Weird Lawyer Woo Young Woo (2022): Season 1, Episode 15 - Episode #1.15 - full transcript
Excuse me?
There's no way it says it's sold out.
I checked that it's already been shipped.
Yes.
It should arrive sometime in the morning
of the ninth for you.
CHOI JIN-PYO
I did check the size.
All right. Have a good one.
Hello, this is Raon.
Gosh.
Yes, ma'am.
Yes, the item you returned
was confirmed to be defective.
Yes.
CHOI JIN-HO: I REWROTE MY COVER LETTER
LIKE YOU TOLD ME TO!
- That was fast.
- Or would you prefer to get a refund?
ATTACHED FILE: COVER LETTER.DOC
DOWNLOADING
DOCUMENT CREATED WITH APPLICATION
PROGRAHM NOT RELATED TO MACROSOFT OFFICE
ALLOW CONTENT
What?
Hey, Jin-pyo. What's up?
Your cover letter file won't open.
Send it again.
I'll take a look at it at home.
I didn't send it to you.
You didn't?
What?
What?
I'll see you tomorrow.
Mr. Choi!
What?
What?
Jin-pyo.
Jin-pyo?
What's wrong?
Sir, I…
I think they got me.
What do you mean?
Spear Phishing.
CASE 15
SAYING AND DOING THINGS NOT ASKED
I don't think…
You and I should date.
Why are you saying that all of a sudden?
I'm sorry.
You have to stay strong, okay?
I am staying strong.
- I'm fine. Don't worry.
- All right.
Attorney Jung!
What?
Attorney Woo.
What brings you here?
The subway brought me here.
No. I mean…
Why are you here
when you should be at work?
Right. I wanted to see you, Attorney Jung.
Because if something goes wrong
and you die,
I won't be able to see you again.
Excuse me?
Mom.
Attorney Woo didn't mean it in a bad way.
Say hi. This is my mom.
Hello. My name is Woo Young-woo.
Whether it's read straight or flipped,
it's still Woo Young-woo.
Kayak, deed, rotator,
noon, race car, Woo Young-woo.
- What?
- Mom, I told you.
Korea's number one in the world
in treating stomach cancer.
So with surgery,
the survival rate is over 70 percent.
Don't worry.
That's because that number
also includes cases of early detection.
With stage three stomach cancer like you,
the 5-year survival rate after surgery
is only 30 to 40 percent...
Shall we go in?
Yes.
Myeong-seok. Hang in there, okay?
- I'll be here.
- I'll see you later.
Please! Come back alive!
Attorney Woo.
Be quiet.
Please! Come back alive!
- You got this.
- Be quiet.
Please.
Namu Gwanseeumbosal.
Hello?
Where are you?
Come to the conference room.
We have a meeting
with our newly assigned clients.
I'm not at work right now.
Then hurry up and get here
as fast as you can.
Right, okay.
It's a bit awkward to say this myself,
but certain people are cut out
for certain jobs, right?
Hanbada has a lot of good attorneys.
But for these corporate cases,
especially in tech, I…
There's another attorney on this case.
She must be here.
Come in.
As I was saying…
Come in already.
Why are you just standing there?
Our clients are here.
Right.
The shock of moving
from one space to another
is very overwhelming for me.
If I count to three and take a deep breath
before going in,
it lessens the shock a bit.
That happens to me sometimes too.
It's uncomfortable when
the space I'm in suddenly changes.
She's quite brave.
I don't want other people
to think I'm weird,
so I pretend that I'm not uncomfortable
even when I am.
Is something like that
funny to you right now?
Does it make you laugh?
Nothing's changed since we were in school.
I'm always the one
who takes things seriously.
Did you two go to the same university?
No, I didn't go to university.
We went to high school together.
And I graduated from Hana University.
Hana University?
Hey!
I mean, we're alumni.
I was a freshman
at Hana University in 2000.
I was a freshman in '97.
I was a freshman in '13.
In '13? Gosh, you're a baby.
Baby?
When I was in school,
you came as a special lecturer,
and it was very inspiring.
I couldn't believe
an alumnus from our school
created the online shopping mall
that the whole country uses.
- Gosh, you flatter me.
- You're really amazing.
Well…
It's not the whole country.
Based on a recent survey,
the number of Raon users is 40,954,173,
but the total population of Korea
is 51,628,117.
Same difference.
It means more than 80 percent
of the entire population uses Raon.
It really is amazing.
Amazing?
We're about to go under.
Shall we get back to business?
- Right.
- Yes.
So the employee in charge of the database
received an email from a hacker?
The hacker hacked into the in box
of our employee in charge of the DB
and was aware of everything
he and his younger brother had discussed.
He even sent the email
using the younger brother's exact tone.
If the attachment containing the malware
was an executable installation file,
our DB manager
would have been more careful.
But since it was a document file,
he didn't think much of it.
I didn't know malware could be spread
with Word files.
Yes, it's possible.
And since it was malware
that was specially made
to attack a specific target,
it wasn't detected
by the anti-malware software.
Was the hacker caught?
No, the police think
it was done by North Korea's
Reconnaissance General Bureau.
But we're not sure yet.
North Korea's RGB?
Just a moment.
Will you take a quick look at this? Here.
Notice anything odd?
- "Prograhm"?
- Yes.
Apparently, North Koreans
spell "program" as "prograhm."
This probably isn't the only reason
they suspect North Korea,
but they're investigating.
If North Korea really is responsible,
it's going to be difficult
to catch the hacker.
Since political issues
will be involved as well.
No, the even bigger problem is
the Korea Communications Commission.
They imposed a 300 billion won
penalty surcharge on us.
And that's why we came to you.
If you think about it, we're victims
of a North Korean cyberattack.
Fining us 300 billion won just because
we couldn't safeguard some personal data?
That's just ridiculous, isn't it?
When the hacker broke into
our DB manager's computer,
the terminal connecting to the DB server
was up on the screen and still logged in.
So from the hacker's perspective,
he didn't have to go through
the trouble of finding out
the manager's ID and password
to connect to the server.
And this is what the KCC
is taking issue with.
That we didn't set an idle timeout
on our DB server properly.
By "idle timeout,"
you mean a "limitation on
the maximum connection time," right?
Yes.
After a certain amount of time,
the connection
would be blocked automatically.
You're not connected to the server
any longer than what's necessary.
And Raon's DB server
didn't have this setting in place?
No.
We didn't set it up.
From what I see,
I think the KCC accidentally added
a few too many zeros.
- What?
- What?
Do you know how much Aha paid
for their penalty surcharge?
No, we don't.
There was an estimated leak
of two million accounts,
and they paid 70 million won.
What?
Yes. Meanwhile, JP Communications
had an even bigger breach.
Almost ten million accounts.
But their penalty surcharge
was a mere 100 million won.
Then why would they ask us
to pay 300 billion won?
Is it because our personal data breach
is the biggest?
Well, the data of more than
40 million people was leaked.
Forty million is nearly the entire…
I mean, it's 80 percent
of the population, right?
But…
It's not like we lost
40 million people's assets.
It's just personal data, right?
When most Korean people
make accounts online,
aren't they aware that their personal data
could be leaked?
Then why are they being like this to us?
The KCC couldn't have made a mistake
by adding too many zeros, right?
Of course not.
Well…
I know some people at the KCC.
I'll see if I can get the full picture
as to why the KCC did this
and how this is proceeding over there.
By the way,
no corporation has ever lost a trial
against the KCC so far.
The KCC is a government organization,
so they can't hire an expensive law firm.
So they always lose to corporations
that work with major law firms.
It'll be the same this time too.
Don't worry.
My fellow alumni.
What? I can't sit here?
There are plenty of other seats.
Okay.
Or you can just sit.
We've eaten together before.
Gosh, you keep changing your mind.
Right.
He and Young-woo broke up.
I didn't realize that Jun-ho
would be eating by himself.
Should we go join him at his table?
I don't think that will be necessary.
Jun-ho. You're eating by yourself today?
Can I sit here?
Sure.
- Jun-ho, you like sausages too?
- Right.
Jun-ho is Mr. Popularity of Hanbada.
He sure is.
Who were you worried about again?
- That color looks so good on you.
- I know, right?
Have some of this too.
A MERE 100 MILLION WON PENALTY SURCHARGE
FOR 7 BILLION PERSONAL DATA LEAKS
Come in.
Gosh, I knew it.
Why are you eating alone
cooped up in your office?
Right.
I have work to do.
That's all the more reason
to go outside for lunch.
You should also eat lunch
and have coffee with other guys.
The weather is so nice today.
What happened with Jun-ho?
What do you mean?
I heard you called things off.
Why did you do that?
Well…
You didn't even give him
a proper explanation?
No.
Are you serious?
That's so rude.
You called things off
and you still haven't told him why?
I don't think it's appropriate to discuss
personal matters during work hours.
It's lunchtime right now.
Then should we talk about whales?
Lunchtime is when I usually talk...
No, I don't want to.
