Establishing a High-Tech Cyber Crime Response System

Korea possesses all of the necessary high-tech techniques and programs
for cyber crime investigation. First of all, the techniques and programs the
Korean cyber crime investigators possess are by far superior to those of other
countries. As previously mentioned, investigation staff and IT technicians are
organized in a well-balanced ratio in the law enforcement office, and each
team gains a synergy effect through special supplemental education and
interactive exchanges with specialists in other fields. Moreover, the specially
employed technical experts from the private sector have thorough knowledge
of not only the windows series, but also other operating systems such as
Linux or Unix and programming languages such as C++, Java, SQL, and they
possess unrivaled abilities to independently develop and operate various
programs that can ferret out cyber criminals. They are also well-acquainted
with databases, network security, not to mention the concept, definition,
layout, and establishment of networks, and are computer whizzes possessing
computer techniques to track and apprehend hackers.
An elaborate description of the recently developed program cannot be
provided for security reasons, but it is known to be a technique of the highest
quality. However, such investigative know-how is not possible by just
possessing advanced IT technology. If not for the cooperation and assistance
of the investigation veterans, who are equipped with many years of practical
experience, the KNPA’s cyber crime investigations would not be as effective.
In addition, the KNPA founded the Digital Evidence Analysis Center in
November 2004, and is developing and complementing the high-tech cyber
crime investigation techniques through scientific equipment. 10) The Digital
Evidence Analysis System is a technology and a procedure that secures
10) Other than the police, the Supreme Prosecutor's Office and the National Intelligence Service are also interested in
the Digital Evidence Analysis Center and have tried to introduce it, but the police established and operated theirs
first, serving as an opportunity to greatly improve the KNPA’s cyber-crime investigation ability.
various evidence to prove the facts constituting an offense when a crime
occurs by searching the HDD of a computer or analyzing internet logs. In other
words, it designates all technologies and procedures that collect, extract, and
reserve all evidence in a crime using a digital medium such as a computer. The
KNPA has invested a budget of 1.8 billion won for the Digital Evidence
Analysis System, and has secured cutting-edge equipment such as an
evidence collecting and analyzing server, HDD replication and initialization
equipment, and mobilized forensic equipment. The Digital Evidence Analysis
System is used inter alia to analyze digital evidence through the system
forensics program and log analysis program.
Fifteen notable experts, all post-doctoral specialists and veteran cyber
investigators who are well-acquainted with IT and investigation technique, are
set up at the Digital Evidence Analysis Center to support high-tech scientific
investigation by restoring/searching, analyzing/breaking ciphers on the digital
evidence procured during the process of crime investigation. Also, to prepare
for modern crime, the center studies each field’s technique for analyzing
evidence such as system evidence analysis and network evidence analysis. It
also carries out activities to standardize and propagate the evidence analysis
procedure, aiming for a multi-factor development goal, in order to engage in
practical investigations and academic research at the same time. Just as the
National Institute of Scientific Investigation has played a central role in offline
crime investigation, the Digital Evidence Analysis Center will lead scientific
investigations in the future cyber age.
The KNPA will expand the Center for Digital Evidence Analysis to the front
lines. To that end, the KNPA is working hard to dispatch personnel and
vehicles to local agencies to gather information used in the analysis, and to
provide facilities for better mobilization to police stations so that they can
swiftly carry out the time-sensitive task of securing evidence at the scene.
286 Dynamics of Government Innovation and Decentralization in Korea
Establishing a High-Tech Cyber Crime Response System
287