Tensions have been rising recently as the number of confirmed cases is again increasing, but South Korea’s fight against COVID-19 is considered a success. Various factors have been cited as contributing to this success, including thorough contact tracing, prompt and active diagnostic tests, transparent disclosure of COVID-19-related information including information on the movements of confirmed cases, safe and effective tests such as drive-throughs, and social distancing campaigns and voluntary cooperation among citizens. Encouraged by this international assessment, the South Korean government is pushing for international standardization of South Korea’s response to COVID-19. The Korean model includes three steps—a) testing and confirmation, b) tracing, and c) treatment and quarantine—or 3T (Test-Trace-Treat).

South Korea’s response to COVID-19 is worth studying in depth. Although technology enabling the collection and monitoring of personal information is used in other countries, such as the use of contact tracking apps and location information, South Korea is a rare case where such technology is extensively used and where such usage is considered effective in the fight against COVID-19. Of course, some are critical of the use of these surveillance technologies. At an online press briefing on the COVID-19 Contact Tracing Support System hosted by the Ministry of Land, Infrastructure and Transport, questions poured in on how to deal with the risk of privacy infringement caused by abuse of the system.

Various aspects must be considered to achieve a fair evaluation of South Korea’s response to COVID-19, or that of other countries. Regarding the use of surveillance technology, for example, it is necessary to verify based on objective data whether the technology usage was executed in a proportional manner, how effective it actually was, and whether voluntary measures were insufficient compared to compulsory measures. We should also consider that basic rights would have been infringed upon if a region was quarantined rather than simply monitored by contact tracing, as well. Furthermore, it is not a simple matter to assess whether a response is “successful.” Infectious disease response policy should not only consider the health and medical aspects. For example, restricting mobility and implementing quarantine could pose threats to the livelihood of individuals. Therefore, it is necessary to discuss the level of confirmed cases that a society’s medical system can handle while also maintaining basic standards of economic and social life and minimizing infringement of basic rights, rather than pursuing unconditional minimization of confirmed cases and deaths. The criteria for “success” will depend on this.

Even if South Korea maintains its current model of response to COVID-19, such assessments and discussions are necessary. The current model is not perfect. The Moon Jae-in administration’s rapid response to COVID-19 was likely impacted by the knowledge that former President Park Geun-hye’s ratings fell due to her administration’s poor response to MERS. Moreover, the Infectious Disease Control and Prevention Act was amended before and after the MERS outbreak, creating a legal basis for the response to COVID-19 and eliminating possible debate over the legality of coercive measures on some level. Just as the policy of disclosing the movements of confirmed cases has been continuously upgraded in the course of the response to COVID-19, it is necessary to upgrade the current response to COVID-19 itself through continuous evaluation. COVID-19 won’t be the last infectious disease we’ll face.

Violating Personal Privacy and Excessive Monitoring via Preventative Measures

The United Nations Secretary General’s report “COVID-19 and Human Rights,” published in April 2020, declared that states must “ensure that any emergency measures, including states of emergency, are legal, proportionate, necessary and non-discriminatory, have a specific focus and duration, and take the least intrusive approach possible to protect public health.” South Korea’s COVID-19 response should also be evaluated using these standards of human rights.

The most debated issue in the South Korean response to COVID-19 was the policy of disclosing the movements of confirmed cases. Local governments disclose this information on their webpages. During the process, excessive personal information was exposed, resulting in some confirmed patients becoming the target of criticism and hatred on the internet. For instance, one confirmed patient’s wife and children tested negative, but his sister-in-law tested positive, raising suspicions of cheating without evidence. A confirmed patient that visited a lot of places became a target of criticism as if the patient spread the virus on purpose. Sexual minorities are scared that they might be identified regardless of the intention of information disclosure and become targets of hatred when information on their movements is disclosed. According to a public opinion poll, people stated that they are more frightened of disclosing information on their movements than contracting COVID-19. Such contact tracing does not help preventive measures. Because disclosed information exposes confirmed patients to criticism and hate comments, people will try to hide where they have been.

However, when you think about the objective of disclosing information on patient movements, doing so for every confirmed patient is unnecessary. When a case is confirmed, those who contacted the patient are sought for public health surveillance. But, there might be some cases where it is hard to confirm whether an individual crossed paths with the confirmed patient at the same place and time. For example, whether a customer was at the same restaurant as a confirmed patient at a similar time. Disclosing information on patient movement is necessary in this case so that the individuals who were in the same place at the same time, who the state cannot trace, can prepare themselves. If all contacted individuals can be traced, there is no need to disclose the confirmed patient’s movements. Instead of releasing the individual movements of each confirmed patient, an aggregated list that includes the time and place of the whereabouts of all confirmed patients should serve the same purpose. This would enable others to check whether they were at the same place at the same time. The National Human Rights Commission of the Republic of Korea and the Korea Disease Control and Prevention Agency recommended not disclosing individuals’ movements, but to instead disclose information in a location-list type with region, place type, business name, and specific address. Despite this advice, local governments continue to release each individual confirmed patient’s movements, and the central government is not monitoring the situation. How can we make sense of this?

The Excessive Collection and Preservation of Private Information

The Infectious Disease Control and Prevention Act allows for the collection of private information of confirmed patients—such as medical condition, records of entry into and departure from the country, credit card and transit card usage, CCTV video footage, and cell phone location information—if health authorities deem it necessary. This is very sensitive personal information, necessitating a warrant even for investigative institutions. However, for the purpose of infectious disease prevention, it is easy to collect such information, requiring only a request from the health authorities and the head of the local government.

It is also possible to collect information on possible confirmed cases of infectious diseases, rather than confirmed cases alone. However, possible cases include not only those that came into contact with confirmed cases but also those that “probably came in contact,” so there is a risk of the target population being arbitrarily expanded. For example, in early May, when there was a confirmed case at a club at Itaewon, Seoul city requested a list of people who were near the club from wireless carriers; the resulting list exceeded 10,000 individuals. However, it is excessive to consider more than 10,000 as possible cases. Also, even though the confirmed patient visited the club at the crack of dawn on May 2, personal information collection on those that visited the area started from a week before, April 24, a meaningless and excessive time frame in terms of contact tracing needs.

How long the collected private information is stored is also ambiguous. In a a press release on the “Support System of COVID-19 Public Health Surveillance,” the government revealed that “this system is operating on a temporary basis considering we are in the crisis management stage of this infectious disease, and private information is scheduled to be destroyed immediately when the COVID-19 situation ends.” However, the Jinbo Network Center (Korean Progressive Network) received a different answer from the Korean Disease Control Prevention Agency on the storage of gathered information. Information on confirmed patients and quarantined individuals was not destroyed after the MERS outbreak, and was said to be semi-permanently preserved. They also said that the criteria for determining the “end of the COVID-19 situation” have not yet been decided.

How can Democracy Coexist with Infectious Disease Management?

There should be careful analysis on why infectious disease response systems based on contact tracing and monitoring, such as that in South Korea, are not widely adopted in democratic countries. With a drastic increase in confirmed cases, quarantining a certain region may be more effective compared to responses based on public health surveillance of individual cases. Moreover, a legal basis is required to adopt measures that may limit basic human rights, but other countries might not have had the room to introduce such hotly-debated policies in the face of the COVID-19 crisis, unlike in South Korea, where the necessary legalization was established after MERS. One notable point is that South Korea is equipped with the physical conditions required to easily trace individuals’ whereabouts over two-week periods. South Koreans use credit cards more than cash, individuals use a nation-wide public transportation system that uses electronic cards for payment, and CCTV cameras are common. Currently, this information is gathered for public purposes, but this also means that it is possible to trace individuals’ whereabouts for other purposes.

