South Korean Cybersecurity Staff Caught Playing StarCraft at Work While Bosses Were Away, One Logged 90 Hours

SEOUL, South Korea — Five employees at a South Korean state-run cybersecurity institute repeatedly logged on to StarCraft game servers during working hours while their supervisors were away on vacation or business trips, a lawmaker said, raising questions about discipline at an agency tasked with defending the country's digital infrastructure.

The employees, who worked at the National Security Research Institute, accessed Blizzard Entertainment's Battle.net online gaming service between September and December 2024, according to records disclosed Monday by Rep. Hwang Jung-a of the ruling Democratic Party.

One employee logged more than 90 hours of total access during the period, the records showed. The longest single-day session reached eight hours and 53 minutes, nearly a full workday.

"Repeatedly accessing game servers while taking advantage of their managers' absence is a serious lapse in discipline for employees tasked with protecting the nation's cybersecurity," Hwang said.

Separate site, open network

The employees worked at the institute's Cybersecurity Training and Exercise Center, which is located apart from the main headquarters. Because the center used an external network for training purposes, the staff were able to reach outside game servers without being blocked by the security controls that would normally apply.

The institute cut off the center's experimental internet connection in December 2024. Even so, some of the employees continued to access the external network afterward, according to the records.

The National Security Research Institute is a government-funded research body affiliated with the Electronics and Telecommunications Research Institute, or ETRI. It develops information security technology for national and public institutions, including cryptographic systems and tools used to protect state networks, and is considered one of South Korea's core institutions for defending against cyberattacks.

The timing of the lapse drew particular attention because South Korea faces persistent cyber threats, including hacking campaigns that Seoul has attributed to North Korea targeting government agencies, defense contractors and research institutes.

Whistleblower brought case to light

The gaming came to light after another employee filed a report through ETRI's anonymous reporting system. ETRI oversees the cybersecurity institute.

When questioned, the employees reportedly said they had logged on to the network for entertainment following a major event, but denied that they had spent all their time online playing games. Officials did not specify what event the employees were referring to.

All five received reprimands, the lightest form of disciplinary action available under South Korea's State Public Officials Act. Their annual paid leave was also reduced in proportion to the amount of time they had spent logged on to the game servers.

The relatively mild penalties are likely to draw scrutiny from lawmakers during the National Assembly's annual audit of government agencies, which is currently underway. The audit season typically brings a wave of disclosures about misconduct and mismanagement at state institutions.

Concerns over treatment of whistleblower

Hwang also raised concerns about how the employee who reported the misconduct was treated afterward. She cited a report that a manager of the employees involved had raised their voice at the person who filed the complaint, saying protections for internal whistleblowers had been inadequate.

"Along with thorough oversight of employees' conduct and strict accountability, the institute must review its safeguards to ensure that internal whistleblowers do not suffer disadvantages," Hwang said.

Hwang, a first-term lawmaker, is a space physicist who worked on satellite development and research before entering politics.

A game with deep roots in Korea

StarCraft, a real-time strategy game released by Blizzard in 1998, holds a unique place in South Korean culture. The game helped launch the country's professional gaming industry in the early 2000s, with matches broadcast on dedicated television channels and top players achieving celebrity status. South Korea's emergence as a global powerhouse in competitive gaming, known as esports, is widely traced to StarCraft's popularity during that period.

The game remains popular in the country decades after its release, particularly among adults who grew up with it. A remastered version was released in 2017.

Its enduring appeal means cases of workplace gaming involving StarCraft periodically surface in South Korea, but the involvement of employees at a national cybersecurity body has made this case especially sensitive.

Questions about network security

Beyond the issue of workplace discipline, the case highlights potential gaps in network controls at an institution responsible for setting security standards for others.

The ability of employees to connect to an outside commercial gaming service from a facility used for cybersecurity training, and to continue doing so after the connection was supposed to be blocked, is likely to prompt questions about how the institute manages access to external networks.

Security experts generally view unauthorized connections to outside services from sensitive facilities as a potential risk, because they can create pathways for malicious software or unauthorized access, even when the activity itself is recreational.

Neither the National Security Research Institute nor ETRI has publicly disclosed whether any security vulnerabilities resulted from the employees' activity. The institute did not immediately respond to requests for further details on the disciplinary process or any changes to its network policies.

Broader scrutiny of public institutions

The disclosure adds to a series of reports this audit season examining discipline and oversight at publicly funded research institutes in South Korea. Lawmakers from both major parties have used the hearings to press agencies on issues ranging from budget management to employee conduct.

For the cybersecurity institute, the case may lead to closer examination of how its training center is supervised when senior staff are absent, as well as how complaints filed through anonymous channels are handled.

Hwang's call for stronger whistleblower protections reflects a wider debate in South Korea over whether employees who report wrongdoing at public institutions are adequately shielded from retaliation. Advocates have long argued that fear of backlash discourages staff from coming forward, particularly in hierarchical workplaces.

It was not immediately clear whether the institute or its parent organization would review the disciplinary measures or take further steps in response to the lawmaker's criticism.