[Editorial] Security negligence

The revelation that the personal information of President Lee Jae Myung and his wife, senior government officials and presidential security personnel had been exposed has sent shock waves through the government.

The disclosure of information directly tied to the head of state's security is grave enough. More alarming, however, is that the presidential office and relevant agencies remained unaware of the breach for more than five months.

The information was leaked through a website that scans files for malware. On June 2, a week before Lee's trip to Europe, a file containing the passenger list for Air Force One was uploaded to the site.

The file held sensitive personal information on all 168 people listed, including the president and his wife, security personnel, ministers and reporters covering the presidential office. Along with their names and positions, it contained their dates of birth and passport numbers.

Passport numbers are particularly sensitive: Like resident registration numbers, they can be exploited for identity theft. Exposing the personal information of close-protection personnel to hostile states or groups could also create serious security risks, potentially revealing the president's movements.

The fact that the presidential office and the Foreign Ministry learned of the breach only after KBS reported it on Nov. 2 lays bare the woeful state of security discipline across government institutions.

The incident raises fundamental questions about whether the government has adequate systems to detect malware and clear rules to prevent sensitive information from being taken outside its networks, particularly amid rampant cyberattacks.

More worrying still is the possibility that the file was downloaded repeatedly over the past five months. Paid members of the website could download files without restriction. This is not a matter that can be resolved simply by issuing new passports. It remains unknown who may have obtained the list or how the information could have been used.

The breach also appears to have stemmed more from internal negligence than from an external cyberattack. What is the point of sophisticated security systems if one employee's carelessness can expose vital state information? If the leak originated inside the government, the same failure could happen again at any time.

The crux of the incident is not merely the exposure of personal information, but the failure of systems meant to manage and safeguard critical national information.

The government must trace the leaked file's path, determine why existing oversight mechanisms failed and hold those responsible strictly accountable. It should tighten controls on access to and transfer of documents, while putting safeguards in place to prevent sensitive information from leaving government networks in the first place.

Banks, telecommunications providers and public institutions are repeatedly falling victim to hackers, with seemingly little ability to stop them. As hackers increasingly weaponize artificial intelligence, attacks are becoming faster and the damage is spreading at an alarming pace. The threat is so serious that the National Intelligence Service has launched emergency security inspections of about 2,100 central and local government agencies.

The cybersecurity crisis has reached a point where it threatens not only the national economy and people's daily lives but also national security. Yet the country still lacks a coordinated, nationwide response.

Despite the obvious limits of a system focused on post-incident responses and inspections, efforts to promote public-private cooperation and build round-the-clock cyber defenses remain stalled.

The priority must be to establish a legal framework for an integrated national cybersecurity policy, coordinated crisis response and a clear division of responsibilities among government agencies.

At a Cabinet meeting on Tuesday, Nov. 3, President Lee urged officials to “actively consider establishing a powerful and effective ‘cybersecurity czar’” to oversee and coordinate security functions now scattered across the government.

Whether through a basic cybersecurity law or a cybersecurity czar, decisive action is urgently needed.