Bereaved family members of the victims of the explosion at Hanwha Aerospace's Daejeon plant visit a joint memorial altar set up at the Yuseong-gu Office in Daejeon on the morning of May 5 to lay flowers. / Photo by Yonhap News

Even when victims gather the URLs and screenshots of malicious posts to file a report, it does not immediately lead to deletion or punishment. For the police to trace the author, they must verify account information, access logs, and telecommunications data step by step. Even if a post has been deleted, criminal proceedings are handled separately.

According to information from the National Investigation Headquarters of the National Police Agency and the Electronic Cybercrime Report Management system (ECRM), investigations into defamation and insult posts targeting victims of disasters and incidents usually begin with a report or complaint. Once the reporter submits the post's URL, screenshots, author nickname, and posting time, the police verify the existence and content of the post based on these materials and initiate tracking procedures.

The investigation starts by identifying when, where, and how the post was uploaded. If the original post has been deleted, the screenshots, URLs, and posting times secured by the victim serve as crucial clues. However, since screenshots alone make it difficult to immediately verify the original post or account information, securing data through the platform must follow.

For domestic platforms, it is relatively feasible to verify account information and access logs according to investigative procedures. Yet, account information does not instantly lead to identifying the actual author. If complications arise—such as accounts under another person's name, public internet networks, foreign emails, identical nicknames, or account deletion—identifying the author inevitably takes time.

Investigations become more complex when foreign servers are involved. Even if access logs remain, pinpointing the actual access location is difficult, and cooperation from foreign operators is frequently required. While foreign platforms run their own reporting systems, deleting a post and identifying the author for a criminal investigation are separate issues. Even if a platform deletes a post for violating its terms of service, criminal proceedings are bound to be delayed if securing the author's information takes time.

Dissemination through social media or highly anonymous messengers presents an even higher investigative hurdle. Even when law enforcement requests data submission, identifying the initial distributor or author takes significant time if operator cooperation is limited. Tracking the distribution path is also challenging once a post is deleted or a chat room is closed.

Numerous legal issues also arise during the application of the law. For online defamation under the Information and Communications Network Act, the key factors reviewed are the purpose of slander, whether true or false facts were stated, and the identifiability of the victim. The crime of insult is also judged based on the background and context of the expression, as well as the specificity of the victim. While defamation of the deceased is regulated under current law, there is no separate crime of insult against the deceased to broadly punish insulting expressions directed at the dead.

Furthermore, the specialized investigation system does not handle all malicious comments in the same manner. The National Investigation Headquarters established a specialized investigation framework last year for secondary victimization crimes targeting victims of major disasters and incidents. However, the scope of these specialized investigations primarily focuses on secondary victimization crimes related to large-scale disasters and catastrophes.

A police official explained, "In principle, we investigate secondary victimization related to disasters and major catastrophes. If we include violent crimes, the volume becomes too overwhelming, so those fall under general insult and defamation investigations." The official added, "The processing time usually takes about three months, but it can extend if the caseload is heavy or the investigation details are complex."

The deletion procedure also operates independently of the investigation. The Korea Communications Standards Commission runs deliberation and deletion request procedures for information infringing on rights, but it does not separately categorize or independently monitor secondary victimization posts. The process moves forward only when the victim files a report or when related agencies, such as the police, make a request.

Lee Yoon-ho, a chair professor of police science at Cyber University of Korea, noted, "There are no separate investigative techniques just because it is classified as secondary victimization. Foreign platforms not only operate on a time difference compared to domestic ones, but obtaining cooperation can sometimes be impossible." He emphasized, "Since secondary victimization is a crime where the damage escalates over time, platforms must take responsibility and filter these out."

                                                                                                             Sul So-young

                                                                                                           Kim Hong-chan