Officials from the joint investigation headquarters of the prosecution and police arrived at the National Election Commission (NEC) headquarters in Gwacheon, Gyeonggi-do, on the 23rd to investigate the circumstances surrounding the shortage of ballots. The joint headquarters launched a compulsory investigation after uncovering evidence that NEC staff had arbitrarily altered statistical figures in the computer system to cover up errors in voter input data. [Photo=Yonhap News] 

[Evidence has emerged that National Election Commission officials arbitrarily adjusted voter turnout and count figures.

If it were merely an initial data entry error, it could be dismissed as a simple mistake. However, the situation changes if, after discovering the error, they attempted to align the totals by altering other numbers instead of following established procedures to correct it.

As allegations have surfaced that officials from the Central Election Commission and regional commissions collaborated on a method of "balancing the numbers," calls for the introduction of a special prosecutor for the NEC are growing.

However, simply introducing a special prosecutor does not guarantee that the truth will be fully uncovered. Depending on how the special prosecutor's act defines the scope of the investigation, it could allow for the verification of the original data and change logs of the election management network, or it could end merely with the punishment of a few local staff members.

Today, we will examine why the scope of the special prosecutor's investigation into the NEC is critical, how election database and modification/deletion logs must be secured, and why a professional warrant review system is necessary.

Hello, and welcome to the Hanmi Ilbo Issue Talk.

Today, we will discuss the core issues of the NEC special prosecutor's act with our editor, Kim Young. Mr. Editor, welcome.]

Thank you, it is a pleasure to be here.

[First, could you explain why this incident is difficult to view as a simple mistake in inputting voter turnout?]

If we look only at the initial incorrect data entry, it could be a mistake.

The problem lies in what actions were taken afterward.

If an error was discovered, it should have been reported to superiors, and the correction should have been made according to established procedures, with records kept of the reason for the change and the values before and after the modification. If, instead of reporting it, they tried to adjust other numbers to balance the total, it is difficult to view this as a simple error correction.

We must investigate whether other computer records were altered to hide the initial incorrect entry, and who directed or condoned these actions.

If the allegations that central and regional NEC officials discussed how to "balance the numbers" are true, we must investigate beyond individual mistakes and consider the possibility of collusion and organized cover-ups.

[Does this incident effectively dismantle the argument that 'NEC computer data cannot be arbitrarily changed by humans'?]

At the very least, it has become difficult to maintain the claim that authorized users within the NEC cannot access and alter official election statistics.

The question used to be:

"Can humans change NEC computer data?"

Now the question has changed to:

"Who, with what account and authority, was able to change which values in which system?"

We have moved beyond a debate over possibility to a stage where we must verify actual access authority, the scope of modifications, whether records were preserved, and the frequency of such behavior.

However, changing voter turnout figures is different from changing the vote counts per candidate. Based on the information currently public, we should not conclude that candidate vote counts or the outcome of the election itself were altered.

[Can the NEC claim that even if there were issues with turnout statistics, it had no impact on the election results?]

They are likely to make that claim.

However, the statement "it had no impact on the results" is not a matter to be settled by the NEC's unilateral declaration.

One must cross-reference the number of voters on the electoral register, the number of ballots issued and remaining, physical ballots, vote counting logs, initial input values, pre- and post-modification data, access accounts and change logs, and backup materials.

It must also be verified how the system recording candidate vote counts is connected to the system managing voter numbers and turnout.

"It had no impact on the results" is not the starting point of verification, but a conclusion to be reached only after verification is completed.

[Who bears the burden of proving that the results were not changed?]

We must distinguish between the burden of proof in legal proceedings and the responsibility of public accountability.

In criminal trials, the prosecutor must prove the criminal facts. In election litigation, the plaintiff raising the issue must argue and prove the illegal acts and their impact on the election results.

The occurrence of this incident does not automatically shift the legal burden of proof to the NEC.

However, if the NEC claims "it had no impact on the election results," it must present the data that serves as the basis for that judgment.

This is because the NEC is the agency that effectively holds a monopoly on the relevant data and systems.

Apart from the legal burden of proof, the NEC has a public duty to explain the basis for its claim that results remained unchanged to the public and to submit to independent external verification.

Witnesses, including former Central Election Commission Chairman Noh Tae-ak, are sworn in during the second hearing of the National Assembly's Special Committee on Election Commission Investigation on the 22nd. The NEC stated that it could open the server if the ruling and opposition parties agree on the scope of verification and if it does not violate other laws. [Photo=Yonhap News] 

[Can't the special committee just have the server opened?]

