South Korean President Lee Jae-myung instructed his cabinet on the 3rd to actively review the creation of a “cybersecurity czar” body to comprehensively coordinate cybersecurity functions. The plan is to unify response systems that are scattered across the public sector, private sector, and finance to counter AI-based attacks at a government-wide level. The move reflects a judgment that the existing siloed approach has hit its limits as a series of hacking incidents at banks and data leaks in the telecommunications, e-commerce, medical, and education sectors have followed one after another.
At the meeting, President Lee said, “Hacking attacks exploiting security vulnerabilities have been occurring in succession at home and abroad,” adding, “We must establish a comprehensive prevention system to confront the cybersecurity crisis, which has expanded to a level that profoundly affects not only people’s daily lives but also the national economy and security.” He then ordered, “Please actively review the creation of a strong and effective ‘cybersecurity czar’ body that can comprehensively coordinate scattered security functions.” By directly using the term “czar”—referring to a leader responsible for comprehensively overseeing and coordinating a specific agenda—he made clear his intent to overhaul the response system.
The problem is that even for the same hacking incident, the reporting and investigation channels differ completely depending on who is affected. If personal credit information is leaked from a financial company, the Financial Services Commission and the Financial Supervisory Service investigate, while the Financial Security Institute handles technical analysis. If personal information leaks from a public institution, the National Intelligence Service conducts a technical investigation and the Personal Information Protection Commission separately examines whether the Personal Information Protection Act was violated. Breach incidents at ordinary companies such as online shopping malls must be reported to the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA). Even for attacks targeting the same vulnerability, the applicable laws and responsible agencies differ.
Indeed, in the recent chain of bank hacks, the financial authorities and the Financial Security Institute led the response. In contrast, in last year’s large-scale data leaks at SK Telecom (017670) and Coupang, and the recent breach at Douzone Bizon (012510), the Ministry of Science and ICT’s public-private joint investigation team analyzed the causes while the Personal Information Protection Commission separately investigated whether personal information was leaked. This is why critics say rapid joint responses are inevitably difficult when multiple institutions are simultaneously affected or an attack spreads across industries.
Affected partyReporting/investigation agencyTechnical supportFinancial companiesFinancial Services Commission, Financial Supervisory ServiceFinancial Security InstitutePublic institutionsNational Intelligence Service (technical investigation), Personal Information Protection Commission (whether law was violated)National Intelligence ServiceOnline shopping malls, ordinary companiesMinistry of Science and ICT, Korea Internet & Security AgencyKISA
Note: Personal information leak cases are subject to a parallel investigation by the Personal Information Protection Commission regardless of the affected party.
Voices in the security industry call for a control tower that can coordinate information sharing and joint responses among agencies while preserving sector-specific expertise. Hwang Seok-jin, a professor at Dongguk University’s Graduate School of International Information Security, said, “When an incident occurs at a financial institution, the financial authorities respond, and KISA and the Personal Information Protection Commission each act as well,” adding, “A control tower is needed to comprehensively coordinate this.” He added, “We should place more weight on prevention than on ex-post sanctions, and evaluate based on how quickly incidents were detected and blocked and how victims were remedied.”
Major countries overseas are already operating response systems that combine government and the private sector. In March last year, Singapore launched “Operation CYBER GUARDIAN,” involving six government agencies including the Cyber Security Agency of Singapore (CSA) and four telecommunications companies. More than 100 security personnel jointly responded for over 11 months to attacks by the hacking group “UNC3886,” blocking intrusion routes without disrupting telecommunications services. The UK is also coordinating government-wide responses to major breaches centered on the National Cyber Security Centre (NCSC). According to the NCSC’s “2026 Annual Report” released that day, it received 1,831 reports related to cyberattacks from September last year to August this year, supported responses to 337 of them, and classified 80 as nationally significant incidents. Through its early warning service, it delivered alerts to 8,500 organizations where signs of suspected system compromise were detected.
However, there is also considerable caution that the creation of a control tower must not lead to a large-scale organizational expansion or uniform tightening of regulations. Kim Byung-hoon, chief technology officer (CTO) of East Security, said, “Rather than creating a large new dedicated organization, it would be efficient to leverage the capabilities of existing specialized agencies such as the National Intelligence Service and KISA, with a small control tower handling policy coordination and rapid decision-making.” Ahn Joon-mo, a professor of public administration at Korea University, emphasized, “I agree with the direction of integrating at the national level, but we must be cautious about applying the same regulatory standards to sectors that require strong security, such as finance, and to other industries,” adding, “Differentiated institutional design is needed to preserve industry-specific characteristics.”
This instruction aligns with calls to shift the response system—currently centered on post-incident cleanup—toward prevention, as AI rapidly expands the speed and scope of attacks. Some in the National Assembly and civic groups argue for creating a dedicated body or a separate supervisory agency, while the security industry largely favors strengthening the execution power of the existing National Security Office and granting it budget and investigative authority. Depending on what form of czar body the government unveils, the incident response procedures and regulatory burden for financial, telecommunications, and platform companies are expected to change.
——————————————————-
Click Here For The Original Source.
