The Invisible Korean Operating System

At the end of the previous instalment I called foreigners an integration test for the Korean digital ecosystem. I wasn’t entirely joking.

Any sufficiently mature system accumulates assumptions. Some are documented, some are buried deep in implementation, and some are so fundamental that nobody involved even thinks of them as assumptions anymore. They are simply how the world works. Then somebody turns up with a 25-character surname, a name which appears in two government databases in a slightly different order, or a perfectly valid Korean residence card but no mobile phone subscription in their own name, and all sorts of interesting things start falling over.

This is not particularly Korean, obviously. Anyone who has ever attempted to put a Portuguese name into an American form which insists that a human being consists of First Name, Middle Initial and Last Name will recognise the genre. At this point I must refer you to the excellent and seminal Falsehoods Programmers Believe About Names; go and read it instead if you haven’t already.

What is particularly Korean, though, is how much of the country’s digital ecosystem came to depend on a remarkably coherent underlying identity infrastructure. Once you have been in Korea for a while, you barely notice it. Your bank knows who you are, your mobile operator knows who you are, and websites and government services can verify who you are. These systems generally agree with one another, and before long you can pass real-name verification in your sleep. It is fantastically convenient when it works.

To understand what happens when it doesn’t, we need to go back considerably further than the Internet.

Everyone Gets a Number

Korea had operated a resident-registration system since the early 1960s, but after the January 21, 1968 Blue House raid, in which a group of North Korean commandos infiltrated Seoul in an attempt to assassinate President Park Chung-hee, the government strengthened it into the modern national identification system. The new system included identity cards and a unique Resident Registration Number intended to make it substantially easier to distinguish legitimate residents from infiltrators.

Here we have a pattern which should be familiar from the previous instalment: something is introduced in response to an entirely real security problem, works well enough, and eventually becomes infrastructure.

The Resident Registration Number, usually abbreviated RRN, was exceptionally useful infrastructure.

A unique identifier solves a boring but surprisingly difficult problem: how do you know that the person standing in Bank A is the same person whose tax record sits in Government Database B and whose telephone subscription is being created by Telecom Operator C? Names are terrible identifiers. They are duplicated, transliterated, changed and misspelt, and generally behave nothing like database engineers would like them to behave. Besides, 20% of the country shares the surname Kim, and another 15% Lee; this almost certainly has something to do with it. A permanent unique number is much easier.

Naturally, once you have one, everybody wants it.

Banks used RRNs. Telecom operators used them. Government agencies used them. Employers used them. Once the Korean Internet appeared, websites discovered that the country had already solved their identity problem too.

By the early 2000s, handing over your RRN when registering for a Korean website had become entirely routine. A 2003 National Human Rights Commission survey found that the vast majority of Korean websites required users to provide an RRN when registering, while 75% of the surveyed users identified the RRN as the personal information they were most reluctant to provide online.

For product designers this was extremely convenient. Want to stop one person creating fifty accounts? RRN. Need age verification? RRN. Want to associate an online account with an actual human being? RRN. Want to stop spam? You catch the drift.

From a privacy point of view, putting the same immutable identifier into thousands of unrelated databases was… less obviously brilliant.

The particularly unpleasant property of a persistent identifier is that it is, well, persistent. If ten databases contain the same value, joining records across them becomes easy. If the number leaks, you cannot solve the problem by clicking “Change password”.

And Korea had some very large personal-data leaks. Ahem. More on those later.

For now, the important point is that Korea had created a powerful, near-universal identity key long before mass-market online services arrived. When they did, building on top of it was the obvious thing to do.

The Internet Would Like to See Your Papers

When you want to use some website or post some content, you are usually asked to register – email, password, sign-in with Google if you are lucky – you know, the usual stuff. Korea actually went one step further.

For a period, Internet regulation explicitly required large online services to verify the real-world identity of users who posted content.

Imagine having to produce your name and papers before posting a Reddit comment.

The so-called Internet real-name system went through several iterations, but by the late 2000s large websites could be required to perform identity verification before allowing a user to post on an Internet bulletin board. The regime was eventually expanded to sites receiving at least 100,000 users per day. It was meant primarily to deal with defamation, harassment and other abusive behaviour online, which was once again not an imaginary problem.

This produced one of my favourite collisions between the global Internet and Korean regulation.

