"Computer Network Down, Network Equipment Issue... No Signs of Hacking"

'Router Port' Physical Damage
Comprehensive Inspection of Aging Equipment Underway

On the 17th, it was finally concluded that the cause of the government administrative network outage was a port malfunction in the network device router (a device that connects different networks). However, no signs of hacking were found.

Deputy Minister of the Ministry of the Interior and Safety, Go Gidong, is giving a presentation at the briefing on the causes of the local administrative computer service failure and future measures held at the Government Seoul Office Building on the 25th. Photo by Yonhap News

Ko Gidong, Vice Minister of the Ministry of the Interior and Safety, and Professor Song Sanghyo of Soongsil University, co-team leaders of the 'Local Administrative Computer Service Reform Task Force (TF),' announced this at the 'Briefing on the Cause of the Local Administrative Computer Service Failure and Future Measures' held at the Government Seoul Office on the 25th.

The TF analyzed that the cause of this failure was highly likely to have occurred in the network area. However, it was confirmed that the issue was with the router, not the previously suspected L4 (a type of network device) switch.

After the failure, the Ministry of the Interior and Safety conducted performance inspections on network equipment by dividing the sections and performing repeated load tests. As a result, it was observed that large packets (units of data transmission) were lost when transmitted through the router, a network device. Professor Song explained, "Due to packet loss, the integrated verification server could not properly receive the packets necessary for service provision from the router," adding, "The delay accumulated, leading to a situation where tasks could not be performed normally."

Lee Jaeyong, Director of the National Information Resources Service, said, "Physical damage to equipment like this is difficult to identify the cause of, but the equipment was introduced in 2016 and is not outdated," adding, "Although the system is checked daily, predicting equipment failure before it occurs is difficult."

According to the TF, after the first failure on the 17th, the malfunctioning L4 switch was replaced with high-performance equipment. Even after replacement, some delay was detected in certain functions, so the router connecting the Gwangju Center and Daejeon Center was analyzed in detail. As a result, a port malfunction was found, and when connected to a different port, the delay issue was resolved. However, since there was a possibility of other errors besides the malfunction, logs (files recording activities occurring in computer systems) generated by the server were analyzed, and equipment abnormalities were verified and tested across various network sections, but no other problems were found.

The TF also kept all possibilities open regarding hacking and conducted checks, but so far, no signs of hacking have been observed.

Vice Minister Ko stated that to prevent recurrence of this incident, they will carefully examine each problem and prepare fundamental and effective supplementary measures. The Ministry of the Interior and Safety plans to conduct a full inspection of old equipment that may have similar port malfunctions. Additionally, they will supplement the manual for handling failures to promptly inform the public and establish a system capable of rapid recovery measures.

Vice Minister Ko said, "We will create a stable digital government without interruption under any circumstances so that the public will never suffer inconvenience from similar problems again," adding, "We will do our best to provide convenient and more stable services worthy of the global reputation of a world-class digital government."