Although personal information submitted by victims to Google for the removal of illegal filming content was exposed on external sites, it has emerged that the government failed to properly grasp even the overall scale of damage. It took eight days from when the government requested action from Google until actual deletion negotiations began between Google and external sites.
According to data submitted by Lee Hun-ki, a lawmaker from the Democratic Party of Korea under the National Assembly’s Science, Technology, and Information Committee, on the 20th to the Broadcasting Media and Communications Committee (BMC), the Broadcasting Media and Communications Review Committee (BMRC), the Ministry of Gender Equality and Family, and Google, the damage scale identified by each institutional investor varied significantly.
Google reported that it had identified 37 cases of leakage on its own. The BMRC took action against 22 posts containing information that could identify victims, confirming 13 unique victims after excluding duplicates. The Ministry of Gender Equality and Family handled approximately 10 cases where victims could be identified and deletion measures were taken.
The BMC explained that it did not directly receive from Google at the time data on the number of victims, exposed information items, or secondary damage status such as viewing, downloading, or re-distribution. However, it stated, “In the early stages of the incident, we received information from the Ministry of Gender Equality and Family regarding the situation and the number of deletion requests,” and added, “On the 11th, we received from Google details on the number of data leaks and the progress of its own measures.”
Concerns were also raised about the speed of response. The Ministry of Gender Equality and Family confirmed the issue on August 12, temporarily halted deletion requests through Google, and informed the BMC on the 19th. On the same day, the BMC requested that Google verify the facts and take action, but Google did not begin direct deletion negotiations with external sites where information was exposed until the 27th—eight days later. The BMRC also launched an emergency review of 18 related URLs on the 26th.
Additional cases emerged during post-incident verification. Google informed the BMC on September 4 that it had deleted all problematic posts, but two days later received and deleted three additional reports. Google explained that during a system transition, manual classification errors by reviewers led to some report information being incorrectly transmitted to external sites. Subsequently, starting from September 7, Google completely halted the procedure of sharing deletion request information received in Korea with external sites and modified its system so that a fixed notice is automatically applied to Non-Consensual Intimate Imagery (NCII) reports.
Lee Hun-ki stated, “The fact that personal information and damage details submitted by victims suffering from illegal filming with desperate hearts were once again exposed constitutes a serious situation where the victim relief process has been turned into a channel for secondary harm,” and added, “We must thoroughly investigate whether there were any illegal acts in Google’s personal data protection measures and response process.”
in TECH
