On July 4, 2019, David Kaye, the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, expressed concerns over the Korean government’s new policy of blocking websites through SNI Filtering and urged the Korean government to ensure that any restrictions on freedom of expression is consistent with Article 19 of the International Covenant on Civil and Political Rights(“ICCPR”) and related human rights standards.
The Special Rapporteur noted that on February 2019, the Korea Communications Commission(“KCC”) announced that it will start using a new technical method called “SNI Filtering” to strengthen regulation of online content. Whereas the previous method of blocking involved a redirect to a warning page notifying the users that the censorship was an act of the government, SNI Filtering fails to provide such notification and thus infringes the users’ right to access information and makes it difficult to object to such actions. SNI Filtering also gives broad leeway for the KCC to execute unilateral authority without there being specific parameters of what standards can be applied. The Special Rapporteur stated that “the policy raises some concerns with respect to its compatibility (with the Korean) Government’s obligations under international human rights law, in particular due to the policy’s use of vague categories as well as with the broad discretion that the policy confers to the communication regulatory agencies”.
In connection with the alleged facts and concerns mentioned above, an Annex on Reference to international human rights law was attached to the Special Rapporteur’s letter providing detailed explanations on how SNI Filtering violated international human rights instruments and standards relevant to these allegations.
The mandate reads that “while governments enjoy a clear legitimate interest when it comes to protect the right or reputation of others, any restriction must be provided law, and necessary and proportionate to the legitimate aim. The policy, through the vague and overbroad categories of “unlawful sites including illegal videos, gambling, pornography, and pirated contents,” may fail the “provided by law” requirement as it leaves open the specific parameters of what constitutes “unlawful” and what standards may be applied by the agencies in conducting SNI filtering. In addition, the broad and vague scope of these terms, coupled with the unilateral executive authority given to the Korean Communication Standards Commission and the Korean Communication Commission, provides your Excellency’s Government with broad leeway to disproportionately restrict the public’s right to access to information that is protected under international human rights law.
Furthermore, SNI filtering, by utilizing the SNI field representing domain name exchanged at the beginning of encryption process, could interfere with online privacy, which is essential to protecting the freedom of expression of individuals. While it has been argued that SNI filtering does not decrypt the actual contents of online communications, the technology nonetheless expands the real-time monitoring and alteration (filtering) of the online traffic and activities by individuals to a new depth. ”
The Special Rapporteur urged the Korean government to ensure that any restrictions on freedom of expression be consistent with Article 19 of the ICCPR and related human rights standards and requested information about the human rights assessments made prior or subsequent to the introduction of the new policy of SNI-filtering and about its compliance with international human rights law and standards.
In response, the Korea Communications Commission expressed that “the KCSC complies with standards and procedures according to the laws and regulations under the principle of least control, and deliberates and makes requests for correction on clearly unlawful information. The Constitutional Court of Korea also decided that: requests for correction are not excessive restriction on freedom of expression.”, “SNI filtering does not restrict expression by examining the information in the packet that is transmitted, but rather is a means to block internet websites which have already been deemed to be unlawful according to due process in order to maintain public order and protect the people as prescribed in the Constitution and relevant laws of the Republic of Korea.”
However, the KCC’s response remains that of a principle nature, and is insufficient to satisfy the Special Rapporteur’s concerns. To the Special Rapporteur’s concern that restrictions on freedom of speech must be sufficiently clear, accessible and predictable to satisfy the requirements of legality, the KCC responded by making a blanket statement that there is no possibility for the KCC or KCSC’s authority to interfere in the interpretation of the law as there are ‘standards for interpretation from relevant laws and decades of precedents’.
In the case of websites being blocked, it is only the ISPs that are notified, and not the website operators or users. Hence, even if legal measures to rectify the situation are in place, it cannot be seen as being readily accessible as the persons wishing to go through the process will not have means to access the relevant information. As such, the public is being deprived of the opportunity to monitor the regulatory bodies’ arbitrary actions.
With regards to the SNI field, the KCC’s response that “the process does not infringe upon privacy” as “SNI information is not encrypted at the beginning of the authentication process”, compounds the concerns raised by the Special Rapporteur that “the monitoring of SNI fields circumvents the privacy protections provided by the encryption, and thereby unduly interferes with freedom of expression”.
September 5, 2019
Open Net
Inquiries: 02-581-1643, master@opennet.or.kr
You can read the Korean original here.
Annex
Reference to international human rights law
General standards for restrictions to the right to freedom of expression
Article 19(1) of the International Covenant on Civil and Political Rights (ICCPR) establishes “the right to hold opinions without interference.” The right to hold opinions is so fundamental that it is “a right to which the Covenant permits no exception or restriction” (CCPR/C/GC/34). Accordingly, this right is not simply “an abstract concept limited to what may be in one’s mind,” and may include activities such as research, online search queries, and drafting of papers and publications” (A/HRC/29/32).
Article 19(2), in combination with Article 2 of the Covenant, establishes State Parties’ obligations to respect and ensure the right “to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice.” Since Article 19(2) “promotes so clearly a right to information of all kinds,” this indicates that “States bear the burden of justifying any withholding of information as an exception to that right” (A/70/361). The Human Rights Committee has also emphasized that limitations should be applied strictly so that they do “not put in jeopardy the right itself” (CCPR/C/GC/34). The General Assembly, the Human Rights Council and the Human Rights Committee have concluded that permissible restrictions on the Internet are the same as those offline.
