International Law

Why You Can?t Buy Anything On-Line in Korea, Mr. Foreigner

Feeling frisky after my success fixing the housing policy problem, I contributed this piece to my firm’s “Law Talk” series in the Korea Herald today.

I’m not completely happy with the final piece, after the “editorial process”, nor the headline supplied by editors—which I think misuses the word “crimp”—but within the 550-word limit allowed by the paper, it’s not all that bad.

Encryption standards crimp Korean internet from globalizing
Korea Herald, March 26, 2008

President Lee Myung-bak’s new administration promises deregulation to improve transparency and the harmonization of Korean practices to so-called global standards. He has his work cut out for him as regulatory choices made around 10 years ago have resulted in Korea’s IT environment being isolated from practices used in the rest of the world. Rather than leading the global community, Korea’s government-led choices have often erected barriers and stagnated development.

Web browsers offer a fine example. In 1998 it was recognized that 40-bit Secure Sockets Layer encryption was insufficient security for internet-based financial transactions. More bits make codes harder to crack. But the United States at that time barred the export of encryption algorithms using more than 40 bits.

In other countries, the U.S. ban on the export of strong encryption created market opportunities. South African entrepreneur Mark Shuttleworth became a billionaire offering the rest of the world 128-bit SSL encryption from Cape Town, outside the reach of U.S. law.

Rather than leave this function to the market, the Korean government instead led the development of official 128-bit encryption based on a homegrown standard called SEED, which uses digital signature certificates issued by a Korean government-approved institute and requires users to install a downloadable ActiveX control into the Windows Internet Explorer browser.

Ten years later, we’re stuck with it. Under the Electronic Financial Transactions Act, SEED encryption is required for most credit-card transactions, despite the fact that all other banks around the world find 128-bit SSL security strong enough.

Korea’s SEED does not work on Apple’s Mac OS X (nobody in Korea has developed a SEED implementation that doesn’t require Windows), nor does it work on the Mozilla Firefox and Opera browsers. Neither does SEED work on Linux.

Only Microsoft Windows users may use the Korean-standard security system for internet transactions. Macintosh and Linux users are cut off from such transactions—by official government policy.

Many of the SEED implementations are sloppy. Programmers assume that whoever downloads SEED must be using a Korean version of Windows, and therefore don’t need any instructions in other languages. English Windows versions also display the Korean-font download controls as gibberish, thereby preventing installation.

In 1999, the U.S. government allowed export of strong encryption. But by that point it was too late for Korea. Since 1999, government officers charged with enforcement of the only-in-Korea SEED standard have not relented and accepted the global dominance of SSL, which is built into all browsers.

SEED locks foreigners and users of other computer operating systems and non-Microsoft browsers out of the Korean market. It prevents Korean online merchants from selling to nonresidents of the country, who are not likely to have obtained Korean government digital signature certificates or to run a Korean-language version of Windows.

Outside Korea, Mac OS X and Linux comprise nearly 10 percent of the worldwide operating system market. Non-Microsoft Web browsers approach 45 percent of the worldwide market. The SEED encryption requirement locks Koreans out of wider trends and forces them to use Microsoft Windows and Microsoft Internet Explorer.

Both are fine software programs, but the government should not be in the practice of forcing users to choose them by the Electronic Financial Transactions Act, especially when equivalent functions are available.

If President Lee’s team wants to move Korea closer to global standards and internationalize Korean practices, amending the Electronic Financial Transactions Act to dump SEED in favor of the already-existing SSL standard would be a good start.

There are, of course, other reasons you can’t buy anything on-line, Mr. Foreigner. They include the ubiquitous foreigners’ registration number, which doesn’t work with most of the ID-checking algorithms in use, and sloppy coding practices for the HTML to be displayed in your browser. A lot of Korean websites simply won’t show anything to a Firefox or Safari user, which tends to keep us away from the payment-processing stage where SEED would be required.

UPDATE: A Korea Herald reader wrote me this morning with the following comment:

Congratulations on a finely argued piece. I’d add just one other point - it is not in Korea’s national interests (or any other small country’s) to promote a foreign monopoly in a key component of technological infrastructure.

Good point. Five hundred words precludes a writer from getting every point into the newspaper—which is why the availability of unlimited Internet space, and the interactive opportunities of blog comments, makes this the place to add more. To the reader (and all readers): If you think other points are important, leave a comment here at Korea Law Blog.

Full post as published by Korea Law Blog on March 25, 2008 (boomark / email).