[Exclusive] "SMEs to Receive Tax Benefits for Security Investments"... National Assembly Proposes Tax Cut Measure [Concealment 10]

Google IT Expert-Turned-Lawmaker Haemin Lee:
"Incentivizing Companies to Invest in Security Is Key to Preventing Hacking"
Reviving the Information Security Investment Tax Credit That Ended Five Years Ago
Expanding Deductions to Cover Security Personnel and Insurance, Not Just Facilities
The United States Also Offers Tax Benefits for Security Investments Up to 1.7 Billion KRW Per Year

▲Haemin Lee, member of the Party for National Innovation, is giving an interview to Asia Economy at the National Assembly Members' Office Building on the 30th of last month. Photo by Hyunmin Kim

A bill that would provide tax benefits to small and medium-sized enterprises (SMEs) investing in cybersecurity is set to be introduced this month. Over the past four months, Asia Economy has investigated the details of hacking incidents and companies that concealed them. The most frequent statement from security experts interviewed was, "It is impossible to completely avoid hacker attacks. The only thing you can do is minimize the damage by preparing in advance." The key to preparation is having security systems such as backup software or firewalls in place. Many SMEs tend to consider hacking as someone else's problem until they fall victim to ransomware. This new legal measure aims to incentivize proactive security investments by these companies.

Haemin Lee, a former Google IT expert and member of the Party for National Innovation who serves on the National Assembly's Science, ICT, Broadcasting, and Communications Committee, told Asia Economy at the National Assembly Members' Office Building on May 30, "I will propose an amendment to the Restriction of Special Taxation Act in June to grant tax benefits to companies that make preemptive investments in security." Lee said, "It is impossible to encourage voluntary investment if we only hold companies accountable after the fact for not being properly prepared when they suffer a hacking incident," and added, "We need to change the system to a carrot approach, where companies benefit financially when they spend on security."

The bill is expected to include provisions similar to the tax credit for information security investment that expired in 2018. The previous law applied to SMEs that newly purchased equipment such as security servers, intrusion detection systems, or backup devices. These companies could directly deduct 3% of their investment amount (4% for listed companies) from their corporate or income tax for the relevant fiscal year.

Lee stated, "We will revive and expand the scope of the tax credit so that more SMEs are encouraged to build security systems." In the past, tax benefits were limited to facility investments, but the proposed amendment will also include tax credits for hiring security personnel, using information security consulting services, and purchasing liability insurance for information security, in addition to equipment. The deduction rate is currently being reviewed in consultation with the National Assembly Secretariat's Legislative Office.

The United States also operates a system in which SMEs receive tax reductions when investing in cybersecurity equipment or software. Companies can expense the full amount spent on security programs up to an annual limit of $1.25 million (approximately 1.7 billion KRW), reducing their taxes for that year.

Editor's NoteIn the real world, when a hostage crisis occurs, someone inevitably reports it?whether the victim does so directly or someone nearby steps in, alerting the police as quickly as possible. However, cyber hostage situations caused by ransomware are quite the opposite. Even after losing all their money and time to hackers, victimized companies are busy hiding the incident as thoroughly as possible. Lee Hyungtaek, head of the Korea Ransomware Incident Response Center, who has dealt with more than 20,000 ransomware attacks over the past ten years, said, "It is extremely rare for companies to report hacking incidents, as SK Telecom did. In fact, nine out of ten companies that suffer damage never inform outsiders," adding, "The structure in which hackers simply take the money and leave is being repeated over and over."