An Era in Which Technology Leakage Shakes an Entire Industry: What Should Management Review?

Behind the fact that technology leakage has begun to be recognized as an industry-wide risk lies a structural change in the targets and methods of leakage.

Technology leakage incidents that occurred over the past five years have been concentrated in national strategic industries such as semiconductors (38%), displays (20%), and electrical and electronics (8%), and among these, leakage of national core technologies alone amounts to 33 cases.

Number of Technology Leakage Cases by Leaked Technology (Source: Korean National Police Agency)

These figures are based on the same policy and industry analysis materials as the status of industrial technology leakage noted above, and they support the conclusion that technology leakage is expanding from a failure of management at a specific company into a problem of vulnerability across the entire industrial structure.

A point that warrants particular attention is the change in the methods of leakage.

Unlike past technology transfers that centered on the recruitment of personnel, the environment in which technology can be accessed through investment and collaboration structures, such as the establishment of joint ventures (JVs), minority equity investments, and the operation of overseas R&D centers, has recently been expanding.

When the management and control of such structures are inadequate, the process of accessing technology itself is likely to lead to a leakage risk.

As a result, the management of technology leakage increasingly needs to be reviewed at the level of business judgment that considers the overall investment and collaboration structure, rather than being limited to internal controls.

Through the Committee on Foreign Investment in the United States (CFIUS), which operates on the basis of the Defense Production Act (DPA), the United States conducts an integrated review of foreign investment from a national security perspective.

Through this system, regardless of the equity ratio or whether formal management control is acquired, security risk is assessed primarily on the basis of whether the investment may provide access to core technology or sensitive information.

As a result, not only mergers and acquisitions (M&A) but also minority equity investments, joint development, and indirect control structures are included as subjects of review, and where a risk is identified, rather than blocking the transaction itself, the method of imposing conditions such as restrictions on technology access, information barriers, and personnel separation is actively used.

This approach functions, in effect, as the benchmark for the current global security screening of foreign investment.

The EU recognizes foreign investment as a route of access to technology, data, and supply chains, and it is elevating investment security screening into a key policy instrument for managing this.

In particular, while reorganizing its screening framework across member states, it has recently been expanding the system in a direction that includes not only direct acquisitions but also indirect investments and circumventing control structures within the scope of review.

The subjects of review are also expanding beyond strategic technologies such as advanced semiconductors, AI, and quantum technology to include media, transportation, and core raw materials, and there is a clear trend in which even greenfield investments, such as the establishment of new production bases, are being incorporated as subjects of management from the perspective of technology and supply chain risk.

In this process, the EU actively uses a conditional approval method, such as restrictions on technology access and information separation, rather than blocking transactions, and it is shifting to a structure that manages risk at the investment stage.

Japan has operated foreign investment regulation on the basis of the Foreign Exchange and Foreign Trade Act (FEFTA), and through amendments made since 2019 it has substantially strengthened the screening of foreign investment in core industries related to security.

It has recognized the possibility of technology access through foreign investment as a national security risk and has continuously strengthened its investment screening standards.

In particular, by adjusting its standards so that even the acquisition of a far smaller equity stake than before can become subject to review, it is including within the scope of regulation the possibility of technology access through minority equity investment or strategic participation.

In addition, placing importance on the character and background of the investor, it operates a precise screening system, classifying cases as separate subjects of management where there is a history of malicious cyber activity or the possibility of circumventing investment through a third country.

Recently, it has also been pursuing the introduction of an integrated screening structure modeled on the U.S. CFIUS, making clear its shift toward preventive security screening centered on information security and technology access rather than on the equity ratio alone.

By contrast, it has been pointed out that Korea has, until now, operated its security screening system for foreign investment primarily on the basis of formal management control standards, such as the acquisition of 50% or more of foreign equity.

As a result, the problem has also been raised that it does not sufficiently capture investment structures in which a substantive possibility of technology access exists, such as minority equity investments, joint ventures (JVs), and research collaboration.

Recently, in order to address these limitations, a discussion that screening should move away from a judgment centered on the equity ratio and focus instead on substantive influence and the possibility of access to technology and datahas continued, led by academia, industry, and policy research institutions.

This is assessed as moving in a direction similar to the screening method of the U.S. CFIUS, which treats the possibility of technology access, rather than the equity ratio, as the key risk standard.

Points of Change That Companies Will Experience

From a company's standpoint, such changes in the policy environment mean that the level of technology management and internal control systems in the process of attracting investment can operate as a determining factor as important as financial indicators.

Going forward, the weaker a company's technology protection framework is, the more likely it may be to face management risks such as delays in investment review, conditional approval, and demands to change the transaction structure.

This trend brings the following changes to corporate management practice.

The core is to build an internal control framework that can manage technology leakage at every stage of prevention, occurrence, and post-incident response.

How the management structure actually operates in the course of work is regarded as more important than formal pledges or regulations.

To prevent technology leakage, a company needs to confirm that there are no gaps in review in the following areas of management.

In particular, when gaps in management arise in the following areas, the risk of technology leakage expands sharply.

In particular, for a company facing the attraction of investment or overseas collaboration, the definition of technology assets, controls on personnel access, and review of the contract structure are indispensable items that should be reviewed in advance.