In 2009, Google decided that it did not want to introduce Korea’s identity-verification requirement on YouTube. Instead, it disabled uploading and commenting for users of the Korean-localised version of the service. Watching videos continued to work; uploading them did not. Users quickly discovered that changing the country setting was enough to get around the restriction, neatly illustrating some of the practical limitations of regulating identity on a globally distributed website. The episode later became part of the legal history of the Korean real-name system.

Google, as it turned out, picked the winning side of that argument. Three years later, Korea’s Constitutional Court struck down the identity-verification requirement as unconstitutional and a disproportionate restriction on free speech. Coincidentally, somewhere around that time, without much fanfare, YouTube promptly restored uploading and commenting to its Korean service. Very neat coincidence indeed.

That could have been the end of the Korean real-identity story. Of course, it wasn’t.

As we saw with ActiveX in the previous post, abolishing a regulatory requirement and dismantling the infrastructure built around it are two different operations.

By then, Korean banks, telecom companies, identity-verification providers, websites and government systems had spent years becoming exceptionally good at answering one question:

Is this online person actually Roman Kirillov?

Plenty of legitimate reasons remained to ask that question after anonymous Internet comments stopped requiring an answer. Banks need to know their customers. Certain products require age verification. Account recovery may demand considerably stronger evidence than access to an email inbox. Government services quite reasonably need to know whether the person submitting a tax form is the taxpayer concerned.

Korea therefore did not get rid of online identity verification. It got rid of the idea that every random website should perform it by collecting your Resident Registration Number.

We Got Rid of the Resident Number. Mostly.

From a security-engineering perspective, the modern Korean system is considerably more interesting than simply typing an RRN into a website.

KISA, the Korea Internet & Security Agency, now describes several recognised methods for performing online identity verification without the service itself receiving the user’s raw RRN. These include mobile-phone verification, i-PIN, credit-card verification and certificates.

Conceptually, this makes a great deal of sense. Instead of every website becoming an identity provider and, more importantly, another database containing millions of RRNs which can and will leak, the website delegates the job to an organisation which already has a trusted relationship with the user. The identity provider verifies the person and tells the website, in effect, yes, this is the human you think it is.

Federated identity is hardly unique to Korea. The interesting part is that mobile phone operators became some of the country’s most important identity providers.

If you have spent any amount of time dealing with Korean websites, you have almost certainly seen the standard phone-verification flow: enter your name, date of birth, mobile operator and number, perhaps specify whether you are a Korean or foreign national, then approve the request through SMS or the PASS app.

On the surface, this looks much like SMS authentication anywhere else. The difference lies in what it proves.

Normally, when a website sends me an SMS code, the claim being tested is essentially:

Whoever is sitting here currently controls +82-10-XXXX-XXXX.

Korean mobile identity verification can prove something stronger:

+82-10-XXXX-XXXX is a subscription registered to this particular legal person, and the person authenticating matches that identity.

KISA’s own documentation makes the point fairly explicitly: the mobile-verification flow assumes a mobile phone subscription registered in the user’s own name, with the carrier helping to verify the subscriber’s identity.

That is a very useful primitive. Age verification becomes straightforward. Fake-account creation becomes more expensive. Account recovery gains a strong additional signal. Financial services and government websites can rely on an existing identity relationship instead of each trying to establish who you are from scratch.

For a Korean citizen with a normal Korean mobile subscription, the whole thing is almost invisible. You enter a few details, press the PASS button, provide a fingerprint, and you are done.

Over time, having a mobile subscription in your own name became one of the standard ways to possess a usable online identity.

That sounds like an academic distinction until someone has an entirely legitimate identity but no mobile subscription represented exactly as the verification system expects (so, every single visitor to Korea runs into this at least once - whether they are trying to purchase online tickets, or register for ubiquitous Naver).

We will get to that later. First, however, we need one more piece of the plumbing.

Meet CI, the Number You Didn’t Know You Had

Removing RRNs from individual websites creates another problem.

Suppose Coupang verifies me today using my mobile phone. Tomorrow I use another identity-verification mechanism, or perhaps another service owned by the same company needs to know whether I am the same person. The raw RRN is no longer supposed to be passed around, which is good, but the system still needs a stable way to say yes, that’s Roman again.

Korea’s answer is CI, or Connecting Information (연계정보).

KISA defines CI as a derived identifier produced during identity verification which allows participating services to link the same person across systems without passing the raw RRN around.