Just answer my question.
What are you doing?
Lunchtime is now over.
It's work hours again.
No more talking about personal matters.
Hey, Young-woo!
Where are you going?
Hey…
Come in.
What brings you here?
Well…
Attorney Jang.
It's not a mistake
that the KCC imposed Raon
with a 300 billion won penalty surcharge.
Excuse me?
The KCC didn't accidentally add
a few too many zeros.
Then what is it?
Did you find the answer
as to why the KCC did that?
A MERE 100 MILLION WON PENALTY SURCHARGE
FOR 7 BILLION PERSONAL DATA LEAKS
"Over the past decade, there have been
seven billion personal data leaks,
but only light punishment
has been imposed."
"The strengthening of punishment
such as introducing a class action system
and expanding punitive damages is needed."
There are a lot of similar articles.
Public opinion on personal data leakage
is leaning toward the necessity
of strengthening punishment for companies.
So what?
The KCC read a few newspaper articles
and raised the penalty surcharge
from 100 million to 300 billion won
out of nowhere?
The Act on the Information
and Communications Network
is revised frequently.
Back when the KCC imposed penalties
of 70 million won and 100 million won
the law had set the maximum
penalty surcharge as 100 million won.
However, under the current law,
a penalty surcharge
of up to three percent of sales
related to the violation can be imposed.
Which is why it became possible
to fine 300 billion won.
She's so arrogant.
Sorry? I didn't quite catch that.
This is your first time
working with me, right?
Yes.
From now on,
there's only one rule you have to follow.
Don't say anything you haven't been asked
and don't do anything
you haven't been asked to do.
Understood?
Aren't those two rules?
What's that?
"Don't say anything
you haven't been asked," one.
"Don't do anything
you haven't been asked to do," one.
That's two in total.
Whether it's one or two,
do you understand?
Yes, I understand.
I brought some side dishes
for your mother, Attorney Jung.
I run a pub
so it seems like all these side dishes
should go with drinks.
Then she can have a drink with them.
It's hard to look after someone
while sober.
She quit drinking.
I see.
Thank you so much
for also thinking of my mother.
Gosh. No need to thank me.
I'm just glad your surgery went well.
I'll put the food in the fridge.
What's wrong, Attorney Woo?
Is something bothering you?
- Yes, something is bothering me.
- What is it?
I can't tell you the details
because of attorney-client privilege.
Then be vague about it
and don't get into the details.
Well…
What do I do
if a senior attorney on a case with me
will not listen to what I have to say?
Who's the senior attorney
on the case with you?
Attorney Jang.
Damn it.
Well, for your sake,
lowering yourself and not doing anything
that might set him off could be a way…
Where are you going?
Gosh.
Young-woo, he didn't mean that literally!
But…
You could never do that, right?
You don't even get
what "lower yourself" means.
Then what do I do?
Attorney Woo,
you have colleagues.
Talk to them.
If you can't get through
to a senior attorney,
have even more discussions
with your colleagues.
Its name reflects the fact
that it's a cyberattack
that targets the weak spot
of a specific individual or organization,
much like throwing a spear.
The attack on Raon's DB manager,
Mr. Choi Jin-pyo,
was also spear phishing.
The hacker used spear phishing
to get malware onto Mr. Choi's computer
and then proceeded with an APT attack.
In other words, the Advanced Persistent...
Plaintiff's counselor.
I appreciate the generous explanation,
but the plaintiff, defendant,
and judges here
all know what an APT attack is,
so can we move on?
Well…
You know what
an Advanced Persistent Threat is?
It means to attack the target
in a continuous, sophisticated manner.
Yes.
If this were a jury trial,
you would have to explain all the details.
But right now, it's just us,
and most of the people in the audience
seem to be reporters.
So why don't you just
get to your argument?
Sure.
Just a moment.
The tablet.
Jeez, I'm not a mind reader.
As such, to impose
such a huge penalty surcharge
of 300 billion won on Raon,
who is also a victim of this hacking,
is both a deviation and abuse
of discretionary power by the KCC.
It's neither a deviation nor an abuse
of discretionary power.
According to the Act on the Information
and Communications Network,
the defendant can impose on the plaintiff
a penalty surcharge of up to three percent
of sales related to the violation.
Raon's sales last year
were 30.3 trillion won.
The defendant could have imposed
a penalty surcharge of 900 billion won,
but took into account
the plaintiff's circumstances
and imposed only 300 billion won,
which is much less than
the maximum amount.
the defendant imposed penalties
of 70 million won
and 100 million won, respectively.
However, to impose 300 billion won
for the same issue
just because the law was revised
is far too unfair.
Forty million personal data records
were leaked due to Raon's carelessness.
They leaked the personal data
of the entire country...
It's not the entire country.
Korea's population is 50 million.
It would be more accurate to say
80 percent of the entire country.
Yes, Your Honor. I stand corrected.
They leaked the personal data
of 80 percent of the entire country.
How much would be fair then?
- That…
- The leaked data from this Raon incident
isn't just basic personal data.
Credit and financial transaction data
of 40 million people
have all been exposed.
But they're saying
that the penalty surcharge, which is only
one percent of their sales, is too much?
This kind of attitude
shows Raon's low level of awareness
of their users' personal data.
That is all.
What's important
in this situation is causation.
You know the difference
between an administrative fine
and a penalty surcharge, right?
No, not really.
Not having set up the idle timeout itself
falls under an administrative fine.
It's less than 30 million won at most.
But if not having
this idle timeout in place
is what caused this personal data breach,
then it falls under a penalty surcharge.
And the amount would also increase
to three percent of related sales.
All right.
So…
If an idle timeout
was set on Raon's servers,
could it have prevented
the personal data breach?
That's like asking,
"If the front door was locked,
would a thief still have been able
to steal from inside the house?"
It depends on the capability
of the hacker,
but we don't know who hacked us
because they haven't been caught yet.
But you're an expert.
I'm asking you to take a guess.
This is something that will decide whether
it's a 30 million won administrative fine
or a 300 billion won penalty surcharge.
Hey, Jin-pyo.
There was a keylogger in the malware
installed on your computer, right?
What?
Yes, there was.
A keylogger?
If a keylogger is installed,
they can see what is being typed.
If Jin-pyo typed his ID and password
to connect to the server,
they could see that too.
It would just take a bit longer
for them to get the information.
So even if the idle timeout was set,
it couldn't have prevented the hacking?
There's no causation between the two?
That's right.
Excuse me.
I just got a phone call.
Our users are filing
a class-action lawsuit against us.
A class-action lawsuit?
To claim damages
for the personal data breach.
Which law firm is representing them?
What law firm has nothing better to do
than take on this tiresome case?
It's…
Taesan Law Firm.
Taesan?
Apparently, they're recruiting litigants
through a website.
I found the website you just mentioned.
That was quick.
It's been less than a month
since the website launched
but there are already a million people.
It seems like they're planning to claim
100,000 won for each victim.
Attorney Jang, what do we do?
The penalty surcharge
isn't important anymore.
If they already have a million people
in less than a month,
it's only a matter of time
before they have 40 million.
And if 40 million people
each claim 100,000 won,
it's four trillion won in total.
That would be the end of us.
Raon will go bankrupt.
Sir, you need to be even calmer
in a situation like this.
This is how it is
for personal data breach cases.
In addition to
the liability under public law
of having to pay a fine or surcharge,
you'll also be expected to
bear liability under the "jurisdiction"
through civil lawsuits.
Now...
Please be mindful of your pronunciation.
What?
The way you pronounced it
refers to "jurisdiction."
The last syllable must be stressed
in the Korean word for "private law."
Although the two are spelled the same,
they mean completely different things
based on their pronunciation.
Attorney Woo.
Is that something
you should be saying to me right now?
Are you teaching me
how to pronounce words?
- Attorney Jang.
- Yes.
May I have a word with you?
- Let's go outside.
- Yes.
I looked into it
and he had been quite active
with Hana University's alumni association.
Who?
Our presiding judge.
Right. Hana University? Yes.
Can we use that to our advantage?
Excuse me?
Within the business industry,
we treat each other to dinners.
If things aren't too different
in the judicial world,
I was wondering
if we could benefit from it.
Right.
Yes, that's right.
"Raon, who failed to protect the personal
information of 40 million users,
filed a lawsuit
against the penalty surcharge,
which accounts for
only one percent of its sales."
"This fact in itself shows
Raon's ridiculous level of awareness
of their users' personal information."
My gosh.
Do you know how many articles
like this are up right now?
It's as if we're doing the trial
to set our client up for criticism.
I'm sorry.
The comments are even worse.
"They make 30 trillion a year,
but they're whining about 300 billion?"
"They leaked the personal data
of the entire country
but are acting like victims
for being hacked."
How did you set up your defense
for public opinion to be this bad?
The penalty surcharge that was
below 100 million won for a similar case
has skyrocketed to 300 billion won
this time.
Which is why we pointed out the KCC's
deviation and abuse of discretionary power
and raised the issue of fairness.
