Korea Developed ID Screening System Using Airport Travelers' Data without Consent

Korean government's development of immigration screening system involving real-time facial recognition used airport travelers' data which was supplied by the Ministry of Justice without consent.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The government compromised the privacy of 170 million individuals by transferring their highly sensitive, non-public biometric facial images to private companies without consent.

Additional risk subdomains

• 6.5 Governance failure: State organizations tasked with regulating technology bypassed the Personal Information Protection Act to facilitate private-sector AI development.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Pre-deployment

The privacy risk and unauthorized data exposure were caused by the intentional decision of South Korean government ministries to share traveler biometric data for AI training prior to the system's full deployment.

EU AI Act risk tier

• Risk tier: 2 High Risk

Risk Level 2: High Risk. The system is a facial recognition and tracking system used for immigration and airport security, which falls under law enforcement and biometric identification applications.

AI system and alleged parties

• AI system: AI identification and tracking system
• AI purpose: Face Recognition; Smart Surveillance
• Behaviour type: Autonomous
• Alleged developer: unnamed Korean companies
• Alleged deployer: Korean Ministry of Science and Information and Communication Technology, Korean Ministry of Justice
• Alleged harmed parties: travelers in Korean airports

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Substantial
• Civil rights: direct Severe, indirect Negligible
• Democracy: direct Substantial, indirect Negligible
• Privacy: direct Severe, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Differential treatment

Reported: The report explicitly describes concerns regarding potential differential treatment, noting that facial recognition is historically deployed disproportionately against immigrants and communities of color.

Indirectly caused: The development of the tracking system using airport traveler data could indirectly lead to disproportionate surveillance and profiling of foreign nationals.

Civil rights

Reported: The report explicitly describes violations of human and civil rights, with advocates calling the project a 'human rights disaster' and a 'devastating infringement' on rights.

Directly caused: The government directly violated the civil rights of 170 million individuals by sharing their sensitive biometric data with private companies without their consent.

Inferred additional harm: The deployment of a mass biometric tracking system at airports is likely to cause ongoing violations of civil liberties and freedom of movement for millions of travelers.

Democracy

Reported: The report explicitly describes an erosion of democratic norms, noting that state organizations secretly handed over public biometric data to private companies.

Directly caused: The secret transfer of public data to private entities by the Ministry of Justice without legislative oversight or public consent erodes democratic accountability and the rule of law.

Privacy

Reported: The report explicitly describes massive privacy violations involving the unauthorized sharing of biometric data.

Directly caused: The Ministry of Justice shared 170 million facial images, which are highly sensitive personally identifiable biometric data, with private companies without the consent of the individuals.

People affected

• Occurrences reported: 1
• People reportedly harmed: 170000000
• People reportedly exposed: 170000000

Potential causes

Management

• Prioritizing tech growth over safety: The government prioritized AI industry promotion over information human rights.
• Accountability gaps in joint MOU: MOJ and MSIT signed a data-sharing agreement without public oversight.

Technology

• Unregulated surveillance algorithms: Private firms trained 1-to-many facial recognition tools on traveler images.
• Mass biometric camera deployment: 88 cameras were installed at Incheon Airport to gather real-time video.

Data Inputs

• Unauthorized biometric data sharing: Over 170 million face photos were shared without obtaining user consent.
• Use of sensitive traveler details: Biometric data, nationality, gender, and age were transferred for training.

Human Factors

• Flawed official legal assumptions: Officials assumed internal legal reviews justified bypassing traveler consent.
• Lack of traveler awareness: Travelers were completely unaware their biometric photos were being shared.

Process and Methods

• Secretive project implementation: Government hid data collection scope and structure during the 2019 launch.
• Inadequate data screening process: No vetting process existed to stop the transfer of sensitive traveler data.

Regulatory Environment

• Violation of privacy protection laws: The data sharing violated South Korea's Personal Information Protection Act.
• Immigration Act limitations: The act did not authorize sharing biometric data for private AI development.
• Delayed regulatory intervention: The Personal Information Protection Commission failed to stop the project.

Information quality

• Classification confidence: High
• Reason for confidence: The reports are highly detailed, consistent across multiple sources (Vice, Hankyoreh, Biometric Update), and contain official government documents and statements confirming the key facts of the data transfer.
• Ambiguities identified: None of significance; the main facts of the unauthorized data sharing are undisputed.
• Alternative interpretations: None.

The South Korean government unauthorizedly transferred 170 million facial images of citizens and foreign travelers to private companies to train an airport biometric tracking system. This massive compromise of biometric privacy represents a severe threat to civil liberties and human rights, raising significant counter-intelligence concerns regarding the tracking of foreign nationals.

• Overall national security impact: Severe
• Scope: Multiple nations
• Primary target: South Korea
• Other affected: Multiple nations
• Alleged perpetrator: South Korean Ministry of Justice and Ministry of Science and ICT

Threat characteristics

• Imminence: Long-term. The incident represents an ongoing strategic and regulatory concern regarding state surveillance capabilities rather than an immediate crisis.
• Autonomy: Human-supervised. The facial recognition system is designed to automatically identify and track individuals, but operates under the supervision of immigration authorities.
• Novelty: Evolved capability. Represents a significant scale expansion of state-sponsored biometric data collection and surveillance training without citizen consent.

Impact by dimension

• Physical security: Minor. Incident involves security systems at a major international airport, a key infrastructure node, but caused no physical disruption or kinetic threat.
• Information security: Substantial. Unauthorized transfer of 170 million biometric facial images, including 120 million foreign nationals, creates significant counter-intelligence risks and database compromises.
• Sovereignty: Minor. State ministries bypassed domestic privacy laws to facilitate the project, representing a domestic governance failure but not a direct threat to state sovereignty.
• Economic security: Minor. The incident involves unauthorized data sharing to boost domestic AI capabilities, but does not involve strategic theft or direct threats to economic stability.
• Societal stability: Severe. Unauthorized transfer of 170 million biometric records for mass surveillance constitutes a severe violation of privacy and civil rights, sparking lawsuits and public backlash.