South Korea mandates spyware on teens' phones
Naked Security Naked Security

South Korea mandates spyware on teens’ phones

Parents can't opt out, regardless of any privacy concerns. Let's hope they don't get hit by an mSpy-esque data breach.

Image of mobile spyware courtesy of ShutterstockHow’s this for adding insult to injury: not only has there been a possible breach of data belonging to customers of spyware company mSpy – a breach that could affect people who don’t even know they’re being bugged – but we also hear that South Korea’s gone and made such spyware mandatory on teens’ mobile phones.

The Associated Press reports that the country’s Korea Communications Commission, which has sweeping powers covering the telecommunications industry, last month passed a law mandating spyware on the mobile phones of anybody under the age of 18.

Unlike countries with similar laws, such as Japan, parents can’t opt out, regardless of any (well-founded) privacy concerns.

Not only is there no opt-out, but the law actually stipulates that mobile phone providers nag parents on a monthly basis until they comply.

Open Net Korea, a group that tracks South Korean censorship efforts, has a translation of some of the new ordinance’s stipulations.


Article 37-8 (Methods and Procedures for Providing Means to Block Media Products Harmful to Juveniles, etc.)
(1) According to Article 32-7(1) of the Act, a telecommunication business operator entering into a contract on telecommunications service with a juvenile under the Juvenile Protection Act must provide means to block the juvenile's access to the media products harmful to juveniles under the Juvenile Protection Act and the illegal obscene information under Article 44-7(1)1 of the ICNA ("Information harmful to juveniles") through the telecommunication service on the juvenile's mobile communications device such as a software blocking information harmful to juveniles.
(2) Procedures prescribed below must be followed when providing the blocking means under (1):
1. At the point of signing the contract:
a. Notification to the juvenile and his/her legal representative regarding types and features of the blocking means; and
b. Check on the installation of the blocking means.
3. After closing the contract: Monthly notification to the legal representative if the blocking means was deleted or had not been operated for more than 15 days.

Government-approved spyware includes an app called Smart Sheriff, which the government actually funded itself, primarily to block access to porn and otherwise offensive online content.

One partial saving grace: The AP reports that it only runs on Android phones, not on iOS.

One of the monitoring apps is supposed to be installed when anyone aged 18 years or under gets a new mobile phone. Although the new ordinance doesn’t apply to older phones, the AP reports that most schools sent out letters to parents encouraging them to install the software anyway.

Smart Sheriff is one of 14 apps that let parents monitor their kids’ every online move, be it when they play games on their phones, what apps they’re using and how often, how long kids use their phones, what websites they visit, and in some cases their geolocation.

As the AP describes Smart Sheriff, with the press of a button, a parent can disable apps or power down the phone completely.

Some of the spying apps are also trained to sniff out keywords, sending alerts when kids use words such as “suicide,” “pregnancy” and “bully” or when they receive messages with those words.

The News-Herald reports that “Smart Relief”, another app for parents to monitor their kids that was also funded by the South Korean government, flags a large number of words or messages – about 800 – including:

Threat, kill, shut up, violence, destroy, handicap, crazy, prostitute, garbage, thief, porn, suicide, pregnancy, inn, obscene, sex, sexual crime, sexual relationship, prostitution, motel, beer, rape, adultery, run away from home, outcast.

It’s understandable why parents would want to know if their children were talking about such things.

But the app also monitors about 300 words or phrases for which children search online, some of which cross into the realm of bubble-wrapping your children.

To wit:

Girl I like, boy I like, dating, boyfriend, girlfriend, breakup, invisible person, don't have friends, jealousy, lonely, stress, don't want to live, loser, complaint, help, worry, breast, plastic surgery, appearance, fat, french kiss, porn, menstruation, adoption, divorce, rape, homosexual love, single parent, IS, terrorism, poison.

The AP says that such apps have been downloaded in South Korea at least 480,000 times.

Some parents are undoubtedly grateful for the ability to peer into their children’s online lives, particularly in a country where addictive internet use is a serious concern.

But not all parents are going along with the plan, including Park Choel-hee, the father of a 10-year-old girl who said that South Korea relies too much on regulation and “arbitrary” decisions about what content is offensive – similar to the Great Firewall of China.

His plan to evade the privacy invasion: give his daughter his second phone.

That will keep her private information away from her father, true. But it will also keep it out of sight of the prying eyes of the government, the developers of these spyware apps, and the telecoms.

As it is, some privacy advocates view the ordinance as a sweeping step, given that it’s rubber-stamping the government’s collection of teenagers’ personal, sensitive data on a broad scale, all without consulting the public nor considering possible consequences.

While spyware vendors typically advise customers to tell their targets that their communications and internet use are being watched, it’s commonplace for such apps to be installed without people’s knowledge.

That means that not only is the data collected by such apps personal and intimate; it also means that the targets often have no idea that their information is being collected.

To think about the possible ramifications, we only have to be reminded of the mSpy data breach, which reportedly involved e-mails, text messages, payments, locations, and other data related to mSpy users, all posted on the dark web, all of which potentially put thousand of kids at risk.

Now, South Korea has mandated that its kids be exposed to that same type of danger.

Open Net Korea is planning to appeal the regulator’s ordinance with South Korea’s Constitutional Court.

The nonprofit organisation views the ordinance as being both unconstitutional and intrusive on teens’ privacy and parents’ rights, as well as laying the path to raising a generation inured to privacy invasion.

The AP quotes Kim Kha Yeun, general counsel at Open Net Korea:

It is the same as installing a surveillance camera in teenagers' smartphones. We are going to raise people who are accustomed to surveillance.

Korean kids are no dummies. They know the value of their privacy, and they know there’s one sure way to avoid having it invaded: wait until they’re 19 to buy a phone.

The AP quoted Paik Hyunsuk, 17:

I'd rather not buy a phone. It's violation of students' privacy and oppressing freedom.

Well said.

Image of mobile spyware courtesy of Shutterstock.