GNP secretary arrested on charges of Election Day DDoS attack

Posted on : 2011-12-03 10:06 KST Modified on : 2019-10-19 20:29 KST
The incident comes as the GNP attempts to repair its image after the controversial KORUS FTA railroad
 Dec. 2.
(Photo by Lee Jung-woo)
Dec. 2. (Photo by Lee Jung-woo)

By Yu Sun-hui

A secretary of ruling Grand National Party Lawmaker Choi Gu-sik was arrested by police on charges of organizing a distributed denial of service (DDoS) attack that shut down the National Election Commission web page on the day of the Oct. 26 by-elections.

Police also suspect the secretary of involvement in an attack the same day on the web site of then Seoul mayoral candidate Park Won-soon, and are currently expanding the investigation.

The Korean National Police Agency’s (KNPA) Cyber Terror Response Center announced Friday that it had apprehended and requested detention warrants for four individuals on charges of ordering the DDoS attack on the NEC web site. The individuals apprehended included a 27-year-old Level 9 personal assistant, identified by the surname Gong, who is currently working in the office of a GNP lawmaker, as well as the 25-year-old president of an IT company, identified by the surname Gang, who is believed to have carried out the actual attack.

Police did not reveal the name of the lawmaker in question, but sources reported that it was Choi Gu-sik of the GNP. During the by-elections, Choi served as head of publicity and planning for GNP mayoral candidate Na Kyung-won.

Based on the police investigation to date, Gong is believed to have carried out an attack causing 263 megabytes per second of traffic to the web page using around 200 zombie PCs on Oct. 26, the day of the mayoral by-election. The NEC web site was paralyzed for around two hours starting at 6 a.m. on Election Day, causing a major inconvenience to citizens attempts to check voting sites and rates.

Police said Gong telephoned web site development company president Gang on the evening before the election to arrange the attack on the NEC web site. Gang, who was in the Philippines on business at the time, allegedly gave orders for the attack to two employees who were then in Korea, a 27-year-old identified as Kim and a 25-year-old identified as Hwang.

All four suspects are from Jinju, South Gyeongsang, and are reportedly close. Police arrested accomplices Gang, Kim, and Hwang on Wednesday and carried out an emergency apprehension of Gong at home on Thursday.

An official with the Cyber Terror Response Center said Gong was a Level 9 personal assistant in a National Assembly lawmaker’s office, with duties including driving, assistance duties, and data collection.

“Gong is currently denying all charges, but the other three accomplices who carried out the attack have confessed,” the official added.

The official added that a thorough investigation was conducted, including bank account tracking, to determine whether Gong committed the crime for political purposes or there was order from higher-up, such as from the lawmaker.

Police are also currently investigating whether Gong and the other suspects were responsible for another attack on Park Won-soon’s web site on the day of the election.

An official with the police said Park office had not requested an investigation, but added, “We are currently investigating because of the very strong possibility [the attack] was carried out by Gong and the others, given similarities in the method of attack and timing.”

Choi Gu-sik said he would resign his National Assembly immediately if found to be implicated.

“I intend to cooperate actively with the investigation so that police can get to the bottom of this,” Choi said.

The GNP expressed dismay about the crisis, regardless of the question of Choi’s involvement.

A major party official said, “This is a huge blow. We will not be able to regain the voters in their 20s to 40s.”

“Even if Lawmaker Choi did not give the order, he bears responsibility for management,” the official added. “He should step down as a lawmaker.”

A first-term Seoul-area lawmaker said, “This has a huge impact on the party’s image.”

“We might as well not even bother with Seoul in the general election,” the lawmaker added.

The GNP has recently been focusing on reforms after losing reliable voters in their twenties to forties in the Oct. 26 by-election. But it has faced setbacks owing to the party’s railroad of the South Korea-U.S. Free Trade Agreement (KORUS FTA) and the lawsuit by independent Lawmaker Kang Yong-seok, who was expelled from the GNP, against a popular comedian.

The NEC issued a press release Friday saying, “The DDoS attack on the NEC home page was a major challenge to the basic democratic order of the Republic of Korea and should be sternly punished.”

“A thorough investigation needs to be conducted not only for the parties involved in the crimes but also the purposes and parties behind the act,” the press release said.

Please direct questions or comments to [englishhani@hani.co.kr]