South Korea wants a cyber tsar, but can it beat complacency?

South Korean President Lee Jae Myung’s push for a centralised cybersecurity agency after his passport details were leaked could face widespread inertia despite what he considers a national security priority.

Tech experts warn that creating a new organisation alone will do little to address the deeper problem of complacency, with businesses and government agencies viewing tighter cybersecurity as an unnecessary expense until a serious breach occurs.

Lee’s proposal comes amid growing scrutiny of South Korea’s cybersecurity vulnerabilities, notably after passport details and other personal information of 168 people, including the president, his wife and senior security officials, were reported to be accessible online for nearly five months.

The leak, involving a passenger list from Lee’s June trip to Europe, prompted an emergency investigation and plans to reissue affected passports. However, authorities later said the incident resulted from an accidental disclosure rather than hacking.

Lee on Tuesday proposed to his officials to “actively consider” appointing a “powerful and effective cybersecurity tsar organisation” to coordinate fragmented government functions overseeing online security.

Park Dong-chul, a professor specialising in security issues at Chung-Ang University, said: “Many companies in this country still regard cybersecurity as little more than a costly nuisance until they suffer a serious security breach. Many of them still resort to reactive, piecemeal measures to contain the damage after an incident occurs.”

At the cabinet meeting on Tuesday, Lee cited a growing wave of cyberattacks at home and abroad when he called for a comprehensive nationwide response system, capable of detecting early signs of attacks and implementing preventive measures.

“With advances in AI, hacking techniques are becoming increasingly sophisticated, advanced and commonplace, exposing clear limitations in existing security systems centred on inspections and responses after incidents occur,” he said.

Park said South Korea should address low public awareness of the importance of cybersecurity if it were to establish the new organisation.

“I wonder whether such a new layer of oversight would be effective as long as the widespread perception persists that investing in cybersecurity is like throwing money out of the window,” he added.

Professor Lim Jong-in of Korea University’s Graduate School of Information Security said a powerful state body was needed to coordinate government and business responses at short notice, given that cybersecurity responsibilities were fragmented across agencies.

Cybersecurity responsibilities are divided among several agencies, with the National Intelligence Service (NIS) overseeing security at critical public infrastructure, the science ministry handling much of the private sector and the Financial Services Commission overseeing financial-sector security.

“In the face of mounting attacks driven by AI agents, there is no time for government agencies to sit down together to discuss responses as in the past,” Lim said. “A 24/7 channel is required to ensure a quick response.”

Lim said cooperation from the private sector would be essential to operating such an organisation smoothly, citing Binance, the world’s largest cryptocurrency exchange, losing US$6 billion to hacking within 20 minutes.

Binance said on Tuesday that hackers had used fake job interviews and an internal artificial intelligence tool in the heist.

The US Federal Bureau of Investigation (FBI) has attributed the theft to North Korea, identifying a hacking group it calls TraderTraitor, a name previously linked to other cryptocurrency thefts.

On Tuesday, Kim Yo-jong, the powerful sister of North Korean leader Kim Jong-un, flatly dismissed the FBI’s findings, calling them a “grave political provocation” against Pyongyang.

With its extensive intelligence capabilities, the NIS is expected to play a leading role in the proposed oversight organisation.

Lim dismissed concerns over the concentration of intelligence powers in the agency’s hands. “Unlike under past authoritarian governments, transparency and public oversight prevent government agencies from surveilling the people,” he said.

Youm Heung-youl, professor emeritus of information security at Soonchunhyang University, told the Korea Times that it remained unclear if the government planned to establish the new organisation through legislation or create a governmentwide committee.

If the government opted for a committee, Youm suggested that Lee be its chairman to accord it sufficient authority under South Korea’s presidential system.

“I personally think it would be better for the president to chair it, even if it is a committee under the president,” he said.

“What matters most is that it has real authority. It shouldn’t be a committee that exists only in name.”

Hwang Suk-jin, a professor at Dongguk University’s Graduate School of Information Security, agreed that the current ministry-by-ministry approach had limitations in dealing with AI-powered attacks and simultaneous security breaches.

“When financial companies assess their own security using regulators’ checklists, actual vulnerabilities can be missed, or the checks can become a formality,” Hwang said.

He called for regular “penetration tests” and on-site inspections to identify vulnerabilities and verify that companies had addressed them, rather than relying solely on self-assessments.

The government has recently stepped up security inspections in response to emerging cyber threats.

On Tuesday, the NIS said that it had been conducting joint cybersecurity inspections across the public sector since May, in cooperation with other government agencies to address growing cyber threats. It has urgently requested more than 2,100 central government agencies and local governments to conduct their own security inspections using a checklist.

The agency plans to complete inspections of internet-facing systems at major public-sector information and communications infrastructure facilities by mid-November.

Its move comes as the country’s financial watchdog, the Financial Services Commission, said last month that cybersecurity incidents involving 100,000 customer records had been confirmed at 16 financial firms, including commercial banks, savings banks and credit finance companies.

Financial regulators have announced plans to tighten identity checks and access controls, improve information sharing and increase corporate executives’ responsibility for cybersecurity.

Last month, Seoul raised the country’s cyber crisis warning level by one notch to “caution”, the second-lowest level in its four-tier system, amid global efforts to address two critical security flaws in PHP, or Hypertext Preprocessor, a widely used programming language.

The government also plans to inspect around 170 major private-sector IT infrastructure facilities to identify security weaknesses.