As data breach incidents continue to occur across both the public and private sectors—targeting churches, banks, and matchmaking agencies—the issue of the absence of a central coordinating body has resurfaced. Critics point out that differing security response frameworks across government ministries are causing a loss of the golden hour needed to respond to threats.
According to a report submitted last month to the National Assembly Research Service by Lee Hae-won, a professor in the Department of Law at Kangwon National University, domestic AI security responses are fragmented by sector. The public sector is overseen by the National Intelligence Service, general private-sector domains by the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA), and the financial sector by the Financial Services Commission and the Financial Security Institute.
Professor Lee pointed out that in an environment where AI models and infrastructure are converging without clear boundaries, such siloed responses delay information sharing and hinder effective nationwide countermeasures. He noted that because there is no central authority to comprehensively coordinate and execute responses when threats emerge, blind spots arise on the rapidly evolving cyber front.
This runs counter to recent global trends. In the case of the European Union (EU), regulatory authorities and reporting procedures were previously divided across laws such as the General Data Protection Regulation (GDPR) for personal data protection, the Network and Information Security Directive 2 (NIS2) for cybersecurity, and the AI Act. However, the EU is currently advancing a “Digital Omnibus Package” that introduces a single point of contact. It aims to unify regulatory enforcement and incident reporting channels that were previously scattered across multiple ministries and institutional investors, thereby establishing an organic response system at the pan-European level.
The United States has centralized cyber threat responses, which were previously divided among the Federal Bureau of Investigation (FBI), the Ministry of National Defense, and information-related institutional investors, under the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security. In particular, by unifying reporting channels through laws such as the Countering America’s Adversaries Through Cybersecurity Act (CIRCIA) and granting civil litigation immunity for voluntary reporting, the U.S. has enhanced the effectiveness of inter-agency information sharing. Japan, following the recent Toss incident, launched “Project Yata,” a government-wide security package, and swiftly revised its AI basic plan centered on an AI Strategy Headquarters. It is building an active cyber defense system that links the authorities of the police and the Self-Defense Forces, demonstrating agile operation of a control tower at the inter-ministerial level.
Meanwhile, legislation with similar content has already been introduced in South Korea and is under discussion. The “National Cybersecurity Act,” spearheaded by Yoo Yong-won, a member of the People Power Party, last July, centers on establishing a National Cybersecurity Center within the National Intelligence Service to carry out comprehensive and systematic national-level cybersecurity operations and respond efficiently to cyberattacks and threats. It also stipulates the establishment and operation of an information sharing system for the efficient distribution, sharing, and management of information necessary for responding to cyberattacks and threats. The bill is currently pending before the National Assembly’s Committee on Intelligence.
Professor Lee stated, “Responses vary by ministry, and companies feel burdened by excessive punitive sanctions and post-incident penalties when security incidents occur, leading to a vicious cycle where information is concealed and the nation’s overall supply chain security capabilities are weakened.” He added, “We must dismantle inter-ministerial silos and provide legal immunity and incentives so that private enterprises can share vulnerability and threat information with peace of mind.”
in TECH