We'll find another way.
What other way?
We're thinking about claiming
that there is no direct causation
between the KCC's grounds
for their disposition and the hacking.
You know that the second round,
which is the class-action lawsuit
that Taesan is preparing,
is more important, right?
Yes, I'm aware.
We need to win this lawsuit
to have the upper hand
in the class-action lawsuit.
It's already bad enough to see
Taesan representing 40 million citizens.
But imagine us losing that fight.
Let's not make that our reality, okay?
Yes, ma'am.
I won't let that happen.
We'll win this.
Whatever it takes.
What's so important
about the pronunciation of a word?
What's so important about that?
What?
Attorney Choi,
you know how to get fired up.
Who cares as long as you can understand?
Why would you nitpick about that?
Things are different
from when we worked with Attorney Jung.
They are?
Of course, they are.
Attorney Jung is…
Well…
He's generous with you.
He just accepts or moves past
whatever weird thing you say.
"Don't say anything
you haven't been asked,
and don't do anything
you haven't been asked to do."
Yes, that's right.
Just stick to that.
ATTORNEY JANG SEUNG-JUN
Yes, Attorney Jang.
Yes, all right.
Okay.
- Where are you going?
- What?
He asked to see me.
Just you?
- Yes.
- Why?
I don't know.
I'll find out when I get there.
Are you sure this will be enough?
Should I have made
a reservation at a hostess bar?
We should start off lightly.
There are some people
who are uncomfortable
with things like that.
Okay.
Then,
should I not give this to him today?
Goodness. Well…
Why don't we see how things go?
Right.
It's this way.
What do you think you're doing?
Sir, as I told you...
You said there was
a Hana University alumnus in a tough spot.
Didn't you tell me I would just be giving
some light legal advice?
What kind of person do you think I am?
Sir. I am a Hana University alumnus
who's in a tough spot.
Please hear me out…
Even if it's just for five minutes.
This is undeniably
an improper solicitation attempt.
Be grateful
that I won't cause an issue with this,
and don't ever do this again.
Sir.
Sir!
Your Honor!
Gosh.
Your Honor!
Attorney Jang.
What do I do now?
What do I do?
Plaintiff.
Do you have anything else to claim?
This time…
You go ahead, Attorney Choi.
Right, okay.
We admit that the plaintiff
did not set the idle timeout.
In other words, a limit
on the maximum connection time.
But this is merely
a violation of protocol,
and thus, subject to an administrative
fine of less than 30 million won,
not a penalty surcharge
of 300 billion won.
Because there is no causation
between not setting up the idle timeout
and the hacking.
There's no causation?
No, Your Honor.
There was a keylogger within the malware
that the hacker installed
on Mr. Choi's computer.
The hacker would have been able to use
this keylogger to track everything
that was being typed
on Mr. Choi's computer.
Therefore, it would have only been
a matter of time for the hacker
to find out the ID and password
to connect to the server.
This means that
even if the plaintiff had set a limit
on the maximum connection time,
they wouldn't have been able
to prevent the personal data breach.
What does the defendant think
about the plaintiff's claim?
The causation between a limit
on the maximum connection time
and the personal data breach
is irrelevant.
Whether there is causation or not,
Raon is still subject to
a penalty surcharge.
- Excuse me?
- Irrelevant?
Why is that?
Because the day
the hacker broke into Raon's servers
and leaked users' personal data
was January 19, 2022,
which was when the Act on the Information
and Communications Network
was partially revised.
Act on Promotion of Information
and Communications Network Utilization
and Information Protection.
Article 64-3, Paragraph 1, Item 6.
Before it was revised,
it was the following.
"In the event in which measures
to protect personal data were not taken,
and therefore,
the user's personal information
is lost, stolen, leaked,
forged, altered, or damaged."
Yes, that's right.
Then do you also know how it was revised?
"In the event in which
the user's personal data
is lost, stolen, leaked,
forged, altered, or damaged
and no measures
to protect personal data were taken."
What's the difference?
Isn't it just the order of the phrasing
that has changed?
No.
Prior to the revision,
if the failure to take protective measures
toward personal data
is what caused the breach
of personal data,
then a penalty surcharge
would have been imposed.
Thus, it was clear that the inaction
had to be the cause of the breach.
However, the revised law states that
within a personal data breach,
in any event in which protective measures
toward personal data were not taken,
a penalty surcharge would be imposed.
Thus, if the breach and inaction
are both acknowledged,
the causation between the two
is irrelevant.
The defendant's counselor is right.
The court will also be more careful
in the interpretation of the legal text.
Your Honor.
Millions of users are deleting
their Raon accounts every day.
And the website
that's preparing the class-action lawsuit
already has more than ten million members.
We're losing users while the compensation
for damages is increasing.
A penalty surcharge of 300 billion won?
Was it that wrong for us
to not have set up an idle timeout?
Do we…
Do we…
Really have to pay this big of a price?
Why don't you calm down?
No other company has done its best
to satisfy users the way Raon has.
How are we supposed to stop a hacker
who is determined to break in?
To be disgraced as a company
that leaked the personal data
of the entire country
and to fall apart like this…
Is unfair.
It…
It really is…
Unfair!
In-cheol.
Hey, what did you just swallow?
Spit it out, man. Hey, In-cheol.
What's wrong, In-cheol?
In-cheol!
Help!
In-cheol.
In-cheol.
Help, please!
Go do something. Hurry.
- In-cheol.
- Sir.
Spit it out, man.
Someone, please help.
Call an ambulance!
Hey, In-cheol.
Is he okay?
Please help!
In-cheol…
We've done everything
that was needed for now.
We'll keep monitoring his condition.
Okay. Can I stay here for a little while?
His parents aren't here yet.
And I can't just
leave him alone like this.
The other nurses and I
will be here with him.
Visiting hours aren't over yet,
so of course, you can stay.
How is Mr. Bae In-cheol doing?
You are his attorneys, right?
We gave him an antidote.
But he swallowed quite a lot of cyanide.
Regarding recovery,
we'll have to keep observing him.
I'll explain further
once his family gets here.
Thank you.
Jun-ho, you said there were
a lot of reporters outside, right?
Yes.
Then you should get the car
out to the front.
So we can get in right away
without any reporters stopping us.
Yes, all right.
We should go too.
Okay.
Are those reporters out there
all waiting for us?
They're probably waiting for an update
on how the CEO of Raon is.
What are we supposed to do
in this sort of situation?
What do you think?
Just keep your mouth shut
and don't say a word.
All right.
Let's go.
What? Okay.
Are you the attorneys for Raon?
How is Mr. Bae doing?
When will the trial continue?
Is it true Mr. Bae ingested poison?
How did he bring poison
into the courtroom?
What exactly was the poison
that Mr. Bae In-cheol ingested?
- Give us a comment.
- Is he awake?
Get in!
Excuse me, coming through.
- Excuse me.
- Coming through.
- Excuse me.
- Excuse me.
- Give us a comment.
- Attorney Jang?
- What the…
- Over here! Hurry!
- Hey, wait. What is he doing?
- What?
- Wait.
- Let's go.
What about the other attorneys?
It's too late for them. Drive!
- What about us?
- We're still here!
Attorney Jang!
Jun-ho!
What about us?
That's so petty of you.
- Let's go.
- This is betrayal.
Coming through, excuse me.
Please!
Excuse me. Let us through.
The food is ready.
But why are we the only customers here?
So that the three of you
can talk comfortably.
We're just being considerate
of our regulars.
We usually don't have any customers
except for her.
But that's strange.
Gosh, that's hot.
All of your food is so good.
Especially this fish cake soup.
- My goodness, Hairy Boss.
- Yes.
He likes the fish cake soup.
Make some noise!
Then it's on the house.
Free food that is more expensive
than the actual menu.
I'll go make more.
He's excited.
Hey, so…
Anyway, what did Attorney Jang say
after singling you out?
Oh, that?
It was nothing.
Really?
I thought it was Hana University alumni
getting together to scheme.
Jeez, Attorney Choi. You're so prejudiced.
So it's okay for SNU alumni
to put their heads together,
but when Hana University alumni do it,
it's scheming?
Put heads together? When did I do that?
You just...
Causation is a principle of law.
Are you talking about the case?
"Criminal Law, Article 17, Causation."
"Any act which is not connected with
the danger which is an element of a crime
shall not be punishable for the results."
That doesn't pertain only to criminal law,
but also to civil law.
Then the administrative punishment
should also be like that.
To punish Raon so severely
with a penalty surcharge
when there is no causation between
their action and the personal data breach
doesn't correspond
to the principles of the law.
But no matter how much we claim that,
if the opposing attorney says,
"This trial isn't to debate
the fairness of the Act on the Information
and Communications Network,"
we can't say much else.
We're not going to request an adjudication
on the constitutionality of statutes.
You're right.
Why did the hacker
have to choose that day?
If it were a day earlier, it would
have ended with an administrative fine.
"A day earlier"?
