Assemblyman Jo Incheol Proposes Bill Mandating Log Record Retention

Immediate Preservation of Critical Logs in the Event of a Security Breach
Strengthening Systems for Root Cause Analysis and Accountability

Jo Incheol

As a series of large-scale hacking and personal data breach incidents have occurred recently, legislation is being pursued to strengthen the log record management system, which serves as a key basis for identifying the causes of incidents and preventing the spread of damage in the event of a security breach. The aim is to address, at the institutional level, the problem of delays in investigations and accountability due to the lack of crucial evidence after incidents.

Jo Incheol, a member of the Democratic Party of Korea (representing Gwangju Seo-gu Gap), announced that he has sponsored an amendment to the “Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.” The bill strengthens the obligation of information and communications service providers to preserve log records and requires relevant servers to be immediately preserved as evidence when a breach occurs.

Recently in Korea, a series of hacking and personal data leak incidents involving major telecommunications companies as well as companies closely tied to daily life, such as Coupang and Lotte Card, have heightened public anxiety. In particular, investigations into major breaches, including at KT, have revealed structural limitations in identifying hacking routes, the scope of damage, and responsibility when critical materials such as log records are not sufficiently secured.

While current law prescribes safeguards to ensure the security of information and communications networks, concerns have been raised that there are not enough explicit and specific standards regarding the preservation of log records, which is essential for identifying the causes of breaches and preventing the spread of damage.

As a result, there have been cases where critical logs are not retained or analysis is delayed after an incident, leading to criticism that both corporate responsibility and public trust in government investigations are undermined.

This amendment focuses on institutionalizing the log record management system, which is a core infrastructure for responding to cyber breaches, in order to address these issues.

The main provisions include: ▲ Setting mandatory log retention periods for information and communications service providers meeting a certain threshold; ▲ Immediate preservation of servers as evidence when a breach such as hacking is confirmed; ▲ Imposing fines for failure to retain log records.

In addition, when a joint public-private investigation team investigates the cause of a breach, the bill requires at least one interim report to be submitted to the relevant National Assembly standing committee during the investigation process, as well as a final report on the investigation results, to enhance transparency.

Assemblyman Jo stated, “Even as large-scale hacking incidents are repeated, if logs are not retained or evidence is not preserved in a timely manner after an incident, it becomes difficult to properly determine both the cause and responsibility.” He emphasized, “In responding to cyber breaches, preserving log records is not merely an ancillary procedure in post-incident investigations; it is a prerequisite for identifying causes and determining accountability.”

He added, “By clarifying the obligation to preserve log records and enhancing transparency in the investigative process, we can create a digital environment where the public can feel secure. I hope that this amendment will serve as an opportunity to take our cybersecurity response system to the next level.”

This content was produced with the assistance of AI translation services.