Tightening the Net Through an “Transmission Eligibility Certification System”…“Blocking Illegal Spam at the Sending Stage”
IT DAILY ·
✦ AI Summary
The government has strengthened its management system to block illegal spam at the sending stage after it was abused as a channel to phishing sites and malicious apps. The registration requirements for bulk text messaging operators were tightened, and the Transmission Eligibility Certification System, which preemptively detects and blocks malicious URLs and prohibited words, was converted into a statutory system in April. Existing operators must obtain certification by the end of October, and the amount of text spam received in the first half of 2024 was tallied at an average of 11.59 messages per person per month.
As illegal spam has been abused not just as advertising but as a channel leading to phishing sites and malicious apps, the government has strengthened its management system to block it at the sending stage. Illegal spam messages can include URLs that connect to phishing sites or malicious apps, and if such URLs are included, they can lead to smishing. If abused for smishing, they can result in the theft of personal information and money.
Accordingly, the government has tightened the registration requirements for bulk text messaging operators. In April, it converted the 'Transmission Eligibility Certification System,' which preemptively detects and blocks malicious URLs and prohibited words, into a statutory system. Existing operators must obtain certification by the end of October.
Spam refers broadly to the act of sending advertising information for profit that users do not want over information and communications networks. Illegal spam refers to the sending of advertising information in violation of provisions under the Act on Promotion of Information and Communications Network Utilization and Information Protection, such as prior consent and refusal of receipt.
The amount of text spam received in the first half of 2024 was tallied at an average of 11.59 messages per person per month. Text spam received in the first half of 2024 reached a peak by annual standard.
The Broadcasting and Media Commission said illegal spam tactics have recently become more diverse. Types of illegal spam included impersonation of parcel delivery and card delivery services, impersonation of financial institutions, exploitation of social issues, and exploitation of user interests. Cases impersonating loan companies and education companies were also detected. In the process, after stealing the verification code sent to a victim's mobile phone, offenders used the stolen code to sign up for a bulk text messaging site and registered the victim's number as the caller ID, then sent illegal spam from that number.
The agencies in charge of illegal spam are the Broadcasting and Media Commission and the Korea Internet & Security Agency (KISA). The Broadcasting and Media Commission is responsible for overseeing illegal spam policy, overseeing related legislation and amendments, issuing corrective orders to relevant parties, and imposing and collecting administrative fines. KISA handles receiving and processing illegal spam reports, operating the illegal spam response center, operating the spam response system, and investigating and analyzing spam distribution trends.
The Broadcasting and Media Commission is responding together with the Ministry of Science and ICT, the Personal Information Protection Commission, and the National Police Agency. These agencies drew up the 'Comprehensive Measures to Respond to Illegal Spam' in November 2024 and are currently responding under those measures.
A Broadcasting and Media Commission official said the agency is pushing to reduce transmission speeds and impose signup restrictions on illegal spam senders. The official also said the commission is working with Samsung Electronics to develop a function that filters out messages suspected of being malicious spam on smartphones, and is also providing a service that separately classifies such filtered messages as blocked. In addition, the agency has shared data on illegal spam with telecom carriers and device manufacturers, and said this is being used to strengthen AI-based blocking of illegal spam.
As a means of filtering out illegal spam before it is sent, the 'Transmission Eligibility Certification System' was introduced as a filtering device at the text-sending stage. At the same time, the 'Transmission Eligibility Certification System' is being converted into a statutory system.
The structure for processing bulk texts is not one in which a single operator handles the entire process directly. A typical sending request flows from the user, such as an advertiser or company, to a text resale operator, a text relay operator, and then a mobile carrier.
The final message reaches the recipient through the mobile carrier's network. In this process, the text relay operator sits between the mobile carrier network and the bulk text messaging operator.
A text relay operator is a special type of value-added telecommunications service provider that connects its system to a mobile telecommunications operator's telecommunications facilities to send text messages. A text resale operator connects its system to the telecommunications facilities of a text relay operator or another text resale operator to send text messages, and provides actual text sending services using that infrastructure.
In response to the possibility that illegal spam senders could abuse bulk text messaging services, the Enforcement Decree of the Telecommunications Business Act was revised last April. As a result, registration requirements for bulk text transmission operators such as text relay companies and text resale companies were tightened, and technical measures to block malicious texts at the sending stage were added to the new requirements.
The Transmission Eligibility Certification System was first introduced in June 2024 as a form of private self-regulation. At the time, it operated as a system in which text relay operators granted eligibility to send commercial advertising text messages to text resale operators, and it also carried out illegal spam prevention and post hoc monitoring. The system was later converted after related laws and regulations were revised.
Accordingly, a statutory certification system based on the Act on Promotion of Information and Communications Network Utilization and Information Protection took effect on April 28 this year. Text resale operators must obtain Transmission Eligibility Certification from the Broadcasting and Media Commission, and must also register with the Central Radio Management Service of the Ministry of Science and ICT as special value-added telecommunications service providers. Existing registered text resale operators, or bulk text transmission operators, were given a 6-month grace period, and their deadline to obtain certification is the end of October.
The Transmission Eligibility Certification review consists of 5 categories and 16 items. The main review point is whether systems for automatically detecting and blocking prohibited words and malicious URLs are actually operating. Operators must have a system in place to identify messages containing malicious URLs and block their transmission at the stage before they reach recipients.
Such a system can be built in-house by using malicious text judgment prohibited-word and API data provided by KISA. It is also possible to introduce an external solution. In July, KISA signed an MOU for the provision of a preemptive malicious text blocking system with Nuralab, SecuriOn, Aton, and Everspin.
The industry agrees with the purpose of the preemptive illegal spam blocking system. However, there have also been comments that the certification process itself involves cost burdens and that detailed requirements need to be supplemented.
Text resale operators raised concerns about the 'additional certification' item under the security system adequacy category and the 'one person, one account principle' under the user management adequacy category. 'Additional certification' refers to performing an extra identity verification procedure for the relevant sender number when sending text messages, to confirm the legitimacy of the sending account. However, many in the industry said it is difficult to apply additional certification to simple automated informational texts such as hospital appointment reservations and transaction confirmations.
The Broadcasting and Media Commission said it had collected feedback from the field. It then said that additional certification is not necessary for such types of text transmissions. This guidance was presented in FAQ format.
The standard for the one person, one account principle is not one account per company, but one account per sender actually using the text-sending system. However, businesses say the operating realities of corporations and associations with multiple managers and parallel work lines have not been sufficiently reflected.
In response, the Broadcasting and Media Commission said that, in unavoidable cases only, management by department, branch, or task is possible. In such cases, usable caller IDs and transmission histories must be identifiable, and the commission said it is checking those parts during the review process.
An industry source said the Transmission Eligibility Certification System is necessary from the standpoint of protecting the public and that businesses need to move in a direction that meets the standards. However, because the text messaging industry includes many small businesses, there can be cost and operational burdens in meeting the certification requirements, so the industry's response and whether the system takes hold in the market need to be monitored after October.
Source: IT DAILY · Seong Won-young
Original: https://www.itdaily.kr/news/articleView.html?idxno=242039
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.