South Korea’s June 3 Local Elections, Chinese Fake News Sites, Voter Data, and AI-Enabled Information Warfare
By Jean Cummings, Co-Editor, The Korea Signal
On June 3, 2026, South Korea held local elections.
But after the election, the country was thrown into turmoil. Polling stations in Seoul’s Songpa District had run out of ballots. What emerged afterward brought citizens into the streets.
Additional ballots had been sent to 140 polling stations nationwide, and 91 of them actually used the extra ballots. The shortage exceeded 7,000 ballots. In Seoul alone, 42 polling stations were affected, including 20 in Songpa District. Voting was temporarily suspended at 26 polling stations. In Songpa and other areas, some voters waited for hours only to leave without casting a ballot because no ballots were available.
Questions soon began to emerge over whether the National Election Commission (NEC) had been misleading the public and whether election fraud had occurred.
Beginning June 5, citizens gathered outside the SK Handball Gymnasium at Seoul Olympic Park. The crowd grew from approximately 6,000 people at first to as many as 40,000 within days. Young people in their 20s and 30s who had never attended a political rally before joined the demonstrations, as did families with young children. Public anger did not quickly subside.
American flags appeared alongside South Korean flags. Citizens wanted the questions surrounding the election to be noticed not only inside South Korea but also by the United States.
Protesters argued that if election fraud had occurred, it would undermine the foundation of democracy and violate the sovereignty of the people. They said they could no longer simply rely on statements from the NEC and demanded public verification of the election process and the restoration of transparency.
Voters had arrived at polling stations only to find that there were no ballots available for them. At the same time, voting was still continuing in some areas even after exit-poll results and election broadcasts had already been released. These circumstances deepened public suspicion.
Signs at the demonstrations called for action over “election fraud,” “a new election,” and alleged “Chinese interference.” The slogans themselves showed what these citizens suspected and why they had taken to the streets.
Citizens also blocked the removal of ballot boxes and election materials from counting sites while demanding public verification. They called for recounts, an explanation of why ballots had run out, and a new election if problems in the election process were confirmed.
Their actions did not end after a day or two. Citizens remained at the site through the end of June to prevent ballot boxes from being removed, and their protests have continued even three months after the election.
The allegations raised in the streets did not remain there. Investigative authorities and lawmakers also began to act.
On June 11, approximately 100 police investigators searched the NEC headquarters and six other election offices in Seoul for 13 hours. On June 18, the National Assembly began a 45-day parliamentary investigation.
Then, on September 7, Special Counsel Lee Tae-han formally began his investigation. His team said it would not simply adopt the conclusions of the previous joint police-prosecution investigation but would reexamine the facts from the beginning. The investigation covers 12 matters, including the ballot shortage and allegations of manipulation of voter-turnout statistics. The special counsel has also established its own digital forensics team. The investigation is expected to continue for up to 150 days.
The special counsel is also seeking an on-site inspection of areas at the Olympic Park counting center that were not fully examined during the National Assembly investigation, including the location where ballot boxes were stored, voter rolls, and vote-counting documents. Three months after citizens blocked the removal of ballot boxes and election materials while demanding public verification, the special counsel is now preparing to examine that same site.
But the demands that began in the streets have not ended.
Some citizens continue to argue that fraud occurred and are demanding a new election. Political authorities and the NEC, however, maintain that the circumstances do not warrant one. The two sides remain far apart.
Now the special counsel is investigating.
What remains is to establish the facts.
Because citizens have also raised allegations of Chinese interference in the election, the investigation should determine whether there were funds, personnel, computer-access records, online accounts, or organized networks connected to China.
Public trust in an election institution cannot be restored simply by dismissing suspicions. The integrity of an election can be restored only when the facts are clearly established and the results are made transparent enough for the public to judge.
But looking more closely at this controversy leads to an older record.
South Korea’s election system had already been warned about vulnerabilities to outside attack before the 2026 local elections.
The NEC’s Computer Network Had Already Raised Security Concerns
In 2023, South Korea’s National Intelligence Service (NIS) and Korea Internet & Security Agency (KISA) conducted a joint security inspection with the National Election Commission.
