Officials from the joint investigation team of prosecutors and police, tasked with uncovering the truth behind the ballot paper shortage, are seen entering the National Election Commission (NEC) building in Gwacheon, Gyeonggi Province, on the 23rd. The joint team initiated a compulsory investigation after detecting circumstances where NEC working-level staff arbitrarily altered statistical figures in the system to cover up an error in voter count input. [Photo=Yonhap News] 

[Circumstances have emerged suggesting that National Election Commission officials arbitrarily adjusted voter count and turnout figures.

An initial input error might have been a simple mistake. However, the situation changes if, upon discovering the error, they failed to correct it through established procedures and instead altered other figures to match the overall total.

With allegations surfacing that officials from the Central Election Commission and local election commissions coordinated on a "figure-matching" method, calls for a special counsel investigation into the NEC are growing.

However, a special counsel alone does not guarantee that the truth will be fully revealed. Depending on what the special counsel act authorizes them to investigate, they might be able to verify the original data and change records of the election management network—or the case could end with the mere punishment of a few working-level staff in specific regions.

Today, we will examine why the scope of the special counsel act for the NEC is critical, how election database and modification/deletion logs must be secured, and why a specialized warrant review system is necessary.

Hello, this is the Hanmi Daily Issue Talk.

Today, we will discuss the key issues of the NEC special counsel act with our editor, Kim Young. Editor Kim, hello.]

Yes, hello.

[First, please explain why it is difficult to view this incident as a mere turnout input error.]

If we look only at the initial incorrect input, it could be a mistake.

The problem lies in the actions taken afterward.

If an error was discovered, it should have been reported to superiors, and the reason for the correction and the values before and after the change should have been recorded and rectified according to established procedures. If, however, they did not report it but instead adjusted other numbers to force the total to match, this can hardly be seen as a simple correction of an error.

We must investigate whether other computer records were altered to hide the incorrect input, and who ordered or condoned these actions.

If the allegations that Central and local NEC officials discussed how to "match the numbers" are true, we must look beyond individual error and investigate the possibility of collusion and organized cover-up.

[Does this incident mean the claim that "NEC computer data cannot be arbitrarily changed by humans" has collapsed?]

At the very least, it is now difficult to maintain the claim that an authorized user within the NEC cannot access and modify official election statistics.

The question used to be:

“Can humans change NEC computer data?”

Now the question has changed:

“Who, with which account and authority, was able to change which figures in which system?”

We have moved beyond a debate on theoretical possibilities to a stage where we must verify actual access authority, the scope of modifications, whether records were preserved, and the repeatability of these acts.

However, changing turnout figures and changing the vote count for individual candidates are different matters. We should not jump to the conclusion that vote counts or election outcomes were altered based solely on currently public information.

[Can the NEC claim that even if there were issues with turnout statistics, there was no impact on election results?]

That is highly likely.

However, the assertion that “there was no impact on the results” is not something that can be finalized by the NEC’s unilateral declaration.

It is necessary to cross-verify the number of voters on the electoral roll, the quantity of ballot papers issued and remaining, the physical ballots, the vote-counting records, initial input values, pre- and post-modification data, access accounts, change logs, and backup materials.

We must also confirm how the system recording individual candidate votes is linked to the system managing voter counts and turnout.

The statement “there was no impact on the results” should not be the starting point of verification, but the conclusion reached only after verification is complete.

[Who bears the burden of proving that the results did not change?]

We must distinguish between the burden of proof in law and the public responsibility to explain.

In criminal trials, the prosecutor must prove the facts of the crime. In election litigation, the plaintiff who raised the issue must claim and prove illegal acts and their impact on the election results.

The mere fact that this incident occurred does not automatically shift the legal burden of proof to the NEC.

However, if the NEC wishes to claim that “there was no impact on election results,” it must present the data that serves as the basis for that judgment.

This is because the NEC is the institution that essentially monopolizes relevant data and systems.

Separate from the legal burden of proof, the NEC has a public duty to explain the basis for its assertion of an unchanged result to the citizens and to subject itself to independent external verification.

Witnesses, including former Central Election Commission Chairperson Noh Tae-ak, are sworn in at the second hearing of the National Assembly's Special Committee on Investigation into the NEC on the 22nd. The NEC stated that it could provide access to its servers if the ruling and opposition parties agree on the scope of verification and if it does not violate other laws. [Photo=Yonhap News] 

[Can't we just have the Special Investigation Committee demand access to the servers?]