The current administration might have less desire to abuse power compared to past dictators, but its actual capacity and power to influence the everyday lives of citizens have become stronger. We need more democratic checks than in the past. First, there is a need to reform the current social system, which operates far from the principle of protecting private information. The resident registration number system that continues to be used for a multitude of purposes, the real-name mobile phone system that can trace individuals’ every move, and the identity verification system that makes personal identification possible on the internet through resident registration numbers are the basis of a monitoring system that infringes on privacy.

In the process of responding to infectious diseases, there should be improvement based on the principles of human rights and democracy. There is a need for a new system to monitor the collection and management of personal information, where the current system depends solely on the arbitrary judgement of the administration. The Personal Information Protection Commission that formed on August 5 this year should play this role together with the National Human Rights Commission of the Republic of Korea. The Infectious Disease Control and Prevention Act should be amended to reflect principles protecting private information. De facto enforcement measures that are without a legal basis such as electronic tagging to monitor the self-quarantined should not be implemented. Evaluating whether a country’s preventive measures were successful should consider the basis of the measures in democracy and human rights, as well as how effective the response was in mitigating or eliminating the infectious disease.

Author: Byoung-il Oh(Korean Progressive Network Jinbonet)

• Source : http://www.keaf.org/book/EAF_Policy_Debate_COVID-19_and_Privacy_in_South_Korea:_How_Can_We_Protect_Human_Rights_and_Democracy 

코로나19 감염병 위기 상황을 맞아 각 국은 자국의 상황에 따라 다양한 대응 방식을 보여주고 있다. 대만과 같이 초기에 해외 입국을 차단하는 등 신속한 대응을 한 나라도 있고, 브라질 등 일부 국가들은 코로나19의 심각성을 낮게 평가하며 다소 안이한 대응을 하고 있으며, 스웨덴은 다른 국가들과 달리 집단면역 정책을 시행하고 있다. 정도의 차이는 있지만 많은 국가들에서 일정기간 동안 봉쇄(Lock-down) 정책을 시행하였고 접촉자 추적을 위해 감시 기술을 사용하고 있으며, 격리를 강제하기 위해 폭력적인 방법을 사용하는 국가도 있다.

최근 코로나19 환자가 다시 많아지면서 긴장감이 높아지고 있지만, 한국의 방역은 성공적인 것으로 평가받고 있다. 그 요인으로는 감염병 환자의 역학조사를 통한 접촉자 파악, 신속하고 적극적인 진단 검사, 확진자 동선을 포함한 감염병 관련 정보의 투명한 공개, 드라이브스루와 같은 안전하고 효과적인 검사, 사회적 거리두기 캠페인과 시민들의 자발적인 협조 등 다양한 요인들이 거론되었다. 이러한 국제적인 평가에 고무되어 한국 정부는 이를 ‘K-방역모델’로 명명하며 국제표준화를 추진하고 있다. K-방역모델은 ‘①검사·확진→ ②역학·추적→ ③격리·치료’로 이어지는 3T(Test-Trace-Treat)로 표현된다.

한국의 방역 조치는 심도 깊게 연구할 가치가 있다. 왜냐하면, 접촉자 추적 앱이나 위치정보의 활용과 같이 해외에서도 감염병 대응 과정에서 개인정보의 수집이나 감시 기술이 일정하게 사용되고는 있지만 한국처럼 광범하게 사용되는 경우는 드문데, 다른 한편 이러한 강력한 감시 조치가 방역에는 효과적인 것으로 평가받고 있기 때문이다. 물론 이러한 감시 기술 사용에 대한 비판적 평가도 존재한다. 국토교통부가 주최한 「코로나19 역학조사 지원시스템」에 대한 온라인 국내외 언론설명회에서도 이 시스템의 남용으로 인한 개인정보 침해 위험성에 대한 대책을 묻는 질의가 쏟아지기도 했다.

한국의 방역 모델, 혹은 해외의 다른 모델에 대한 공정한 평가를 위해서는 여러 측면을 고려해야 한다. 예를 들어, 감시 기술의 사용과 관련해서는 방역에 필요한 만큼만 비례적으로 이루어졌는지, 실제로 방역에 효과는 어느 정도 있었는지, 강제적인 조치가 아니라 자발적인 조치가 우선할 수는 없었는지 등을 객관적인 데이터에 기반하여 검증할 필요가 있다. 감시와 추적을 통한 접촉자 파악이 아니라 봉쇄 정책을 취했다면, 이 역시 다른 방식으로 기본권을 제한하는 정책이라는 점도 고려해야 할 것이다. 과연 무엇이 ‘성공’적인 대응인가라는 점도 간단한 문제는 아니다. 감염병 대응 정책은 단지 보건의료적 측면만을 고려해서는 안 되기 때문이다. 예를 들어 방역을 목적으로 이동을 제한한다면 누군가에게는 생계의 위협이 될 수 있다. 따라서 감염병 환자와 사망자의 무조건적인 최소화가 아니라 기본적인 경제적, 사회적인 삶을 유지하고 기본권 침해를 최소화하면서, 우리 사회의 의료 시스템이 감당할 수 있는 감염병 발병 수준은 어디까지인지에 대한 논의가 필요하며, 성공의 기준 역시 이에 따라 달라질 것이다.

한국의 방역 모델을 유지한다고 하더라도 이러한 평가와 논의는 필요하다. 현재의 모델 역시 완벽한 것은 아니기 때문이다. 코로나19에 대한 문재인 정부의 신속한 대응에는 메르스에 대한 대응 실패로 박근혜 전 대통령의 지지도가 하락했던 기억이 영향을 미쳤을 것이다. 또한 메르스 유행을 전후하여 감염병 예방법을 개정하여 코로나19 방역에 필요한 대응의 법적 근거를 이미 만들었기 때문에 강압적 조치에 대한 적법성 논란을 일정하게 해결할 수 있었다. 확진자 동선 공개 정책이 코로나19 대응 과정에서 계속 업그레이드 된 것처럼, 현재의 시스템에 대한 지속적인 평가를 통해 대응 방법을 고도화할 필요가 있다. 코로나19가 우리가 맞이할 마지막 감염병은 아닐 것이기 때문이다.

방역 과정의 개인정보 침해와 과도한 감시

유엔 사무총장은 ‘코로나19와 인권’ 정책 문서를 발표하며 “모든 긴급 조치는 적법하고 비례적이며 필요하고 비차별적이어야 하며, 특정한 초점과 기간을 가져야 하고 공중 보건 보호를 위한 가장 덜 침해적인 접근을 취해야 한다”고 언급하였다. 한국의 방역 조치도 이러한 인권 기준에 맞춰 평가할 필요가 있다.