Article 64-3, Paragraph 1, Item 6
of the Act on the Information
and Communications Network
was revised on January 19, 2022.
The day the hacker got into Raon's server
and stole users' personal data
was also January 19, 2022.
Yes, so? What is it?
What day did the hacker send
the email to Mr. Choi?
January 18, 2022, at 11:14 p.m.
Mr. Choi checked his email
and downloaded the attached file
on January 18, 2022, at 11:48 p.m.
Wait, so then this…
The hacking started
a day before the Act on the Information
and Communications Network was revised!
Do you think this is some sort of game?
The judge doesn't really like us
to begin with,
and you want me
to lead with that nonsense?
It's not nonsense.
According to Article 14, Paragraph 1 of
the General Act on Public Administration,
one may ask for a disposition
based on the law
at the time of the violation.
I also know Article 14, Paragraph 1 of
the General Act on Public Administration,
and that applies only to facts
completed or terminated
before the enforcement of the new law.
For Raon,
the hacking might have taken place
before the new law was enforced,
but didn't the personal data leak
occur after?
Didn't it?
There's still room for argument.
According to Article 14, Paragraph 3 of
the General Act on Public Administration,
even in the event in which the law
before the revision needs to be applied,
if the new law makes
the sanctions lenient,
the new law is required to be applied.
For Raon, it is much more advantageous
for the plaintiff
if the law before the revision is applied,
so there is room for adjustment
according to the judge...
Stop it already!
Attorney Woo.
Do you know the law that well?
Who do you think you are
to try to teach me?
If you're so great,
you can do it by yourself!
As of today, Attorney Woo,
you are off this case.
Why are you just standing there?
Get out right now!
Attorney Jang.
What do you have to say?
Yes, I'm Attorney Jang. So what?
It's nothing.
We'll be on our way too.
But...
What's wrong with you?
If you want to suck up to him,
do it by yourself.
Why are you stopping me
from saying something?
Not all of the senior attorneys
we'll be working with
will be like Attorney Jung.
We have to learn how to act accordingly.
You can learn, Attorney Kwon.
Young-woo was kicked off the case
for no reason.
Can you still not see that we're different
from Attorney Woo?
What?
Attorney Woo…
Is a genius.
She can do whatever she wants
and be kicked out like that,
and people will think of her as
a stubborn genius and understand her.
But we're different.
If we act like Attorney Woo,
we'll be treated as juniors
who can't please their seniors
and who are difficult to work with.
You're right.
You're so right
that it's getting on my nerves.
But can't you just be a fool for once?
"Fool"?
For your colleague.
For something you believe is right.
Can't you put down your tactics
and politics for a bit
and just be brave like a fool?
Why…
Why should I have to do that?
Because…
I like guys who are like that.
Attorney Woo.
Yes?
Why can't we be together?
Why on earth do we have to break up?
I've been thinking about it.
But I just can't figure out why.
I'm…
Not sure if I'm someone
who can make you happy.
I think I'm just someone
you have to take care of.
Did you hear…
What my sister
said to me?
Is that why?
Attorney Woo,
I'm happy just being with you.
For me to be happy, I have to be with you!
But haven't you ever felt lonely
when you were with me?
All of my thoughts
tend to center around me,
so I make people close to me lonely.
I don't know when or why I do that.
And I don't know what I can do to stop it.
I…
Like you.
But…
I'm afraid…
That I'll make you lonely.
What are you doing?
I want to say bye to Young-woo
before we leave.
Say bye?
Like "Bye, we're off to the trial
without you"?
Just get going.
Why do you care if I say bye or not?
Hurry up or you'll be late.
Come in.
Young-woo.
I'll see you later.
The Raon trial is today, remember?
Right.
Should I get you something on my way back?
What about Choi Su-yeon gimbap today,
instead of Woo Young-woo gimbap?
There's no such thing
as Choi Su-yeon gimbap.
No, there isn't.
I'm going now.
Okay.
Also, the fact that
the victims are preparing for
a large-scale compensation lawsuit
is an overwhelming mental burden
for the plaintiff.
Of course,
with a personal data breach,
liability under public law
and liability under the "jurisdiction"
must both be...
Please be mindful of your pronunciation.
Excuse me?
You must stress the last syllable
when pronouncing the Korean word
for "private law."
They mean completely different things
based on their pronunciation.
Yes.
Continue.
Right.
How did I pronounce…
Never mind.
I apologize.
I will correct myself.
I'm sorry.
Your Honor,
Article 64-3, Paragraph 1, Item 6
of the Act on the Information
and Communications Network
was revised and enforced
on January 19, 2022.
The hacker also got into Raon's server
and stole personal data that same day.
But the day the hacker sent
the email with malware
to the DB manager, Mr. Choi Jin-pyo,
was a day earlier, January 18, 2022.
And?
What's your point?
I'm saying that the hacking began one day
before the Act on the Information
and Communications Network was revised.
According to Article 14 of
the General Act on Public Administration,
which states new laws do not apply
to facts that were completed
or terminated before
the enforcement of the new law,
the plaintiff is subject
to an administrative fine,
not a penalty surcharge,
in accordance with the Act
before its revision.
Attorney Choi, what are you doing?
Can't you see I'm in the middle
of my closing argument?
Stop it. Do you think Attorney Woo
would like this?
This isn't about Young-woo.
I'm doing what I feel is right.
Your Honor, the hacking may have begun
on January 18th,
but the leak of personal data happened
on January 19th.
After the revised Act on the Information
and Communications Network was enforced.
With what standard does
the defendant's counselor determine
to be the line between hacking
and the leak of personal data?
Doesn't a theft begin
the moment a thief breaks into a house?
Choi Su-yeon.
One more word and you're off the case.
Am I clear?
Your Honor, Article 14 of
the General Act on Public Administration,
which the plaintiff's counselor mentioned
as grounds for refutation,
only applies to facts
that were completed or terminated
before the enforcement of the new law.
Please make the judgment based on
when the leak of personal data ended,
not when the hacking began.
Your…
Let go!
According to Article 14, Paragraph 3 of
the General Act on Public Administration,
even in the event in which the law
before its revision needs to be applied,
if the new law
makes the sanctions lenient,
then application of
the new law is required.
In this case,
it is advantageous for the plaintiff
if the law before the revision is applied.
"When in doubt, rule for the accused,"
should not be a principle
that only applies to criminal law.
I plead for your broad generosity
in understanding
the plaintiff's circumstances.
That is an interesting point.
I'll make a decision
after careful deliberation.
Thank you.
That is all.
WOO YOUNG-WOO GIMBAP
There are a few resorts across the country
that can be used
with the Hanbada employee membership.
Pick whichever one you want,
and take a couple of months off
with Young-woo.
Think of it as a paid vacation.
Is this really necessary?
I can stop it for now,
but once the article is out,
reporters will be
all over Attorney Woo too.
Just lay low until things die down.
She can return to Hanbada afterward.
Return?
Return to Hanbada
after the whole world finds out
that she's Tae Su-mi's daughter
who was born out of wedlock?
Will she be able to have a proper career
with that label on her?
Look.
You said you'd allow it once.
You said you'd allow me to use
Attorney Woo to get Tae Su-mi
in return for giving her a job at Hanbada.
Why are you going back on your word?
Seon-young.
Is there no other way?
Is there really no other way
besides revealing it to the press?
I've put much thought into it too.
As of right now,
this is the best I can do
for you and Attorney Woo.
Raon, the online shopping mall that had
a personal data breach of 40 million
due to their inability to stop the hack,
has won the lawsuit for the cancellation
of the 300 billion won penalty surcharge
imposed by the KCC.
The Seoul Administrative Court cited
Raon's negligence of access control,
including the absence of a limit
on maximum connection time,
but recognized that it was not
the direct cause
of the personal data breach
and ruled in favor of the plaintiff.
Meanwhile, Raon's co-CEO, Bae In-cheol,
who collapsed after ingesting poison
during the trial,
is receiving treatment
but has been confirmed
as still being unconscious.
Mr. Bae had complained
of the unfairness by stating
"No other company has done its best
to satisfy users the way Raon has,"
and "How are we supposed to stop a hacker
who is determined to break in?"
After which he ingested
the poison he had prepared in advance...
The person you are trying to reach
is unavailable.
Please leave a message after the tone.
Hey, I just saw the news.
Is In-cheol still unconscious?
You told me he was fine.
You said he was awake now.
Please answer the phone.
Don't make me have to hack you
to get your location too.
Answer your…
What is it?
What do you mean?
I'm home early.
Let's have dinner together.
Why did you come to see me?
Because I don't think you'll do
what my mom tells you to.
Me?
I'm just curious about
what you decide to do, Attorney Woo.
I'll meet with Attorney Tae and ask her
to allow Sang-hyeon to testify in court.
How are you going to convince Tae Su-mi?
Will she even meet with you
when her confirmation hearing is so close?
You weren't a good mother to me,
but at the very least,
please be a good mother to Sang-hyeon.