The NEC replied that it could cooperate with server verification if the ruling and opposition parties reach an agreement, but it also added the caveat of “within a range that does not violate other laws.”

The NEC can limit the scope of submission and the method of verification based on reasons such as personal information protection, ballot secrecy, IT security, and ongoing investigations.

They might claim cooperation after submitting partial internal business messenger or electronic approval documents, while simultaneously asserting that the actual database and change logs of the election management network—which processes voter counts, turnout, and vote-counting data—are difficult to disclose.

While a parliamentary investigation can demand material and summon officials to testify, it is not a criminal investigation procedure that allows for the seizure of servers and storage media or the acquisition of forensic images against the will of the NEC.

Ultimately, the effectiveness of the parliamentary investigation is bound to depend largely on the extent of the NEC's cooperation.

[Is that why a special counsel is needed?]

That is correct.

If a special counsel clarifies the relevance of criminal charges to the material subject to seizure and requests a warrant, it is the court, not the NEC, that determines whether the materials can be seized.

If the court issues a lawful search and seizure warrant, it is difficult for the NEC to refuse execution based on its own judgment.

If a parliamentary investigation is a procedure of knocking on the door with the NEC’s cooperation, a special counsel investigation is a procedure that can forcibly secure necessary materials through a court warrant.

However, a special counsel cannot just open the entire election network without limits.

The special counsel must also explain to the court the relevance between criminal charges and the materials to be seized, as well as the necessity and proportionality of the scope of seizure. This is precisely why what is defined as the subject of investigation in the special counsel act is so important.

Officials from the joint investigation team of prosecutors and police are seen talking to an NEC employee while preparing for a search and seizure at the Central Election Commission in Gwacheon, Gyeonggi Province, on the 23rd. A key point of contention is whether this investigation was limited to part of the business network or if it secured the originals and change records of the election management network. [Photo=Yonhap News] 

[Didn't the joint investigation team already conduct a search and seizure at the Central Election Commission?]

The expression "Central Election Commission servers" should not be treated as a single monolith.

The NEC computer network consists of a business network handling internal messengers and electronic approvals, and an election management network that actually manages election data and statistics.

It is possible that investigative agencies entered the NEC building and secured an official's mobile phone, business network data, and some computer records related to a specific incident.

However, it is a separate matter whether they comprehensively secured the operational database of the election management network, the entire history of changes, and similar modification records from other regions and past elections.

If the current charges are limited to the false input of turnout in a specific region and time, the scope of the warrant may have been narrowed to the relevant employee, account, period, and data.

The fact that investigators entered the NEC’s computer facilities is entirely different from the claim that the entire election management network has been verified.

[What should be included as the subject of investigation in the special counsel act?]

First, whether there was any instruction, reporting, condoning, or collusion among Central and local NEC officials.

Second, the original input values and input/modification/deletion records of the election management network.

Third, securing forensic images of the operational database, database transaction/change history, application programs, administrator audit logs, and account-based access records.

Fourth, verifying whether original data matches backup or copy data, and whether there was any deletion, damage, or concealment of logs or materials.

Fifth, securing the time synchronization records of servers and systems. This is because the accuracy of system time is a prerequisite for verifying whether the creation/modification time of computer records matches the actual time of the act.

Sixth, the ability to investigate whether the same or similar modification methods were repeated in other regions or past elections.

Lastly, it must include a clause on related cases so that any directly related crimes discovered during the investigation can be pursued.

Without this clause, a problem could arise where a special counsel finds new criminal circumstances but is forced to stop the investigation simply because it is not explicitly listed in the special counsel act.

An official makes a phone call in the hallway of the Songpa-gu Election Commission in Seoul on the 23rd, the day the joint investigation team began search and seizure operations. On this day, the joint team conducted searches at the Central Election Commission and the Songpa, Gangnam, and Seocho District Election Commissions. [Photo=Yonhap News]

[Could there be a counterargument that investigating even past elections is an excessively broad investigation?]

It does not mean that we should reinvestigate all past elections without grounds.

It means verifying whether the same accounts, modification patterns, and report-avoidance methods identified in this case were repeated in other regions or past elections.