코로나19 대응 과정에서 가장 큰 논란이 일었던 쟁점은 확진자의 동선을 공개하는 정책이었다. 지방자치단체는 홈페이지를 통해 확진자의 동선을 공개하고 있는데, 이 과정에서 지나친 개인정보가 노출되어 일부 확진자들이 인터넷 상에서 비난과 혐오의 대상이 되었다. 예를 들어 한 확진자는 부인과 자녀는 음성 판정을 받았지만 처제만 양성 판정을 받아 불륜이 아니냐는 근거 없는 의혹을 받았다. 여러 곳을 돌아다닌 확진자는 마치 감염병을 일부러 퍼뜨린 것처럼 비난의 대상이 되었다. 성소수자들은 동선 공개를 통해 자신의 의도와 무관하게 낙인 찍히고 혐오의 대상이 될 것을 두려워한다. 한 여론 조사에 따르면, 사람들은 코로나19에 걸리는 것보다 자신의 동선이 공개되는 것이 더 무섭다고 답변할 정도다. 이와 같은 방식의 동선 공개는 방역에도 도움이 되지 않는다. 공개된 동선이 비난과 혐오 발언에 노출될수록 사람들은 자신의 동선을 숨기려 할 것이기 때문이다.

그런데 동선 공개의 목적을 생각한다면 확진자별 동선 공개는 불필요하다. 확진자가 발생하면 역학 조사를 통해 접촉자를 파악하는데, 예를 들어 어떤 식당에 비슷한 시각에 있었던 다른 손님과 같이, 확인하기 힘든 접촉자가 있을 수 있다. 그래서 확진자의 동선을 공개하여 확진자와 같은 시간에 같은 장소에 있었던 사람들이 스스로 대비할 수 있도록 정보를 제공하는 것이다. 모든 접촉자를 파악할 수 있다면 그 확진자의 동선은 공개할 필요가 없다. 따라서 확진자별 동선이 아니라, 임의의 확진자의 동선에 포함된 시간과 장소의 목록만을 공개하고, 시민들은 그 시간과 장소에 본인이 있었는지 확인하면 충분하다. 국가인권위원회와 질병관리본부도 개인별 동선을 공개하지 말고 장소목록 형태로 지역, 장소 유형, 상호명, 세부주소 등의 정보를 공개하도록 했다. 그럼에도 불구하고 지자체에서는 여전히 확진자별 동선을 공개하고 있고, 정부도 이에 대해 아무런 감독을 하지 않는 상황이 지속되는 것을 어떻게 이해해야 할까.

개인정보의 과도한 수집과 보존

감염병 예방법에 의해 보건당국이 필요하다고 판단하면 확진자의 동선 파악을 위해 진료 내역, 출입국 기록, 신용카드 및 교통카드 사용내역, CCTV 영상정보, 휴대전화 위치정보 등을 수집할 수 있다. 이것들은 매우 민감한 개인정보들이어서 수사기관조차 접근하기 위해서는 법원의 영장이 필요한데, 감염병 예방 목적으로는 보건당국과 지자체장의 요청만으로 손쉽게 수집이 가능하다.

또한 감염병 환자뿐만 아니라 감염병 의심자에 대한 정보도 필요하면 수집할 수 있도록 하고 있다. 그런데 감염병 의심자를 감염병 환자와 접촉한 사람 뿐만 아니라 ‘접촉이 의심되는 사람’까지 포함하고 있어 자의적으로 그 대상이 확대될 위험이 있다. 예를 들어, 지난 5월 초 이태원 클럽에서 확진자가 발생했을 당시 서울시는 이동통신사에 요청해 클럽 주변에 있었던 사람들의 명단을 받았는데 그 수가 무려 1만명이 넘었다. 그러나 1만명이 넘는 사람을 감염병 의심자로 간주하는 것은 과도하다. 또한 확진자가 5월 2일 새벽에 클럽을 방문했었음에도 불구하고 1주일 전인 4월 24일부터의 클럽 주변의 방문자 개인정보를 요구했다는 점에서 역학적인 필요성도 불분명했다.

수집된 개인정보를 얼마나 오래 동안 보관하는지도 모호하다. 정부는 <코로나19 역학조사 지원시스템>에 대한 보도자료에서 “이 시스템은 감염병 위기대응 단계를 고려하여 한시적으로 운영되며, 코로나19 상황이 종료되는 즉시 개인정보는 파기할 예정”이라고 밝혔다. 그러나 진보네트워크센터가 질병관리본부에 질의하여 받은 답변은 반대였다. 메르스 사태 이후 수집된 확진자와 격리자 정보는 파기하지 않았으며 준영구적으로 보존할 예정이라고 하며, ‘코로나19 상황의 종료’에 대한 판단 기준 역시 정해지지 않았다고 한다.

방역과 민주주의 조화, 어떻게 할 것인가?

해외 민주주의 국가에서 한국과 같이 확진자의 과거 동선에 대한 추적과 감시에 기반한 방역 시스템이 왜 일반적으로 도입되지 않고 있는지에 대한 면밀한 분석이 필요할 것이다. 확진자가 폭발적으로 증가하여 개별 확진자의 역학조사에 기반한 대응보다는 봉쇄조치와 같은 다른 대책이 더 효과적이었을 수 있고, 기본권 제한 조치를 도입하기 위해서는 법적 근거가 필요한데 메르스 이후 관련 법제를 이미 도입한 한국과 달리 다른 나라는 코로나19에 대응하면서 논란이 많은 법제를 도입할 여유가 없었을 수도 있다. 우리가 인식해야 할 점은 한국이 개인의 2주 동안의 행적을 쉽게 추적할 수 있는 물리적인 조건을 갖추고 있다는 것이다. 현금보다는 신용카드를 더 많이 사용하고 전국 어디에서나 버스와 지하철을 탈 때 단일한 교통카드를 이용하며, CCTV가 촘촘하게 설치되어 있기 때문이다. 지금은 방역이라는 공공 목적을 위해 이러한 정보들이 수집되지만, 또 다른 목적을 위해 내 동선이 추적되는 것도 언제든지 가능하다는 것이다.

지금의 정치 권력은 과거의 독재자보다 권력을 남용하려는 욕망은 적을지 몰라도, 사람들의 일상적인 삶에 실질적으로 권력의 영향을 미칠 수 있는 능력은 훨씬 강해졌다. 그래서 우리는 과거보다 더 많은 민주주의가 필요하다. 우선 개인정보 보호 원칙에서 벗어나는 사회 시스템을 개혁할 필요가 있다. 여전히 다목적으로 활용되고 있는 주민등록번호 제도, 모바일 환경에서 개인의 일거수 일투족을 추적할 수 있는 휴대전화 실명제, 주민등록번호와 연계되어 온라인에서 개인 식별을 가능하게 하는 본인확인 제도 등이 개인정보 보호 원칙을 벗어난 감시 시스템의 물질적인 기반이다.

감염병 대응 과정에서도 인권과 민주주의 원칙에 맞게 개선되어야 한다. 방역당국의 자의적인 판단에만 의존하는 개인정보 수집 및 처리를 감독할 수 있는 시스템이 필요한데, 올해 8월 5일에 발족된 개인정보보호위원회가 국가인권위원회와 함께 이러한 역할을 해야 한다. 감염병 예방법도 개인정보 보호원칙을 반영하여 개선될 필요가 있다. 자가격리자 감시를 위한 손목밴드(전자팔찌)와 같이 법적인 근거도 없이 사실상의 강제조치가 시행되어서는 안된다. 한 국가의 방역이 성공적인지 여부에 대한 평가는 감염병에 효과적으로 대응했는지 여부와 함께 얼마나 인권과 민주주의에 기반한 시스템인지 고려해야 한다.

• 이 글은 동아시아재단 정책논쟁 제147호에 실린 글입니다.

