Time to Revamp Korea's National ID System?

I recommend another very interesting article generated by the cyber-attack and leakage of personal information from Nate and Cyworld accounts.  This one, accompanied by a nice graphic (click to see a larger version) was published in The Korea Times.

The article notes that the compromised information included names, passwords, phone numbers, e-mail addresses, and most alarmingly, resident registration numbers, the country’s equivalent to social security numbers.

Government officials insist that the country’s computer security defense is still salvageable as they scramble to apply the patchwork. But critics, unconvinced, claim it’s officially time to blow up the national ID system and start over.

``The resident registration number of virtually every Korean is out there ― the information is so easily available that police announced a while ago that hackers are barely getting 1 won for each code. And we have heard rumors that criminals are passing these numbers around in (Microsoft) Excel files,’’ said Jang Yeo-gyeong, a computer security expert at activist group Jinbo Net.

From a security standpoint, resident registration numbers are flawed from the start. The 13-digit code reveals the birth date, sex and registration site of a person, unlike comparable systems in the United States and Japan based on random numbering.

People here submit their national ID numbers to Korean Web sites due to local laws requiring them to make verifiable real-name registrations for virtually every type of Internet activity, not only for encrypted communications like e-commerce, online banking and e-government services but also casual tasks like e-mail and blogging.

Apple, Google in Violation of Korean Law

As reported in the Joongang Daily, South Korea’s telecommunications regulator announced yesterday that Apple and Google’s location tracking capabilities violate Korean laws, fining Apple Korea and ordering that both companies rectify the issues.The Korea Communications Commission (KCC) has been investigating since April, after two computer engineers argued that the latest version of Apple’s mobile operating system, iOS 4.0, keeps track of users’ locations as far back as June 2010, which was when the operating system was launched. That caused controversy worldwide.

While the Korean government was hardly alone in launching an investigation into location tracking issues, it is the first in the world to actually declare that Apple and Google violated laws and order punitive measures.

According to Location Information Law Article 15, when businesses seek to collect, utilize and offer people’s location data, they should get their consent. Furthermore, Location Information Law Article 16 dictates that businesses take protective technological measures to prevent the data from being exposed, falsified or damaged.

“We haven’t been tracking anyone,” Apple CEO Steve Jobs said earlier this year. “The files they found on these phones were basically files we have built through anonymous, crowd-sourced information that we collect from the tens of millions of iPhones out there.”

Google also explained that “all location sharing on Android is an opt-in by the user.” When a user activates an Android phone, a screen appears saying Google will collect anonymous location data.

More on Cyber Leaks and Cyber Warfare in Korea

Press coverage of the recent cyber attacks on Nate and Cyworld and the resulting leakage of personal information is just beginning. Readers who found my previous post interesting may wish to read today's article in the Joongang Daily. It notes that controversy is heating up over Korean Web portal operators’ collection and storage of private data after the country’s worst cyber hacking case put over two-thirds of its population at risk of identity theft.

It also put a question mark on the effectiveness of the country’s controversial Internet regulations, such as the real-name verification law, which critics argue provide incentives for online companies to hoard personal information.



“While they didn’t have the ability to protect private data, they have been excessively collecting it,” said Lim Jong-in, dean of the Graduate School of Information Security at Korea University, referring to the country’s major Web portals.



Korean Internet users rely heavily on do-it-all, one-stop Web portals. They visit industry leader Naver at least three times for every four Internet uses, according to market research firm Metrix Corp., and the three most-visited Web portals account for more than 90 percent of the country’s Web search traffic.

These Web portals ask for names, resident registration numbers, birth dates, addresses and phone numbers to join their services, which are accumulated, some of them encrypted, in their servers for at least five years and become attractive “booty” for hackers.

“Instead of mere lists of online accounts, [hackers] could steal the full package of real world identities,” said Nakho Kim, a media researcher at the University of Wisconsin-Madison. “Due to government policies and industry laziness, many Korean online services tend to collect a lot of personal identity information.”

Readers following the broader global context of the recent cyber attacks on Nate and Cyworld will want to read The New York Times article entitled "Security Firm Sees Global Cyberspying."

Seoul Police Raid Google Korea's Offices

The global controversy over collection and use of location data from Apple and Android smartphones has taken a new turn in Korea.   The media today, including both the Chosun Ilbo and the Joongang Daily, are reporting that the Seoul Metropolitan Police raided Google Korea's offices in Yeoksam-dong. (click on the accompanying graphic to see a full size version)

According to the Chosun Ilbo account, Police said members of their cyber unit conducted the raid Tuesday. They carried away hard drives and other equipment related to Google's AdMob unit, which is suspected of collecting personal location information without authority or permission.The probe is not directly related to a previous investigation of Google in Korea. That probe concerned the incidental collection of personal data while Google cars were cruising through neighborhoods and taking photographs for the company's Street View service.

