UN Special Rapporteur Expresses Concern over the Korean Government’s New Policy of Blocking Websites Through Server Name Indication

On July 4, 2019, David Kaye, the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, expressed concerns over the Korean government’s new policy of blocking websites through SNI Filtering and urged the Korean government to ensure that any restrictions on freedom of expression is consistent with Article 19 of the International Covenant on Civil and Political Rights(“ICCPR”) and related human rights standards.

▶Mandate of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression

The Special Rapporteur noted that on February 2019, the Korea Communications Commission(“KCC”) announced that it will start using a new technical method called “SNI Filtering” to strengthen regulation of online content. Whereas the previous method of blocking involved a redirect to a warning page notifying the users that the censorship was an act of the government, SNI Filtering fails to provide such notification and thus infringes the users’ right to access information and makes it difficult to object to such actions. SNI Filtering also gives broad leeway for the KCC to execute unilateral authority without there being specific parameters of what standards can be applied. The Special Rapporteur stated that “the  policy raises some concerns with respect to its compatibility (with the Korean) Government’s obligations under international human rights law, in particular due to the policy’s use of vague categories as well as with the broad discretion that the policy confers to the communication regulatory agencies”.

In connection with the alleged facts and concerns mentioned above, an Annex on Reference to international human rights law was attached to the Special Rapporteur’s letter providing detailed explanations on how SNI Filtering violated international human rights instruments and standards relevant to these allegations.

The mandate reads that “while governments enjoy a clear legitimate interest when it comes to protect the right or reputation of others, any restriction must be provided law, and necessary and proportionate to the legitimate aim. The policy, through the vague and overbroad categories of “unlawful sites including illegal videos, gambling, pornography, and pirated contents,” may fail the “provided by law” requirement as it leaves open the specific parameters of what constitutes “unlawful” and what standards may be applied by the agencies in conducting SNI filtering. In addition, the broad and vague scope of these terms, coupled with the unilateral executive authority given to the Korean Communication Standards Commission and the Korean Communication Commission, provides your Excellency’s Government with broad leeway to disproportionately restrict the public’s right to access to information that is protected under international human rights law.

Furthermore, SNI filtering, by utilizing the SNI field representing domain name exchanged at the beginning of encryption process, could interfere with online privacy, which is essential to protecting the freedom of expression of individuals. While it has been argued that SNI filtering does not decrypt the actual contents of online communications, the technology nonetheless expands the real-time monitoring and alteration (filtering) of the online traffic and activities by individuals to a new depth. ”

The Special Rapporteur urged the Korean government to ensure that any restrictions on freedom of expression be consistent with Article 19 of the ICCPR and related human rights standards and requested information about the human rights assessments made prior or subsequent to the introduction of the new policy of SNI-filtering and about its compliance with international human rights law and standards.

In response, the Korea Communications Commission expressed that “the KCSC complies with standards and procedures according to the laws and regulations under the principle of least control, and deliberates and makes requests for correction on clearly unlawful information. The Constitutional Court of Korea also decided that: requests for correction are not excessive restriction on freedom of expression.”, “SNI filtering does not restrict expression by examining the information in the packet that is transmitted, but rather is a means to block internet websites which have already been deemed to be unlawful according to due process in order to maintain public order and protect the people as prescribed in the Constitution and relevant laws of the Republic of Korea.”

▶Korea Communications Commission’s Response to the Communication from the Special Rapporteur of the United Nations Human Rights Office of the High Commissioner

However, the KCC’s response remains that of a principle nature, and is insufficient to satisfy the Special Rapporteur’s concerns. To the Special Rapporteur’s concern that restrictions on freedom of speech must be sufficiently clear, accessible and predictable to satisfy the requirements of legality, the KCC responded by making a blanket statement that there is no possibility for the KCC or KCSC’s authority to interfere in the interpretation of the law as there are ‘standards for interpretation from relevant laws and decades of precedents’.

In the case of websites being blocked, it is only the ISPs that are notified, and not the website operators or users. Hence, even if legal measures to rectify the situation are in place, it cannot be seen as being readily accessible as the persons wishing to go through the process will not have means to access the relevant information. As such, the public is being deprived of the opportunity to monitor the regulatory bodies’ arbitrary actions.

With regards to the SNI field, the KCC’s response that “the process does not infringe upon privacy” as “SNI information is not encrypted at the beginning of the authentication process”, compounds the concerns raised by the Special Rapporteur that “the monitoring of SNI fields circumvents the privacy protections provided by the encryption, and thereby unduly interferes with freedom of expression”.

 

▶Korean Translation of the Annex of the Mandate of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression

 

September 5, 2019

Open Net

Inquiries: 02-581-1643, ma****@op*****.kr

 

You can read the Korean original here.

Annex 

Reference to international human rights law 

General standards for restrictions to the right to freedom of expression  

Article 19(1) of the International Covenant on Civil and Political Rights (ICCPR) establishes “the right to hold opinions without interference.” The right to hold opinions is so  fundamental that it is “a right to which the Covenant permits no exception or restriction” (CCPR/C/GC/34). Accordingly, this right is not simply “an abstract concept limited  to what may be in one’s mind,” and may include activities such as research, online search queries, and drafting of papers and publications” (A/HRC/29/32).

Article  19(2), in combination  with Article 2 of the Covenant,  establishes State Parties’ obligations  to respect and ensure the right “to seek,  receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice.” Since Article 19(2) “promotes so clearly a right to information of all kinds,” this indicates that “States bear the burden of justifying any  withholding of information as an exception to that right” (A/70/361). The Human Rights Committee has also emphasized that limitations should be applied strictly so that they do “not put in jeopardy the right itself” (CCPR/C/GC/34). The General Assembly, the Human Rights Council and the Human Rights Committee have concluded that permissible restrictions on the Internet are the same as those offline.

Article 19(3) establishes a three-part test for permissible restrictions on freedom of expression:

First, restrictions must be “provided by law.” In evaluating the provided by law standard,  the Human Rights Committee has noted that any restriction “must be made accessible to the public” and “formulated with sufficient precision to enable an individual to  regulate his or her conduct accordingly” (CCPR/C/GC/34). Moreover, it “must not confer unfettered discretion for the restriction of freedom of expression on those charged with its execution” (CCPR/C/GC/34).

Second, restrictions must only be imposed to protect legitimate aims, which are limited  to those specified under Article 19(3), that is “for respect of the rights or reputations of others” or “for the protection of national security or of public order (ordre public),  or of public health and morals”. The term “rights…of others” under Article 19(3)(a) includes “human rights as recognized in the Covenant and more generally in international human rights law” (CCPR/C/GC/34).

Third, restrictions must be necessary to protect one or more of those legitimate aims.  The requirement of necessity implies an assessment of the proportionality of restrictions, with the aim of ensuring that restrictions “target a specific objective and do not  unduly intrude upon the rights of targeted persons” (A/70/361). The ensuing interference with third parties’ rights must also be limited and justified in the interest supported by the intrusion. Finally, the restriction must be “the least intrusive instrument among those which might achieve the desired result” (CCPR/C/GC/34).  \

 

Application of international human rights standards to the SNI-filtering policy 

While governments enjoy a clear legitimate interest when it comes to protect the right  or reputation of others, any restriction must be provided law, and necessary and proportionate  to the legitimate aim. The policy, through the vague and overbroad categories of “unlawful sites including illegal videos, gambling, pornography, and pirated contents,”  may fail the “provided by law” requirement as it leaves open the specific parameters of what constitutes “unlawful” and what standards may be applied by the agencies  in conducting SNI filtering. In addition, the broad and vague scope of these terms, coupled with the unilateral executive authority given to the Korean Communication Standards  Commission and the Korean Communication Commission, provides your Excellency’s Government with broad leeway to disproportionately restrict the public’s right to access to information that  is protected under international human rights law.

Furthermore, SNI filtering, by utilizing the SNI field representing domain name exchanged  at the beginning of encryption process, could interfere with online privacy, which is essential  to protecting the freedom of expression of individuals. While it has been argued that SNI filtering  does not decrypt the actual contents of online communications, the technology nonetheless expands the  real-time monitoring and alteration (filtering) of the online traffic and activities by individuals to a new depth.

As  I have  explained  in my June  2015 report to  the Human Rights  Council, encryption and  anonymity technologies establish  a “zone of privacy online to hold opinions and exercise freedom of expression without arbitrary and unlawful interference or attacks” (A/HRC/29/32). Any restrictions on these technologies must meet the well-known  three-part test” established under Article 19(3) and “States should avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows.”(A/HRC/29/32). Accordingly, governments have encouraged the use of tools such as HTTPS to enhance privacy of the users. The monitoring of SNI fields circumvents the privacy protections provided by encryption, and thereby unduly interferes with freedom of expression. I am concerned that such practice of  exploring vulnerabilities for censorship purposes undermines credibility and public confidence in the security governance which requires voluntary technical cooperation and information exchange among all stakeholders.

The  opacity  of the censorship  process, coupled with  the broad categories of “unlawful  sites,” burdens the right of people  in the Republic of Korea to access information and exerts a chilling effect on freedom of expression in the country.

With respect to Article 21 of the Act Establishing KCC, I am concerned that this provision fails to meet the level of clarity and precision required by Article 19(3) of the ICCPR for restrictions on freedom of expression. To satisfy the requirements of legality, restrictions  must additionally be sufficiently clear, accessible and predictable (CCPR/C/GC/34). The wording of the statute does not meet the level of clarity and predictability as required by international human rights law and such ambiguity may confer excessive  discretion on regulatory agencies. Not only blanket delegation of authority to the lower-level Presidential Decree is unacceptable but also the Presidential Decree itself is any more specific than the statutory language: the scope of its Article 8 includes “any information deemed  necessary to be deliberated upon.”    Under  this imprecise mandate, many lawful contents have been deleted or blocked as sometimes courts have shown.

The expansive discretion given to these agencies, combined with the opacity of the procedure, standards, and even the contents subject to censorship, appears particularly problematic given extremely limited opportunities for review or appeal of removals. The lack of  independent and external review or oversight of removal orders reinforces the unchecked discretion of government authorities and raises concerns of due process. Consistent with my past reporting, I urge Your Excellency’s Government to categorically reject a model of regulation “where government agencies, rather than judicial authorities, become the arbiters of lawful expression.” (A/HRC/38/35).

Also,  the proportionality  of website blocking as  a measure abating the harms arising of expressions must be seriously reassessed.  Website blocking by a government blinds its own citizens from certain information  available to the citizens of all other countries, undermining media literacy and social stock of information of its own citizens while leaving intact the more culpable sources of the harms.  Other measures seem more proportionate to the culpability of the parties involved, i.e., filing a suit overseas to identify the source of the harmful information and abating the  source either by prosecuting the source or by simply deleting the source content.