By Lee Hyo-sik

Police said Sunday they were tracing bank account transactions of a ruling party staffer and three IT firm workers who allegedly attacked the website of the National Election Commission (NEC) during the Oct. 26 by-elections.

Investigators are widening their search to look into why they launched such an attack and who was behind them.

Police said they are focusing on two possibilities. First, the secretary of Rep. Choi Gu-sik of the governing Grand National Party (GNP), indentified as Gong, 27, and the three accomplices might have planned and crashed the website through a distributed denial of service (DDoS) attack on their own.

The second one is that politicians or other influential figures may have ordered them to disable the site.

Officers have begun checking phone records of the four suspects, who were detained Saturday after a judge issued arrest warrants for them. They are also tracing their banking transactions while tracking down what they did before and after the cyber attack.

It has been suspected the DDoS attack was an attempt to prevent young voters who favor opposition parties and usually vote in the morning before going to work from checking their polling stations on the website. Rep. Choi, a former reporter of the countrylargest daily Chosun Ilbo, was in charge of public relations for the GNP’s election camp at that time.

On Friday, the National Police Agency’s Cyber Terror Response Center said Gong asked one of the accomplices, 26-year-old Kang who runs an IT company, to organize the attack a day before the election. Kang, who was staying in the Philippines at the time, then instructed two of his company workers in Korea to attack the NEC website, according to police.

Gong and the three have known each other for a long time. The three accomplices used 200 zombie computers for the DDoS attack, police said. They were also found to have attacked the website of the then Seoul mayoral candidate Park Won-soon twice on the same day.

“We are investigating what they launched the cyberattack for and whether they were ordered to do so by someone. We are tracing their phone records and financial transactions to check whether any additional party was involved in the DDoS attack,” a police officer said.

Gong has been flatly denying his involvement in the cyberattack, while his three accomplices have admitted to committing the offense against the NEC website and Mayor Park’s personal homepage under Gong’s instructions. Rep. Choi has also denied his involvement in the hacking scheme.

Investigators are questioning Gong and Kang about what they discussed on the phone on the by-election day. They were found to have called each other about 30 times.

Gong claimed that he talked with Kang about insurance products, but police suspect that the two were colluding in the DDoS attack over the phone.

“As both ruling and opposition parties want us to get to the bottom of the case, we will look into all possibilities,” the officer said.

The investigation has been attracting keen public attention as it could shake up the local political landscape. If Rep. Choi and other GNP figures are found to be involved in the hacking, it could deal a severe blow to the party ahead of next year’s parliamentary and presidential elections.

경찰 최구식의원 비서 계좌·통화기록 추적

한나라당 최구식 의원 비서의 중앙선거관리위원회 홈페이지 공격사건과 관련해 경찰의 수사가 확대되고 있다.

4일 경찰청에 따르면 최 의원의 수행비서인 공모(27)씨 등 4명에 대한 구속영장이 발부됨에 따라 이들을 대상으로 범행 동기 등을 파악하는 데 수사력를 모으고 있다.

특히 경찰은 공씨의 계좌와 통화기록, 범행 전후 행적 등을 추적해 윗선의 개입과 특정인의 사주가 있었는지를 수사하고 있다.

경찰은 선거 전날인 10월 25일 밤에야 공씨가 사이버 공격을 의뢰한 점에 비춰 우발적인 단독 범행일 가능성이 있는 것으로 보고 있지만, 중대한 선거 범죄를 저지르는 과정에 외부의 개입이 없었다고는 단정하지 않고 있다.

경찰은 공씨가 경찰에 체포된 직후 강모(25)씨 등 실제 공격을 수행한 정보기술(IT) 업체 직원들과의 대질 조사과정에서 혐의를 전면 부인하고 법원의 구속영장 실질심사에서도 범행을 완강히 부인하고 있는 점에 대해 의구심을 갖고 있다.

경찰은 공씨가 주위 인물에 대한 경찰의 수사를 차단하기 위해 범행을 부인하고 있는지, 실제로 범행을 주도하지 않았기 때문에 범행을 부인하는지 여부를 집중적으로 캐묻고 있다.

또 10.26 재보궐선거 전날 밤부터 선거 당일 오전 3시30분께까지 강씨와 30여차례 통화한 내용에 대해서도 조사를 하고 있다. 공씨는 이 통화가 보험투자에 관한 내용이라고 설명하고 있지만 경찰은 범행 상황과 연관됐을 가능성이 큰 것으로 추정하고 있다.

아울러 경찰은 이들이 박원순 당시 서울시장 후보의 홈페이지인 `원순 닷컴'을 공격한 배경에 대해서도 수사를 하고 있다. 경찰은 박 시장 측에 피해 사실과 관련한 자료를 요청했지만 아직 이렇다 할 답변은 받지 못한 것으로 전해졌다.

경찰은 민주당은 물론 한나라당에서도 진상 규명을 요구하고 있는 만큼 모든 가능성을 열어 놓고 수사를 진행할 방침이다.

민주당은 이번 사건을 '서울시장 보선에서의 젊은 층 투표를 방해하기 위한 사이버테러 시도'라고 규정하면서 한나라당 부정선거 사이버테러 진상조사위원회'를 구성했다. (연합뉴스)