As the use of generative artificial intelligence (AI) in the National Assembly increases, so do security concerns. The process of analyzing sensitive personal information and confidential government and corporate data with AI raises the risk of leaks. Critics point out that the National Assembly lacks specific security guidelines and management systems, leaving sensitive information vulnerable.
On November 11, a survey by Aju Economy revealed that 29 out of 30 lawmaker offices are using generative AI, with ChatGPT, Gemini, and Claude being the most commonly utilized services. Six offices reported using all three AI platforms.
During the National Audit period, lawmakers actively employed AI to manage the influx of data. Each office requests hundreds to over a thousand documents from approximately 840 national and public institutions. Given the limited staff available to review extensive materials and draft inquiries, the use of AI has become increasingly common to alleviate workload.
A staff member from the Legislative and Judiciary Committee stated, “I believe we used AI for over 50% of our work during the audit. It helps reduce the time spent on data collection, and when drafting inquiries, we can provide necessary information and ask for relevant questions.” A representative from the Political Affairs Committee added, “Although it’s not openly discussed, everyone is likely using AI to learn from the data. The materials we handle often contain numbers and graphs, making it useful for extracting necessary information.”
The issue arises from the potential inclusion of unspecified personal data or confidential government and corporate information in the materials inputted into AI. There is a risk that data entered by users could be stored on the service provider's servers or used for model improvements according to service policies.
Recently, a leak of the passenger list for the presidential aircraft was attributed to a staff member who uploaded a file to an external site to check for malware. This incident highlights the potential for sensitive information to be compromised when using external services, raising alarms about the use of AI in the National Assembly.
In this context, a representative from C's office remarked, “Honestly, during the audit period, we sometimes input confidential materials directly into AI due to the workload. It’s not an exaggeration to say that an environment is being created where AI can understand what each office is reviewing and what inquiries they are preparing.”
Concerns are also growing that sensitive information related to national security, such as data produced or acquired by the National Defense and Intelligence Committees, could pose a threat if inputted into AI services that utilize overseas servers. A staff member from D's office noted, “In the Defense and Intelligence Committees, there are cases where only viewing materials is permitted, but it’s not impossible to photograph them and input them into AI. If the information comes from tips rather than official requests, even more sensitive internal documents could be utilized by AI.”
Multiple National Assembly officials have warned that there is a possibility of corporate trade secrets or undisclosed important information being inputted into AI during the preparation of inquiries or audits involving companies.
Despite the sensitive information being inputted into private AI services, it has been confirmed that there are virtually no independent security guidelines or management systems for AI use at the National Assembly. The Assembly has merely posted the “Security Guidelines for Utilizing Generative AI” issued by the National Intelligence Service in 2023 on its internal bulletin board. However, many offices were found to be unaware of the existence of these guidelines during the reporting process.
Moreover, there are concerns about the lack of enforcement mechanisms to ensure compliance with these guidelines, diminishing their effectiveness. Oh Byung-il, head of the Digital Justice Network, emphasized, “Entering confidential or personal information into AI poses the risk of that data being transferred to AI companies. To mitigate such risks, it is essential to establish independent servers to store data.”
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.