Subtitle translation by: Hyun-soo Cho
There's no way it says it's sold out.
I checked that it's already been shipped.
Yes.
It should arrive sometime in the morning
of the ninth for you.
CHOI JIN-PYO
I did check the size.
All right. Have a good one.
Hello, this is Raon.
Gosh.
Yes, ma'am.
Yes, the item you returned
was confirmed to be defective.
Yes.
CHOI JIN-HO: I REWROTE MY COVER LETTER
LIKE YOU TOLD ME TO!
- That was fast.
- Or would you prefer to get a refund?
ATTACHED FILE: COVER LETTER.DOC
DOWNLOADING
DOCUMENT CREATED WITH APPLICATION
PROGRAHM NOT RELATED TO MACROSOFT OFFICE
ALLOW CONTENT
What?
Hey, Jin-pyo. What's up?
Your cover letter file won't open.
Send it again.
I'll take a look at it at home.
I didn't send it to you.
You didn't?
What?
What?
I'll see you tomorrow.
Mr. Choi!
What?
What?
Jin-pyo.
Jin-pyo?
What's wrong?
Sir, I…
I think they got me.
What do you mean?
Spear Phishing.
CASE 15
SAYING AND DOING THINGS NOT ASKED
I don't think…
You and I should date.
Why are you saying that all of a sudden?
I'm sorry.
You have to stay strong, okay?
I am staying strong.
- I'm fine. Don't worry.
- All right.
Attorney Jung!
What?
Attorney Woo.
What brings you here?
The subway brought me here.
No. I mean…
Why are you here
when you should be at work?
Right. I wanted to see you, Attorney Jung.
Because if something goes wrong
and you die,
I won't be able to see you again.
Excuse me?
Mom.
Attorney Woo didn't mean it in a bad way.
Say hi. This is my mom.
Hello. My name is Woo Young-woo.
Whether it's read straight or flipped,
it's still Woo Young-woo.
Kayak, deed, rotator,
noon, race car, Woo Young-woo.
- What?
- Mom, I told you.
Korea's number one in the world
in treating stomach cancer.
So with surgery,
the survival rate is over 70 percent.
Don't worry.
That's because that number
also includes cases of early detection.
With stage three stomach cancer like you,
the 5-year survival rate after surgery
is only 30 to 40 percent...
Shall we go in?
Yes.
Myeong-seok. Hang in there, okay?
- I'll be here.
- I'll see you later.
Please! Come back alive!
Attorney Woo.
Be quiet.
Please! Come back alive!
- You got this.
- Be quiet.
Please.
Namu Gwanseeumbosal.
Hello?
Where are you?
Come to the conference room.
We have a meeting
with our newly assigned clients.
I'm not at work right now.
Then hurry up and get here
as fast as you can.
Right, okay.
It's a bit awkward to say this myself,
but certain people are cut out
for certain jobs, right?
Hanbada has a lot of good attorneys.
But for these corporate cases,
especially in tech, I…
There's another attorney on this case.
She must be here.
Come in.
As I was saying…
Come in already.
Why are you just standing there?
Our clients are here.
Right.
The shock of moving
from one space to another
is very overwhelming for me.
If I count to three and take a deep breath
before going in,
it lessens the shock a bit.
That happens to me sometimes too.
It's uncomfortable when
the space I'm in suddenly changes.
She's quite brave.
I don't want other people
to think I'm weird,
so I pretend that I'm not uncomfortable
even when I am.
Is something like that
funny to you right now?
Does it make you laugh?
Nothing's changed since we were in school.
I'm always the one
who takes things seriously.
Did you two go to the same university?
No, I didn't go to university.
We went to high school together.
And I graduated from Hana University.
Hana University?
Hey!
I mean, we're alumni.
I was a freshman
at Hana University in 2000.
I was a freshman in '97.
I was a freshman in '13.
In '13? Gosh, you're a baby.
Baby?
When I was in school,
you came as a special lecturer,
and it was very inspiring.
I couldn't believe
an alumnus from our school
created the online shopping mall
that the whole country uses.
- Gosh, you flatter me.
- You're really amazing.
Well…
It's not the whole country.
Based on a recent survey,
the number of Raon users is 40,954,173,
but the total population of Korea
is 51,628,117.
Same difference.
It means more than 80 percent
of the entire population uses Raon.
It really is amazing.
Amazing?
We're about to go under.
Shall we get back to business?
- Right.
- Yes.
So the employee in charge of the database
received an email from a hacker?
The hacker hacked into the in box
of our employee in charge of the DB
and was aware of everything
he and his younger brother had discussed.
He even sent the email
using the younger brother's exact tone.
If the attachment containing the malware
was an executable installation file,
our DB manager
would have been more careful.
But since it was a document file,
he didn't think much of it.
I didn't know malware could be spread
with Word files.
Yes, it's possible.
And since it was malware
that was specially made
to attack a specific target,
it wasn't detected
by the anti-malware software.
Was the hacker caught?
No, the police think
it was done by North Korea's
Reconnaissance General Bureau.
But we're not sure yet.
North Korea's RGB?
Just a moment.
Will you take a quick look at this? Here.
Notice anything odd?
- "Prograhm"?
- Yes.
Apparently, North Koreans
spell "program" as "prograhm."
This probably isn't the only reason
they suspect North Korea,
but they're investigating.
If North Korea really is responsible,
it's going to be difficult
to catch the hacker.
Since political issues
will be involved as well.
No, the even bigger problem is
the Korea Communications Commission.
They imposed a 300 billion won
penalty surcharge on us.
And that's why we came to you.
If you think about it, we're victims
of a North Korean cyberattack.
Fining us 300 billion won just because
we couldn't safeguard some personal data?
That's just ridiculous, isn't it?
When the hacker broke into
our DB manager's computer,
the terminal connecting to the DB server
was up on the screen and still logged in.
So from the hacker's perspective,
he didn't have to go through
the trouble of finding out
the manager's ID and password
to connect to the server.
And this is what the KCC
is taking issue with.
That we didn't set an idle timeout
on our DB server properly.
By "idle timeout,"
you mean a "limitation on
the maximum connection time," right?
Yes.
After a certain amount of time,
the connection
would be blocked automatically.
You're not connected to the server
any longer than what's necessary.
And Raon's DB server
didn't have this setting in place?
No.
We didn't set it up.
From what I see,
I think the KCC accidentally added
a few too many zeros.
- What?
- What?
Do you know how much Aha paid
for their penalty surcharge?
No, we don't.
There was an estimated leak
of two million accounts,
and they paid 70 million won.
What?
Yes. Meanwhile, JP Communications
had an even bigger breach.
Almost ten million accounts.
But their penalty surcharge
was a mere 100 million won.
Then why would they ask us
to pay 300 billion won?
Is it because our personal data breach
is the biggest?
Well, the data of more than
40 million people was leaked.
Forty million is nearly the entire…
I mean, it's 80 percent
of the population, right?
But…
It's not like we lost
40 million people's assets.
It's just personal data, right?
When most Korean people
make accounts online,
aren't they aware that their personal data
could be leaked?
Then why are they being like this to us?
The KCC couldn't have made a mistake
by adding too many zeros, right?
Of course not.
Well…
I know some people at the KCC.
I'll see if I can get the full picture
as to why the KCC did this
and how this is proceeding over there.
By the way,
no corporation has ever lost a trial
against the KCC so far.
The KCC is a government organization,
so they can't hire an expensive law firm.
So they always lose to corporations
that work with major law firms.
It'll be the same this time too.
Don't worry.
My fellow alumni.
What? I can't sit here?
There are plenty of other seats.
Okay.
Or you can just sit.
We've eaten together before.
Gosh, you keep changing your mind.
Right.
He and Young-woo broke up.
I didn't realize that Jun-ho
would be eating by himself.
Should we go join him at his table?
I don't think that will be necessary.
Jun-ho. You're eating by yourself today?
Can I sit here?
Sure.
- Jun-ho, you like sausages too?
- Right.
Jun-ho is Mr. Popularity of Hanbada.
He sure is.
Who were you worried about again?
- That color looks so good on you.
- I know, right?
Have some of this too.
A MERE 100 MILLION WON PENALTY SURCHARGE
FOR 7 BILLION PERSONAL DATA LEAKS
Come in.
Gosh, I knew it.
Why are you eating alone
cooped up in your office?
Right.
I have work to do.
That's all the more reason
to go outside for lunch.
You should also eat lunch
and have coffee with other guys.
The weather is so nice today.
What happened with Jun-ho?
What do you mean?
I heard you called things off.
Why did you do that?
Well…
You didn't even give him
a proper explanation?
No.
Are you serious?
That's so rude.
You called things off
and you still haven't told him why?
I don't think it's appropriate to discuss
personal matters during work hours.
It's lunchtime right now.
Then should we talk about whales?
Lunchtime is when I usually talk...
No, I don't want to.
Just answer my question.
What are you doing?
Lunchtime is now over.