Personal Privacy Concerns in the Information Age

As reported in the Joongang Daily, the Korea Communications Commission yesterday gave the public some advice on how to use social networking services in ways that protect private information.  The Commission cited a recent study by the Korea Internet and Security Agency, some findings of which are summarized in the accompanying graphic (click to enlarge the graphic).  This marks the first time a government agency has officially acknowledged the privacy issues posed by such social networking services as Facebook, Twitter and Me2Day.

The KCC’s 10-point guideline advised users to set security and privacy settings on networks to the appropriate level; to agree to be connected with people only when you are certain who they are; and logging out when you're not using the SNS. It also warned users about publishing personal information that may be used by advertisers and marketers for targeted advertising. It reminded users that once they upload postings, they can be widely distributed through other Web sites without the user’s knowledge.

National Police Agency Says Google Illegally Collected Private Data

The National Police Agency's cybercrime unit yesterday said they found evidence that Google illegally collected private data while producing its street view mapping service in Korea.  As reported in the Joongang Daily, police last August confiscated 79 hard disks at Google's Seoul office in Yeoksam-dong. After decoding passwords on the disks, which took several months, “We discovered e-mails and online chats individuals exchanged through [unencrypted] Wi-Fi networks,” said a police official.  The police have been investigating 10 Google employees in Korea and the United States.  Similar investigations are taking place in the U.S., Canada, Spain, Australia and Germany.  According to The Guardian, investigations are underway in 20 countries around the world.  Google started collecting street images in Korea in October 2009 using SUVs equipped with nine cameras, similar to the one shown in the accompanying graphic from The Guardian.

Google said it was "profoundly sorry" for mistakenly collecting the so-called "payload" data and vowed to continue to cooperate with South Korean authorities.
"As soon as we realised what had happened, we stopped collecting all Wi-Fi data from our Street View cars and immediately informed the authorities," Google's Korean arm said.

More on Social Networking Trends in Korea

The Joongang Daily has an interesting article today dealing with the problems of security on social networking sites in Korea.  It quotes a Facebook representative in Korea as saying that Koreans have a relatively low awareness of social network security.   I would suggest that this is part of the broader cultural differences in thinking about and using social networking sites, as discussed in earlier posts.   Cyworld is dramatically different from Facebook with the latter being introduced over four years later in the U.S.

According to eMarketer, 61.4 percent of Internet users worldwide have an SNS account, up from 51.4 percent in 2009 and 45.1 percent in 2008. And it turns out that people spend more time on social media Web sites than they do e-mailing or Web surfing. Those surveyed spent 4.6 hours a week on SNS sites, compared to 4.4 hours for e-mail.    Here in Korea, according to the Korea Communications Commission, 65.7 percent of the population uses SNS sites.

The article notes that the very concept of social networking is about sharing personal information.  However, there are limits, as most people would not want credit card or certain employment-related information publicized over the internet.   In Korea, as shown by the accompanying graphic, Cyworld is still the most popular "social networking" web site (click on graphic to see a larger version).

Online attacks have been a common occurrence in Korea, with the most famous being “dog poop girl.” In 2005, a photo of a girl who left the subway train without picking up her dog’s waste was spread on the Internet. Korean netizens revealed her identity as well as her school, and she ended up dropping out in disgrace.

Although the graphic in this post shows the current dominance of Cyworld, it should be noted that Facebook and Twitter are experiencing much more rapid growth with the booming growth of mobile broadband and smartphones.  This all amounts to many future challenges for Korean consumers, the government and the legal system here as South Korea adjusts to the realities and the security risks of social networking.

Some Context for the Police Raid on Google Korea Offices

Press reports provide additional context surround the policy raid on Google Korea's offices, as noted in my previous post.  As reported in The Korea Times, the raid here was unexpected, as the company had been talking closely with the Korea Communications Commission on how to handle the data it had collected.  Talks with the KCC were reportedly focused more on retrieving the data than on destroying it and the police raid came as a surprise.  Korea is one of about a dozen countries, including the U.S., Canada, Germany, France, Britain and Australia, that are investigating whether Google broke their privacy laws in pushing out he localized versions of street view.

Korean Netizens Flock to YouTube, Making it Number One

As reported by the Korea Times, YouTube recently became the number one video-sharing website in Korea for the first time since it entered this market in 2008. KoreanClick, a local online consultancy, said Sunday that Youtube carved out a 42.79-percent market share last month, up from 36.29 percent in May, in overall usage time.

It outdistanced business bellwether Pandora TV, which saw its market share dwindle from 40.75 percent in May to 34.19 percent last month.

Youtube's footing was expected to slip further in April, when the site was at odds with the Korean government due to the Internet real-name system.

