Microsoft's Active-X is a black hole in South Korea's cyber security

For quite a few years now, I've been happily using Skype, including the paid Skype-out service which allows low cost calling directly to telephones anywhere in the world using the service.  A few weeks ago I logged on to add another $25 to my Skype-out account, only to find to my astonishment that the service had disappeared!   Instead I was directed to a new web page hosted by the Daesung Group that described a new set of services and calling rates and instructed me to download an ActiveX control in order to purchase Skype credits!   Of course, that would have meant installing Microsoft's Internet Explorer browser, which I abandoned years ago in favor of the faster, safer and more efficient Chrome browser.

I tell this story only to illustrate a much larger problem, as reported today in The Korea Herald.  Continued widespread use of Microsoft's ActiveX control in Korea creates a massive security problem.  As the accompanying graphic shows, (click to see a full sized version) there have been a series of massive leaks of personal information over the past five years.  This issue is so important that I'm going to include a lengthy quote from the newspaper article below.   

"Many Korean websites depend on Internet Explorer’s cumbersome “ActiveX” platform, posing another risk factor. KAIST professor Lee Min-hwa said, “ActiveX is a program that momentarily disarms the computer to download codes from an outside source, which can be abused by hackers seeking to plant malicious codes.” Lee, one of the key patrons of President Park Geun-hye’s signature science and technology-based “creative economy,” said that Korea’s dependence on the ActiveX-based public key certificate system created a “black hole” in cyber security. The public key certificate is a type of digital document that enables online transactions. Korea’s online regulations require that certificates should be issued for any transaction worth more than 300,000 won ($268), and the issuance also requires a download of proprietary software on Internet Explorer via ActiveX. The mechanism, introduced in the late 1990s, is intended chiefly for South Korean citizens who use Microsoft Internet Explorer. Other Web browsers, such as Google’s Chrome, do not support ActiveX, and the whole system means foreigners often find it virtually impossible to purchase items on Korean websites. The mix of ActiveX and the key certificate system was originally designed to protect personal data, but experts say it is now making computers in Korea more susceptible to cyber attacks and identity theft."

The "death of Internet Explorer" in Korea?

A week ago today I was interviewed by Chance Dorland, a reporter for TBS eFM 101.3 MHz, an English language station in Seoul. The topic was the "death of Internet Explorer" and its implications for South Korea, which continues to be heavily dependent on the browser despite the fact that Microsoft and most of the rest of the world are moving away from IE. (you may listen to the interview here with an mp3 player)  The interview prompted me to do a bit more research on the current status of Internet Explorer in South Korea.  Its hold, or perhaps one should say "iron grip" on the browser market here is one of the fascinating stories of ICT sector policies and growth here.
To place the matter in global context, the overall pattern of browser usage worldwide is shown in the graphic at left (click to see a full size version) which is based on statistics gathered by StatCounter and published by Wikimedia.  Note that StatCounter records data from 3 million or more websites and its statistics are based on page views.  It makes no adjustments and weightings and it is independent with no commercial support.  However, the data it reports can still be influenced by sample size and other factors.  For that reason, the accompanying graphic is mainly useful for showing several broad, long term trends over the seven year period represented.  First is the dramatic decline in usage of IE (blue line).  Second, there is an equally clear increase in use of Chrome (green).  Finally, the pink line shows a rapidly rising percentage of internet browsing is done on mobile devices rather than desktop computers.

The rapidly increasing usage of mobile devices is a major factor to keep in mind when interpreting the above line graph from StatCounter.  In fact, data from the 2015 Mobile Internet Usage Survey published by The Korea Internet and Security Agency (KISA) show, not surprisingly, that mobile internet usage in Korea is far higher than the global averages.  As shown in the second line graph based on data for only desktop internet usage, IE is still being used by more than 60 percent of Koreans to surf the web.  This is a much higher proportion than the global average.
So, as noted at the conclusion of the radio interview, IE is far from dead in Korea.   This raises a key question.  What are the costs to the Korean economy as a whole and individual consumers, both Korean and expat of this continued heavy reliance on an outdated Microsoft product?  

