The police Friday concluded that the Oct. 26 cyber attacks on the websites of the state election watchdog and Seoul Mayor Park Won-soon were masterminded by the former secretary of a Grand National Party lawmaker.

The conclusion dismissed the suspicion that the attack was ordered by those higher up in the GNP.

The main opposition Democratic Party upbraided the police for their “insufficient” investigation and vowed to uncover the truth behind the attack through a parliamentary investigation or a special probe by an independent counsel.

The 27-year-old secretary of GNP Rep. Choi Gu-sik, surnamed Gong, asked his acquaintances to conduct the distributed-denial-of-service attacks on the National Election Commission’s website and Park’s homepage, according to the cyber terror response team of the National Police Agency.

The DDoS attacks, which swamp selected websites with massive traffic, used virus-infected “zombie computers” to simultaneously access them.

His close friend Kang, who runs an IT firm, and two of his employees carried out the attacks. Investigators also found that another employee at the firm, who is also Gong’s close friend, was involved in the attacks. All the suspects including Gong have been arrested.

Wrapping up their 10-day investigation, the police handed the case to the prosecution.

Police said that they could not find any evidence that Gong received any money from anybody for the attacks, based on their analysis of confiscated materials such as his bank accounts, credit card records and emails.

“So far, we have yet to find any evidence to find that anybody (in higher authority) was behind the attacks,” Hwang Un-ha, senior NPA official, told reporters during a press conference.

“Gong thought that it would be beneficial for GNP candidate Na Kyung-won should the attack paralyze the election watchdog’s website to make voters unable to find the locations of polling stations.”

Police also said that the reasons why they believe Gong’s decision on the attacks was “spontaneous” rather than premeditated are that Gong phoned his associate for the first time in a month before the attacks, and that Kang was in the Philippines at the time of the attacks.

They also pointed out that although criminals usually test their cyber attacks long before the real attacks, the suspects carried out test-attacks just some five hours before the actual attacks.

The NPA official Hwang said that there was “insufficient” time to verify the complete truth, pledging to continue their investigation into the case after the prosecution begins its part of the probe.

The cyber attack on the election watchdog and a rival candidate in a major election has roiled political circles. The case further deepened the woes of the ruling GNP, already faltering after its defeat in the Seoul by-election.

By Song Sang-ho (sshluck@heraldcorp.com)