Article 19(3) establishes a three-part test for permissible restrictions on freedom of expression:
First, restrictions must be “provided by law.” In evaluating the provided by law standard, the Human Rights Committee has noted that any restriction “must be made accessible to the public” and “formulated with sufficient precision to enable an individual to regulate his or her conduct accordingly” (CCPR/C/GC/34). Moreover, it “must not confer unfettered discretion for the restriction of freedom of expression on those charged with its execution” (CCPR/C/GC/34).
Second, restrictions must only be imposed to protect legitimate aims, which are limited to those specified under Article 19(3), that is “for respect of the rights or reputations of others” or “for the protection of national security or of public order (ordre public), or of public health and morals”. The term “rights…of others” under Article 19(3)(a) includes “human rights as recognized in the Covenant and more generally in international human rights law” (CCPR/C/GC/34).
Third, restrictions must be necessary to protect one or more of those legitimate aims. The requirement of necessity implies an assessment of the proportionality of restrictions, with the aim of ensuring that restrictions “target a specific objective and do not unduly intrude upon the rights of targeted persons” (A/70/361). The ensuing interference with third parties’ rights must also be limited and justified in the interest supported by the intrusion. Finally, the restriction must be “the least intrusive instrument among those which might achieve the desired result” (CCPR/C/GC/34). \
Application of international human rights standards to the SNI-filtering policy
While governments enjoy a clear legitimate interest when it comes to protect the right or reputation of others, any restriction must be provided law, and necessary and proportionate to the legitimate aim. The policy, through the vague and overbroad categories of “unlawful sites including illegal videos, gambling, pornography, and pirated contents,” may fail the “provided by law” requirement as it leaves open the specific parameters of what constitutes “unlawful” and what standards may be applied by the agencies in conducting SNI filtering. In addition, the broad and vague scope of these terms, coupled with the unilateral executive authority given to the Korean Communication Standards Commission and the Korean Communication Commission, provides your Excellency’s Government with broad leeway to disproportionately restrict the public’s right to access to information that is protected under international human rights law.
Furthermore, SNI filtering, by utilizing the SNI field representing domain name exchanged at the beginning of encryption process, could interfere with online privacy, which is essential to protecting the freedom of expression of individuals. While it has been argued that SNI filtering does not decrypt the actual contents of online communications, the technology nonetheless expands the real-time monitoring and alteration (filtering) of the online traffic and activities by individuals to a new depth.
As I have explained in my June 2015 report to the Human Rights Council, encryption and anonymity technologies establish a “zone of privacy online to hold opinions and exercise freedom of expression without arbitrary and unlawful interference or attacks” (A/HRC/29/32). Any restrictions on these technologies must meet the well-known three-part test” established under Article 19(3) and “States should avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows.”(A/HRC/29/32). Accordingly, governments have encouraged the use of tools such as HTTPS to enhance privacy of the users. The monitoring of SNI fields circumvents the privacy protections provided by encryption, and thereby unduly interferes with freedom of expression. I am concerned that such practice of exploring vulnerabilities for censorship purposes undermines credibility and public confidence in the security governance which requires voluntary technical cooperation and information exchange among all stakeholders.
The opacity of the censorship process, coupled with the broad categories of “unlawful sites,” burdens the right of people in the Republic of Korea to access information and exerts a chilling effect on freedom of expression in the country.
With respect to Article 21 of the Act Establishing KCC, I am concerned that this provision fails to meet the level of clarity and precision required by Article 19(3) of the ICCPR for restrictions on freedom of expression. To satisfy the requirements of legality, restrictions must additionally be sufficiently clear, accessible and predictable (CCPR/C/GC/34). The wording of the statute does not meet the level of clarity and predictability as required by international human rights law and such ambiguity may confer excessive discretion on regulatory agencies. Not only blanket delegation of authority to the lower-level Presidential Decree is unacceptable but also the Presidential Decree itself is any more specific than the statutory language: the scope of its Article 8 includes “any information deemed necessary to be deliberated upon.” Under this imprecise mandate, many lawful contents have been deleted or blocked as sometimes courts have shown.
The expansive discretion given to these agencies, combined with the opacity of the procedure, standards, and even the contents subject to censorship, appears particularly problematic given extremely limited opportunities for review or appeal of removals. The lack of independent and external review or oversight of removal orders reinforces the unchecked discretion of government authorities and raises concerns of due process. Consistent with my past reporting, I urge Your Excellency’s Government to categorically reject a model of regulation “where government agencies, rather than judicial authorities, become the arbiters of lawful expression.” (A/HRC/38/35).
Also, the proportionality of website blocking as a measure abating the harms arising of expressions must be seriously reassessed. Website blocking by a government blinds its own citizens from certain information available to the citizens of all other countries, undermining media literacy and social stock of information of its own citizens while leaving intact the more culpable sources of the harms. Other measures seem more proportionate to the culpability of the parties involved, i.e., filing a suit overseas to identify the source of the harmful information and abating the source either by prosecuting the source or by simply deleting the source content.
0 Comments