At a joint hearing hosted by six standing committees on the National Assembly’s Science, ICT, Broadcasting and Communications Committee on Tuesday over Coupang’s personal data leak case, lawmakers kept up their attack on the company’s self-investigation results announced on Dec. 25. Lawmakers criticised Coupang’s key evidence as having many technical flaws. The government also called it “malicious” for Coupang to stake out a conclusion before investigative and inspection results were released, and signalled a tough response.

◆“A laptop fished out of a river is all-powerful?” Technical questions pile up over key evidence

Lee Jun-seok, a lawmaker from the Reform Party on the National Assembly’s Science, ICT, Broadcasting and Communications Committee, questioned the technical credibility of Coupang’s self-investigation. He asked whether it is possible to pin down the scope of a leak in a case premised on large-scale access to personal information based only on forensics from a single laptop.

Lee said that assuming circumstances in which structured data amounting to tens of millions to hundreds of millions of records were exchanged, the explanation that such data were directly crawled and stored on a personal device such as a MacBook Air is technically unconvincing. He said the actual data were on an online server and the laptop was likely no more than a terminal for access.

He also said that an announcement limiting the leak to “thousands of cases” based solely on laptop forensics could be seen as a narrative that downplays the substance of the incident. He said key issues such as the access range, the storage range and the possibility of external transmission were not sufficiently verified.

In response, Brad Mathis, Coupang’s chief information security officer, said, “We cannot deny any possibility.” He effectively acknowledged that external server transmission right after crawling or other storage paths cannot be ruled out.

A similar concern was raised by the government side. Deputy Prime Minister Bae Kyung-hoon said there was no way information on the laptop could be properly analysed, and mentioned the possibility of storage and leakage through other routes such as a separate computer or a cloud server. He added that results should be announced after completing all such analysis, and criticised Coupang for getting ahead of the conclusion with its announcement.

◆“Thrown away in a bag with the Coupang logo” ... allegations of a staged act

Lee Hae-min, a lawmaker from the Rebuilding Korea Party, took issue with Coupang repeatedly emphasising the “government” in its statement. Lee said the word “government” appears 42 times in Coupang’s announcement, and raised concerns that it was putting government cooperation front and centre to blur the focus of responsibility.

Lee also mentioned the possibility that Coupang could have destroyed evidence. He asked, “They say they put the laptop in an eco-bag with the Coupang logo and soaked it in water. How many people would accept this as fact rather than a staged act?” He added that it had become a laughingstock on Reddit, citing reactions from overseas online communities.

He also mentioned the need for cooperation with the U.S. Internal Revenue Service to raise pressure on executives including Bom Kim, chairman of Coupang Inc’s board. Lee urged the National Tax Service to cooperate with the IRS based on the South Korea-U.S. tax treaty and other grounds, saying action must start with the IRS for Coupang’s management to move. National Tax Service Commissioner Lim Kwang-hyun replied, “We will do as much as possible on the parts where we can cooperate with the U.S. IRS.”

◆Coupang says it followed instructions from government bodies; Bae says NIS only helped move overseas data to South Korea

A dispute continued over the truth of government ministries and agencies that Coupang says cooperated.

Lee said, “Isn’t the National Intelligence Service involved in Coupang’s self-investigation?” He pressed Coupang over what he suggested was an attempt to turn it into a fight over truth among agencies framed around NIS instructions and intervention.

Bae said the Ministry of Science and ICT is the lead ministry with jurisdiction over platform companies, and said the ministry had never issued any instruction. He showed displeasure. On the suspicion of NIS cooperation, he said it was not involved in the self-investigation or drawing conclusions, and explained that it only provided cooperation on security and procedural aspects in the process of moving related materials that were overseas into South Korea.

In addition to Lee, Democratic Party lawmakers Hwang Jung-a and Kim Young-bae and others questioned Coupang about government cooperation. Coupang interim chief executive Harold Rogers said, “Government bodies instructed us and we followed,” adding, “Why don’t they tell the Korean people this fact?” as he appealed that the company was being treated unfairly.