진보통신연합(Association for Progressive Communications, APC)은 2015년 세계정보사회감시 보고서(Global Information Society Watch 2014, GISWatch)를 발간하고 이를 홈페이지를 통해 공개했다. 진보통신연합 APC는 정보통신 관련 세계시민사회의 네트워크로, 진보네트워크센터도 APC의 회원단체로 가입되어 있다. GISWatch 보고서는 개방적이고 지속가능한 정보사회를 위해 APC가 2007년부터 매년 발간하고 있는 보고서인데, 2015년 보고서는 <성적 권리와 인터넷(Sexual Rights and the Internet)>을 주제로 하였다.

이 보고서는 전 세계적으로 성과 성적 권리를 위한 활동이 온라인에서 어떻게 벌어지고 있는지를 다루고 있다. 성적 정체성이 어떻게 수용되고 있는지, 성적 권리가 인터넷에서 어떻게 규제되고 있는지, 그리고 이것이 감시나 검열, 온라인 폭력과 어떻게 관련되어 있는지 등에 대한 연구 성과들이 담겨 있다. 이 보고서는 8개의 주제별 보고서와 57개 국의 국가별 보고서를 포함하고 있는데, 진보네트워크센터는 한국의 현황 보고서를 담당하였다.

이 보고서는 인터넷을 통해 다운받아 볼 수 있다.

경실련 시민권익센터는 법사위의 이해하기 힘든 보류결정을 내린 것에 심심한 유감을 표한다. 이는 시민들의 표현의 자유를 침해하는 인터넷 실명제 폐지 노력을 저지한 것이다.

현행 「공직선거법」은 선거운동기간 중 인터넷언론사 홈페이지 게시판 등에 정당·후보자에 대한 지지·반대의 정보를 게시할 경우 이용자의 실명을 확인하도록 규정하고 있다. 하지만 이는 2012년 인터넷 실명제는 위헌이라고 판단한 헌법재판소의 결정에 위배되는 것이다. 당시 헌법재판소는 인터넷실명제 시행이후 명예훼손 등의 불법정보 게시가 의미 있게 감소하지도 않았고, 무엇보다 공익적 효과가 명확하지도 그 목적을 달성하지도 못했다고 판단했다.

헌법재판소의 결정 이후 인터넷 실명제가 일부 폐지됐지만 여전히 「공직선거법」 등에 그 잔재가 남아 시민들의 의사표현을 제한하고 있다. 선거를 주관하는 중앙선거관리위원회마저 인터넷 실명제가 인터넷상 정치적 표현의 자유를 제한하고, 허위사실 등을 게시한 자를 적발하기 위한 효과적 수단도 되지 않는 점을 고려해 폐지해야한다고 주장하고 있지만 논의는 더디게 진행됐다.

인터넷 실명제는 대규모 개인정보 유출사건이 계속돼 전 국민의 개인정보가 전 세계의 공공재가 된 우리의 현실을 고려하면 하루빨리 폐지해야하는 제도이다. 박근혜 대통령 역시 국정 과제로 “인터넷 표현의 자유” 증진을 국민들에게 약속한 바 있다.

국회 법사위는 이와 같은 시민들과 대통령, 국회, 주무부처의 의지와 노력을 무시한 것이다. 특히 이 같은 법사위의 행태가 특정 여당 의원의 이유 없는 반대와 소위 회부 주장에 의한 것이라 더욱 충격을 주고 있다. 반대를 위한 반대는 시민들을 무시하고 헌법을 무시하는 몽니에 불과하다.

최근 프리덤하우스가 발표한 “2015 인터넷 자유” 보고서에서 한국 언론과 인터넷 자유는 지난해보다 하락했다. 우리는 여전히 의사표현이 “부분적으로 자유로운” 국가에 살고 있다. 경실련 시민권익센터는 국회 법사위가 하루빨리 「공직선거법」 개정안을 의결하여 시민들의 기본권인 표현의 자유를 보장하기 위해 앞장서 줄 것을 촉구한다.

Network Neutrality in S.Korea

written by Borami Kim(Lawyer, Citizens’ Coalition for Economic Justice) and Byoungil Oh(Activist, Korean Progressive Network Jinbonet)

1.   Regulation and laws that affect NN

The Ministry of Science, ICT and Future Planning(MSIP), telecommunication regulatory authority, has a big hand over the existing telecommunication services. Even internet access service provider is defined as common carrier, which natually should obtain service license from MSIP and be regulated by the Tecommunications Business Act.

Telecommunications Business Act

The Telecommunication Business Act granted enourmous power for telecommunication regulatory authority to regulate telecoms practices undermining unfair competition and users interests. Therefore, although there is no clear statement of network neutrality, telecommunication business act has some provisions which could be used for net neutrality regulation. (You can refer to annex 1 for provisions related to network neutrality)^[1] 

The act had not been intended for regulating communications over the Internet but is still aimed at the telephone industry as common carriers. But to keep up with the shift towards all-IP communications in the telecom industry, some amendments have been made to the act to include communications over the internet into the definition of common carriers and, therefore, a common carrier which provides Internet access service is subject to the same duties as apply to telephone service providers.

Article 2 (11) defines the term “common telecommunications services” as telecommunications services for transmitting or receiving sounds, data, images, etc. without any change in the form or contents thereof and to lease telecommunications line equipment and facilities for the use of transmission or reception of sounds, data, images, etc., such as telephone services or Internet services. This provision states that common telecommunications services providers have the obligation to transmit sounds, data, images, etc. “without any change in the form or contents” thereof on the Internet, which can be interpreted as no restriction, one of the net neutrality principles. In addition, the Article 3 (1) of the act prohibits telecommunications business operator from refusing to privide any telecommunications service, without justifiable grounds.^[2]

Article 28 (3) of the act provides grounds to regulate the terms and conditions of use of authorized operators, as follows: 1) they shall consider their influence over fair competition environments, etc.; 2) they shall not put users at a disadvantage in terms of cost-sharing methods; 3) they shall not unfairly restrict the use of telecommunications line facilities by other telecommunications business operators or users; 4) and they shall not unfairly discriminate specific persons. These provisions provide grounds for implementing net neutrality principles of no restriction and no discrimination.

Article 50 defines ‘prohibited acts’, among which acts of unfair discrimination and undermining of user’s  interests by a telecommunication carrier are included. 

While the act could be interpreted and used for net neutrality as seen above,  Korean regulatory authority has the perception that the current act has nothing to do with net neutrality or net neutrality is a complex matter that should be determined by social consensus, so set up consulatative body, network neutrality forum, to discuss network neutrality guideline on May, 2011.

The Guidelines on the Net Neutrality and Internet Traffic Management

Korea Communications Commission (KCC), which was a telecommunication regulatory authority at that time^[3],  announced a guideline on net neutrality and Internet traffic management (NN guideline) which specifies net neutrality principle on December, 2011.^[4] The guideline stipulated user’s right to access to any lawful contents, application and services of their choice, using devices which are not harmful to network, and to get informed of traffic management informations. It also stated transparency of traffic management, no blocking and no unreasonable discriminations. (You can refer to annex 2 for the full text of the guideline)

The guideline clarified Net Neutrality prinicples broadly, but had a limitation to be applied to current issues, eg throttling of mVoIP. KCC told  in the announcement that it would continue to discuss on the detailed standard on traffic management and policies for new services such as mVoIP as a next step since 2012, which means that the guideline had no practical use for regulaing the practice of throttling mVoIP by telecoms.