Korea's bizarre reliance on Microsoft's Active-X

Yesterday I attempted to book a KTX ticket from Incheon to Busan online and was surprised to see that Korail, among other public organizations, continues to require the download and installation of a Microsoft Active-X control in order to complete the transaction.   At that point, I gave up my attempt to book the ticket, not wanting to expose my PC to the security risk that use of Active-X entails.
The problem of Active-X has been apparent for many years, as illustrated by these prior posts.   Three years ago, then- President Park Geun-hye assembled a large group of business leaders at the Blue House and implored them to stop using Active-X.   Today it is truly amazing that this issue continues to hamper Korea's online commerce.   It is a subject of media attention again, now that the new administration of President Moon Jae-In has promised to rid the country of its reliance on Active X.  See, for example, this article in The Investor.

Part of the problem is the continued widespread use of Microsoft's old Internet Explorer browser in Korea.   As shown in the first graphic (click for a full size version) the Chrome browser overtook Explorer in early 2012 on a worldwide basis.  In sharp contrast, according to Statcounter, usage of Chrome only overtook Internet Explorer in Korea as of early 2016, a full four years later. (click on the second graphic for a full size version)  In fact, Japan and Korea are the only major economies where a large portion of the population continues to use Internet Explorer.  Microsoft's new Edge browser does not support Active X because it is a security risk and the company has warned consumers of the dangers of Active X for years.  
At this point, "bizarre" is not too strong a word to describe South Korea's entrenched reliance on Active X.  It is damaging to the economy and a major security risk.  It may relate in part to this nation's heavy concentration on hardware manufacturing and export rather than software and services.    However, the rest of the world has long since moved away from Active-X and it is long past time that South Korea does as well, before this situation becomes even more of an embarrassment.

The continuing problem of Korea's Microsoft Monoculture

Since I live in South Korea, direct personal experience with the so-called "Microsoft monoculture" here is more or less inevitable.  I've posted somewhat regularly on this topic.
At any rate, this week I tried to make use of a Google docs presentation in one of my classes, only to discover that the electronic podium was loaded with Windows XP and an older version (IE 6.1 I believe) of Internet Explorer that would not even allow me to log on to Google docs, let alone view the presentation!  That excruciating experience reminded me that it was about time to take another look at this nation's excessive dependence on Microsoft software that much of the rest of the world has already discarded.   The Korea Times carried a good summary a few days ago, entitled "Korea still stuck in Active-X."   The opening two paragraphs of the story pretty much tell the story about internet use in South Korea, as follows.
"Many Internet users find Web browsers Google Chrome and Firefox more convenient than Internet Explorer (IE), but users here often stay with the latter due to the prevalence of Active X technology.
Over 80 percent of the country’s Internet sites still use this technology, which is not only vulnerable to malicious code, but also damages consumers’ right to freely choose the Web browser they want." The article goes on to note that "Internet users wanting to engage in commerce have no option but to use the Microsoft browser, and as a result IE has an 80 share of the browser market here while its ratio has fallen to below 40 percent globally."  The accompanying graphic from StatCounter shows the global trend (click on the graphic to see a full-size version).
The Korea Times article contains some interesting background detail on how the current situation in Korea came about and is well worth reading.
I am one of many consumers, both Korean and expatriate, who would love to use my smartphone to check bank account balances or do other such routine tasks, but this will have to await decisions by government and industry bodies here to shed their dependence on outdated Microsoft software and enter the 21st century.  People like me will not switch from using Chrome or Firefox back to Internet "exploder" just to do their banking or credt card transactions, especially with the security risks that such a move might involve.

The deepening dictator's dilemma: North Korea bans WiFi and Satellite Internet

The recent news that North Korea has banned use of WiFi networks and Satellite Internet for foreigners brings that nations dilemma once again into clear focus.  It needs to develop digital networks and use the internet if it is to have any hope of economic development.  However, by doing so in this age of ever smaller, more powerful and cheaper internet-capable digital devices, it loses the tight control over information that the leadership covets.
As reported by the North Korea Tech website on September 9,"North Korea has banned the use of satellite Internet connections and WiFi networks by foreign embassies and international organizations unless they get government approval."
The reason for this ban?  Last month The Diplomat reported that housing prices had skyrocketed in a residential area of Pyongyang where the foreign embassies are located as North Koreans were scrambling to move to that area, expecting to use the embassies’ Wi-Fi. The article further noted the following. "For example, after a Middle Eastern embassy installed a strong router, college students in Pyongyang began walking around the embassy in order to use the Internet with their mobile phones. It’s known that North Korea removes all the programs related to usage of the Internet, such as Internet explorer, when selling mobile phones to its people."
Although anecdotal, this adds to a growing body of evidence that Johann Galtung's conception of how Korea might be reunified has merit. Galtung argues that unification only necessitates the free flow of people, goods and services, and information and ideas between the two Korean states, not the dissolution of ROK and DPRK into a single Korean state. This was discussed in an earlier post after his 2008 lecture at a university in Busan.

