A file containing passenger information for Air Force One, including President Lee Jae-myung and First Lady Kim Hye-kyung, has been confirmed to match the format of documents handled by the Ministry of Foreign Affairs.

Speaking to reporters on November 3, a Foreign Ministry official said, "It does match the Foreign Ministry's document format," adding, "However, because it is in an Excel sheet format, it is not an official government document."

The official explained, "As the coordinating agency for presidential overseas trips, the Foreign Ministry compiles and creates such (passengers' personal) information," noting, "It is similar to the format prepared by the Foreign Ministry."

However, the official added, "It is difficult to state definitively whether it is or is not a Foreign Ministry document because an investigation is currently underway."

Within the ministry, the Office of the Chief of Protocol serves as the working-level division overseeing presidential trips abroad and manages the Air Force One passenger list and related data, the official explained.

This has led to the presumption that the leaked file was drafted within the Office of the Chief of Protocol and leaked to the outside through some circumstance.

The file in question was found uploaded to VirusTotal, an overseas malware scanning website.

When asked whether security documents such as passenger lists are uploaded to external sites in this manner to scan for malware, the Foreign Ministry official stated, "There is no such protocol (procedure) in the Office of the Chief of Protocol," adding that the ministry does not generally use VirusTotal.

Regarding whether external private contractors involved in presidential tour events could have accessed the document, the official said, "To my knowledge, only employees with security clearance can view it," adding that an investigation is underway while "keeping open" the possibility of a leak from within the Foreign Ministry.

The Foreign Ministry, together with the police and the National Intelligence Service, is working to trace the point of the leak based on the file's distribution channels.

Personnel from the ministry's Office of the Chief of Protocol and staff at South Korean embassies in the destination countries are expected to be the primary subjects of the investigation.

The Foreign Ministry official explained that distribution routes and the scope of sharing cannot be disclosed at present because they constitute confidential matters concerning presidential overseas trips.

The Foreign Ministry said it became aware of the file leak yesterday evening, before the case was first reported.

The official explained, "We received a tip from an agency."

Another Foreign Ministry official explained that immediately after becoming aware of the incident, an emergency security check was conducted on external communication channels, such as email systems, that could have served as leak routes; since no hacking or abnormal access was detected, authorities currently view the incident as a "leak" that occurred during the process of conducting the presidential tour rather than as a hacking incident.

While no additional leaks have been confirmed so far, files uploaded to VirusTotal can be downloaded by paid subscribers, and the file in question had been left exposed on the site for five months after being uploaded in June.

Police are investigating the download history from the site, which is expected to reveal the full extent of whether the file was further disseminated.

(Photo: Yonhap News)