소프트웨어 공급망 공격의 형사법적 대응

Abstract

Recently, the number of damage cases caused by software supply chain attacks is increasing rapidly around the world. Software supply chain attack is a newly emerging cyber hacking technique in which hackers penetrate the software development and distribute malicious programs to an unspecified number of software users by tampering with normal software. Due to the nature of penetrating the software supply chain, detecting such attacks is challenging, and all organizations using the tampered software may be affected, thereby leading to widespread damage compared to conventional hacking attacks. Given their potential to create substantial societal disruptions, urgent research and countermeasures are necessary. Fortunately, in recent times, both policy and technological research on software supply chain attacks have been actively conducted in South Korea. However, there is still a lack of research evaluating this new type of cybercrime from a criminal law perspective. This study aims to investigate how to prosecute software supply chain attacks under current criminal laws, identify issues with current regulations, and consider the establishment of more effective punitive measures. Specifically, this study analyzes the concept of software supply chain attacks and examines globally occured cases to identify their common characteristics and risks. This study also assesses how current South Korean criminal laws can be applied to prosecute software supply chain attacks. Finally, this study raises questions about whether existing criminal laws can adequately reflect the illegality of software supply chain attacks and thus proposes the introduction of new punitive provisions within the Act on Promotion of Information And Communications Network Utilization And Information Protection to penalize such crimes appropriately.