The inspection identified multiple vulnerabilities in systems used to manage voter rolls, early voting, and vote counting.
The NIS said at the time that if an attacker gained access to the NEC’s internal network, the vulnerabilities could potentially be exploited to alter voter information, manipulate early-voting status, or print unauthorized ballots.
Three years later, attempts to attack the NEC’s computer networks were continuing.
From January 1 through June 18, 2026, the NEC recorded 101,179 attempted cyberattacks against its website, servers, and related systems. Based on IP addresses, 17,884 came from the United States, 6,084 from Vietnam, 5,719 from India, and 3,543 from North Korea. Attempts originating from North Korean IP addresses rose sharply from 52 the previous year to 3,543.
But the first IP address identified in a cyberattack does not necessarily reveal the attacker’s actual nationality. Servers in other countries, VPNs, and compromised computers can all be used as intermediate points in an attack.
The important question, therefore, is not simply how many attacks appeared to come from a particular country. Investigators need to trace the actual path of the attacks and determine how foreign servers, VPNs, or compromised computers were used along the way. They also need to determine what the attackers were targeting and which NEC systems they attempted to access.
The United States Reveals Data on 220 Million Voters
During the same summer that South Korea was debating the security of its election system, the United States released information involving Chinese acquisition of voter data on a far larger scale.
On July 30, 2026, the White House released a fact sheet on foreign election interference based on U.S. intelligence that President Trump had ordered declassified.
According to the White House, Chinese actors and their proxies acquired voter-registration records on as many as 220 million Americans through purchase, theft, and hacking. The information included nonpublic data. U.S. intelligence agencies also said they had detected a Chinese network-intrusion actor accessing voter-registration information stored on commercial websites in 2022.
The more important question is why China acquired information on hundreds of millions of American voters and how it intended to use it.
The declassified intelligence assessment explained that foreign actors possessing voter-registration data could alter information to make it more difficult for individual voters or groups of voters to cast ballots, create delays on Election Day, or use the data to identify targets and tailor messages for other influence operations.
A name and address may look like ordinary personal information when viewed alone. But when those records are combined with location, contact information, and data that can reveal or suggest political preferences, the picture changes. Such information can be used to identify which voters in which areas are most responsive to particular issues and then combined with social media, online advertising, fake accounts, and political messaging.
Election influence, in other words, does not occur only at the ballot box. Access to information such as a voter’s address, age, party registration, and voting history can allow an actor to identify particular regions and groups of voters and repeatedly expose them to tailored political messages. Information designed to increase distrust of a candidate or discourage voter participation can also affect an election.
U.S. intelligence definitions reflect this broader understanding. Foreign election influence is not limited to operations targeting candidates or political parties. It can include activities intended to affect voters’ judgments and preferences or the political process itself. When voter-registration systems and data, voting and counting systems, or election reporting are targeted, such activities can fall within the category of election interference.
The U.S. government’s concern did not end with the July disclosure.
On September 3, a federal grand jury indicted Yupeng Sun, a Chinese national living in Andover, Massachusetts, on charges involving fraudulent voter registration and illegal voting.
According to the U.S. Department of Justice, Sun allegedly used the identity of another Chinese national who was a lawful permanent resident to register online to vote in October 2024 and then cast an early ballot under that person’s name at Malden City Hall later that month.
The United States is also intensifying scrutiny of voter rolls themselves.
On September 8, the Trump administration asked the U.S. Supreme Court to allow the Department of Homeland Security’s SAVE database to be used for large-scale citizenship checks of state voter rolls. A lower court had blocked the practice over privacy concerns and the risk that errors could remove eligible voters. The administration appealed, arguing that the decision interfered with efforts to protect election integrity.
Then, on September 11, the Department of Justice instructed 29 states and Washington, D.C., to preserve all records related to the 2024 presidential election. The Justice Department is pursuing litigation seeking detailed voter-registration records from several states and warned that destruction of relevant records could have legal consequences.
State and federal authorities continue to disagree over privacy and the scope of federal power. But one point is clear: in the United States, voter rolls, noncitizen voting, and election data are now being treated not simply as administrative matters, but as issues of election security at the national level.
China’s methods of influencing other countries, however, are not limited to voter data. In South Korea, information operations using media outlets have already been identified.
