NIS Strengthens Security for IoT Devices
Military, Airport Operator and KHNP Among Targets
Measures Aim to Prevent Video and Location Data Leaks
Expert Calls for Security Oversight of Cloud Data Transfers
South Korea's National Intelligence Service (NIS) has issued guidelines strengthening security measures for a broad range of camera-equipped Internet of Things (IoT) devices, including smart glasses, to prevent video footage from inside national security facilities from being leaked.
Vehicle access management, including connected cars, has also been identified as a major target for tighter security. The measures reflect concerns that cameras and location-tracking devices installed in Chinese-made vehicles could transmit not only footage of national security facilities but also precise location information to external destinations.
According to relevant government ministries and public institutions on Oct. 21, the NIS has instructed central government ministries, local governments and public institutions to strengthen security measures for all types of camera-equipped IoT devices. The measures apply to organizations managing national security facilities, including military installations, Korea Airports Corporation (KAC), power generation companies such as Korea Hydro & Nuclear Power (KHNP), and Korea National Oil Corporation (KNOC).
The NIS explained that the measures are intended to prevent video footage from inside national security facilities from being leaked externally. An NIS official said, “As camera-equipped IoT devices become more widespread, bringing such devices into national security facilities could create a risk of video footage being leaked. These measures are part of our efforts to prevent such incidents.”
The enhanced security measures are understood to cover a wide range of IoT devices equipped with cameras and communication capabilities, including connected vehicles and smart glasses.
“The guidelines include instructions to strengthen security measures related to vehicle access, including connected cars,” an official at a public institution said. “We were instructed not only to tighten vehicle access controls but also to strengthen security training for employees regarding these measures.”
The measures come in response to concerns about potential information leaks through Chinese-made connected cars that emerged around the time of the National Assembly's annual parliamentary audit.
Earlier this month, Rep. Kim Byung-joo of the Democratic Party of Korea disclosed during the parliamentary audit that at least 135 Chinese-made connected vehicles were registered for access to military facilities. He also revealed that unregistered vehicles had entered major naval facilities hundreds of times.
The biggest concern is the possibility that video footage and geographic coordinate data collected by Chinese-made connected vehicles could be leaked externally.
In its 2024 annual report, Estonia's intelligence authorities warned, “We obtained information that a Chinese lidar developer had attempted to transmit environmental scanning data unnecessary for autonomous driving to a database in China.” The authorities cautioned that autonomous vehicles incorporating Chinese technology could be exploited for national intelligence gathering.
Furthermore, while South Korean authorities can verify data collection and transmission records from domestically manufactured vehicles through their manufacturers and other channels, obtaining the same level of information access and conducting subsequent verification are difficult when dealing with Chinese companies. If such information were transferred to a hostile country, it could create a serious national security vulnerability.
However, the guidelines are essentially an emergency response intended to address gaps in the existing security management framework. Specific access control and security standards for connected vehicles and camera-equipped IoT devices still need to be established and refined.
“Security must cover not only the installation locations and IP addresses of camera-equipped IoT devices but also the cloud services through which recorded footage is transmitted in real time,” said Kim Yong-dae, a professor at the School of Electrical Engineering at the Korea Advanced Institute of Science and Technology (KAIST).
“Both the devices themselves and the cloud environments through which video footage is transmitted and stored must be managed together,” Kim emphasized.