It's work hours again.
No more talking about personal matters.
Hey, Young-woo!
Where are you going?
Hey…
Come in.
What brings you here?
Well…
Attorney Jang.
It's not a mistake
that the KCC imposed Raon
with a 300 billion won penalty surcharge.
Excuse me?
The KCC didn't accidentally add
a few too many zeros.
Then what is it?
Did you find the answer
as to why the KCC did that?
A MERE 100 MILLION WON PENALTY SURCHARGE
FOR 7 BILLION PERSONAL DATA LEAKS
"Over the past decade, there have been
seven billion personal data leaks,
but only light punishment
has been imposed."
"The strengthening of punishment
such as introducing a class action system
and expanding punitive damages is needed."
There are a lot of similar articles.
Public opinion on personal data leakage
is leaning toward the necessity
of strengthening punishment for companies.
So what?
The KCC read a few newspaper articles
and raised the penalty surcharge
from 100 million to 300 billion won
out of nowhere?
The Act on the Information
and Communications Network
is revised frequently.
Back when the KCC imposed penalties
of 70 million won and 100 million won
the law had set the maximum
penalty surcharge as 100 million won.
However, under the current law,
a penalty surcharge
of up to three percent of sales
related to the violation can be imposed.
Which is why it became possible
to fine 300 billion won.
She's so arrogant.
Sorry? I didn't quite catch that.
This is your first time
working with me, right?
Yes.
From now on,
there's only one rule you have to follow.
Don't say anything you haven't been asked
and don't do anything
you haven't been asked to do.
Understood?
Aren't those two rules?
What's that?
"Don't say anything
you haven't been asked," one.
"Don't do anything
you haven't been asked to do," one.
That's two in total.
Whether it's one or two,
do you understand?
Yes, I understand.
I brought some side dishes
for your mother, Attorney Jung.
I run a pub
so it seems like all these side dishes
should go with drinks.
Then she can have a drink with them.
It's hard to look after someone
while sober.
She quit drinking.
I see.
Thank you so much
for also thinking of my mother.
Gosh. No need to thank me.
I'm just glad your surgery went well.
I'll put the food in the fridge.
What's wrong, Attorney Woo?
Is something bothering you?
- Yes, something is bothering me.
- What is it?
I can't tell you the details
because of attorney-client privilege.
Then be vague about it
and don't get into the details.
Well…
What do I do
if a senior attorney on a case with me
will not listen to what I have to say?
Who's the senior attorney
on the case with you?
Attorney Jang.
Damn it.
Well, for your sake,
lowering yourself and not doing anything
that might set him off could be a way…
Where are you going?
Gosh.
Young-woo, he didn't mean that literally!
But…
You could never do that, right?
You don't even get
what "lower yourself" means.
Then what do I do?
Attorney Woo,
you have colleagues.
Talk to them.
If you can't get through
to a senior attorney,
have even more discussions
with your colleagues.
Its name reflects the fact
that it's a cyberattack
that targets the weak spot
of a specific individual or organization,
much like throwing a spear.
The attack on Raon's DB manager,
Mr. Choi Jin-pyo,
was also spear phishing.
The hacker used spear phishing
to get malware onto Mr. Choi's computer
and then proceeded with an APT attack.
In other words, the Advanced Persistent...
Plaintiff's counselor.
I appreciate the generous explanation,
but the plaintiff, defendant,
and judges here
all know what an APT attack is,
so can we move on?
Well…
You know what
an Advanced Persistent Threat is?
It means to attack the target
in a continuous, sophisticated manner.
Yes.
If this were a jury trial,
you would have to explain all the details.
But right now, it's just us,
and most of the people in the audience
seem to be reporters.
So why don't you just
get to your argument?
Sure.
Just a moment.
The tablet.
Jeez, I'm not a mind reader.
As such, to impose
such a huge penalty surcharge
of 300 billion won on Raon,
who is also a victim of this hacking,
is both a deviation and abuse
of discretionary power by the KCC.
It's neither a deviation nor an abuse
of discretionary power.
According to the Act on the Information
and Communications Network,
the defendant can impose on the plaintiff
a penalty surcharge of up to three percent
of sales related to the violation.
Raon's sales last year
were 30.3 trillion won.
The defendant could have imposed
a penalty surcharge of 900 billion won,
but took into account
the plaintiff's circumstances
and imposed only 300 billion won,
which is much less than
the maximum amount.
the defendant imposed penalties
of 70 million won
and 100 million won, respectively.
However, to impose 300 billion won
for the same issue
just because the law was revised
is far too unfair.
Forty million personal data records
were leaked due to Raon's carelessness.
They leaked the personal data
of the entire country...
It's not the entire country.
Korea's population is 50 million.
It would be more accurate to say
80 percent of the entire country.
Yes, Your Honor. I stand corrected.
They leaked the personal data
of 80 percent of the entire country.
How much would be fair then?
- That…
- The leaked data from this Raon incident
isn't just basic personal data.
Credit and financial transaction data
of 40 million people
have all been exposed.
But they're saying
that the penalty surcharge, which is only
one percent of their sales, is too much?
This kind of attitude
shows Raon's low level of awareness
of their users' personal data.
That is all.
What's important
in this situation is causation.
You know the difference
between an administrative fine
and a penalty surcharge, right?
No, not really.
Not having set up the idle timeout itself
falls under an administrative fine.
It's less than 30 million won at most.
But if not having
this idle timeout in place
is what caused this personal data breach,
then it falls under a penalty surcharge.
And the amount would also increase
to three percent of related sales.
All right.
So…
If an idle timeout
was set on Raon's servers,
could it have prevented
the personal data breach?
That's like asking,
"If the front door was locked,
would a thief still have been able
to steal from inside the house?"
It depends on the capability
of the hacker,
but we don't know who hacked us
because they haven't been caught yet.
But you're an expert.
I'm asking you to take a guess.
This is something that will decide whether
it's a 30 million won administrative fine
or a 300 billion won penalty surcharge.
Hey, Jin-pyo.
There was a keylogger in the malware
installed on your computer, right?
What?
Yes, there was.
A keylogger?
If a keylogger is installed,
they can see what is being typed.
If Jin-pyo typed his ID and password
to connect to the server,
they could see that too.
It would just take a bit longer
for them to get the information.
So even if the idle timeout was set,
it couldn't have prevented the hacking?
There's no causation between the two?
That's right.
Excuse me.
I just got a phone call.
Our users are filing
a class-action lawsuit against us.
A class-action lawsuit?
To claim damages
for the personal data breach.
Which law firm is representing them?
What law firm has nothing better to do
than take on this tiresome case?
It's…
Taesan Law Firm.
Taesan?
Apparently, they're recruiting litigants
through a website.
I found the website you just mentioned.
That was quick.
It's been less than a month
since the website launched
but there are already a million people.
It seems like they're planning to claim
100,000 won for each victim.
Attorney Jang, what do we do?
The penalty surcharge
isn't important anymore.
If they already have a million people
in less than a month,
it's only a matter of time
before they have 40 million.
And if 40 million people
each claim 100,000 won,
it's four trillion won in total.
That would be the end of us.
Raon will go bankrupt.
Sir, you need to be even calmer
in a situation like this.
This is how it is
for personal data breach cases.
In addition to
the liability under public law
of having to pay a fine or surcharge,
you'll also be expected to
bear liability under the "jurisdiction"
through civil lawsuits.
Now...
Please be mindful of your pronunciation.
What?
The way you pronounced it
refers to "jurisdiction."
The last syllable must be stressed
in the Korean word for "private law."
Although the two are spelled the same,
they mean completely different things
based on their pronunciation.
Attorney Woo.
Is that something
you should be saying to me right now?
Are you teaching me
how to pronounce words?
- Attorney Jang.
- Yes.
May I have a word with you?
- Let's go outside.
- Yes.
I looked into it
and he had been quite active
with Hana University's alumni association.
Who?
Our presiding judge.
Right. Hana University? Yes.
Can we use that to our advantage?
Excuse me?
Within the business industry,
we treat each other to dinners.
If things aren't too different
in the judicial world,
I was wondering
if we could benefit from it.
Right.
Yes, that's right.
"Raon, who failed to protect the personal
information of 40 million users,
filed a lawsuit
against the penalty surcharge,
which accounts for
only one percent of its sales."
"This fact in itself shows
Raon's ridiculous level of awareness
of their users' personal information."
My gosh.
Do you know how many articles
like this are up right now?
It's as if we're doing the trial
to set our client up for criticism.
I'm sorry.
The comments are even worse.
"They make 30 trillion a year,
but they're whining about 300 billion?"
"They leaked the personal data
of the entire country
but are acting like victims
for being hacked."
How did you set up your defense
for public opinion to be this bad?
The penalty surcharge that was
below 100 million won for a similar case
has skyrocketed to 300 billion won
this time.
Which is why we pointed out the KCC's
deviation and abuse of discretionary power
and raised the issue of fairness.
We'll find another way.
What other way?