Chinese Sites Using the Names of South Korean News Organizations
In November 2023, South Korea’s National Intelligence Service announced that it had identified 38 fake Korean-language news sites designed to resemble South Korean media outlets. Chinese public-relations firms Haimai and Haixun were linked to their operation.
The sites copied articles from South Korean news organizations without permission and falsely presented themselves as members of the Korea Digital News Association. The NIS also said it found indications that pro-China and anti-U.S. content had been distributed through these sites and related networks.
What makes this method dangerous is not any particularly sophisticated technology. If a site is given a name resembling a South Korean news organization and filled with actual articles copied from Korean media, readers may have little reason to suspect that it is operated by a foreign company. If messages serving another purpose are then mixed into that content, they can be received as though they were reporting produced by a legitimate Korean news organization and can be used to influence public opinion.
Once an article is shared on social media and then moves through online communities or platforms such as KakaoTalk, its original source becomes increasingly difficult to identify. After several rounds of sharing and forwarding, the content itself can remain while the identity of the person or organization that first created it disappears. Information from an unknown source can then be accepted as though it were legitimate reporting.
In April 2025, another Chinese public-relations firm, Qunmeishe, was found to have operated seven websites using the names of South Korean media organizations, including Seoul Shinmun, Jeju Ilbo, Daegu Shinmun, Maeil Shinmun, and Seoul Ilbo. Their domains were registered not only in China but also in the United States and Singapore.
The NIS said it had not found evidence that the seven newly identified sites had distributed problematic content. But it also said that two earlier investigations in 2023 had identified more than 200 websites operated by Chinese public-relations firms while impersonating South Korean news organizations.
The important issue is not simply how much pro-China content was distributed. Spreading negative views of the United States, increasing distrust of the U.S.-ROK alliance, or intensifying hostility between South Korea’s conservative and progressive camps can itself produce significant effects.
Turning the population of another country into supporters of China is not always necessary. In some circumstances, amplifying the divisions that already exist inside that society can be far more effective.
7,704 Fake Accounts — and Methods That Keep Changing
Foreign influence operations linked to China become even clearer when we look at how they have operated abroad.
In August 2023, Meta dismantled a large covert influence network operated from China.
In connection with the operation known in the security community as Spamouflage, Meta removed 7,704 Facebook accounts, 954 pages, 15 groups, and 15 Instagram accounts.
The operation was not limited to Facebook and Instagram. Evidence of the same network appeared across more than 50 platforms, including X, YouTube, TikTok, Reddit, Pinterest, Medium, and Blogspot. Meta described it at the time as the largest known cross-platform covert influence operation in the world.
But more important than the number of accounts is how these operators attempted to enter the conversations of real people.
In 2024, Graphika reported that Spamouflage had operated accounts posing as American voters ahead of the U.S. presidential election. The accounts attacked candidates from both Democratic and Republican parties while exploiting issues that already deeply divided American society, including guns, drugs, homelessness, and race.
Feeding additional grievances to citizens already dissatisfied with the political system, or giving people who already distrusted the opposing side new reasons for suspicion, could further intensify existing divisions.
More recently, manipulated event notices have been used in attempts to disrupt real-world events.
On July 13, Graphika reported that Spamouflage had distributed manipulated event flyers on Facebook and X in an effort to disrupt events in the United States and Europe critical of the Chinese Communist Party, as well as demonstrations related to Tibet and the Uyghurs. The flyers included false information about event times or locations in an apparent effort to interfere with attendance.
Until recently, however, carrying out these operations on a large scale inside South Korea was not easy. The Korean language and South Korea’s distinctive culture created significant barriers.
Even grammatically correct Korean does not necessarily sound as though it was written by a Korean. Expressions vary by age group and political orientation, while honorifics, colloquial language, and internet slang are mixed in ways that can make natural Korean difficult for a foreign operator to reproduce.
But that barrier is now falling rapidly.
AI Is Removing the Korean-Language Barrier
On February 25, 2026, the Stimson Center published a policy report examining the implications of Chinese influence operations for South Korea and the U.S.-ROK alliance.