The NEC replied that it could cooperate with server verification if the ruling and opposition parties agree, but it added the proviso: "to the extent that it does not violate other laws."

The NEC can limit the scope of submission and the method of verification based on reasons such as personal information protection, voting secrecy, computer security, and ongoing investigations.

They might claim to be cooperating by submitting some internal business messengers or electronic approval records while refusing to disclose the databases and change logs of the election management network that actually processes voter counts, turnout, and counting data.

While a parliamentary investigation can demand material and summon witnesses, it is not a criminal investigation procedure that allows for the seizure of servers and storage media or the acquisition of forensic images against the will of the NEC.

Ultimately, the effectiveness of the parliamentary investigation is bound to be largely dependent on the scope of the NEC's cooperation.

[Is that why a special prosecutor is necessary?]

That is correct.

If a special prosecutor clarifies the relevance between criminal allegations and the targets for seizure and requests a warrant, it is the court—not the NEC—that decides whether the material can be seized.

If the court issues a lawful search and seizure warrant, it is difficult for the NEC to refuse execution based solely on its own judgment.

If a parliamentary investigation is a procedure of knocking on doors with the NEC's cooperation, a special prosecutor's investigation is a procedure that can forcibly secure necessary materials through a court-issued warrant.

However, just because it is a special prosecutor does not mean they have unlimited access to the entire election network.

The special prosecutor must also explain to the court the relevance between criminal charges and the materials to be seized, as well as the necessity and proportionality of the seizure scope. This is precisely why the investigation targets specified in the special prosecutor's act are so important.

Officials from the joint investigation headquarters of the prosecution and police talk with NEC staff while preparing for a search and seizure at the Central Election Commission in Gwacheon, Gyeonggi-do, on the 23rd. The key issue is whether this investigation stopped at parts of the business network or managed to secure the original and modification logs of the election management network itself. [Photo=Yonhap News] 

 [Didn't the joint investigation headquarters already search and seize the Central Election Commission?]

We should not lump everything together under the expression "the NEC server."

The NEC computer network consists of a business network that handles internal messengers and electronic approvals, and a separate election management network that actually manages election data and statistics.

Investigative agencies may have entered the NEC building and secured an official's mobile phone, business network materials, and some computer records related to a specific incident.

But whether they comprehensively secured the operational database, complete change history, and similar modification records from other regions and past elections for the election management network is an entirely separate matter.

If the current charges are limited to false voter turnout inputs in a specific region and time, the scope of the warrant might have been narrowed to relevant employees, accounts, timeframes, and materials.

The fact that investigators entered NEC facilities is entirely different from saying that the entire election management network has been verified.

[What should be included as subjects of investigation in the special prosecutor's act?]

First, whether there was direction, reporting, tacit approval, or collusion by officials of the central and regional election commissions.

Second, the initial input values and the input, modification, and deletion logs of the election management network.

Third, securing forensic images of the operational database, database transaction/modification history, application and administrator audit logs, and account-based connection records.

Fourth, verifying whether the original data matches the backups and copies, and whether there was any deletion, damage, or concealment of logs or materials.

Fifth, securing time synchronization logs of servers and systems. This is because the accuracy of system time is a prerequisite for verifying whether the creation/modification time of computer records matches the actual time of the act.

Sixth, investigating whether the same or similar modification methods were repeated in other regions and past elections.

Finally, a clause regarding related offenses should be included to allow the investigation of directly related crimes discovered during the process. Without this, a problem could arise where a special prosecutor might have to halt an investigation even after discovering new criminal evidence because it was not explicitly specified in the act.

An official makes a phone call in the hallway of the Songpa-gu Election Commission in Seoul on the 23rd, the day the joint investigation headquarters launched a search and seizure. On this day, the joint headquarters conducted searches at the Central Election Commission as well as the Songpa, Gangnam, and Seocho District Election Commissions. [Photo=Yonhap News]

[Could there be a counterargument that investigating past elections is too broad an investigation?]

It does not mean that we should reinvestigate every past election without grounds.

It means verifying whether the same accounts, modification patterns, and report-avoidance methods identified in this incident were repeated in other regions or past elections.

If the allegations that a Central Election Commission official proposed how to "balance the numbers" to a regional commission are true, it is only natural to investigate whether this was a one-time deviation or a method used within the organization previously.

Including past elections in the scope of the investigation is not about predetermining the conclusion that those past election results were wrong.

It is about determining whether these acts are recurring and structural.

We can also mitigate criticisms of over-investigation by limiting the scope to materials with a reasonable connection to the accounts, systems, and modification methods identified in this case.

[Will simply writing a broad scope of investigation into the act make actual searches and seizures possible?]

That alone is not enough.

Even if the scope is defined broadly in the special prosecutor's act, if the court limits the targets of seizure to specific employees and timeframes, it will be difficult to verify identical acts in other regions or past elections.

An election network is different from a typical mobile phone or office computer.

One must understand the interlinkage between systems, the relationship between the operational database and backups, log retention methods, separation of personal information, and forensic imaging procedures to distinguish between necessary seizures and excessive ones.

Therefore, it is necessary to consider a plan for multiple warrant-dedicated judges with expertise in election law and digital evidence to examine related warrants professionally and consistently.

[Does this mean having a special trial division or a special warrant-dedicated department, like in the insurrection trials?]

We should be cautious about the special trial division method where politicians directly select the judges for a specific case.

If the composition of a panel changes according to political interests, it could lead to controversies regarding the independence of the trial and the undermining of principles of judge assignment.

However, it is a different matter to have multiple judges within the existing court system who are experts in election law and digital evidence operate as dedicated warrant judges.

Rather than an act specifying certain judges, the Supreme Court and the competent courts should establish a dedicated system with expertise within the existing administrative principles of duties and case assignment.

Randomly assigning cases to multiple judges can reduce controversy over selecting specific judges while ensuring expertise and consistency in judgment.

The first hurdle for a special prosecutor's investigation is not the main trial, but the search and seizure warrant.

If they fail to secure the database original, change logs, connection records, and backup materials in the initial stages, the subsequent investigation will be difficult to conduct properly.

If related cases are likely to be scattered across multiple divisions after indictment, we can also consider operating a dedicated trial division according to independent procedures within the court.

The important thing is that it should be a dedicated system based on independent internal distribution of duties and random assignment, not a special trial division where politicians choose the judges.

Special Prosecutor Cho Eun-seok announces the final investigation results regarding the December 3rd martial law insurrection and treason case at the Seoul High Prosecutors' Office press room in Seocho-gu, Seoul, on December 15, 2025. [Photo=Yonhap News] [Is the ultimate goal of the special prosecutor to uncover election fraud?]

We should not conduct an investigation with a predetermined conclusion.

Based on the information disclosed so far, we cannot conclude that the vote counts per candidate or the election outcome were changed.

The purpose of a special prosecutor is not to manufacture a conclusion called "election fraud."

It is to independently verify whether the NEC's assertion that "it had no impact on the results" is actually true.

If the verification results show that the physical ballots, counting data, electoral registers, computer data, and modification records all match, that fact should be disclosed to the public.

Conversely, if the same modification methods are discovered in other regions or systems, or if the originals and backups do not match, the investigation should be expanded accordingly.

Either way, the conclusion should be reached through objective data and external verification, not the NEC's own self-exoneration.

[What do you think will determine the success or failure of this special prosecutor's act?]

Simply launching the special prosecutor's office is not enough.

What is written into the law as the subject of investigation is crucial.

If the investigation is narrowly limited to the case of false voter turnout input, it may end merely with charges of forgery or alteration of electromagnetic records against a few staff members involved in balancing the numbers.

The act must be defined to allow investigation into the initial input values and input/modification/deletion records of the election management network, operational databases and backups, whether there was direction or collusion by central and regional NEC officials, and whether identical or similar acts occurred in other regions or past elections.

A dedicated system within the court that can professionally and consistently review search and seizure warrants within that scope is also necessary.

A parliamentary investigation is a procedure of knocking on doors with the NEC's cooperation.

A special prosecutor is a procedure that can open those doors through court warrants.

Ultimately, the success or failure of the special prosecutor does not depend solely on the appointment of the special prosecutor.

It depends on which doors the special prosecutor's act defines can be opened in the election network, and how professionally and independently the court reviews the warrants to open those doors.

[Thank you for your insights today.]

Thank you.

[We have been discussing the scope of the NEC special prosecutor's investigation and the necessity of a professional warrant review system with our editor, Kim Young.]