South KoreaInformation and Communications Network Act, Article 48 (network intrusion and anti-circumvention)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Audit expectation
- none
What it requires
- Do not access an information and communications network without authorization, or beyond the scope of granted authorization, to collect data.NIST AI RMFMAP 4.1
- Do not build, install, or distribute a tool whose purpose is to bypass a network's normal access-control or authentication procedures.no control in the NIST AI RMF
- Scraping a public, unauthenticated page without defeating an access control has not itself been held to violate this article (Supreme Court, Yanolja Co. v. GC Company, 2021Do1533, ).
These lines are LexLint's reading of the law's text. Also read by: Supreme Court of Korea, judgment of , case no. 2021Do1533 (applying Article 48(1) as it stood before the amendment of ) (recorded ).
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://www.law.go.kr/precInfoP.do?precSeq=221765
- Case citation
- Supreme Court of Korea, judgment of , case no. 2021Do1533 (applying Article 48(1) as it stood before the amendment of )
- Open questions
- Does Article 48(4) of the Information and Communications Network Act, which bars installing, delivering or distributing a program or technical device "circumventing the normal protection and authentication procedures" of a network, reach a scraper's tool that uses an unpublished interface address but defeats no access control, after the Supreme Court judged Article 48(1) by the access authority the service provider granted?
What it makes you log
Logging duty
Article 48 bars intruding on an information and communications network without or beyond a rightful authority for access, spreading malicious programs, causing network trouble by mass signals or data, and installing or distributing a tool that bypasses protection or authentication procedures. It imposes no duty to create, keep, produce or review a log or record. The Act's cyber-incident articles (48-3 on reporting, 48-4 on analysing causes) are outside the article this row cites and are not part of this row. Article 5-2 applies the whole Act to an act done overseas that affects the domestic market or users in it, and that clause reaches Article 48.
- Kind
- None
- As of
What this law does
Article 48(1) prohibits intruding into an information and communications network without legitimate access authority or beyond the scope of permitted authority. The Supreme Court held in Yanolja Co. v. GC Company (2021Do1533, ) that scraping publicly available data without defeating an authentication or access-control measure did not violate this provision as charged.
Paragraph (4), added , separately prohibits installing, transmitting, or distributing a program or technical device whose purpose is to bypass a network's normal protection or authentication procedures, reaching a scraper's own circumvention tools directly even though paragraph (1)'s basic prohibition predates it and remains the article's core text.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .