Police focus on investigation into 'suspicion of Coupang data preservation order'... “Intentionality is the key”

The police are speeding up their investigation into whether data preservation orders were violated in relation to the 'Coupang personal information leak incident'. As some data that can confirm how specific information was accessed is lost, the possibility of administrator punishment is also raised.

According to the police on the 11th, the Seoul Metropolitan Police Agency's Coupang Investigation Task Force began an additional investigation into a request from the Ministry of Science and ICT the previous day regarding Coupang's failure to comply with data preservation orders.

The Ministry of Science and ICT announced the final results of its investigation into the Coupang infringement incident the previous day, confirming that app access records (logs) were deleted for a total of 11 days from May 23 to June 2 last year, and requested the police to investigate. In addition to requesting an investigation into the deletion of web logs in December of last year, the scope of the investigation was expanded to include the deletion of app logs.

In accordance with the Information and Communications Network Act, the Ministry of Science and ICT ordered Coupang to preserve data on November 19 last year when a report of an infringement incident was reported, but Coupang did not adjust its automatic log storage policy, so the records that should have been preserved disappeared.

According to the Ministry of Science and ICT, Coupang stores app logs every six months. If the data preservation order had been implemented immediately, the records from May 23 should have remained, so the government believes that Coupang took relevant action only after December of last year.

An app log is a type of 'logbook' in which all user actions while running an app are recorded. This is an important clue to specifically identify the subject accessing information when analyzing a breach incident. Heung-yeol Yeom, Professor Emeritus of Information Security at Soonchunhyang University, explained, “To determine the circumstances of the leak, both web logs and app logs are needed.”

The police are investigating not only app logs but also the circumstances of web log deletion. Web logs were deleted for about 5 months before the leak suspect left the company. Although there is a difference from the time when the suspect began committing the crime in earnest, it is evaluated as data that can be used to examine the background of the attack.

Park Jeong-bo, Commissioner of the Seoul Metropolitan Police Agency, said at a regular meeting on the 9th, "We are also investigating the necessary officials in relation to the investigation requested by the Ministry of Science and ICT."

Under current law, deleting access records can result in imprisonment of up to 2 years or a fine of up to 20 million won. Corporations can also be punished as they fall under the dual punishment provisions. Accordingly, the police are expected to look into why Coupang did not comply with the data preservation order.

The controversy over data preservation has been repeated in the past with each personal information leak, including at SK Telecom and KT. As the possibility of evidence being destroyed has been steadily raised, the Personal Information Committee recently announced a policy to establish a new evidence preservation order system that enforces data preservation when an investigation begins. In the political world, a bill was proposed last year that would allow preservation orders to be issued even before hacking damage occurs.

Jang Ji-woon, an attorney at Daeryun Law Firm, said, “Whether there was intent will be the key issue,” and added, “The main issue will be whether there was intentional destruction of evidence for the purpose of destroying evidence and interfering with the investigation.” Seo Jeong-bin, a lawyer at Soul Law Firm, also said, “If the purpose of (deletion) is concealment or reduction, there is a possibility of aggravated punishment.”
 

Reporter Min Soo-jeong (crystal@mt.co.kr)

[View full article]
Police aims to investigate 'suspicion of Coupang data preservation order'... “Intention is the key” (Shortcut)