[Reporter’s Notebook] Government Measures That Missed the Mark

"We decided that it would be better to invest after the model was finalized, rather than incur additional costs by investing in the wrong (redundancy) model." (Ministry of the Interior and Safety official)

Ultimately, it was the government's complacent judgment that paralyzed South Korea's IT infrastructure. Six days after the fire at the National Information Resources Service (NIRS), the government has mobilized more than 700 people to restore the system, but the recovery rate remains in the 10 percent range. Even the systems marked as restored come with caveats such as "issuance restricted."

If proper system redundancy had been implemented, the aftermath of the fire would have been different. Disaster Recovery (DR) systems that duplicate cloud and server infrastructure allow uninterrupted service from external centers equipped with "twin functions" in the event of a disaster. This was a lesson learned from the 2022 data center fire that caused the "KakaoTalk outage crisis." After that incident, Kakao completed redundancy for its data centers.

It has been three years since the importance of redundancy was highlighted by the KakaoTalk crisis and the 2023 "government administrative network outage." The government systems failed to heed this lesson. Last year, the government issued a directive prohibiting investment in DR systems for Grade 1 and 2 information systems. The reason was to first find the "optimal model" through research projects and pilot programs before full implementation. As a result, only the "minimum necessary" DR systems exist at the Daejeon and Gwangju NIRS centers.

Another lesson was also missed. Following Kakao, the "Aricell disaster" that occurred last year highlighted the risks of lithium-ion battery fires. These batteries are vulnerable to fires due to thermal runaway, where the internal temperature rises rapidly, and their unique characteristics make firefighting operations difficult. This is why it took more than 20 hours to fully extinguish the fire at the NIRS.

After the Aricell factory fire, the government announced comprehensive measures to prevent battery fires, including those involving lithium. However, the "Fire Safety Priority Management Targets," which require annual fire safety plans and safety inspections, were designated mainly for factories like Aricell. An official from the National Fire Agency explained, "While lithium battery handling and storage facilities were included, NIRS is not among the priority management targets." It was also revealed that the NIRS Daejeon center’s computer room did not undergo a fire safety inspection last year because it was classified as a "security facility."

Since the new administration took office, one repeated phrase in disaster and safety management has been, "Respond to an excessive degree." The NIRS fire clearly exposed the government’s passive response approach that has persisted until now. While the government imposes its guidelines on the private sector, it remains overly cautious in its own actions. In light of the lessons from the NIRS fire, the government must also adopt "excessive" vigilance and establish preventive measures.