By

Robert Morgus

,

Justin Sherman

, and

Seonghyun Nam

The Korean government soon created the Korea Esports Association (KeSPA) to manage Esports in Korea. KeSPA is a member of the National Olympic Committee of South Korea. Furthermore, they played a major part in building the world’s first Esports stadium in 2005 in Yongsan. Esports in Korea is now run like a professional sports franchise league. Online gambling remains strictly illegal in Japan, but casinos can now open in resorts as long as the facilities include entertainment venues, an international conference hall and a hotel. Operators themselves are subject to very strict screening, and the entire process of legalising land-based casino gambling in Japan is expected to be.

March 15, 2019

In this Internet Realities Analysis, we break down and analyze South Korea’s recent decision to block a number of overseas-based websites—primarily those hosting pornography or pirated content, or those for gambling—by having internet service providers (ISPs) monitor the Server Name Indication (SNI).

The policy shift in South Korea, which was initially announced by the Korean Communications Commission (KCC) in February of this year, is essentially aimed at enabling the Korean Communications Standards Commission (KCSC)—the Korean governmental entity that regulates and effectively monitors and censors the internet—to enforce laws (about offline information) online by blocking access to gambling websites and certain pornography sites. There will be an inclination by policymakers in countries like Russia and China to equate the Korean policy to the Great Firewall in China or Russia’s new internet law.

Arguably, what distinguishes the Korean policy from these things is the presence of adequate oversight and the democratic process through which the laws that underpin the filtering program were created. Indeed, this program is the result of a desire to take laws that were democratically established offline (e.g., banning gambling or pornography featuring unconsenting parties) and enforcing them online. In Korea, it could be argued that democratic processes, checks and balances, and oversight back this practice up. And that is what distinguishes this case from similar ones in countries where executive government entities have relatively uninhibited, arbitrary power to censor content at their will—like with Roskom, Russia’s internet regulator—leading to censorship that goes well beyond blocking child pornography or gambling websites.

Nonetheless, this may be a cause for concern to some in the internet freedom community. There are, for example, similarities to the United States’ proposed Stop Online Piracy Act (SOPA) and the PROTECT IP Act (PIPA), which made headlines in January 2012 when major internet companies “blacked out” their websites in protest to the proposed legislation. Essentially, the laws would have allowed the Department of Justice to go after websites hosting pirated content and force U.S.-based internet service providers to block access to those sites. The bills were not passed, even though they would have been taking laws previously established offline (through democratic processes) and enforcing them online. The point is, South Korea is not the only democracy with interest in building out internet censorship regimes based on existing laws.

In essence, therefore, what South Korea is attempting to do is configure a national content firewall, but based on pre-existing laws. However, it can be seen as a wider realization, even by democratic governments, that there is a need to balance the responsibility to protect their citizens from harms delivered through the internet and to preserve the openness of the internet that has been part of its success. In the Korean case, media and non-governmental organizations, like the Korean Sexual Violence Center, have called for the government to improve its capacity to block access to illegal websites.

As Justin recently argued in Foreign Policy, democratic governments are increasingly realizing the need to do more to protect their constituents from cyber harms. The vision of a global, free, and open internet is under threat—in part because of concerns over harm and security. It is therefore incumbent on leaders of the democratic world to negotiate the difficult grey spaces between outright censorship and protecting their citizens from harm. All the while, these same policymakers can’t lose sight of the precedents their actions set for others around the world, and the need to develop an internet model that preserves the benefits of a global and open internet while taking some action to address cybersecurity threats.

What, exactly, is the policy change?

Is Gambling Illegal In Korea

In practical terms, this is not really a new policy. Rather, it is a stepped-up enforcement of existing laws using existing regulatory provisions, but a newtechnicalmethod of enforcement. The policy derives from several laws and regulations, such as the Criminal Law, the Sexual Violence Punishment Act, the Information and Communication Network Act, and the Information and Communication Reviewing Regulation. Due to these legal statutes and KCSC’s regulatory authority, the KCSC has long sought to either delete illegal material hosted on servers inside of South Korea or block requests for illegal material hosted outside of South Korea.

In an explanatory blog post (in Korean) from February, the Korean Communications Commission—the regulatory body in charge of media—specifically cites child pornography sites and illegal gambling websites as the types of websites that would be blocked. Although the KCC does not suggest political content will be blocked, there are instances of the KCSC blocking what could be deemed political content—such as content praising North Korea—in selectcases.

The big change appears to be the KCSC’s method for blocking requests for material hosted outside of the country. In order to enforce laws around illegal content, the KCSC creates a set of blacklisted web addresses that host illegal content in question. Then, the new policy compels internet infrastructure operators to block those blacklisted websites by monitoring the Server Name Identification field, which we explain in greater detail below. In essence, the SNI field allows a network operator to see where traffic is coming from and where it intends to go, but not the actual content of the traffic.

By monitoring this way, the KCSC can leverage ISPs to block certain blacklisted domains, while not snooping on traffic containing legal internet content. In the past, the KCSC appears to have used conventional blocking techniques like Domain Name System (DNS) filtering to achieve similar ends—making this a notable technical switch from previous means and one of the first observed uses of SNI-based filtering for national-level content filtering.

How does this filtering work?

The new policy compels internet service providers to monitor the Server Name Identification field, which is an extension of the Transport Layer Security (TLS) protocol. The TLS protocol is the security protocol that encrypts the traffic between an internet browser (application element) and the server hosting the requested content (physical element). In the early days of the internet, because of the way requests were sent, each web address had be be hosted on its own server with its own Internet Protocol (IP) address. Today, through a method called “virtual hosting,” single servers can host multiple web addresses using a single IP address. SNI is the means that enables these servers with single IPs to host multiple web addresses, by helping the server identify and send the requested domain. The SNI field, then, indicates which host is being requested by the browser.

Although TLS encrypts the content of the traffic, neither it nor SNI encrypts the requested server name. Because the server name is in the open throughout the data transmission, monitoring the SNI allows ISPs to identify and block server names that have been blacklisted by the KCSC. This avoids the risk of potentially over-filtering by blocking entire IPs, which can again correspond to multiple website domains—some of which may host legal content and others of which may host illegal content.

Image reproduced in English from: 불법 음란 사이트 접속차단, 방송통신심의위 심의로 결정 (translation: Blocking Illegal Overseas Websites Is Not Censorship or Infringing Freedom of Expression), http://www.korea.kr/news/actuallyView.do?newsId=148858720.

Traffic filtering using this method is unlikely to be completely effective, as the KCC and the Blue House (Korea’s equivalent to the White House) acknowledge (post