W7y8w3

Table 1.Base-station data provided to investigatorsBase-station dataAll communications metadataSecond half of 2009 15,440,864 15,778,8872010 38,706,986 39,391,2202011 36,800,375 37,304,8822012 24,831,080 25,402,6172013 15,245,487 16,114,668source: Government of the Republic of Korea (Korea Communications Commission, the Ministry of Future Creation and Science)Table 2.Requests for telecommunications interceptionYear Prosecution Police NISMilitary investigativeunit or othersTotalNIS requestsas % of total2010 4 227 8,391 48 8,670 96.8%2011 3 263 6,840 61 7,167 95.4%2012 0 139 5,928 20 6,087 97.4%2013 1 96 5,927 8 6,032 98.3%source: Government of the Republic of Koreathen releases statistics about the number of thesecases twice a year.Besides the above, telecommunications serviceproviders, including intermediaries, should keepcommunication metadata depending on the servicethey offer:• Twelve months for mobile service providers• Six months for landline service providers• Three months for internet service providers.Communications surveillance:Cases and civil society reactionAlthough the PCSA was an attempt to legallyregulate communications surveillance, the rapid developmentof the internet and mobile technologies,and the prompt adoption of them by the agencies,makes it overwhelming. A popular example isreal-time location tracking of telecommunicationdevices.Real-time location trackingWhen the PCSA created the framework for theregulation of communication metadata in 2002,it referred to historical communication records.Without any external request, telecommunicationsservice providers have kept the historical communicationmetadata related to billing, and theywere to some extent expected to and asked to bytheir customers. However, agencies then started torequire the “future” location information of theirtargets. The telecommunications service providersaccepted the request, not only because collectingreal-time location information and providing thiswas technically possible, but also because the relatedregulatory clause was not clearly defined onthat matter.For example, in the case of a mobile phone location,the telecommunications service providerinforms a police officer of the location of the basestation capturing the signal from the specifiedmobile phone by text message every 10 minutes. Inthe case of IP addresses, the internet service providerinforms the police officer when the specifiedID logs in. 4 Because telecommunications serviceproviders in South Korea confirm their subscribers’or users’ identities before activating mobile phoneor internet services including online games, thiskind of location information helps the agencies toaccurately track the subject.Real-time tracking was illustrated when awoman worker had been staging a sit-in protest atthe top of a 35-metre-high crane for more than 150days to oppose a huge lay-off of workers. “Buses ofhope” had been organised to support her struggle,carrying thousands of supporters to the place ofprotest. To arrest those who organised the buses,the police and the prosecutors traced the real-timelocation of the mobile phones of the activists andtheir families for months. Human rights NGOs challengedthis in the Constitutional Court in 2012, filinga second petition against tracing the mobile phonesand internet IDs of the leaders of the KRWU andtheir families in 2014. Both Constitutional Court reviewsare still underway.The use of data from base stationsAnother constitutional controversy surroundingcommunication metadata concerns the use of datafrom mobile base stations. The PCSA does not clearlydefine whether or not agencies should specify thetechnical scope of the request when they require atelecommunications service provider to hand overcommunication metadata. Consequentially, agenciesare offered mobile phone numbers captured bybase stations around the areas where assembliesand demonstrations take place to identify peoplewho participate in these protests. In the case of4 Some online game companies have subsidiaries to deal with theserequests as they receive too many from the police. newsmaker.khan.co.kr/khnm.html?mode=view&code=115&artid=201112061719361&pt=nvhighly populated areas, the agency could be providedwith over 10,000 mobile phone numbers fromjust one base station.In 2012, a phone number of a journalist who coveredan opposition party event was included in thebase-station data offered to investigators. Jinbonetand the victim submitted a constitutional petitionand the review is now underway.Table 1 shows statistics on the amount of basestationdata offered to investigators, compared toall the metadata handed over to authorities.Internet packet inspectionBecause the Korean intelligence agency, the NationalIntelligence Service (NIS), not only has the rightto collect secret information but also the power toinvestigate, it now conducts the largest number oftelecommunications interceptions among the agencies,according to official government statistics.The statistics are aggregated using the data fromtelecommunications service providers who have offereddata to the agencies. However, the statisticson interception conducted by the NIS using its ownequipment have never been open to public scrutinyand are cloaked in secrecy. 5Table 2 shows the overall statistics for telecommunicationsinterceptions in South Korea comparedto NIS requests.It was first known that the NIS had been monitoringthe internet network and intercepting contentby using deep packet inspection (DPI) in 2009.Monitoring the internet network in this way infringesbasic human rights such as the right to privacyand freedom of expression and communication, as5 In 2005, the fact that the intelligence agency had monitored CDMAmobile phones was revealed by the government. The agency hadofficially denied all queries from NGOs, media and the nationalassembly for a long time. The intelligence agency had developedtapping equipment that could be attached to the wirelines ofmobile communication service providers as well as the equipmentfor intercepting radio frequencies. See Jinbonet. (2009). MobileSurveillance and the Protection of Communications Secrets Act ofKorea. act.jinbo.net/drupal/node/6306it allows the agency to monitor not only emails butall other interests of an internet user, including relationshipsand the financial life of a subject. Humanrights NGOs, including Jinbonet, revealed the presenceof internet packet inspection by the NIS at amedia conference, held together with its victims.They also submitted a petition to the ConstitutionalCourt when the NIS again conducted internet packetinspection in 2011 while investigating a personsuspected of being in violation of the country’s nationalsecurity laws.The NIS insists that it is impossible to investigateforeign-based emails such as Gmail withoutpacket inspection, while it can investigate domesticinternet usage by approaching service providers.The constitutional review is now underway.Provision of personal informationIt is a massive infringement of human rights thatinternet service providers (ISPs) provide personalinformation of subscribers or users such as name,ID, resident registration number, address, etc. tothe agencies, without any restriction. This provisionhas faced severe criticisms, with allegations that itis abused by authorities who deliberately target internetusers who criticise the government. The factthat there have been 9,574,659 cases of personalinformation provided in 2013 means that the personalinformation of 26,232 people was providedevery day, and that the details of around 19% of thetotal national population have already been providedin South Korea. Table 3 shows statistics on theprovision of personal information.ConclusionsThe reason why stored communication metadata isoffered to law enforcement agencies is because thedata is needed as evidence in investigations, andthese requests by authorities are allowed. However,when a crime has not yet happened, the “reserved”location data of someone is not necessary160 / Global Information Society Watch korea, republic of / 161