2024.07.21. The Fair Economy — Employees of the Incheon International Airport Corporation (IIAC), led by President Lee Hak-jae, were found storing confidential documents and important papers on their personal desks or in unlocked drawers. It was also confirmed that some staff had written down login IDs and passwords for internal systems at the bottom of their computer monitors. Personal access badges, which should be carefully managed to prevent loss or theft, were often left unattended on desks or in drawers.
For an agency responsible for facilities whose occupation, destruction, or functional paralysis would seriously affect national security and people's lives, the security management was lax.
IIAC is a public corporation that operates and manages Incheon International Airport, which is designated as a 'Grade A' security facility by the state.
According to the 'Results of the Inspection on Official Discipline and Duty Performance Ahead of the General Election,' recently released by IIAC's Audit Office, nearly 100 employees were found to have neglected their security management duties.
Under IIAC's 'Security Business Regulations,' confidential documents must be stored in secure containers with locking mechanisms, such as safes or double steel cabinets, pursuant to Article 23, Paragraph 3. The regulations also stipulate that boxes for storing important documents must be locked when employees leave work.
However, these rules were often ignored in the workplace.
For example, IIAC employee A was caught leaving 'confidential documents' in an unlocked personal drawer. B and 82 others were found to have left 'important documents' — including undisclosed internal documents, design drawings, classified management records, documents containing important information, CDs storing contract outputs, work notebooks containing important information, work notebooks containing personal information, and documents prohibited from external disclosure — in unlocked personal drawers or cabinets, or on personal desks.
Six other employees were reprimanded for leaving work PC passwords, internal system IDs/PWs, and other information at the bottom of monitors or on personal desks, or for leaving work-related secure USB drives on personal desks or in personal drawers.
This constitutes a violation of IIAC's 'Information Security Guidelines.' According to Article 71, Paragraph 1, Item 9 of the guidelines, individual and shared system users are prohibited from writing down passwords and storing them elsewhere. Additionally, Appendix 2 of the same guidelines (related to Article 72) stipulates that general-purpose portable storage media must be securely stored in personal drawers, cabinets, etc.
Two employees were also caught leaving their personal access badges in personal drawers or on personal desks.
The Audit Office pointed out, "This violates relevant regulations. There was a risk that important information could be leaked externally due to negligence in managing confidential and important documents and failure to comply with information security guidelines, and there was a risk that restricted-area access badges could be used improperly."
The employees subject to audit criticism offered various excuses, such as "shortcomings occurred during preparation for the management evaluation audit," "there were no important documents in the personal drawer," and "the locking device was broken when the personal cabinet was handed over."
However, the Audit Office emphasized that reports and materials such as 'Proposal Evaluation Results,' 'Facility Improvement Plans,' and 'Major Policy Decisions of the Corporation,' which these employees claimed were not important documents, were indeed important and non-public materials. According to the Audit Office's findings, the audited employees could not accurately distinguish which materials were important and non-public.
The Audit Office notified IIAC's president to impose a 'warning' on Employee A for neglecting the security management of confidential documents, and 'cautions' on 82 related parties including Employee B for neglecting the security management of important documents, six employees for neglecting the management of system user IDs and passwords or portable storage media (USBs), and two employees for neglecting the management of access badges.
It also recommended that measures be taken to enhance employees' security awareness to prevent similar cases in the future, and that necessary actions such as education and publicity be carried out.
0 Comments
No comments yet.