A related identifier, DI or Duplication Information, solves a narrower problem. It lets a service determine whether the same person has already registered while incorporating a service-specific identifier, so different sites need not receive the same value.

There is a lot to like here from an engineering perspective. The raw national identifier no longer needs to be sprayed across the Internet. A service which merely wants to prevent duplicate registrations can receive a service-specific pseudonymous identifier, while services with a legitimate reason to connect identities can use CI.

Architecturally, this leaves a fairly coherent identity graph underneath a large part of Korean digital life:

government identity → telecom subscription / identity provider → CI or DI → online service

Banks and other regulated industries attach their own identity relationships to the same person. Government services do likewise. A mobile subscription is more than a communications service; it participates in identity. An identity-verification transaction is more than authentication; it can produce stable identifiers which allow services to recognise you over time.

That is what I mean by the invisible Korean operating system.

There is no gigantic government database sitting underneath Kakao, Naver, Coupang and every Korean bank. The reality is more decentralised and considerably less sinister. But there is a common set of assumptions, identifiers and verification mechanisms which acts rather like a platform API. If you fit the expected model, everybody can talk to everybody else and the plumbing disappears, normally a sign of good infrastructure.

The problems, obviously, begin when you do not fit the model.

And Then a Foreigner Walks Into the API

This is where foreigners become useful - for the purposes of our discussion, at least. It’s not because Korean systems have some uniquely pathological dislike of foreign users (even though some genuinely do), but because foreigners are much more likely to violate assumptions which remain invisible for the majority population.

A Korean citizen will normally have a Resident Registration Number. A foreign resident historically had a different registration number. Names which are utterly mundane in Russian, English, Spanish or Arabic may be surprisingly long by Korean database standards, contain spaces, or appear in different orders in immigration, bank and telecom records. Or, you know - gasp - may not even be spelled in Hangul!

None of this makes the person difficult to identify in any meaningful real-world sense. They may be standing there holding a government-issued residence card and a passport.

Computers are famously unimpressed by this sort of argument.

Nor is this merely folklore from expat Facebook groups. More than fifteen years ago, Korea’s National Human Rights Commission was documenting failures of online identity verification for foreigners, including cases where systems built around Korean resident-registration data offered no equivalent verification path for people holding foreign registration documents.

That is why I think integration test is the right mental model.

The problem was rarely that Korea had no idea who the foreign resident was. Immigration knew perfectly well. The person had identity documents and an entry in a government database.

The problem was that the path from “this person has a valid identity” to “this website can verify that identity” contained assumptions about the usual shape of Korean identities and how they propagate through the ecosystem.

The question is not always:

Can you prove who you are?

Sometimes it is:

Can you prove who you are through one of the identity paths this service knows how to consume?

That is a much more interesting problem, and Korea has been changing its answer.

Notably, in January 2025, the Ministry of Justice began issuing mobile residence cards to registered foreign residents, giving the mobile credential the same legal validity as the physical residence card and explicitly presenting it as part of an effort to reduce the digital gap experienced by foreigners (previously foreigners HAD to carry their resident card on them, at all times - or at least that’s how the theory goes).

This is the direction in which you would hope the system would move: a proper government-backed digital credential, instead of every private service inventing another way to prove that the holder of a foreign residence card is the person named on it.

There is, however, a detail which I find almost too perfect.

To obtain the mobile residence card, the user needs a smartphone registered in their own name.

Korea has built a shiny modern mobile identity credential partly intended to help people who historically struggled with the existing identity ecosystem. One prerequisite for entering it is already being correctly represented inside the Korean mobile identity ecosystem.

This is not as ridiculous as it sounds. There are good security reasons to bind a high-value digital identity credential to an identified subscriber and device. It does, however, illustrate rather beautifully how technological transitions happen.

The new system does not replace the old one overnight. It lands on top of it.

The mobile credential is new. The dependency graph underneath it is considerably older.

And identity is hardly the only part of the Korean digital ecosystem going through this transition. Over roughly the last decade, Korea has been quietly dismantling an extraordinary amount of its Galápagos architecture: ActiveX, the accredited-certificate monopoly, financial network separation, restrictions on foreign payment platforms, parts of its mapping regime, and increasingly some of the assumptions buried inside digital identity itself.

The interesting question for the final instalment, then, is no longer how Korea ended up here - but it is how you reconnect an island to the mainland without destroying everything which evolved successfully on the island.