Digital Sovereignty in the AX Era: Assessing the Coupang Incident and Rule of Law in the ROK–U.S. Data Alliance
Implications for Security Governance and Alliance Modernization
Chi-beom Shin
Professor, Department of Military Science
Konyang University
Planning Director, Future Society Association
A New Paradigm of Digital Territory and Sovereignty
In contemporary international relations, the concept of national security is no longer confined to physical domains such as territory, airspace, or territorial waters. It is rapidly expanding into cyberspace and data governance. The “AX (AI Transformation) Era” represents a structural inflection point in which computational capacity, connectivity, and machine intelligence collectively redefine the foundations of national power.
In this environment, data is no longer merely informational; it has become a strategic asset central to economic competitiveness, societal stability, and national security. For the Republic of Korea, one of the most consequential challenges of the 21st century is establishing the rule of law within this emerging “digital territory” and modernizing the traditional ROK–U.S. military alliance into a comprehensive data and cyber security partnership.
The recent large-scale personal data breach at Coupang is emblematic of these challenges. Affecting approximately 33.7 million individuals—nearly 65 percent of South Korea’s population—the incident far exceeds the scope of an ordinary corporate security failure. It constitutes a critical test of state responsibility in the platform economy and of institutional maturity within the ROK–U.S. alliance in the AX era.
The Rule of Law as the Foundation of the AX Ecosystem
The rule of law constitutes the indispensable foundation of both the market economy and the AX ecosystem. The state’s most fundamental obligation is to protect the lives, property, and fundamental rights of its citizens. Market freedom derives legitimacy only when paired with commensurate responsibility, and innovation can flourish only within a trusted legal framework.
At the core of the AX era lies large-scale data integration and interoperability, which presuppose robust governance and institutional trust. The Coupang incident, however, revealed a clear breakdown of that trust. Investigations indicate that the breach resulted from systemic management failures—specifically, the abuse of internal system access privileges by a former employee who retained credentials after departure. This was not an unavoidable technical accident, but a preventable, human-induced failure of security governance.
In this context, the South Korean government’s decision to establish a cross-ministerial task force and pursue rigorous enforcement measures represents a legitimate exercise of sovereign authority grounded in constitutional principles. Law enforcement actions and investigations by the Personal Information Protection Commission constitute standard legal procedures that apply equally to all firms operating within South Korean jurisdiction, irrespective of nationality.
Coupang’s initial effort to minimize the scope of the breach by asserting that only approximately 3,000 records were affected further underscores the problem of corporate moral hazard. Strict application of the law is therefore not punitive but corrective, aimed at restoring trust and preserving the integrity of the market ecosystem.
The Distorted “Lobbying” Narrative and Its Implications
Despite these facts, some voices within U.S. political circles have characterized Korea’s enforcement actions as discriminatory treatment of an American company. Such framing obscures the central issue: failures in security controls and corporate governance. Public criticisms by figures such as former National Security Advisor Robert O’Brien and Congressman Darrell Issa tend to reduce a complex regulatory and security matter to a simplistic political narrative.
It is also relevant to note that since its New York Stock Exchange listing, Coupang Inc. has reportedly spent approximately $10.75 million on lobbying activities over the past five years. While lobbying itself is a lawful practice, the mobilization of political pressure to delegitimize a partner nation’s law enforcement actions raises serious concerns about alliance trust.
The ROK–U.S. alliance is strengthened not by political convenience, but by mutual respect for sovereignty and shared adherence to universal norms. The United States itself applies stringent standards to data breaches and corporate disclosure failures. Labeling South Korea’s lawful enforcement as a trade barrier reflects a double standard. More fundamentally, attempts by private firms to leverage political influence against the regulatory authority of an allied government risk eroding the normative foundation of the alliance.
Global Standards and Investor Protection
An often-overlooked dimension of this case is that South Korea’s enforcement actions ultimately serve the interests of U.S. investors. As a company listed on the New York Stock Exchange (NYSE), Coupang is subject to U.S. Securities and Exchange Commission (SEC) regulations requiring the disclosure of material cybersecurity incidents within four business days of determination.
According to publicly available information, Coupang delayed disclosure for approximately one month after becoming aware of the breach. During this period, the company’s share price declined sharply, erasing more than $8 billion in market capitalization and imposing substantial losses on shareholders, including U.S. investors.
Ongoing shareholder class action litigation in the United States centers precisely on these issues of delayed disclosure and alleged investor deception. From this perspective, the Korean government’s efforts to clarify the facts and assign responsibility contribute directly to reinforcing global disclosure norms, enhancing transparency in capital markets, and protecting investors—including American ones.
Future-Oriented Tasks for the ROK–U.S. Data Alliance in the AX Era
A genuine alliance is not one that avoids friction, but one that builds durable trust by addressing challenges through shared principles and the rule of law. This logic is even more compelling in the AX era. While respecting each other’s data sovereignty, the Republic of Korea and the United States should institutionalize a “digital mutual defense framework” encompassing shared standards, coordinated responses, and clearly defined responsibilities for countering transnational cyber and data threats.
Just as militaries are pursuing AI-driven modernization through initiatives such as South Korea’s Defense AX Strategy, the center of gravity in national security has already shifted toward data resilience and cyber capabilities. Data now constitutes the foundational infrastructure of both economic vitality and security.
A rigorous resolution of the Coupang incident can therefore serve two purposes: affirming South Korea’s digital sovereignty and providing a strategic inflection point for expanding the ROK–U.S. alliance beyond traditional military and economic domains into comprehensive data security cooperation.
The rule of law is not negotiable. The South Korean government must continue to investigate thoroughly and assign responsibility transparently, grounded in public trust. The United States, for its part, should view this case not as an opportunity for political pressure, but as a platform for cooperative norm-setting that strengthens the alliance’s data ecosystem. When principled enforcement and institutionalized joint responses proceed in parallel, the alliance advances concrete mutual interests. This is the true starting point of digital sovereignty in the AX era.