Death of Internet Explorer goes viral

 

Readers of this blog will know that I've long been interested in Korea's heavy dependence on Microsoft's Internet Explorer browser, years after Microsoft itself warned against its use (click here for posts on IE and cyber-security).  The tombstone displayed in this photo (click for a full size version) was made by a Korean software engineer and displayed on the roof of his brother's cafe in Gyeongju went viral on the Internet.

The story was covered by CNN (see story here) and other mainstream media, but a review of posts on this blog will provide additional detail.

What's wrong with these maps?

This morning I showed the accompanying map from the Information Geographies collection at the Oxford Internet Institute to students in two of my undergraduate classes at SUNY Korea in Songdo. (click to see a full size version of the graphic)  I'm a great fan of the various graphics being produced by the Oxford Internet Institute, and indeed the problem with this map lies in part with its data source (Alexa) rather than the Oxford researchers.  I'm referring, of course, to the grey shading for Korea, which  indicates "no information" and which also covers the whole Korean peninsula, merging North with South Korea.
The first part of the problem, that of "no information" about Korea may be because the Oxford team did not trust the 2013 Alexa data.  I just checked Alexa and found that Google.com is listed as the top site in Korea, followed by Naver.com.  However, these Alexa data are highly questionable and should not be used for South Korea.  Alexa's data are gathered from a panel of users that install an English language toolbar in Microsoft's Internet Explorer.  Although IE is widely used here, the fact that the Alexa toolbar is only available in English, immediately makes it almost useless in Korea, where the vast majority of users prefer web browsing in Korean.  For a good critique of Alexa versus other companies that provide web statistics, see this article, "Web statistics for internet market research: pick a number, any number".
In fact, Naver.com is the most widely used web site in South Korea, with about 31 million unique visitors or almost 95% of internet users (reach) during the most recent measurement period by Nielsen Korea.  It was followed by daum.net with an 82% reach and google.com ranked eight with about 12 million unique visitors and a reach of 37%.
As to the second part of the problem, that of shading the entire Korean peninsula grey, it obscures the digital divide between North and South Korea, the most dramatic and poignant such divide in the entire world and a tragic vestige of the Cold War era.  South Korea has the highest rate of internet penetration in the world, while North Korea ranks near the bottom among all nations of the world.

So the second problem with Korea's representation on the "Most visited website per Country" map is shared with another, otherwise very informative map based on internet population and penetration. (click for full size version)

Do Koreans enjoy Internet freedom?

The headline of a recent article in The Korea Times says it all by posing the question, "Do Koreans enjoy Internet freedom."  For several reasons, the answer appears to be "partly."  For example, the most recent report by Freedom House, Freedom on the Net 2013 ranked the internet in South Korea as only "partly free," mainly because of the blocking of certain political or social content.  The report noted that political tensions with North Korea are a significant motivation for online restrictions.  It also reported that the Constitutional court in August of 2012 declared that section 44(5) of the Information and Communications Network Act which required users to verify their real names before posting comments on major domestic websites was unconstitutional.  However, other laws mandating real-name registration in specific circumstances remained in place.  Censorship of the internet in South Korea is carried out by the Korea Communications Standards Commission (KCSC), which was established in 208 to maintain ethical standards in broadcasting and internet communications.  As reported by Freedom House, "A team of 20 to 30 monitoring officers flag possible offenses, including obscenity, defamation, and threats to national security."
In general, the findings of the latest Freedom House report on internet filtering in South Korea mirror those of The Open Net Initiative.
There is more in The Korea Times report, including the continued widespread requirement that Microsoft's Internet Explorer and Active-X be used for banking and financial transactions.