A Ministry of Science and ICT audit concluded that two enterprise-resource-planning vendors servicing Seoul Metro left flood gates at 14 stations in manual override mode without logging who flipped the switches, forcing emergency credential rotations and a 72-hour retest before Monday evening’s commuter rush.
Inspectors opened the review after Sunday’s surface flooding raised questions about whether underground barriers would deploy automatically when Jungnangcheon and Hongjecheon streams surged. No tunnel inundation occurred, but auditors found password sticky notes on control-room monitors at two sites—an easy physical-security fail atop the software lapse.
What manual mode means
Flood gates normally drop on telemetry from stream gauges and pump status. Manual mode lets maintenance crews hold gates open during inspections—but vendors failed to revert modes or record operators, blurring accountability if water entered tracks.
Seoul Metro said gates were physically capable of closing; the issue was governance and audit trails, not rusted machinery. Still, commuters posted photos of water dripping near platform ends in Gangbuk, spooking evening riders even after officials declared lines safe.
Vendor contracts under scrutiny
MSIT threatened fines under critical-infrastructure rules introduced after 2024 data-center floods. Vendors must now ship signed change logs every shift; Seoul Metro embedded KISA penetration testers to verify remote-access paths were disabled during storms.
Opposition lawmakers linked the audit to broader capital-region drainage failures, arguing underground and surface systems share the same maintenance culture—react after TV images, not before leaf season.
Rider communications
Station announcements Monday morning explained retests in Korean and English, a rarity outside strike periods. Delays stayed under four minutes as crews cycled gates during off-peak hours. Evening rush plans include spare personnel at Yeonsinnae and Jeungsan transfer corridors where passengers connect to flooded bus detours.
Cybersecurity teams rotated VPN certificates after discovering vendor support staff shared one account across three cities—a practice MSIT banned outright in the remediation order.
Broader lessons
Korean metros invested heavily in gate hardware after 2010 floods, but software governance lagged. The audit does not allege sabotage; it documents sloppiness that could become catastrophic if a stream gauge fails during a simultaneous power blip.
Seoul’s smart drain rollout and Naver’s flood routing layer address surface water; MSIT’s order reminds operators that underground assets need equal discipline. Commuters will not see gates drop in drills this week—only logs proving they could.
Remediation timeline
Vendors must deliver signed change logs for every manual override by Wednesday or face contract penalties that Seoul Metro said could reach eight percent of annual maintenance fees. Third-party testers will attempt remote gate closure from a backup control center to prove credentials were rotated correctly.
Union safety reps requested daylight drills so passengers are not surprised by barrier tests; management agreed to run them after 10 p.m. through Thursday. MSIT will publish a redacted summary for other metros in Busan and Daegu running similar ERP stacks.