Employees of the National Security Technology Research Institute (NSTRI), which is responsible for national cyber security, were caught accessing the "StarCraft" game server during working hours. Although some employees accumulated more than 90 hours of connection time, all five involved staff members received only a light disciplinary sanction in the form of a reprimand.
According to documents submitted by NSTRI, an affiliate of the Electronics and Telecommunications Research Institute (ETRI), to Democratic Party of Korea lawmaker Hwang Jung-a, who serves on the National Assembly's Science, ICT and Communications Committee, five employees at NSTRI's Cyber Security Training Center repeatedly accessed Battle.net, a StarCraft game server, during working hours from September to December 2024.
Investigations revealed that they used work PCs and other equipment to access the game server while administrators were away on vacation or business trips. They exploited the fact that the Cyber Security Training Center is located in a separate building distant from the main campus, and that external educational lines did not block access to game servers.
The cumulative connection time per employee reached up to more than 90 hours. One employee accessed the game server for a maximum of 8 hours and 53 minutes in a single day, while another left records showing a maximum daily connection time of 7 hours and 21 minutes. These durations corresponded to the majority of normal working hours. Traces indicated that some employees continued to access the server via the internal local network even after the experimental internet line was blocked in December of the same year.
Their actions came to light after a colleague at the same center reported them through ETRI's "Sinpungo" (whistleblowing system). The identified employees testified that they accessed the game following a suggestion to unwind after a major event concluded. However, they explained that they did not actually play games for the entire duration of their server connections.
Controversy also arose over the severity of the disciplinary action. NSTRI held a disciplinary committee meeting and issued reprimands to all five employees. In particular, while the committee determined that a pay cut was necessary for an employee who had the longest game server connection time and was also found to have improperly used parental leave among other issues, the sanction was reduced to a reprimand in consideration of the employee's history of receiving commendations from the National Research Foundation (NRF) Lee (President). NSTRI explained that it deducted personal annual paid leave equivalent to the game server connection time, and for employees with insufficient annual leave, it deducted the amount from their salaries.
Issues regarding the protection of internal whistleblowers also surfaced. It is known that the whistleblower filed a complaint alleging workplace harassment, stating that after the incident, the manager of the employees who participated in the game raised their voice at them and engaged in other such behavior. However, NSTRI ultimately determined that the conduct did not constitute workplace harassment following deliberations by its grievance handling committee.
NSTRI acknowledged management shortcomings and stated that it has integrated external educational lines under a centralized management system to block access to non-work sites such as games. The institute also established systems for monitoring usage records and conducting regular inspections and reporting, and explained that it implemented security training for all employees and conducted two related training sessions within the center.
Hwang (Rep.) pointed out, "It is a serious lapse in discipline for employees who are supposed to guard national cyber security to repeatedly access game servers taking advantage of the absence of administrators." They added, "Reducing the sanction to a reprimand on the grounds of past commendations, despite determining that a pay cut was necessary, is a lenient punishment that does not meet public standards." Furthermore, they emphasized, "In addition to thorough duty management and strict pursuit of responsibility, the protection system must be reviewed to ensure that internal whistleblowers do not suffer disadvantages."
in TECH
