Murder suspect used his former company's internal network to get his stalking victim's location information

What happened? 

A murder suspect gained unauthorized access to the victim's personal information through a public organization's internal computer network, and used it to locate the victim's working area. 

What's the issue? 

Currently there are inadequate safety precautions preventing such unauthorized access of personal information collected by government organizations, which can be abused by criminals seeking the personal information of their targeted victims. 

What does this mean? 

This case demonstrates how inadequate protection measures for personal information controlled by government institutions can be exploited by criminals to facilitate violent crimes, such as by knowing their target's address and working locations. 

More Detail: 

The murder that happened in Sindang Station, Korea on Sept 14 is notable for the murder suspect's use of a publicly owned company’s internal computer network to access the victim’s personal information and locate their working area. The suspect had already been fired from his job, but still managed to gain access to his former company(Seoul Metro)'s internal network by claiming to be an employee of another station on vacation. There was a similar incident last year where personal information was leaked through a public worker and used in a serious crime. Investigations into these and similar crimes involving personal information being used by criminals found that the problem was the incomplete safety mechanisms preventing unauthorized access to personal information in public organizations. Korea’s PIPC(Personal Information Protection Commission) also reported that 16 local government organizations did not meet the standards of Korea’s national privacy laws (in particular, s29 of the Personal Information Protection Act, which deals with the duty of personal information controllers to protect the personal information under their control). 

Also see:  Suspect in subway restroom murder found to be victim's stalker, colleague 

Possible Impact? 

In addition to strengthening anti-stalking laws, this case may result in improved privacy protection measures for personal data collected and stored by organizations in Korea, especially regarding location data. 

Are there similar cases in Canada? 

While there have been few if any cases of violent crime where the perpetrator illegally accessed the personal information of their targets to facilitate their crime, there has recently been a case where the personal information of Canada Revenue Agency whistleblowers were available for anyone to read in public court documents. The case is currently under investigation by the Privacy Commissioner of Canada. 

Regarding personal information collected by government institutions, such information is protected under the federal Privacy Act, which obligates government institutions to protect it by ensuring that people's personal information is not used or disclosed outside of accepted purposes (s7 and s8 of the Privacy Act), which certainly do not include access by employees - both current and former - for personal reasons. 

Written by Simplawfy