South Korea's National Intelligence Service (NIS) has directly refuted the "Coupang report" issued by the U.S. House Judiciary Committee, stating that it "never issued any instruction or order to Coupang during the incident investigation." The agency reiterated its existing position that Coupang's allegation of an "NIS-directed incident investigation" is a false claim.
In a statement released Tuesday, the NIS said the report "mentions content related to the NIS in a way that differs from the facts," adding that "the NIS never issued any instruction, order, or coercion to Coupang regarding the incident investigation."
The NIS stressed that it has continuously rebutted Coupang's claims concerning the massive Coupang personal data breach. On Dec. 26 last year, it issued a statement saying, "The NIS is not in a position to issue any instructions to Coupang and has never issued any instructions." On the 30th of the same month, it asked the National Assembly to file a complaint accusing the Coupang chief executive, who claimed there had been an "NIS investigation order," of perjury. Police subsequently received the National Assembly's complaint and are currently conducting an investigation into the matter.
The NIS explained that its contact with Coupang took place at the level of consultation to share information related to the massive personal data breach. "Based on Article 4 of the NIS Act, we recognized the massive data breach caused by a foreigner as a national security threat and conducted work consultations with Coupang to collect related information and prevent the spread of damage," the NIS said. "We received some of the materials that Coupang had already submitted to the police."
The NIS also rebutted Coupang's claim that "the NIS proposed hiring a specific Korean cybersecurity firm for 'data analysis.'" The NIS said, "Coupang first requested an introduction to a domestic firm, saying that 'the response from the U.S. firm's analysis was slow,' and we merely shared general-level information."
Regarding Coupang's claim that "the NIS led the recovery of IT equipment stored by the leaker who had fled to China," the agency drew a clear line, saying that "until we received a request from Coupang, delivered through another government agency, for support in transporting the equipment into the country, neither the working-level staff nor anyone else was aware of the existence of the equipment or the fact that it had been secured." It added, "Under these circumstances, Coupang first requested the transport of the equipment into the country through another government agency, and the NIS, judging that the personal information of some 33 million of our citizens might be stored on the laptop and other devices that the leaker had discarded in a river, merely supported the safe transport into the country so that the equipment would not be lost or seized."
The NIS said, "Coupang's claim that the series of processes, including securing the IT equipment from the leaker, was carried out by the instructions or orders of the NIS is a clear falsehood." It added, "We express regret over Coupang's one-sided false claims and will continue to actively cooperate in all activities to establish the truth."
