Police decide to notify the Central Investigation Agency of the financial institution hacking incident... Judgment of ‘serious crime’ (comprehensive)

(Seoul = Yonhap News) Reporter Han Ji-eun and Kang Ryu-na = The police decided to notify the Serious Crimes Investigation Office of the recent series of financial institution hacking incidents. The Central Investigation Agency will take over the case and decide whether to investigate.

The National Investigation Headquarters of the National Police Agency announced on the 20th that it plans to apply additional charges of violating the Electronic Financial Transactions Act to the financial institution hacking case in addition to violating the existing Information and Communications Network Act and notify the Central Investigation Agency.

Kooksubon explained that this decision was made after comprehensive consideration of the investigation details, legal review, the Financial Services Commission's authoritative interpretation, and the opinions of the victimized financial companies.

Accordingly, the financial institution hacking case being investigated by the police is expected to be transferred to the Central Investigation Agency.

According to the Central Investigation Agency Act and its enforcement ordinance, if the police recognizes a serious crime, they must immediately notify the Central Investigation Agency. However, if they first reported it by phone, etc., they must also notify it in writing within three days from the date of recognition.

In principle, the Central Investigation Agency must reply whether or not to initiate an investigation within 7 days from the date of receiving written notification.

If there are unavoidable circumstances such as data collection, the response period may be extended.

Cyber ​​crimes subject to notification include ‘violation of the Information and Communications Network Act due to hacking of national core infrastructure, etc.’ and ‘violation of the Electronic Financial Transactions Act due to hacking of electronic financial infrastructure, etc.’

Previously, the police determined that the hacked financial company's system did not fall under the national core infrastructure.

However, we requested an authoritative interpretation from the Financial Services Commission, believing that interpretation by the financial authorities was necessary to determine whether it constituted electronic financial infrastructure.

In particular, given that many of these hacking attacks targeted financial companies' internal business systems, the issue was whether they could be considered facilities used for electronic financial transactions.

The Financial Services Commission recently responded to Kuksubon with an authoritative interpretation that the system in question is likely to fall under electronic financial infrastructure under the Electronic Financial Transactions Act.

On the 6th, the police converted the financial sector hacking case into a formal investigation on charges of violating the Information and Communications Network Act.

The Cyber ​​Terror Investigation Team was designated as a dedicated investigation team, and a total of 4 teams, 43 people, were assigned to the investigation, with the head of the Cyber ​​Terror Response Department as the team leader.

Guksubon said, “We will continue to conduct a thorough investigation to ensure that there are no gaps in the investigation according to the procedures stipulated by the law.”