The report found that research associated with China’s People’s Liberation Army has shown interest in influencing South Korean public opinion, interfering in South Korean elections, and weakening the U.S.-ROK alliance. It identified the development of generative artificial intelligence and large language models as a particularly important change.
Chinese military researchers have themselves acknowledged that weak foreign-language capabilities and limited understanding of local cultures have been disadvantages in China’s overseas influence operations. But large language models have made it far easier to tailor political messages to different age groups and target audiences. AI can also generate profiles for fake personas, produce large volumes of comments and posts, and distribute them across multiple platforms far more quickly and at much greater scale.
Graphika’s 2025 research into AI-enabled influence operations identified a similar shift. AI-generated content does not have to be sophisticated or perfect to matter. What has changed is the ability to produce far more fake posts and comments in the same amount of time and distribute them across multiple platforms.
The Stimson Center assessed that Chinese influence operations targeting South Korea have so far been more limited in scale and actual effect than operations targeting the United States or Taiwan. But it also warned that AI could change those conditions. Countries once considered “secondary targets,” where language and cultural barriers made large-scale influence operations difficult, can now be targeted with locally adapted content produced and distributed on a much larger scale.
150,000 Foreign Voters and the Question of Reciprocity
Under current South Korean law, foreign nationals age 18 or older who have held F-5 permanent-resident status for at least three years and are listed in the foreign-resident registry are eligible to vote in local elections. They cannot vote in presidential or National Assembly elections.
In the June 3, 2026 local elections, 151,532 foreign residents were eligible to vote under these rules. That was an increase of 18.7 percent from 127,623 in 2022 and more than 20 times the number when foreign residents were first permitted to vote in local elections in 2006.
A final breakdown of foreign voters by nationality in the 2026 election is difficult to confirm from publicly available data. In the 2022 local elections, however, 99,969 of the 127,623 eligible foreign voters were Chinese nationals, accounting for approximately 78 percent of the total.
The issue has already reached the National Assembly.
On March 13, 2026, National Assembly member Lim Jong-deuk and nine other lawmakers introduced an amendment to the Public Official Election Act that would extend the permanent-residency requirement for foreign voters from three years to seven. The bill would also deny local voting rights to nationals of countries that do not grant equivalent voting rights to South Korean citizens.
The bill passed through the Special Committee on Political Reform before being referred to the Public Administration and Security Committee in July and was discussed again on August 24. A separate amendment introduced on March 6 by National Assembly member Seo Ji-young and 18 other lawmakers similarly raised the issue of reciprocity, noting that countries including the United States, China, and Japan do not grant local-election voting rights to South Korean permanent residents.
In U.S. federal elections, only U.S. citizens are permitted to vote. Yet as discussed earlier, a Chinese national has now been indicted in federal court for allegedly registering and voting under the identity of another Chinese national who was a lawful permanent resident.
South Korea also needs to strengthen its scrutiny of whether its election system is adequately protected from the possibility of foreign influence.
Especially at a time when Chinese influence operations involving voter data and online political activity have already been documented, foreign influence on elections should now be treated as a national security issue.
Free and Fair Elections Are at the Heart of Democracy
Article 1, Paragraph 2 of the Constitution of the Republic of Korea states: “The sovereignty of the Republic of Korea shall reside in the people, and all state authority shall emanate from the people.”
The most fundamental principle of democracy is that citizens choose, through elections, the representatives who will govern on their behalf and entrust them with political power.
That is why a free and fair election is not simply a matter of election administration. It is the process through which the sovereignty guaranteed to the people by the Constitution is translated into political power. No outside force should be allowed to interfere with that process.
South Korean citizens are still in the streets, engaged in a difficult fight for public verification of the election in order to protect their sovereignty.
When citizens raise questions about an election, the responsibility of the government and investigative authorities is to thoroughly examine the basis of those concerns and establish the facts in a way the public can understand. In particular, if allegations are raised that China or other foreign actors interfered in an election, the issue is no longer simply an election controversy. It is a matter of political sovereignty and national security.
If the integrity of elections collapses, the people ultimately lose their right to choose for themselves who will exercise power on their behalf.
If citizens can no longer trust that their own vote, cast according to their own free will, will help determine the future of their country, can that society truly call itself a democracy?