In April, the government urged Youtube to embrace the real-name system ― the Web site was obliged to ask users to present their names and identification details before uploading any video files or write-ups. In defiance of the instruction, Youtube stopped Web users from posting video clips or comments on its Korean Internet site, prompting concerns that users would leave Youtube.

As the Planet Size Brain blog put it, YouTube basically told the Korean government to bug off when it announced that it would reject a local law that requires users to prove their identity when they upload videos and post comments.  By voluntarily disabling comments and video uploads from the Google Korean language site, Google actually generated a favorable reaction from many netizens in Korea, who could easily go to one of Google's many other YouTube portals to upload their comments and content.  Some even said they would seek "online political asylum."   Whatever the reason, use of YouTube in Korea and Korean-language contributions have increased markedly since April.

South Korea's Differences with Google

The Hankyoreh newspaper is reporting some interesting background information on the fallout after Google refused to allow YouTube to accept the Korea Communication Commission's real-name system for posting comments or uploading content to popular web sites in South Korea.  The situation is showing signs of developing into a clash between the South Korean government, which is seeking to extend the application of its internet regulations to all Internet businesses, and the world’s largest Internet company, which is trying to maintain its principle of “freedom of expression” based on the option of exercising the “freedom of anonymous expression” on the Internet that it maintains elsewhere throughout the world.

An official at the Korea Communications Commission (KCC), who wished to remain nameless, said Thursday that the KCC was “in an uproar” over Google’s April 9 decision. “The people higher up said that they could not just leave Google alone and told us to find something to punish them with, so the related team is researching possible illegalities,” the official said.

On April 9, Google announced that it would be blocking users with South Korean nationality from uploading content and posting comments on YouTube Korea’s Web site, effectively rejecting the implementation of the real name system.

Industry experts suggest that the differences between the South Korean government and Google over how to apply the new Internet regulations reveals the fallacy of creating regulation that applies to only specific geographical regions on the Internet, which is a “network of networks.” According to the government, the difficulty it faces is that it is impossible to regulate Internet policy if it leaves cases like Google’s alone. Jeon Byeong-guk, director of the Internet consulting company SearchMaster.co.kr, says that the government and Google “have come face-to-face in a situation where there are no points of agreement.” Jeon added, “Since Google does not have a large share of the South Korean market, the question is what is to be gained from the government simply cracking its whip.” I would only add that it is not only Korea, but governments around the world that face this challenge in their efforts to regulate the internet. The inherently global and interlinked character of the internet demands global approaches to governance and regulation.

Korean Websites to Stop Using Citizen's National Identification Numbers

As reported widely in the press , the Korea Communications Commission has announced a revision to the Act on Promotion of Utilization of Information and Communication Network and Data Protection. All portal sites with average daily visitors of 50,000 or more, and all online commercial and games websites with average daily visitors of 10,000 or more must devise a new membership registration process that does not require resident registration number. Under the current system of relying on the citizens national ID number for registration, there has been considerable leakage of private data. About 1,176 websites will be affected by these new rules.

Leakage of Private Information a Major Problem

According to an article in the Korea Times, the unauthorized leaking of private information continues to be a major problem in South Korea. According to a member of the ruling Grand National Party, ".. unauthorized officials at public firms had searched and even leaked sensitive private information on numerous citizens.

He said officials at the National Health Insurance Corp. had inspected more than 12,000 citizens' private information such as home address, annual income and health conditions between 2002 and May this year, adding such illegalities have been rampant at the National Pension Service as well. Among the victims are famous entertainers and politicians including Bae Yong-joon, Kim Tae-hee and even President Lee Myung-bak. Males searched the data to check whether their girl friends had an abortion. Employees collected home addresses to dole out wedding invitation cards. Some workers sold a pile of such information to private financial companies."

"A recent Korea Information Security Agency (KISA) report showed that of 700 public offices' Web sites, 54.1 percent or 379 were highly vulnerable to leaks. The report stated KISA collected more than 67,000 social security numbers through the Internet homepages." The social security numbers referred to in the Korea Times article are actually national citizen's ID numbers, the rough Korean equivalent of a U.S. social security number, but arguably even more personal and confidential than a social security number.

The Korea Times article also notes that the government is updating regulations to prevent private information leakage on public institutes' Web sites. It also plans to spend $700 million to install anti-hacking tools on them. A new law will mandate every public and private organization handling private information to encode subscribers' information such as bank accounts, social security (citizen's national ID) numbers, IDs and passwords.

The web site of Korea Information Security Agency (KISA) is a useful source of information regarding all aspects of internet security, including SPAM, identity theft, electronic certificates and privacy issues. Unfortunately, the English side of the web site has not been updated, for the most part, since 2006. However, it is still worth a visit.