At a comprehensive parliamentary audit by the National Assembly’s Science, ICT, Broadcasting and Communications Committee, ruling and opposition lawmakers pressed officials on responses to PHP security vulnerabilities, the process behind the Frontier AI project, and allegations of a hacking cover-up by LG Uplus.

The Ministry of Science and ICT said it would prepare security measures across ministries and push regulatory improvements to foster the AI industry. LG Uplus said it would take appropriate responsibility if the hacking cover-up allegations are confirmed as fact.

PHP vulnerability prompts cyber alert upgrade to 'caution'; smart glasses spying also an issue

The audit also scrutinised the government’s response to security vulnerabilities in PHP, a programming language widely used by websites worldwide. After two serious vulnerabilities were found in PHP, the government raised the civilian-sector cyber crisis alert to 'caution' from 'attention' on Oct. 22.

Concerns were raised that the vulnerabilities were highly risky because hackers could execute malicious commands on servers without a separate login. PHP, used by many websites, could become a channel for personal data leaks or website tampering and outages.

People Power Party lawmaker Seo Cheon-ho (서천호) questioned when the government became aware of the vulnerabilities and how it responded. Choi Woo-hyuk (최우혁), head of the information protection and network policy office at the science ministry, said the ministry confirmed the vulnerabilities at 11 p.m. on Oct. 21 and posted a security advisory 20 minutes later.

Democratic Party lawmaker Han Jun-ho (한준호) asked whether the Korea Internet & Security Agency, or KISA, was tracking the status of security patches related to PHP. KISA President Lee Sang-joong (이상중) said it has not yet identified the actual patch status at domestic companies and institutions, and there are limits to directly checking individual systems.

Bae said there is a need to establish broader measures beyond PHP and that the government would prepare a cross-ministry response plan.

Concerns were also raised about illegal filming using AI smart glasses. Democratic Party lawmaker Lee Jeong-heon (이정헌) displayed live footage filmed with smart glasses at the audit and said stickers were even being sold to cover the recording indicator light. Bae said he would work with related agencies, including the Personal Information Protection Commission and the police, to prepare countermeasures.

Dispute over Frontier AI decision-making process; AIDC regulatory changes also discussed

In the AI sector, key issues included the rollout of the 4.7 trillion won Frontier AI project and measures to promote data centre investment.

People Power Party lawmaker Park Jeong-ha (박정하) repeatedly demanded submission of official documents that could confirm the Frontier AI project’s decision-making process. He said it was difficult to verify the process based only on the expert discussion results and explanatory materials for fiscal authorities that the government submitted.

Park said funds must be executed transparently, soundly and appropriately even if it is not 5 trillion won but 50 trillion won. He said the issue was not the need for the project but the transparency of the budget allocation and policy decision process.

Bae responded in a somewhat heated tone. He raised his voice, saying he had provided answers multiple times but Park kept talking about something else. Bae said it began in April because of 'Claude Mythos' and that detailed materials on the process were submitted as discussions with fiscal authorities began in May. He said he would visit in person next week to explain again.

Bae said in particular that the Frontier AI project was not a directive from the president. He said the government initially considered having a company selected for an independent AI foundation model project develop it, but changed it from a grant-funded project to an equity investment project over concerns about concentrating support on a specific company.

Regulatory changes to promote investment in AI data centres were also discussed. Democratic Party lawmaker Kim Nam-kuk (김남국) pointed out that leased AIDC facilities are excluded from tax credits and urged improvements to the system.

Bae said AIDC is designated as a national strategic technology project and receives tax benefits, but leased AIDC does not. He said he would consult fiscal authorities on whether to extend tax benefits.

He said the climate, energy and environment ministry was reviewing a 50 megawatt threshold for exempting non-capital-region AIDC facilities from power grid impact assessments, while the science ministry was reviewing 100 megawatts. Bae also agreed on the need to introduce a 'one-stop fast track' to simplify permitting procedures.

The burden of communications costs tied to rising subscriptions for AI and online video services also emerged as an issue. Democratic Party lawmaker Lee Hoon-ki (이훈기) said the real effect of reducing communications costs was limited as telecom companies expanded products bundling AI and OTT subscription services.

Bae said the government would ease the subscription burden through 'AI for All', which everyone will be able to use for free in December.

Lee Jeong-heon proposed changing the communications fee discount system for vulnerable groups into a 'digital voucher' approach that supports AI and content use and device purchases. He said not only telecom companies but also platform and content businesses should share the funding burden.

Lee Jeong-heon also pointed to high subscription fees for short-form dramas and demanded measures by the science ministry. Second Vice Minister Ryu Je-myeong (류제명) said the ministry would look for improvement measures in various ways, taking into account the situation where digital consumption is becoming burdensome.

The audit also addressed how to promote technology start-ups at government-funded research institutes. Democratic Party lawmaker Hwang Jeong-a (황정아) said the number of start-ups at such institutes in the first half of this year rose to 11, up 120 percent from a year earlier, and urged follow-up rules for relevant laws. Bae said he would personally take care of follow-up steps such as refining regulations.

LG Uplus hacking cover-up allegations intensify; caution urged on contract penalty waivers

In the telecom sector, disputes continued over allegations that LG Uplus covered up a hacking incident and obstructed investigations. LG Uplus is under police investigation over allegations it concealed evidence of the hacking incident last year by scrapping servers and reinstalling operating systems. Both ruling and opposition lawmakers asked LG Uplus CEO Hong Beom-sik (홍범식) whether the company would waive contract penalties for number portability if an intentional cover-up is confirmed.

Hong said he was deeply sorry for causing inconvenience. He said if there is a judgment by judicial authorities and government guidelines, the company will take appropriate responsibility accordingly.

Bae said the government would take measures depending on the extent of the investigation and the degree of responsibility. He also said that if intentional obstruction of investigations is confirmed, the company would be at fault.

Han Jun-ho pressed LG Uplus Chief Information Security Officer Hong Gwan-hee (홍관희) about preserving hacking-related evidence. Hong said he was sorry in response to criticism that evidence preservation measures were insufficient.

Seo Cheon-ho also took issue with LG Uplus promoting its 'very excellent' grade received in a user protection performance evaluation. The evaluation covered 2024 performance, so allegations related to the 2025 breach incident were not reflected. Hong said the company did not look into it closely and that it would improve.

Separately, the audit also raised controversy over political neutrality involving a Nuclear Safety and Security Commission member. Hwang Jeong-a said Park Jong-woon (박종운), a non-standing member of the commission, posted on social media content insulting or mocking politicians, and argued it should be examined whether he violated his duty of political neutrality.

The committee, after a ruling-opposition agreement, added Park as a witness for the audit. Park, who arrived at the National Assembly at about 5:40 p.m., took the witness stand and apologised, saying it was inappropriate behaviour.