정통망법상 본인확인제도의 한계와 문제점－ 기술과 법의 갈등 －

Abstract

The Public Office Elections Act (as amended in 2004) stipulated that internet news media must implement “real name verification measure” if they are to allow users to post “comments which support or oppose a candidate or a political party” during the election period. The real name verification measure must be distinguished from user authentication because it merely checks whether the name and the resident’s registration number supplied by a user corresponds to a person’s real name and the resident’s registration number issued to the person. There is no way of verifying whether the user supplied his/her real name. Any real name and the corresponding resident’s registration number will do. Information and Communications Network Act (as amended in 2007; ICNA) required that websites operated by all public bodies and other websites who attract on average more than 100,000 unique visits per day must implement “authentication of user’s true identity” rather than real name verification. ICNA stipulates that the authentication must be done by ‘official’ digital certificate or by an authentication service provider, among others. Korean official digital certificates pose technical and business constraints because they are stored at a non-standard location using non-standard file names and encrypted with an algorithm (SEED) which is not supported by web-browsers. In order to use them, web servers must purchase and install proprietary software (server-side plugin) and distribute client plugins to handle the non-standard client certificates. Most web servers simply cannot afford to do so except for banks and financial service providers who are obligated to use official digital certificate by Financial Supervisory Service Directive. I-Pin authentication service is a less burdensome alternative. But only about 3 million users have so far applied for an I-Pin ID. As a result, real name verification – which is not an authentication method – is widely used (and regulators accept it) in practice as if it can carry out “authentication of user’s true identity”. Although the purported aim of these mandatory verification/authentication measures is to remove or reduce anonymity so as to prevent illegal activities on the Internet, it is doubtful in the first place whether the Internet offers anonymity. By its nature, Internet communication leaves a number of technical traces which can be used to track down the user. Removing such traces would require a great deal of technical expertise and effort. It is equally doubtful whether the real name verification measure can help tracing a user who is determined to conceal his identity. In fact, this measure has no real impact on those who supply a false name (their freedom of expression is not impaired), whereas it removes the sense of anonymity from those who voluntarily supply their true name and resident’s registration number (thus restricting their freedom of expression by exposing their identity). The measure, even though it is not a proper authentication method, can certainly have a generalised chilling effect for the vast majority of ‘honest’ users. Perhaps this is what the government intended in the first place. However, the verification/authentication requirement is rapidly becoming unenforceable and obsolete as the social commenting platform is adopted by increasing number of websites. Users can now post comments with their Twitter, Facebook, Yahoo, Google ID. The real name verification or the non-standard Korean ‘official’ digital certification method is simply not supported by the social commenting platforms currently available. Government is not in a position to ‘ban’ the social commenting platforms.