating destruction of evidence. Lee said, "Coupang asked an outside firm to conduct digital forensics (on the laptop, etc.)," adding, "If there was data tampering or falsification, the charge of instigating destruction of evidence could apply."
Lee went on, "Regardless of the credibility of Coupang's internal findings, authorities could regard it as an act that disrupts public authority," adding, "By analogy, it looks like insiders decided it wasn't a crime among themselves and then asked investigative authorities to issue a certificate."
Law firm Jihyang, representing victims of the Coupang personal information leak, additionally filed a complaint with the Seoul Metropolitan Police Agency's cyber investigation unit on this day, accusing Coupang head Bom Kim and Coupang, Inc. acting CEO Harold Rogers and other top executives of obstruction of official duties by deception, destruction of evidence, and obstruction of business.
Law firm Jihyang said, "Coupang's unilateral contact with the leaker and its announcement (of findings) the previous day go beyond responding to a simple personal information leak incident; they seek to obstruct the state's official investigation and operations and to systematically conceal crimes," adding, "This is a grave challenge to the national judicial system and a malicious act that hinders relief for 33.7 million victims."
Coupang said the previous day that it had contacted former employee A, the personal information leaker, and recovered all devices used to leak customer information. A allegedly used an internal security key stolen while employed to unlawfully access customer information via a personal PC and laptop.
According to Coupang, A destroyed the laptop to obliterate evidence and put it in a bag with a brick before throwing it into a stream. Coupang said it deployed divers to retrieve the laptop from the stream. It then commissioned an outside firm for digital forensics and claimed, "(According to the forensics) the former employee saved only 3,000 items of information and there was no external leak."
The government strongly protested, saying, "They unilaterally announced a matter under investigation."
Experts stressed that an investigation must determine whether Coupang sought to align stories with the suspect or attempted to damage evidence through its internal probe.
Lee Jong-su, a professor at Sogang University School of Law (law school), said, "It is not an issue for a company to internally investigate an individual's misconduct such as embezzlement or breach of trust, but it seems inappropriate for a company to conduct an internal probe and unilaterally announce results on a matter the investigative authorities are currently investigating that involves the entire company," adding, "From the authorities' perspective, they will have no choice but to investigate whether there was any inducement of statements or destruction of evidence during the internal probe."
Attorney Jang Hee-jin of Garojae Law Office also said, "Voluntary submission only has meaning if you don't touch it," adding, "At this point, how can anyone know what Coupang added or removed?" Jang added, "At a time when police are currently investigating, telling them 'do this, do that' under the pretext of an internal probe was inappropriate."
The Seoul Metropolitan Police Agency's cyber investigation division is conducting digital forensics on evidence such as the laptop that Coupang submitted on the 21st. They are verifying not only whether the submitted laptop belongs to the suspect and was used in the crime, but also whether there was any data tampering or falsification before the voluntary submission. They are also verifying Coupang's internal finding that there was no secondary leak.
Moon Song-chun, an emeritus professor at the Korea Advanced Institute of Science and Technology (KAIST) business school and the "No. 1 Ph.D. in computer science in Korea," said, "It is hard to take Coupang's claims at face value," adding, "Since police have secured server logs through a search and seizure, it is important to compare them and determine the truth."
Police are also said to be examining whether Coupang violated any laws by meeting the suspect directly to obtain a written statement, securing key evidence, and then commissioning digital forensics to an external institution.
Coupang said both the contact with the personal information leaker and the recovery of evidence were carried out under government direction. Coupang said, "The probe was not an 'internal probe'; it was an investigation we conducted over several weeks in close daily cooperation with the government, in accordance with government direction," adding, "Nevertheless, false claims continue to be made that we investigated independently without government oversight, creating unnecessary anxiety."