By Lee Hyo-sik
Police said Sunday they were tracing bank account transactions of a ruling party staffer and three IT firm workers who allegedly attacked the website of the National Election Commission (NEC) during the Oct. 26 by-elections.
Investigators are widening their search to look into why they launched such an attack and who was behind them.
Police said they are focusing on two possibilities. First, the secretary of Rep. Choi Gu-sik of the governing Grand National Party (GNP), indentified as Gong, 27, and the three accomplices might have planned and crashed the website through a distributed denial of service (DDoS) attack on their own.
The second one is that politicians or other influential figures may have ordered them to disable the site.
Officers have begun checking phone records of the four suspects, who were detained Saturday after a judge issued arrest warrants for them. They are also tracing their banking transactions while tracking down what they did before and after the cyber attack.
It has been suspected the DDoS attack was an attempt to prevent young voters who favor opposition parties and usually vote in the morning before going to work from checking their polling stations on the website. Rep. Choi, a former reporter of the countrylargest daily Chosun Ilbo, was in charge of public relations for the GNP’s election camp at that time.
On Friday, the National Police Agency’s Cyber Terror Response Center said Gong asked one of the accomplices, 26-year-old Kang who runs an IT company, to organize the attack a day before the election. Kang, who was staying in the Philippines at the time, then instructed two of his company workers in Korea to attack the NEC website, according to police.
Gong and the three have known each other for a long time. The three accomplices used 200 zombie computers for the DDoS attack, police said. They were also found to have attacked the website of the then Seoul mayoral candidate Park Won-soon twice on the same day.
“We are investigating what they launched the cyberattack for and whether they were ordered to do so by someone. We are tracing their phone records and financial transactions to check whether any additional party was involved in the DDoS attack,” a police officer said.
Gong has been flatly denying his involvement in the cyberattack, while his three accomplices have admitted to committing the offense against the NEC website and Mayor Park’s personal homepage under Gong’s instructions. Rep. Choi has also denied his involvement in the hacking scheme.
Investigators are questioning Gong and Kang about what they discussed on the phone on the by-election day. They were found to have called each other about 30 times.
Gong claimed that he talked with Kang about insurance products, but police suspect that the two were colluding in the DDoS attack over the phone.
“As both ruling and opposition parties want us to get to the bottom of the case, we will look into all possibilities,” the officer said.
The investigation has been attracting keen public attention as it could shake up the local political landscape. If Rep. Choi and other GNP figures are found to be involved in the hacking, it could deal a severe blow to the party ahead of next year’s parliamentary and presidential elections.