The standard on reasonable management and usage of communication network and transparency of traffic management

In 2012, KCC launched ‘policy consultative committee on NN’ and let it develope so-called traffic management guideline. The draft of traffic management guideline, released on July, 2012, had many poisonous clauses which override NN guideline. For example, it allows discrimination of certain traffic, such as P2P, heavy user’s traffic. It also allows the terms and conditions of use which could discriminate certain contents and applications. Eventually, the traffic management guideline had been dismissed by KCC at the end of 2012, due to the opposition of civil societies and some politicians.

In 2013, the MSIP, new telecommunication authority of new government, reignited it. It revised the draft and, in the end, announced ‘the standard on reasonable management and usage of communication network and transparency of traffic management’ on 5 December, 2013.^[5]

It mainly aimed at preventing arbitrary traffic management by network operators and publishing traffic management information to users in a transparent manner in 2013. It proposes four criteria to consider in assessing the reasonability of traffic management as follows : 1) transparency – whether traffic management policy is disclosed enough, 2) proportionality – whether traffic management is proportionate to its aim and motive, 3) non-discrimination – whether there is unfair discrimination between similar type of contents, and 4) technical characteristics of network.

However, it allows network operators to provide different price bands according to service quality and volume, which could be interpreted as allowing discrimination of mVoIP in lower price bands. Actually, the MSIP told in the announcement that mVoIP rate system would be in principle within the remit of network operators, so should be decided by them autonomically, but it would guide them to allow mVoIP in all price bands since 2014.

On 30, June, 2014 MSIP announced the plan on ‘reduction measure of consumer communication cost’, which included the policy that mVoIP would be allowed in all price band, but with limited volume depending on price bands, which means that users can’t use mVoIP after they run up the volume allowed for mVoIP even if they still have the volume for other internet services.

There is a guideline on NN in S.Korea, but it is little more than a name.

2.   Net Neutrality disputes

Disputes related to mVoIP

As seen above, throttling of mVoIP such as Voice Talk, Line, skype and viber etc, brought about heated debate on NN in S. Korea.

The Citizens’ Coalition for Economic Justice and Korean Progressive Network Jinbonet reported telecommunications carriers to the KCC on November 23, 2011 for charging users more for mVoIP applications or blocking their use entirely on the ground that such acts violate Article 3 which defines the duties of telecommunications business operator to provide service, Article 50 (1)-1 which defines prohibited acts that place unfair or discriminative conditions or restrictions, and Article 50 (1)-5 which defines prohibited acts that provide telecommunications services in a manner which substantially undermines telecommunications users’ interests. However, the regulators avoided to give a judgment on the claim and only responded to CCEJ on Dec 26, 2011 that it would not rush to conclusion and rather look at the issue from a longer-term point of view by thoroughly examining technological progress, market competition situation, etc. Actually,the throttling of mVoIP by mobile incumbents depended on their terms and conditions of use which had been approved by KCC.

Meanwhile, KCC deveoped and announced NN guideline on Dec, 2011, it clarified its policy position on mVoIP, that it  would not directly intervene in the market.

Telecoms argued that mVoIP service, which is the substitue of their existing voice communication service , would decrease their profit, and so finally reduce their capacity for further investment to network, which in other words means that they admitted they wanted to kill their competitors using their superior market power as owners of physical infrastruture.

Korean telecommunication market is being dominated by the oligopoly of three big telecom incumbents, SKT, KT and LGU+. Especially in mobile market, their total market share is almost 98%, in terms of subscribers

But, they charged this kind of application service is a free riding activity on their network and argued application providers should share the expenses of futher investment to network infrastructure.^[6]

As explained above, Telecoms allowed mVoIP in all price bands, but with limited volume according to the price band since 2014, which is criticised by NN advocates as still violation of NN.

Disputes related to Smart TV

On Feb 10, 2012, KT started to block its high-speed internet service subscribers from using Smart TV by using four security routers (2 located near Guro-dong and 2 located near Hyehwa-dong) to identify and discard data that was being sent to Samsung Smart TV server (identified by IP addresses). But, by the arbitration of KCC, KT withdrew the restriction on Feb 14, 2012.^[7]

In this case, KCC determined that Smart TV was a type of PC by which one could connect to the Internet and hence blocking Internet access, while there was no grounds that would justify such an act in the terms and conditions of use, constituted prohibited acts which provide telecommunications services in a manner different from the terms and conditions of use stipulated in the former part of Article 50 (1)-5 of the Act; and that blocking Samsung’s SmartTV alone while allowing LG’s product constituted prohibited act which provide telecommunications services in a manner which discriminates users based on their device manufacturer (the latter part of Article 50 (1)-5 of the Act and Article 42, starred item 3 V.(5) – a of the Enforcement Decree of the Telecommunications Business Act.

However, while KCC was dealing with a dispute related to net neutrality, the regulator stated that it was needed to determine whether the access should be allowed or not based on the current Telecommunications Business Act and the terms and conditions of use, aside from the net neutrality debate. In other words, KCC was presenting an explanation that the no restriction and no discrimination clauses included in the Telecommunications Business Act were different from net neutrality principles without giving any ground. It seems that the main reason regulator made such an explicit statement was the upcoming net neutrality guideline which was under discussion at the time.

3.   Civil Society responses to NN issues

Network Neutrality User Forum of S.Korea

To respond NN issues, Network Neutrality User Forum(NNUF), which had been composed of eleven civil society organizations^[8], end users, and some experts, has been formed on May, 2012. (http://nnforum.kr) 

To promote public discourse on net neutrality, NNUF have held many meetings and fora including three fora, three public lectures, an open forum, three open seminars as well as a citizen’s request. It published out one book, <Speaking of Net Neutrality> in January 2013, which is an outcome of discussion and its acivities.

Proposed amendment of law with regard to NN

NNUF is preparing to legislate so-called ‘net neutrality act’, the amendment of Telecommunication Business Act.

Though the act potentially provide a substantial basis for resolving net neutrality dispute as mentioned above, the duties stipulated in the act are still not based on the net neutrality principle, but laid down by expanding the scope of common carriers regulations which used to apply to traditional telephone service providers alone to include Internet business operators. Given that, even though the provisions that have net neutrality elements can potentially be used as grounds to resolve such disputes, there still remains the fundamental issue of the lack of legal basis in the telecommunications law that guarantees users’ right to choose. NN guidelines are not legally binding, which makes it hard to apply them in reality. In this respect, it is time to find a fundamental solution to the issue by officially enacting the ground provisions in the Telecommunications Business Act, laying down legislation that specifies net neutrality principle.

Major proposed changes in the act is as follows :

1) Create provisions on the definition of Internet user and users’ right : To define the term “end user” in the Internet technology field with a conventional term “Internet user” and establish grounds for Internet users’ right with regard to net neutrality,

2) Create provisions on managed service : To define managed service and establish grounds upon which such services are prevented from influencing the internet network,

3) Create provisions on limited reasonable traffic management : To establish grounds upon which the scope of traffic management can be limited for human rights reasons, and

4) Create provisions to mandate monitoring of traffic management technologies : To establish grounds for mandating the monitoring of traffic management technologies by considering their impacts on the privacy of Internet users and making the results public

<Annex 1>

Provisions related to NN in the Telecommunication Business Act

Article 2 (Definitions)

11. The term "common telecommunications services" means telecommunications services for transmitting or receiving sounds, data, images, etc. without any change in the form or contents thereof and to lease telecommunications line equipment and facilities for the use of transmission or reception of sounds, data, images, etc., such as telephone services or Internet services: Provided, That this shall not include telecommunications services (referring to detailed independent services among telecommunications services under subparagraph 6; hereinafter the same shall apply) determined and publicly announced by the Ministry of Science, ICT, and Future Planning;

Article 3 (Duties to Provide Services, etc.)(1) No telecommunications business operator may refuse to provide any telecommunications service, without justifiable grounds.