We're thinking about claiming
that there is no direct causation
between the KCC's grounds
for their disposition and the hacking.
You know that the second round,
which is the class-action lawsuit
that Taesan is preparing,
is more important, right?
Yes, I'm aware.
We need to win this lawsuit
to have the upper hand
in the class-action lawsuit.
It's already bad enough to see
Taesan representing 40 million citizens.
But imagine us losing that fight.
Let's not make that our reality, okay?
Yes, ma'am.
I won't let that happen.
We'll win this.
Whatever it takes.
What's so important
about the pronunciation of a word?
What's so important about that?
What?
Attorney Choi,
you know how to get fired up.
Who cares as long as you can understand?
Why would you nitpick about that?
Things are different
from when we worked with Attorney Jung.
They are?
Of course, they are.
Attorney Jung is…
Well…
He's generous with you.
He just accepts or moves past
whatever weird thing you say.
"Don't say anything
you haven't been asked,
and don't do anything
you haven't been asked to do."
Yes, that's right.
Just stick to that.
ATTORNEY JANG SEUNG-JUN
Yes, Attorney Jang.
Yes, all right.
Okay.
- Where are you going?
- What?
He asked to see me.
Just you?
- Yes.
- Why?
I don't know.
I'll find out when I get there.
Are you sure this will be enough?
Should I have made
a reservation at a hostess bar?
We should start off lightly.
There are some people
who are uncomfortable
with things like that.
Okay.
Then,
should I not give this to him today?
Goodness. Well…
Why don't we see how things go?
Right.
It's this way.
What do you think you're doing?
Sir, as I told you...
You said there was
a Hana University alumnus in a tough spot.
Didn't you tell me I would just be giving
some light legal advice?
What kind of person do you think I am?
Sir. I am a Hana University alumnus
who's in a tough spot.
Please hear me out…
Even if it's just for five minutes.
This is undeniably
an improper solicitation attempt.
Be grateful
that I won't cause an issue with this,
and don't ever do this again.
Sir.
Sir!
Your Honor!
Gosh.
Your Honor!
Attorney Jang.
What do I do now?
What do I do?
Plaintiff.
Do you have anything else to claim?
This time…
You go ahead, Attorney Choi.
Right, okay.
We admit that the plaintiff
did not set the idle timeout.
In other words, a limit
on the maximum connection time.
But this is merely
a violation of protocol,
and thus, subject to an administrative
fine of less than 30 million won,
not a penalty surcharge
of 300 billion won.
Because there is no causation
between not setting up the idle timeout
and the hacking.
There's no causation?
No, Your Honor.
There was a keylogger within the malware
that the hacker installed
on Mr. Choi's computer.
The hacker would have been able to use
this keylogger to track everything
that was being typed
on Mr. Choi's computer.
Therefore, it would have only been
a matter of time for the hacker
to find out the ID and password
to connect to the server.
This means that
even if the plaintiff had set a limit
on the maximum connection time,
they wouldn't have been able
to prevent the personal data breach.
What does the defendant think
about the plaintiff's claim?
The causation between a limit
on the maximum connection time
and the personal data breach
is irrelevant.
Whether there is causation or not,
Raon is still subject to
a penalty surcharge.
- Excuse me?
- Irrelevant?
Why is that?
Because the day
the hacker broke into Raon's servers
and leaked users' personal data
was January 19, 2022,
which was when the Act on the Information
and Communications Network
was partially revised.
Act on Promotion of Information
and Communications Network Utilization
and Information Protection.
Article 64-3, Paragraph 1, Item 6.
Before it was revised,
it was the following.
"In the event in which measures
to protect personal data were not taken,
and therefore,
the user's personal information
is lost, stolen, leaked,
forged, altered, or damaged."
Yes, that's right.
Then do you also know how it was revised?
"In the event in which
the user's personal data
is lost, stolen, leaked,
forged, altered, or damaged
and no measures
to protect personal data were taken."
What's the difference?
Isn't it just the order of the phrasing
that has changed?
No.
Prior to the revision,
if the failure to take protective measures
toward personal data
is what caused the breach
of personal data,
then a penalty surcharge
would have been imposed.
Thus, it was clear that the inaction
had to be the cause of the breach.
However, the revised law states that
within a personal data breach,
in any event in which protective measures
toward personal data were not taken,
a penalty surcharge would be imposed.
Thus, if the breach and inaction
are both acknowledged,
the causation between the two
is irrelevant.
The defendant's counselor is right.
The court will also be more careful
in the interpretation of the legal text.
Your Honor.
Millions of users are deleting
their Raon accounts every day.
And the website
that's preparing the class-action lawsuit
already has more than ten million members.
We're losing users while the compensation
for damages is increasing.
A penalty surcharge of 300 billion won?
Was it that wrong for us
to not have set up an idle timeout?
Do we…
Do we…
Really have to pay this big of a price?
Why don't you calm down?
No other company has done its best
to satisfy users the way Raon has.
How are we supposed to stop a hacker
who is determined to break in?
To be disgraced as a company
that leaked the personal data
of the entire country
and to fall apart like this…
Is unfair.
It…
It really is…
Unfair!
In-cheol.
Hey, what did you just swallow?
Spit it out, man. Hey, In-cheol.
What's wrong, In-cheol?
In-cheol!
Help!
In-cheol.
In-cheol.
Help, please!
Go do something. Hurry.
- In-cheol.
- Sir.
Spit it out, man.
Someone, please help.
Call an ambulance!
Hey, In-cheol.
Is he okay?
Please help!
In-cheol…
We've done everything
that was needed for now.
We'll keep monitoring his condition.
Okay. Can I stay here for a little while?
His parents aren't here yet.
And I can't just
leave him alone like this.
The other nurses and I
will be here with him.
Visiting hours aren't over yet,
so of course, you can stay.
How is Mr. Bae In-cheol doing?
You are his attorneys, right?
We gave him an antidote.
But he swallowed quite a lot of cyanide.
Regarding recovery,
we'll have to keep observing him.
I'll explain further
once his family gets here.
Thank you.
Jun-ho, you said there were
a lot of reporters outside, right?
Yes.
Then you should get the car
out to the front.
So we can get in right away
without any reporters stopping us.
Yes, all right.
We should go too.
Okay.
Are those reporters out there
all waiting for us?
They're probably waiting for an update
on how the CEO of Raon is.
What are we supposed to do
in this sort of situation?
What do you think?
Just keep your mouth shut
and don't say a word.
All right.
Let's go.
What? Okay.
Are you the attorneys for Raon?
How is Mr. Bae doing?
When will the trial continue?
Is it true Mr. Bae ingested poison?
How did he bring poison
into the courtroom?
What exactly was the poison
that Mr. Bae In-cheol ingested?
- Give us a comment.
- Is he awake?
Get in!
Excuse me, coming through.
- Excuse me.
- Coming through.
- Excuse me.
- Excuse me.
- Give us a comment.
- Attorney Jang?
- What the…
- Over here! Hurry!
- Hey, wait. What is he doing?
- What?
- Wait.
- Let's go.
What about the other attorneys?
It's too late for them. Drive!
- What about us?
- We're still here!
Attorney Jang!
Jun-ho!
What about us?
That's so petty of you.
- Let's go.
- This is betrayal.
Coming through, excuse me.
Please!
Excuse me. Let us through.
The food is ready.
But why are we the only customers here?
So that the three of you
can talk comfortably.
We're just being considerate
of our regulars.
We usually don't have any customers
except for her.
But that's strange.
Gosh, that's hot.
All of your food is so good.
Especially this fish cake soup.
- My goodness, Hairy Boss.
- Yes.
He likes the fish cake soup.
Make some noise!
Then it's on the house.
Free food that is more expensive
than the actual menu.
I'll go make more.
He's excited.
Hey, so…
Anyway, what did Attorney Jang say
after singling you out?
Oh, that?
It was nothing.
Really?
I thought it was Hana University alumni
getting together to scheme.
Jeez, Attorney Choi. You're so prejudiced.
So it's okay for SNU alumni
to put their heads together,
but when Hana University alumni do it,
it's scheming?
Put heads together? When did I do that?
You just...
Causation is a principle of law.
Are you talking about the case?
"Criminal Law, Article 17, Causation."
"Any act which is not connected with
the danger which is an element of a crime
shall not be punishable for the results."
That doesn't pertain only to criminal law,
but also to civil law.
Then the administrative punishment
should also be like that.
To punish Raon so severely
with a penalty surcharge
when there is no causation between
their action and the personal data breach
doesn't correspond
to the principles of the law.
But no matter how much we claim that,
if the opposing attorney says,
"This trial isn't to debate
the fairness of the Act on the Information
and Communications Network,"
we can't say much else.
We're not going to request an adjudication
on the constitutionality of statutes.
You're right.
Why did the hacker
have to choose that day?
If it were a day earlier, it would
have ended with an administrative fine.
"A day earlier"?
