The Major Crimes Investigation Agency has decided not to open an investigation into a hacking attack on a financial institution that police had classified as a major crime and formally referred to the agency. Police concluded the case fell under the agency's jurisdiction after obtaining a legal interpretation from the Financial Services Commission, but the agency declined to take it on, citing the stage of the existing investigation. With the agency also reported to be reluctant to accept some cases being transferred from the Public Prosecution Office, concerns are mounting that inadequate preparation is leaving gaps in the investigation of serious crimes.
The Seoul Regional Major Crimes Investigation Agency said on the 23rd that it had "notified police that it would not open an investigation" into the hacking case. The agency said it took into account that "police began investigating the matter before the agency opened, the investigation has progressed substantially, and international cooperation with relevant overseas agencies is under way."
The National Office of Investigation at the Korean National Police Agency decided on the 20th to refer the hacking case to the agency. Police initially opened the investigation on suspected violations of the Information and Communications Network Act but later added charges under the Electronic Financial Transactions Act, based in part on a legal interpretation from the Financial Services Commission. Investigators determined that the hacked system could qualify as electronic financial infrastructure under that law, placing the case in the category of major crimes that fall to the agency.
Under the current law governing the agency, police must notify it when they identify a major crime. The agency must respond within seven days of receiving written notice on whether it will open an investigation, and police continue the investigation if the agency does not request a transfer.
The agency maintains that it is more efficient for police to continue the case, but legal experts are focusing on the possibility that a lack of capacity to handle a large-scale hacking case played a role. The post of head of the cybercrime investigation division at the Seoul Regional Major Crimes Investigation Agency is currently vacant. Some forensic science equipment needed for digital search and seizure also remains in use by the Public Prosecution Office under a transitional grace period for investigations. Because hacking cases require a high level of expertise to identify suspects and prove charges, shortages of staff and equipment may have weighed on the decision to open an investigation, analysts said.
Friction has also emerged over the transfer of cases from the Public Prosecution Office. Since the 19th, the office has designated about 300 cases that prosecutors had opened as direct investigations for priority transfer and has been sending them in stages to police and the agency. The agency, however, has asked that some of those cases be routed to police instead, prompting tension between the institutions, according to officials.
Legal experts criticize the agency for seeking to cherry-pick cases that can produce quick results while its investigative foundation — staffing, facilities and computer networks — remains incomplete. "The agency has gone so far as to say its offices are too cramped to receive case files," one legal source said. "Some have even asked that we hand over cases where suspects can be detained right away."
With the agency declining to investigate a case police referred as a major crime and also at odds with the Public Prosecution Office over case transfers, concerns are growing about investigative gaps arising from the overhaul of the criminal justice system. Despite the stated aim of improving expertise and efficiency by separating investigation from prosecution, repeated reluctance among investigative bodies to take on cases will inevitably hamper the response to serious crimes, critics said.
A police official with experience in cybercrime investigations said: "This was a cyberterrorism case of national importance, classified as a major crime even after a legal interpretation was obtained, and the agency still declined it simply because police had been investigating it. That shows the agency's passivity." The official added that the decision "appears to reflect an internal mood that it is difficult to take on investigations when the agency is not ready to handle large cases."