South Korea's president orders a review of a government-wide cybersecurity czar

South Korean President Lee Jae Myung has ordered officials to study the creation of a cybersecurity czar agency that would coordinate security work now scattered across the government. The instruction came at a Cabinet meeting in Seoul on Tuesday, days after hackers stole more than $6 billion from Binance and as a run of breaches hit domestic banks, brokerages and exchanges.

Lee told officials to "proactively consider the formation of a cybersecurity czar agency" that can serve as a strong and effective control tower for security management, Yonhap reported. He also called for a government-wide body covering both the public and private sectors, and for a task force that spans the two.

The reasoning he gave was blunt. "The existing security system, which centres on inspections and after-the-fact responses, is showing clear limitations," Lee said, according to The Straits Times. He added that artificial intelligence is making hacking techniques smarter, more sophisticated and more routine, and that the country needs to detect signs of an attack in advance rather than respond after the damage.

The order followed a string of intrusions at home. Yonhap listed recent breaches of customer information at Mirae Asset Global Investments, the crypto exchange Bithumb and Daishin Securities. The Binance theft of Oct. 29, which the FBI has attributed to North Korean hackers, formed part of the backdrop, though Lee did not name North Korea while discussing the attack, The Straits Times noted.

The scale of the government's own exposure is already under review. The National Intelligence Service has begun emergency security inspections covering more than 2,100 central government ministries, local governments and public institutions, Yonhap reported. Korean regulators also held an emergency meeting with domestic exchanges on Monday to review their security measures after the Binance attack, The Korea Herald reported.

Coordination has long been split. Korea already runs a Joint National Cyber Crisis Management Group, established in May 2023 to bring government agencies and private-sector experts into the same response, but responsibility for cybersecurity remains divided among intelligence, military and civilian authorities, according to The Korea Herald. Hwang Seok-jin, a professor of digital forensics and financial crime at Dongguk University, told the outlet that when a financial institution is attacked, financial, cybersecurity and privacy regulators each open investigations under different laws, which leaves companies dealing with overlapping reporting requirements while authorities should be sharing threat intelligence.

The comparison cases the government is measuring itself against already exist abroad. Singapore's Cyber Security Agency can enforce security requirements and compel operators to report certain incidents under its Cybersecurity Act, The Korea Herald reported, and CSA chief Gwenda Fong said the point of such a body is to bring operators and agencies together so they can respond regardless of which sector is hit. Britain's National Cyber Security Centre said Tuesday it had supported responses to 337 cyber incidents over the past year and warned 8,500 organizations of suspected breaches, the outlet reported. In the United States, the Cybersecurity and Infrastructure Security Agency works with civilian infrastructure operators alongside separate intelligence and military authorities.

Not everyone thinks a single coordinator is the answer. A cybersecurity industry official who previously worked at a South Korean agency told The Korea Herald that forcing military, government and civilian cybersecurity under one massive control tower risks becoming another layer of bureaucracy. The same official proposed a dedicated agency for civilian critical infrastructure, covering telecommunications, finance and manufacturing, with its own legal authority and staff. Earlier breaches point at the same gap: Korea has suffered major intrusions at SK Telecom and Coupang since last year, followed by a wave of attacks on banks and other financial institutions since late September, the outlet reported.

Lee has not said whether the proposed coordinator would sit inside the existing government structure or require a separate agency, The Korea Herald reported. He separately ordered officials to fix cybersecurity shortcomings at major state institutions and key infrastructure in information communications, energy and finance, Yonhap reported.