If the circumstances that an NEC official suggested a method for matching numbers to a local commission are true, investigating whether this was a one-time deviation or a method used within the organization for a long time is a natural part of the investigative process.

Including past elections in the scope of the investigation is not an argument to pre-determine that past election results were wrong.

It is to confirm whether the crime is repetitive and structural.

Concerns about an overreaching investigation can be mitigated by limiting the scope to materials with a reasonable connection to the accounts, systems, and modification methods identified in this case.

[Does simply writing a broad scope of investigation into the special counsel act make actual search and seizure possible?]

That alone is not enough.

Even if the scope of investigation is defined broadly in the act, if the court limits the targets of seizure to specific employees and specific periods, it becomes difficult to verify identical acts in other regions or past elections.

The election network is different from a regular mobile phone or office computer.

One must understand the linkage structure between systems, the relationship between the operational database and backups, log retention methods, personal information separation, and forensic imaging procedures to distinguish between necessary and excessive seizure.

Therefore, it is necessary to review a plan where multiple warrant-dedicated judges with expertise in election law and digital evidence professionally and consistently review relevant warrants.

[Does that mean creating a special trial division or a special warrant-dedicated department, like in treason trials?]

We must be wary of the method of a special trial division where political circles directly select the judges who will handle specific cases.

If the composition of a court varies depending on political interests, it could lead to controversy over undermining the independence of the trial and the principles of judge assignment.

However, operating multiple judges already within the court who possess expertise in election law and digital evidence as warrant-dedicated judges is a different matter.

It should not be a method where the special counsel act designates specific judges, but one where the Supreme Court and relevant courts establish a dedicated system with expertise within the existing principles of work division and case assignment.

Randomly assigning cases to multiple judges can secure expertise and consistency in judgment while reducing controversy over "judge shopping."

The first gateway for a special counsel investigation is not the main trial, but the search and seizure warrant.

If the database originals, change logs, access records, and backup materials are not secured at the initial stage, subsequent investigations cannot proceed properly.

If there is a possibility that related cases will be scattered among several court divisions after indictment, one could also consider operating a dedicated trial division according to independent internal court procedures.

The important thing is that it should be a dedicated system based on independent internal work division and random assignment, not a special trial division selected by political figures.

Special Prosecutor Cho Eun-seok announces the final investigation results of the Dec. 3 emergency martial law-related treason and foreign treason case at the Seoul High Prosecutors' Office press room in Seocho-gu, Seoul, on December 15, 2025. [Photo=Yonhap News] [Is the purpose of the special counsel ultimately to uncover fraudulent elections?]

One should not conduct an investigation with a predetermined conclusion.

Based only on currently public content, one cannot conclude that candidate vote counts or election outcomes were changed.

The purpose of a special counsel is not to manufacture a conclusion of "election fraud."

It is to independently verify whether the NEC’s claim that “there was no impact on the results” is true.

If the verification results show that the physical ballots, counting records, electoral rolls, computer data, and change records all match, that fact should also be disclosed to the public.

Conversely, if the same modification method is found in other regions or systems, or if original and backup data do not match, the investigation should be expanded accordingly.

In either case, the conclusion should be reached through objective data and external verification, not the NEC's self-explanation.

[What do you think will determine the success or failure of this special counsel act?]

Simply launching the special counsel is not enough.

What is written in the law as the subject of investigation is important.

If only the false turnout input case is narrowly included, it could end as a case of falsifying or altering electromagnetic records by a few working-level staff who participated in "number matching."

The law must define the scope to allow investigation into the original input values and input/modification/deletion records of the election management network, operational databases and backups, whether there was instruction or collusion among Central and local NEC officials, and the repetition of identical or similar acts in other regions or past elections.

A dedicated system within the court to professionally and consistently review search and seizure warrants for that scope is also necessary.

A parliamentary investigation is a procedure of knocking on the door with the NEC’s cooperation.

A special counsel is a procedure that can open that door through a court warrant.

Ultimately, the success or failure of the special counsel does not depend solely on the appointment of the special prosecutor.

It depends on which doors of the election network the special counsel act allows to be opened, and how professionally and independently the court reviews the warrants to open those doors.

[Thank you for your insights today.]

Thank you.

[We have been discussing the investigation scope of the NEC special counsel act and the necessity of a professional warrant review system with our editor, Kim Young.]