Five employees at the National Security Research Institute, which is responsible for national cybersecurity, were found to have played games during working hours. Some staff logged more than 90 hours in total, but all were confirmed to have received only light disciplinary action.

Documents submitted by the National Security Research Institute, affiliated with the Electronics and Telecommunications Research Institute (ETRI), to Hwang Jung-a (황정아), a lawmaker of the opposition Democratic Party and a member of the National Assembly’s Science, ICT, Broadcasting and Communications Committee, showed that five employees at the institute’s Cybersecurity Training Center repeatedly logged into Battle.net, a StarCraft game server, during working hours from September to December 2024.

They logged into the game server using work PCs while their manager was away on leave or business trips. The Cybersecurity Training Center is in a separate building away from the main institute, and access to game servers was not blocked on the external training line.

The cumulative access time by employee was up to more than 90 hours. One employee logged in for as long as 8 hours 53 minutes in a day, while another logged in for as long as 7 hours 21 minutes. Some employees continued to log in using an internal local network even after the experimental internet line was blocked in December that year.

The incident became known after an employee at the same center reported it through ETRI’s whistleblowing channel. The employees said they logged into the game after agreeing to unwind following a major event. They said they were not actually playing the game for the entire time they were connected to the server.

The institute held a disciplinary committee meeting and issued reprimands to all five employees involved. It judged that a pay cut was needed for the employee with the longest access time, for whom other issues, including improper use of parental leave, were also identified, but lowered the penalty to a reprimand in consideration of the employee’s history of receiving an award from the chairman of the National Science and Technology Research Council (NST). The institute said it deducted personal annual paid leave equivalent to the time spent accessing the game server, and docked pay for employees with insufficient leave.

The institute integrated its external training line into a centrally managed system and implemented measures to monitor usage records and block access to non-work sites such as games. It also conducted security training for all employees and related training at the center twice.

Hwang said repeated access to game servers by employees who should protect national cybersecurity, taking advantage of the absence of their manager, was a serious lapse in discipline. She said lowering the penalty to a reprimand despite judging that a pay cut was needed, on the grounds of a past award, was a slap-on-the-wrist punishment that did not meet public expectations.