Article 28 (Reporting, etc. on Terms and Conditions of Use)

(3) In cases under the main sentence of paragraph (2), the Ministry of Science, ICT, and Future Planning shall authorize the terms and conditions of use, if they satisfy the following requirements:

1. Telecommunications service charges shall be determined with reasonable consideration of the cost for supply, profits, classification of expenses and profits corresponding to each service, cost saving depending on the methods of service delivery, influence over fair competition environments, etc.;

2. They shall not put users at a disadvantage in terms of matters concerning the responsibility of common telecommunications business operators and relevant users or cost-sharing methods for installation works of telecommunications facilities and other works;

3. They shall not unfairly restrict the use of telecommunications line facilities by other telecommunications business operators or users;

4. They shall not unfairly discriminate specific persons;

Article 50 (Prohibited Acts) (1) No telecommunications business operator may commit any of the following acts (hereinafter referred to as "prohibited acts") which undermine or are feared to undermine fair competition or users’ interests, or allow other telecommunications business operators or third parties to commit such acts:

1. Acts which place unfair or discriminative conditions or restrictions on the provision of equipment and facilities, joint utilization, interconnection or joint-use services, wholesale services, provision of information, etc.;

5. Acts which provide telecommunications services in a manner different from the terms and conditions of use (limited to the terms and conditions of use reported or authorized under Article 28 (1) and (2)), or in a manner which substantially undermines telecommunications users’ interests;

<Annex 2>

The Guidelines on the Net Neutrality and Internet Traffic Management

●     This is the unofficial translation of ‘The Guidelines on the Net Neutrality and Internet Traffic Management’. 

The Guidelines on the Net Neutrality and Internet Traffic Management

Ⅰ. Objective

1.    These guidelines aim at fostering an open and fair Internet usage environment, and to improve a healthy and sustainable Information and Communication Technology (hereinafter referred to as “ICT”) ecosystem through the basic principles for Net Neutrality and Internet Traffic Management.

Ⅱ. Basic Principles

User’s Rights

2.    Internet users have the right to use lawful content, application, service, and not harmful devices or equipment freely, and to be provided with information regarding Internet traffic management by related carriers.

■      Internet users mean end users.

Transparency on Internet Traffic Management

3.    An Internet access service provider shall disclose the traffic management policy which clarifies objectives, scopes, conditions, processes, and ways, etc. of Internet traffic management. When implementing the necessary measures of traffic management, it shall inform the relevant users of the facts and the effects. (However, when there are unavoidable reasons that prevent them from informing users of important information, it can be replaced by a notice.) The Korean Communications Commission could lay down additional rules regarding the scopes and the ways of disclosure, and the information to be provided.

■      An Internet access service provider means a Telecommunications carrier which provides a fixed and wireless Internet access service pursuant to the Telecommunications Business Act.

No Blocking

4.    An Internet access service provider shall not block lawful content, applications, services, or not harmful devices or equipment. However, it is allowed when the need for reasonable traffic management is approved.

No Unreasonable Discrimination

5.    An Internet access service provider shall not unreasonably discriminate against any lawful contents according to the types or providers of these contents, applications, and services. However, it is allowed when the need for reasonable traffic management is approved.

Reasonable Traffic Management

6.    The need for reasonable traffic management includes, but is not limited to, the following subparagraphs. The Korean Communications Commission will lay down additional rules on the scope, condition, processes, ways of reasonable traffic management; a standard of judgment on whether traffic management is reasonable, etc. In these cases, it could be different, according to the type of network (fixed or wireless, etc), and technology characteristics.

1)    For Net security and stability

2)    For protecting most users’ interests by avoiding net congestion caused by  temporary overload etc.

3)    For the request of states’ agencies according to the laws, or need of enforcement by other laws.

Ⅲ. Managed Service

7.    An Internet access service provider could provide Managed Service, without quality deterioration of Best Effort Internet below the reasonable standard. The Korean Communications Commission additionally monitors the Best Effort Internet’s quality, and the effect on the market when Managed Service is implemented.

■      Managed Service means a service which guarantees the traffic transmission quality, such as transmission bandwidth, etc., by traffic management technology other than generally Best Effort Internet.

Ⅳ. Mutual Cooperation

8.    Internet access service providers and content/application/service providers, etc. shall collaborate with each other for the healthy and sustainable development of the ICT ecosystem, and according to principle of good faith, they especially shall cooperate to give information regarding providing content/applications/service, and operating a stabilized net, etc. when necessary. Also they could organize a policy consultative body for building market self-regulating standards, etc. regarding Net Neutrality and Internet traffic management when necessary.

Ⅴ. Building and Managing Policy Consultative Body

9.    The Korean Communications Commission builds and manages the additional policy consultative body in which interest groups, specialists, etc., participate, for the improving Internet traffic management transparency, pertaining to the necessary measurement of these guidelines implementation, such as providing judgment standards for reasonable traffic management scopes, conditions, procedures, whether it is reasonable, discussing on policy direction for spreading emerging services, such as mVoIP, etc., and trying to find a way for new market order according to the ICT ecosystem change. The Korean Communications Commission additionally will decide its requirements regarding its members, management, etc.

2014-12-22

수  신: 각 언론사 IT/인터넷 전문 기자, 사회부, 경제부 기자

발  신: 진보네트워크센터

제  목: 진보넷, 주민등록번호 수집 법령에 대한 검토보고서 발표

일  자 : 2014년 12월 10일 (수)

문  의 : 오병일 (02-774-4551, antiropy@gmail.com)

주민번호 수집 관행 여전히 계속되고 있다

– 진보넷, 주민등록번호 수집 법령에 대한 검토보고서 발표

– 1000 개가 넘는 법령에서 주민번호 수집 허용, 주민번호 수집 법정주의 취지 훼손

– 주민번호 수집의 불가피성, 모든 법령을 대상으로 재검토해야

1. 2014년 8월 7일, 주민등록번호 수집 법정주의가 시행되었습니다.

즉, 개정된 개인정보보호법 제24조의2(주민등록번호 처리의 제한)에 근거하여 ‘법령에서 구체적으로 주민등록번호의 처리를 요구하거나 허용한 경우’ 외에는 정보주체의 동의가 있어도 주민등록번호를 수집할 수 없습니다. 그러나 현재 주민등록번호 수집을 허용하고 있는 법령은 1000개가 넘을 것으로 추산되고 있습니다. 이는 주민등록번호의 무분별한 수집을 제한하고자 한, ‘주민등록번호 수집 법정주의’의 취지를 훼손하기에 충분합니다. 이에 진정으로 주민등록번호 수집이 불가피한 것인지, 진보넷은 현행 법령을 분석해보았습니다.

2. 현행 법령에 대한 분석 결과는 다음과 같습니다.