Article 64-3, Paragraph 1, Item 6
of the Act on the Information
and Communications Network
was revised on January 19, 2022.
The day the hacker got into Raon's server
and stole users' personal data
was also January 19, 2022.
Yes, so? What is it?
What day did the hacker send
the email to Mr. Choi?
January 18, 2022, at 11:14 p.m.
Mr. Choi checked his email
and downloaded the attached file
on January 18, 2022, at 11:48 p.m.
Wait, so then this…
The hacking started
a day before the Act on the Information
and Communications Network was revised!
Do you think this is some sort of game?
The judge doesn't really like us
to begin with,
and you want me
to lead with that nonsense?
It's not nonsense.
According to Article 14, Paragraph 1 of
the General Act on Public Administration,
one may ask for a disposition
based on the law
at the time of the violation.
I also know Article 14, Paragraph 1 of
the General Act on Public Administration,
and that applies only to facts
completed or terminated
before the enforcement of the new law.
For Raon,
the hacking might have taken place
before the new law was enforced,
but didn't the personal data leak
occur after?
Didn't it?
There's still room for argument.
According to Article 14, Paragraph 3 of
the General Act on Public Administration,
even in the event in which the law
before the revision needs to be applied,
if the new law makes
the sanctions lenient,
the new law is required to be applied.
For Raon, it is much more advantageous
for the plaintiff
if the law before the revision is applied,
so there is room for adjustment
according to the judge...
Stop it already!
Attorney Woo.
Do you know the law that well?
Who do you think you are
to try to teach me?
If you're so great,
you can do it by yourself!
As of today, Attorney Woo,
you are off this case.
Why are you just standing there?
Get out right now!
Attorney Jang.
What do you have to say?
Yes, I'm Attorney Jang. So what?
It's nothing.
We'll be on our way too.
But...
What's wrong with you?
If you want to suck up to him,
do it by yourself.
Why are you stopping me
from saying something?
Not all of the senior attorneys
we'll be working with
will be like Attorney Jung.
We have to learn how to act accordingly.
You can learn, Attorney Kwon.
Young-woo was kicked off the case
for no reason.
Can you still not see that we're different
from Attorney Woo?
What?
Attorney Woo…
Is a genius.
She can do whatever she wants
and be kicked out like that,
and people will think of her as
a stubborn genius and understand her.
But we're different.
If we act like Attorney Woo,
we'll be treated as juniors
who can't please their seniors
and who are difficult to work with.
You're right.
You're so right
that it's getting on my nerves.
But can't you just be a fool for once?
"Fool"?
For your colleague.
For something you believe is right.
Can't you put down your tactics
and politics for a bit
and just be brave like a fool?
Why…
Why should I have to do that?
Because…
I like guys who are like that.
Attorney Woo.
Yes?
Why can't we be together?
Why on earth do we have to break up?
I've been thinking about it.
But I just can't figure out why.
I'm…
Not sure if I'm someone
who can make you happy.
I think I'm just someone
you have to take care of.
Did you hear…
What my sister
said to me?
Is that why?
Attorney Woo,
I'm happy just being with you.
For me to be happy, I have to be with you!
But haven't you ever felt lonely
when you were with me?
All of my thoughts
tend to center around me,
so I make people close to me lonely.
I don't know when or why I do that.
And I don't know what I can do to stop it.
I…
Like you.
But…
I'm afraid…
That I'll make you lonely.
What are you doing?
I want to say bye to Young-woo
before we leave.
Say bye?
Like "Bye, we're off to the trial
without you"?
Just get going.
Why do you care if I say bye or not?
Hurry up or you'll be late.
Come in.
Young-woo.
I'll see you later.
The Raon trial is today, remember?
Right.
Should I get you something on my way back?
What about Choi Su-yeon gimbap today,
instead of Woo Young-woo gimbap?
There's no such thing
as Choi Su-yeon gimbap.
No, there isn't.
I'm going now.
Okay.
Also, the fact that
the victims are preparing for
a large-scale compensation lawsuit
is an overwhelming mental burden
for the plaintiff.
Of course,
with a personal data breach,
liability under public law
and liability under the "jurisdiction"
must both be...
Please be mindful of your pronunciation.
Excuse me?
You must stress the last syllable
when pronouncing the Korean word
for "private law."
They mean completely different things
based on their pronunciation.
Yes.
Continue.
Right.
How did I pronounce…
Never mind.
I apologize.
I will correct myself.
I'm sorry.
Your Honor,
Article 64-3, Paragraph 1, Item 6
of the Act on the Information
and Communications Network
was revised and enforced
on January 19, 2022.
The hacker also got into Raon's server
and stole personal data that same day.
But the day the hacker sent
the email with malware
to the DB manager, Mr. Choi Jin-pyo,
was a day earlier, January 18, 2022.
And?
What's your point?
I'm saying that the hacking began one day
before the Act on the Information
and Communications Network was revised.
According to Article 14 of
the General Act on Public Administration,
which states new laws do not apply
to facts that were completed
or terminated before
the enforcement of the new law,
the plaintiff is subject
to an administrative fine,
not a penalty surcharge,
in accordance with the Act
before its revision.
Attorney Choi, what are you doing?
Can't you see I'm in the middle
of my closing argument?
Stop it. Do you think Attorney Woo
would like this?
This isn't about Young-woo.
I'm doing what I feel is right.
Your Honor, the hacking may have begun
on January 18th,
but the leak of personal data happened
on January 19th.
After the revised Act on the Information
and Communications Network was enforced.
With what standard does
the defendant's counselor determine
to be the line between hacking
and the leak of personal data?
Doesn't a theft begin
the moment a thief breaks into a house?
Choi Su-yeon.
One more word and you're off the case.
Am I clear?
Your Honor, Article 14 of
the General Act on Public Administration,
which the plaintiff's counselor mentioned
as grounds for refutation,
only applies to facts
that were completed or terminated
before the enforcement of the new law.
Please make the judgment based on
when the leak of personal data ended,
not when the hacking began.
Your…
Let go!
According to Article 14, Paragraph 3 of
the General Act on Public Administration,
even in the event in which the law
before its revision needs to be applied,
if the new law
makes the sanctions lenient,
then application of
the new law is required.
In this case,
it is advantageous for the plaintiff
if the law before the revision is applied.
"When in doubt, rule for the accused,"
should not be a principle
that only applies to criminal law.
I plead for your broad generosity
in understanding
the plaintiff's circumstances.
That is an interesting point.
I'll make a decision
after careful deliberation.
Thank you.
That is all.
WOO YOUNG-WOO GIMBAP
There are a few resorts across the country
that can be used
with the Hanbada employee membership.
Pick whichever one you want,
and take a couple of months off
with Young-woo.
Think of it as a paid vacation.
Is this really necessary?
I can stop it for now,
but once the article is out,
reporters will be
all over Attorney Woo too.
Just lay low until things die down.
She can return to Hanbada afterward.
Return?
Return to Hanbada
after the whole world finds out
that she's Tae Su-mi's daughter
who was born out of wedlock?
Will she be able to have a proper career
with that label on her?
Look.
You said you'd allow it once.
You said you'd allow me to use
Attorney Woo to get Tae Su-mi
in return for giving her a job at Hanbada.
Why are you going back on your word?
Seon-young.
Is there no other way?
Is there really no other way
besides revealing it to the press?
I've put much thought into it too.
As of right now,
this is the best I can do
for you and Attorney Woo.
Raon, the online shopping mall that had
a personal data breach of 40 million
due to their inability to stop the hack,
has won the lawsuit for the cancellation
of the 300 billion won penalty surcharge
imposed by the KCC.
The Seoul Administrative Court cited
Raon's negligence of access control,
including the absence of a limit
on maximum connection time,
but recognized that it was not
the direct cause
of the personal data breach
and ruled in favor of the plaintiff.
Meanwhile, Raon's co-CEO, Bae In-cheol,
who collapsed after ingesting poison
during the trial,
is receiving treatment
but has been confirmed
as still being unconscious.
Mr. Bae had complained
of the unfairness by stating
"No other company has done its best
to satisfy users the way Raon has,"
and "How are we supposed to stop a hacker
who is determined to break in?"
After which he ingested
the poison he had prepared in advance...
The person you are trying to reach
is unavailable.
Please leave a message after the tone.
Hey, I just saw the news.
Is In-cheol still unconscious?
You told me he was fine.
You said he was awake now.
Please answer the phone.
Don't make me have to hack you
to get your location too.
Answer your…
What is it?
What do you mean?
I'm home early.
Let's have dinner together.
Why did you come to see me?
Because I don't think you'll do
what my mom tells you to.
Me?
I'm just curious about
what you decide to do, Attorney Woo.
I'll meet with Attorney Tae and ask her
to allow Sang-hyeon to testify in court.
How are you going to convince Tae Su-mi?
Will she even meet with you
when her confirmation hearing is so close?
You weren't a good mother to me,
but at the very least,
please be a good mother to Sang-hyeon.
Subtitle translation by: Hyun-soo Cho