The Korean Railway Worker’s Union (KRWU) went on strike on 9 December 2013 opposing the privatisation of the railroad. The Korean government’s response was hard-line, and the police imposed widespread surveillance on the striking workers and their families.<\/span><\/span><\/p>\n Firstly, the police acquired all the mobile communication records of union members and their families, including schoolchildren, and tracked the real-time location of their mobile phones – the mobile service providers had offered to provide this information at 10-minute intervals for several months. The police also asked popular websites, such as game sites and internet shopping malls, to provide the real-time access IP addresses of the workers and their families. The mobile service providers also handed over the identities of about 300 to 400 people who talked on the phone with the strikers to the police, who used this information to interview the subscribers about details of their relationship with the strikers<\/span><\/span>. Railway workers and human rights NGOs, including Jinbonet, filed a petition to the Constitutional Court against the real-time location tracking<\/span><\/span> on May 2014.<\/span><\/span><\/p>\n The NGOs argued that the lack of adequate legal requirements for police to access communication metadata in an investigation is unconstitutional. The authorities conduct surveillance on workers exercising their right to strike as if they were criminals – it has been maintaining a DNA database of criminals, which includes striking workers, since 2010.<\/span><\/span>1<\/sup><\/a><\/span><\/span><\/sup> Communications surveillance in particular, which has insufficient legal control given the rapid development of the internet and mobile technologies, has significantly extended the power of the police and the intelligence agency beyond the law.<\/span><\/span><\/p>\n Communications surveillance in South Korea is regulated by the Protection of Communications Secrets Act (PCSA). The previous military dictatorship in South Korea had conducted communications surveillance for a long time without any legal regulation. The PCSA, passed in 1993 in the aftermath of a wiretapping controversy among presidential candidates, allows the intelligence agency and investigation agencies to intercept the content of communications in real time with prior court approval. The content of communications such as stored email or SMS messages is provided to agencies with a prior warrant for search and seizure under the Criminal Procedure Act. However real-time wiretapping on foreign groups and nationals can be conducted merely with the approval of the president. The intelligence agency and the investigation agencies can wiretap in real time by making use of intermediaries, including telecommunication service providers, or by using their own technologies. They can also wiretap without any permission for 36 hours if it is considered an emergency.<\/span><\/span><\/p>\n Since 2002 the PCSA has begun to regulate communication metadata: the record of the date and the time of communications, the IP address, the internet logs, the location of the base station or the communication device, etc. Although court permission has been required to collect communication metadata since 2005, when it is “necessary to conduct any investigation,” the permission is given without any specific restrictions. According to the Telecommunications Business Act, personal information to identify the subscriber or user such as name, residential registration number (which is the national ID number in South Korea),<\/span><\/span> address, etc. is separately provided to the agencies without any permission from external supervisory agencies such as the courts.<\/span><\/span><\/p>\n Ex-post notification<\/span><\/span>2<\/sup><\/a> has been implemented regarding undercover communications surveillance: users have been notified of wiretapping since 2001, of the handing over of communication metadata to agencies since 2005, and of the search and seizure of stored communications content since 2009.<\/span><\/span>3<\/sup><\/a><\/span><\/span><\/sup> The personal information of the subscriber or the user is not included in this notification. The government then releases statistics about the number of these cases twice a year.<\/span><\/span><\/p>\n Besides the above, telecommunications service providers, including intermediaries, should keep communication metadata depending on the service they offer:<\/span><\/span><\/p>\n Twelve months for mobile service providers<\/span><\/span><\/p>\n<\/li>\n Six months for landline service providers<\/span><\/span><\/p>\n<\/li>\n Three months for internet service providers.<\/span><\/span><\/p>\n<\/li>\n<\/ul>\n Although the PCSA was an attempt to legally regulate communications surveillance, the rapid development of the internet and mobile technologies, and the prompt adoption of them by the agencies, makes it overwhelming. A popular example is real-time location tracking of telecommunication devices.<\/span><\/p>\n When the PCSA created the framework for the regulation of communication metadata in 2002, it referred to <\/span>historical<\/i><\/span> communication records. Without any external request, telecommunication service providers have kept the historical communication metadata related to billing, and they were to some extent expected to and asked to by their customers. However, agencies then started to require the “future” location information of their targets. The telecommunications service providers accepted the request, not only because collecting real-time location information and providing this was technically possible, but also because the related regulatory clause was not clearly defined on that matter.<\/span><\/p>\n For example, in the case of a mobile phone location, the telecommunications service provider informs a police officer of the location of the base station capturing the signal from the specified mobile phone by text message every 10 minutes. In the case of IP addresses, the internet service provider informs the police officer when the specified ID logs in.<\/span>4<\/sup><\/a><\/span><\/sup> Because telecommunications service providers in South Korea confirm their subscribers’ or users’ identities before activating mobile phone or internet services including online games, this kind of location information helps the agencies to accurately track the subject.<\/span><\/p>\n Real-time tracking was illustrated when a woman worker had been staging a sit-in protest<\/span> at the top of a 35-metre-high crane for more than 150 days to oppose a huge lay-off of workers. “Buses of hope” had been organised to support her struggle, carrying thousands of supporters to the place of protest. To arrest those who organised the buses, the police and the prosecutors traced the real-time location of the mobile phones of the activists and their families for months. Human<\/span> rights NGOs challenged this in the Constitutional Court in 2012, filing a second petition against tracing the mobile phones and internet IDs of the leaders of the KRWU and their families in 2014. Both Constitutional Court reviews are still underway.<\/span><\/p>\n Another constitutional controversy surrounding communication metadata concerns the use of data from mobile base stations. The PCSA does not clearly define whether or not agencies should specify the technical scope of the request when they require a telecommunications service provider to hand over communication metadata. Consequentially, agencies are offered mobile phone numbers captured by base stations around the areas where assemblies and demonstrations take place to identify people who participate in these protests. In the case of highly populated areas, the agency could be provided with over 10,000 mobile phone numbers from just one base station.<\/span><\/p>\n In <\/span>2012<\/span><\/span>, a phone number of a journalist who covered an opposition party event was included in the base-station data offered to investigators. Jinbonet and the victim submitted a constitutional petition and the review is now underway.<\/span><\/p>\n Table 1 shows statistics on the amount of base-station data offered to investigators, compared to all the metadata handed over to authorities.<\/span><\/p>\n Table 1. Base-station data provided to investigators<\/p>\nPolicy and political background<\/h2>\n
\n
Communications surveillance: Cases and civil society reaction<\/h2>\n
Real-time location tracking<\/h3>\n
The use of data from base stations<\/h3>\n