The Major Crimes Investigation Agency has decided not to open an investigation into a hacking attack on a financial institution, a case police had classified and reported to the agency as a serious crime. Police concluded the case fell under the agency's jurisdiction, based in part on a legal interpretation from the Financial Services Commission, but the agency declined to take it on, citing how far the existing investigation had already progressed. Critics say concerns about agencies passing cases back and forth are now materializing. The agency is also said to be reluctant to accept some of the cases being handed over by the Public Prosecution Service, which had been investigating them directly, deepening worries that a lack of preparation will leave serious crimes without proper investigation.
The Seoul Metropolitan Major Crimes Investigation Agency said on the 23rd that it had "notified police of its decision not to open an investigation" into the hacking case. The agency said it had taken into account that "police began investigating the matter before the agency opened, that the investigation has progressed substantially, and that international cooperation with relevant overseas agencies is under way."
The National Office of Investigation at the Korean National Police Agency had reported the case to the agency on the 20th, judging that the alleged offenses amounted to a "serious cybercrime" under the law governing the new agency. Police determined it was a violation of the Electronic Financial Transactions Act, which falls under the reporting requirement, citing the Financial Services Commission's interpretation that the hacked financial institution's system could qualify as "electronic financial infrastructure."
Under the current law, police must notify the agency when they detect a serious crime. The agency must respond within seven days of receiving written notice on whether it will open an investigation, and if it does not request a transfer, police continue the case.
The agency maintains it is more efficient for police to keep the case, but legal experts are focusing on the possibility that insufficient capacity to handle a large-scale hacking case played a role. The post of head of the cybercrime investigation division at the Seoul agency is currently vacant. Forensic equipment needed for digital searches and seizures is still being used by the Public Prosecution Service, which must wrap up investigations during a grace period that runs through the end of December, so the handover is incomplete. Because hacking cases require a high level of expertise to identify suspects and prove allegations, analysts say shortages of staff and equipment may have weighed on the decision to take up the investigation. The Korea Information System of Criminal Justice Services, known as KICS, is only partially operational, leaving investigators to handle most tasks by hand, including writing case records and entering ledger data.
Friction has also emerged in the transfer of cases from the Public Prosecution Service. Since the 19th, the service has designated about 300 of the cases that prosecutors had opened on their own initiative as the first batch to be handed over, transferring them in stages to police and the new agency. But the agency has asked that some of them be sent to police instead, prompting a standoff between the institutions, according to sources.
Legal experts say the agency, lacking staff, facilities and IT systems, is trying to cherry-pick cases that can produce results quickly. One person in legal circles said the agency "is reluctant to take transfers, even citing a lack of office space to store case files," adding that "some have gone so far as to say they would like to receive cases where suspects can be detained right away."
With the agency declining to investigate a case police flagged as a serious crime and at odds with the Public Prosecution Service over transfers, concerns are mounting that the overhaul of the criminal justice system will leave an investigative gap. Critics say that if investigative bodies repeatedly balk at taking on cases, the response to serious crime will inevitably suffer, contrary to the stated aim of improving expertise and efficiency by separating investigation from prosecution.
A police official with experience in cybercrime investigations said the decision "shows how passive the agency is — a cyberterrorism case of national importance was classified as a serious crime, even after a legal interpretation was obtained, and the agency still refused it simply because police had been handling it." The official added, "It appears to reflect an internal view that the agency cannot take on a major investigation when it is not ready to handle large cases."
Kim Ji-yong, commissioner of the Major Crimes Investigation Agency, addressed such concerns at a brief press encounter on the 19th, saying, "We can carry out investigations well enough with the staff we have now," while adding, "But many cases will be coming in, and for that we need to settle in quickly."