ED Cybersecurity double standards must end

The Financial Security Institute (FSI) was hit with a cyberattack. Despite the significance of the incident, the news barely made headlines, as cyber breaches have become almost commonplace. Thieves stole about 200 documents, including consent forms for the collection, use and disclosure of personal credit information and the personal information of 300 customers. The victims were employees in the banking sector, whose names and dates of birth were part of the compromised information.

Before the FSI incident, two other state-run organizations had suffered security breaches this year: the Ministry of the Interior and Safety and the Bank of Korea.

Public-sector institutions have faced no punitive measures or other disadvantages as a result of the cyberattacks. This lack of accountability stands in stark contrast to the severe penalties regulatory authorities have imposed on private companies. Coupang was hit with a record-high fine of 630 billion won ($470 million) after the personal data of more than 33 million customers was compromised and for other violations. Before that, SK Telecom (SKT) was fined 135 billion won following a massive data breach. SKT subsequently filed a lawsuit against the government, arguing that the penalty was excessive. The legal battle is still underway.

The regulatory authorities' markedly different, if not discriminatory, responses to breaches in the public and private sectors have fueled allegations of a double standard. Why do they turn a blind eye to public institutions while imposing strict liabilities on businesses for comparable security failures? Is it fair for state-run organizations to remain immune and not be held accountable?

The FSI is responsible for overseeing cybersecurity and data protection in the financial sector. It monitors network traffic in real time and operates dedicated DDoS mitigation centers to absorb and filter malicious traffic. It also collects and disseminates actionable cyberthreat intelligence.

If an institution entrusted with helping safeguard the financial sector against malicious cyberattacks can itself be infiltrated, how can regulators credibly insist that private companies alone should bear the burden of accountability for cyber intrusions?

According to the Personal Information Protection Commission (PIPC), fines are calculated based on corporate revenue, with penalties reaching up to 3 percent of a company's average annual revenue over the preceding three years in cases of data breaches. The commission maintains that such penalties are not imposed simply because companies have suffered cyber intrusions, but because they have failed to implement adequate safeguards to protect customer data as required under the Personal Information Protection Act. Article 29 of the law requires companies to implement appropriate technical, managerial and physical safeguards to prevent personal information breaches. Companies that fail to meet these obligations face legal consequences.

The PIPC has recently raised the maximum fine for repeated violations from 3 percent to 10 percent of average annual revenue. This signals that regulatory authorities are taking personal data breaches more seriously than ever.

Comparable standards of accountability should also apply to the public sector. Sensitive personal information belonging to 168 passengers aboard the Korean presidential jet was leaked onto a paid malware-scanning website, where it remained exposed for more than five months. The compromised information included passport numbers, names and dates of birth, including those of President Lee Jae Myung, his wife, presidential staff members and journalists covering the presidency. This incident should serve as a test case for imposing strict accountability on those responsible for security failures.

The rapidly changing cybersecurity landscape in the age of artificial intelligence (AI) further complicates the government's regulatory approach. Since the advent of generative AI, preventing cyberattacks has become increasingly unrealistic, if not impossible. AI-powered attackers enjoy a significant advantage over human security personnel, who cannot always respond quickly enough to stop automated intrusions and data theft. Attackers can also exploit generative AI to create highly personalized spear-phishing campaigns on an unprecedented scale.

Policymakers must change their mindset. Private companies are not their adversaries; they are partners. The government and businesses should work together to build robust, AI-assisted cybersecurity infrastructure capable of mitigating the damage caused by increasingly sophisticated, machine-driven attacks.

Regulations designed before the advent of AI are increasingly outdated and may no longer be effective against emerging threats. Rather than relying solely on punitive measures after breaches occur, regulators should focus on strengthening preventive capabilities and fostering cooperation between the public and private sectors.

Now is the time to move beyond the blame game, rethink outdated regulatory approaches and invest in building a more resilient cybersecurity infrastructure for the AI era.