(1) 안전행정부는 주민등록번호 수집의 불가피성에 대해 제대로 검토하지도 않았습니다. 안전행정부가 발표한 <주민등록번호 수집 금지 제도 가이드라인>을 보면, ‘현재 주민번호를 수집하고 있는 업무가 법령에 근거를 두고 있’다면, ‘별도 조치 불필요’라고 안내하고 있습니다. 그러나 주민등록번호 수집 법정주의가 ‘법령에 근거만 있으면 자유롭게 주민등록번호를 수집할 수 있다’는 것으로 왜곡되어서는 안됩니다. 지금까지 주민등록번호를 허용해왔던 관행들이 진정으로 필요한 것인지 기존 법령을 엄격하게 재검토해야 합니다.

(2) 8.7 법정주의 시행에 즈음하여 이루어진 시행령 개정안들에 대한 심사도 허술하게 이루어졌습니다. 개별 사안에 대한 판단에 일관성이 없는 경우도 있고(즉, 유사한 사례에서 어떤 경우는 주민등록번호 수집을 허용하고, 어떤 경우는 허용하지 않는 등), 이미 서식에서 생년월일을 사용하고 있음에도 불구하고 시행령 개정을 통해 주민등록번호 수집을 허용하는 식으로 후퇴한 경우도 있었습니다.

(3) 다른 방식으로 충분히 대체 가능한 경우에도, 여전히 편의상 주민등록번호 수집을 허용하고 있습니다. 교육이수여부 확인이나 출입통제와 같은 경우에 주민등록번호를 수집하는 것은 과도합니다. (2)에서의 사례에서와 같이 생년월일로 대체 가능한 경우에도 주민등록번호 수집을 허용하고 있습니다. 또한 유공자 지원이나 공제회와 같이 한정된 사람만을 대상으로 하는 경우에도 주민등록번호를 수집하고 있는데, 이는 개인정보의 조합으로 처리 가능하거나 고유의 식별번호를 사용하는 것이 바람직합니다.

(4) 금융, 조세 등과 연계된 경우에는 현재의 시스템에서는 주민등록번호의 수집이 불가피하지만, 장기적으로 고유한 목적별 번호로 대체해나가는 것이 가능하며, 바람직합니다. 실제로 해외의 주요 국가에서는 국민식별번호와 별개로 조세번호(납세자번호)를 사용하고 있습니다.

3. 이번 분석을 토대로 진보넷은 다음과 같이 제안합니다.

(1) 개인정보보호위원회의 주도로 주민등록번호 수집을 허용하고 있는 현행 법령을 대상으로 주민등록번호 수집 불가피성에 대해 전면적으로 재검토해야 합니다. 기존 정부 부처들은 자신들에게 보다 편리하고, 개편 비용이 들지 않는 주민등록번호를 사용하고자 하는 유혹에 약할 수 밖에 없기 때문입니다.

(2) 주민등록번호 수집 불가피성에 대해 엄격한 기준을 적용해야 합니다. 유사한 영역에서 이미 주민등록번호를 생년월일로 대체하는 등 운영이 가능하다면, 다른 영역에서도 (다른 특별한 이유가 있지 않는 한) 이를 기준으로 판단해야 합니다.

(3) 유공자 관리, 공제회 등 특정 그룹만을 대상으로 한 관리를 위해 주민등록번호를 사용할 이유가 없습니다. 특정 영역에서는 고유한 식별번호를 사용할 것을 권고해야 하며, 조세, 금융 등 전 국민을 대상으로 한 업무의 경우에도 조세번호 등 별도의 목적별 번호를 사용하는 방식으로 바꿔나갈 필요가 있습니다. 이를 위해 안전행정부가 아니라, 총리실 주도로 범 정부 차원에서 국가식별번호 체계 개편안을 마련해야 합니다.

(4) (특히 관리의 대상이 한정적일 경우에는) 주민등록번호 대신 생년월일, 핸드폰 번호 등 다양한 식별자가 본인 확인을 위해 활용될 수 있습니다. 주민등록번호를 통한 본인확인이라는 강박에서 벗어나야 합니다.

(5) 주민등록번호의 수집 필요성을 세분화하여 해당 목적에 맞는 한도 내에서만 엄격히 활용을 제한하고, 개인정보 처리의 각 단계에서 정보주체가 선택권을 행사할 수 있도록 보장할 필요가 있습니다. 예를 들어, 신원 조회만을 위해 주민등록번호가 필요하다면, 신원 조회 후 그 결과 만을 남기고 주민등록번호를 삭제하는 것이 바람직합니다. 혹은 당사자가 제3기관에 직접 신원 조회를 하는 것이 아니라, 당사자가 필요한 자격을 입증할 수 있는 서류를 제출하도록 할 수도 있을 것입니다.

(6) 가능한 주민등록번호의 수집 및 활용 범위를 법으로 규정할 필요가 있습니다. 지금과 같이 서식만을 통해서도 주민등록번호 수집을 가능하게 한다면, 자의적인 수집 및 활용을 배제할 수 없습니다.

4. 이번 분석은 이를 위해 8.7 주민등록번호 수집 법정주의에 맞춰 개정 여부가 검토된 시행령 개정안에 대한 각 부처의 의견과 이에 대한 안전행정부의 평가 자료를 참고로 한 것입니다. 이 자료는 2014년 국정감사에서 정청래 의원실이 안전행정부로부터 받은 것이며, 정청래 의원실의 요청에 따라 진보넷이 자료를 제공받아 분석하였습니다. 한편, 이번 연구는 ‘4.9통일평화재단’이 후원하였습니다.

2014-12-09

2014-11-17

Introduction

The Korean Railway Worker’s Union (KRWU) went on strike on 9 December 2013 opposing the privatisation of the railroad. The Korean government’s response was hard-line, and the police imposed widespread surveillance on the striking workers and their families.

Firstly, the police acquired all the mobile communication records of union members and their families, including schoolchildren, and tracked the real-time location of their mobile phones – the mobile service providers had offered to provide this information at 10-minute intervals for several months. The police also asked popular websites, such as game sites and internet shopping malls, to provide the real-time access IP addresses of the workers and their families. The mobile service providers also handed over the identities of about 300 to 400 people who talked on the phone with the strikers to the police, who used this information to interview the subscribers about details of their relationship with the strikers. Railway workers and human rights NGOs, including Jinbonet, filed a petition to the Constitutional Court against the real-time location tracking on May 2014.

Policy and political background

The NGOs argued that the lack of adequate legal requirements for police to access communication metadata in an investigation is unconstitutional. The authorities conduct surveillance on workers exercising their right to strike as if they were criminals – it has been maintaining a DNA database of criminals, which includes striking workers, since 2010.¹ Communications surveillance in particular, which has insufficient legal control given the rapid development of the internet and mobile technologies, has significantly extended the power of the police and the intelligence agency beyond the law.

Communications surveillance in South Korea is regulated by the Protection of Communications Secrets Act (PCSA). The previous military dictatorship in South Korea had conducted communications surveillance for a long time without any legal regulation. The PCSA, passed in 1993 in the aftermath of a wiretapping controversy among presidential candidates, allows the intelligence agency and investigation agencies to intercept the content of communications in real time with prior court approval. The content of communications such as stored email or SMS messages is provided to agencies with a prior warrant for search and seizure under the Criminal Procedure Act. However real-time wiretapping on foreign groups and nationals can be conducted merely with the approval of the president. The intelligence agency and the investigation agencies can wiretap in real time by making use of intermediaries, including telecommunication service providers, or by using their own technologies. They can also wiretap without any permission for 36 hours if it is considered an emergency.

