South Korea’s Broadcast Media Communications Commission is reviewing a plan to set the validity period of connected information (CI) used to identify individuals online at 1 year. It plans to prepare an institutional improvement plan within this year and push to revise related laws from next year.

According to a written reply submitted on Oct. 26 to questions for a parliamentary audit by the National Assembly’s Science, ICT, Broadcasting and Communications Committee, the commission said it is reviewing a 1-year validity period that can secure a balance between security and service continuity. It was responding to a query by Democratic Party lawmaker Jun-ho Han (한준호) about introducing a CI validity-period system.

Han asked how far the commission’s working group studying improvements to the CI system has reviewed whether to introduce a validity-period system, an appropriate renewal cycle and replacement procedures in the event of a data leak.

CI is information used online to identify the same user and link sign-up information across multiple services. Because its structure makes it effectively difficult to change once created, a leak could raise concerns it may be used to connect personal information scattered across different services or exploited for secondary crimes such as identity-theft loans and smishing.

In a parliamentary audit on Oct. 12, lawmakers repeatedly pointed to harm from CI leaks and limitations of the current system. Seon-min Kim (김선민) of the Rebuilding Korea Party said 1.29 million users’ CI leaked from Lotte Card last year and 13.24 million cases leaked from Tving this year, urging a user right to request renewal and the provision of alternative authentication methods. People Power Party lawmaker Hyung-doo Choi (최형두) also called for introducing a CI validity period and setting up institutional measures that would allow renewal of information already leaked.

People Power Party lawmaker Cheon-ho Seo (서천호) raised the issue of management and supervision of financial institutions where CI leaks occurred. He pointed out that leaks occurred even after Woori Bank and Shinhan Bank received suitability approval from the commission for CI generation and processing.

At the time, commission chair Jong-cheol Kim (김종철) replied that it was reviewing a validity-period system with a 1 to 3-year cycle and improvements to related legislation.

The commission is reviewing renewal cycles and replacement procedures in a way that reduces damage from CI leaks while minimising user inconvenience and the burden on businesses of converting their systems.

In the authentication industry, it has been reported that views were presented that renewal every 6 months would create a heavy administrative burden, while 1 year 6 months to 3 years would have limited effects in strengthening security. The review process appears to have referred to the fact that the Korea Customs Service’s personal customs clearance code also introduced a 1-year renewal system.

The commission is also reviewing a plan not only for regular renewal but also for replacing an existing CI with a new value when a data-leak incident occurs. It plans to include all CI, including already leaked CI, as targets and to build a testbed to verify the technical feasibility of applying a validity period and implementing replacement procedures.

It is also reviewing the costs needed for service modification development by businesses that use CI and for changes to database structures, as well as ways to divide roles among institutions.

The commission plans to gather additional industry views, including from identity-verification agencies and CI-using institutions, and finalise an institutional improvement plan within this year. It plans to push from next year to amend the Information and Communications Network Act, judging that there are limits to introducing the system through a simple revision of a public notice.