Since 2002 the PCSA has begun to regulate communication metadata: the record of the date and the time of communications, the IP address, the internet logs, the location of the base station or the communication device, etc. Although court permission has been required to collect communication metadata since 2005, when it is “necessary to conduct any investigation,” the permission is given without any specific restrictions. According to the Telecommunications Business Act, personal information to identify the subscriber or user such as name, residential registration number (which is the national ID number in South Korea), address, etc. is separately provided to the agencies without any permission from external supervisory agencies such as the courts.

Ex-post notification² has been implemented regarding undercover communications surveillance: users have been notified of wiretapping since 2001, of the handing over of communication metadata to agencies since 2005, and of the search and seizure of stored communications content since 2009.³ The personal information of the subscriber or the user is not included in this notification. The government then releases statistics about the number of these cases twice a year.

Besides the above, telecommunications service providers, including intermediaries, should keep communication metadata depending on the service they offer:

• Twelve months for mobile service providers

• Six months for landline service providers

• Three months for internet service providers.

Communications surveillance: Cases and civil society reaction

Although the PCSA was an attempt to legally regulate communications surveillance, the rapid development of the internet and mobile technologies, and the prompt adoption of them by the agencies, makes it overwhelming. A popular example is real-time location tracking of telecommunication devices.

Real-time location tracking

When the PCSA created the framework for the regulation of communication metadata in 2002, it referred to historical communication records. Without any external request, telecommunication service providers have kept the historical communication metadata related to billing, and they were to some extent expected to and asked to by their customers. However, agencies then started to require the “future” location information of their targets. The telecommunications service providers accepted the request, not only because collecting real-time location information and providing this was technically possible, but also because the related regulatory clause was not clearly defined on that matter.

For example, in the case of a mobile phone location, the telecommunications service provider informs a police officer of the location of the base station capturing the signal from the specified mobile phone by text message every 10 minutes. In the case of IP addresses, the internet service provider informs the police officer when the specified ID logs in.⁴ Because telecommunications service providers in South Korea confirm their subscribers’ or users’ identities before activating mobile phone or internet services including online games, this kind of location information helps the agencies to accurately track the subject.

Real-time tracking was illustrated when a woman worker had been staging a sit-in protest at the top of a 35-metre-high crane for more than 150 days to oppose a huge lay-off of workers. “Buses of hope” had been organised to support her struggle, carrying thousands of supporters to the place of protest. To arrest those who organised the buses, the police and the prosecutors traced the real-time location of the mobile phones of the activists and their families for months. Human rights NGOs challenged this in the Constitutional Court in 2012, filing a second petition against tracing the mobile phones and internet IDs of the leaders of the KRWU and their families in 2014. Both Constitutional Court reviews are still underway.

The use of data from base stations

Another constitutional controversy surrounding communication metadata concerns the use of data from mobile base stations. The PCSA does not clearly define whether or not agencies should specify the technical scope of the request when they require a telecommunications service provider to hand over communication metadata. Consequentially, agencies are offered mobile phone numbers captured by base stations around the areas where assemblies and demonstrations take place to identify people who participate in these protests. In the case of highly populated areas, the agency could be provided with over 10,000 mobile phone numbers from just one base station.

In 2012, a phone number of a journalist who covered an opposition party event was included in the base-station data offered to investigators. Jinbonet and the victim submitted a constitutional petition and the review is now underway.

Table 1 shows statistics on the amount of base-station data offered to investigators, compared to all the metadata handed over to authorities.

Table 1. Base-station data provided to investigators

* Source: Government of the Republic of Korea (Korea Communications Commission, the Ministry of Future Creation and Science)

Internet packet inspection

Because the Korean intelligence agency, the National Intelligence Service (NIS), not only has the right to collect secret information but also the power to investigate, it now conducts the largest number of telecommunication interceptions among the agencies, according to official government statistics. The statistics are aggregated using the data from telecommunications service providers who have offered data to the agencies. However, the statistics on interception conducted by the NIS using its own equipment have never been open to public scrutiny and are cloaked in secrecy.⁵

Table 2 shows the overall statistics for telecommunications interceptions in South Korea compared to NIS requests.

Table 2. Requests for telecommunications interception

* Source: Government of the Republic of Korea

It was first known that the NIS had been monitoring the internet network and intercepting content by using deep packet inspection (DPI) in 2009. Monitoring the internet network in this way infringes basic human rights such as the right to privacy and freedom of expression and communication, as it allows the agency to monitor not only emails but all other interests of an internet user, including relationships and the financial life of a subject. Human rights NGOs, including Jinbonet, revealed the presence of internet packet inspection by the NIS at a media conference, held together with its victims. They also submitted a petition to the Constitutional Court when the NIS again conducted internet packet inspection in 2011 while investigating a person suspected of being in violation of the country’s national security laws.

The NIS insists that it is impossible to investigate foreign-based emails such as Gmail without packet inspection, while it can investigate domestic internet usage by approaching service providers. The constitutional review is now underway.

Provision of personal information

It is a massive infringement of human rights that internet service providers (ISPs) provide personal information of subscribers or users such as name, ID, resident registration number, address, etc. to the agencies, without any restriction. This provision has faced severe criticisms, with allegations that it is abused by authorities who deliberately target internet users who criticise the government. The fact that there have been 9,574,659 cases of personal information provided in 2013 means that the personal information of 26,232 people was provided every day, and that the details of around 19% of the total national population have already been provided in South Korea. Table 3 shows statistics on the provision of personal information.

Table 3. Provision of personal information by ISPs

* Source: Government of the Republic of Korea

Conclusions

The reason why stored communication metadata is offered to law enforcement agencies is because the data is needed as evidence in investigations, and these requests by authorities are allowed. However, when a crime has not yet happened, the “reserved” location data of someone is not necessary information which telecommunications service providers have to generate or keep in order to provide it to the authorities. The data is processed only to make it convenient for the agencies to electronically trace their subjects in real time. This practice goes against data protection norms which require that collecting and using any personal information should be the minimum necessary.

The data protection norms, including the country’s Data Protection Act, grant many exceptions to the intelligence and investigation agencies. The data generated under these exceptions might also be used for the financial benefit of the service providers.Considering that the purpose of the constitution and international human rights law is to protect private life, personal information, and the privacy and freedom of communication from any governmental surveillance, the present legal system in South Korea, such as PCSA and the Data Protection Act, means that the government is infringing on these human rights.

Action steps

There is a serious communication surveillance crisis, not only in South Korea but throughout the whole world. As a UN resolution⁶ pointed out in November 2013, it is necessary to improve domestic laws related to the protection of privacy, communication privacy and personal information in the digital age. It is essential to establish an independent body that supervises communications surveillance conducted by the intelligence agency and the investigation agencies. Both the Personal Information Protection Commission and the National Assembly in South Korea have not performed this supervisory role well enough.

Additionally, an international norm to regulate secret surveillance by intelligence agencies is needed in each country. As Edward Snowden revealed, as long as intelligence agencies across the world collect information by cooperating with or competing with each other, no citizen of any nation can be guaranteed privacy.

To achieve this, lawmakers in South Korea have to recognise the seriousness of communications surveillance and improve domestic laws. They also need to cooperate internationally to build proper international norms on the issue. Human rights NGOs will continue taking vigorous action to demand that these steps are implemented.⁷

2014-09-10