2024.06.04. The Fair Economy — The government has agreed to cooperate in providing pseudonymized real data, such as voice phishing call data, for use in developing artificial intelligence (AI) systems. This is expected to accelerate the development of various AI technologies and services to combat voice phishing.
The Personal Information Protection Commission (PIPC), the Ministry of Science and ICT (MSIT), the Financial Services Commission (FSC), the FINANCIAL SUPERVISORY SERVICE (FSS), the National Forensic Service (NFS), and the Korea Internet & Security Agency (KISA) announced on November 3 that they signed a "Mutual Memorandum of Understanding (MOU) for AI and Data-Based Voice Phishing Prevention" at the Government Complex Seoul.
The government has pursued various AI and data policies to combat voice phishing, one of the most common financial crimes affecting ordinary people's livelihoods. In November last year, the "Data Economy Revitalization Task Plan," jointly announced by relevant ministries, included support for private-sector development of AI services to curb the spread of voice phishing. In April this year, MSIT, the FSC, the FSS, and telecommunications and financial industry associations signed a "Memorandum of Understanding Between the Telecommunications and Financial Sectors to Strengthen Response and Cooperation Against Financial Crimes Affecting People's Livelihoods."
With this agreement, the PIPC, the NFS, and KISA have joined the cooperation framework for combating voice phishing, significantly expanding the scope and depth of inter-agency collaboration.
Call data to be provided to firms developing prevention AI
Under this agreement, financial authorities and investigative agencies will cooperate to provide actual voice phishing call data they hold to private companies developing AI for voice phishing prevention.
When private companies, including telecommunications carriers, develop AI technologies and services to prevent voice phishing, they will be able to receive voice phishing call data from the FSS, the NFS, and other agencies to use in training AI models and testing their performance.
The FSS will continue to provide voice call data collected from reports by voice phishing victims to the NFS for forensic investigation support purposes, and the NFS will build a data-sharing system that processes such data — including de-identification — before providing it to private entities that need it.
The PIPC and KISA will review ways to improve regulations, including legal interpretations and regulatory sandbox exemptions, to address issues that may arise under the Personal Information Protection Act during the process of providing, collecting, and using the data, thereby supporting safe data use. They will also support the pseudonymization of data and the implementation of safety measures through comprehensive consulting support projects for the use of pseudonymized information.
Boosting cooperation between the telecommunications and financial industries
The agencies will promote and support cooperation between the telecommunications and financial industries so that a variety of voice phishing prevention AI can be developed.
The FSC, the PIPC, and MSIT will actively identify AI technologies and services for voice phishing prevention based on cooperation between the telecommunications and financial industries, and will seek legal interpretations and regulatory improvements so such projects can proceed without violating relevant laws. If necessary, they will work with the PIPC to establish ways for businesses to comply with personal information laws during service development, and will make use of the PIPC's "advance adequacy review system," under which no disadvantageous action under the Personal Information Protection Act is taken against a business that has implemented such measures.
Pursuing government-led technology development projects for response
The government will plan and pursue research and development (R&D) projects for voice phishing response technologies.
MSIT and the PIPC will plan and carry out government-led R&D projects so that innovative technologies for detecting and preventing voice phishing can be developed. MSIT will plan specific projects with relevant experts and provide budget support, while the PIPC will identify regulatory improvements related to the "Personal Information Protection Act" during the research process and pursue regulatory sandbox exemptions if necessary.
Meanwhile, as the first achievement of this inter-agency cooperation, SKT is developing an AI service to detect and prevent voice phishing. The service is expected to determine in real time, based on the context of a call, whether it is suspected of being voice phishing, and will include a feature that alerts the user or their family members.
For example, the service will detect key words and patterns used in voice phishing, and through analysis of conversational context, it will immediately recognize a range of voice phishing situations — such as impersonating investigative agencies or demanding personal information under the pretext of a financial transaction — and classify them as suspicious calls. Rather than simply blocking suspicious lines, the service analyzes call content through AI to detect voice phishing, which is expected to allow for a more effective response to rapidly evolving criminal methods.
SKT to detect voice phishing on-device, without sending data to a server
SKT plans to further strengthen personal information protection by applying on-device AI technology, which processes call data within the device itself rather than sending it to a server. Applying such on-device AI requires implementing a small language model (sLM), and developing a high-performing sLM requires high-quality data. For this reason, SKT has been requesting that the PIPC, the FSS, the NFS, and KISA provide voice phishing call data held by the FSS and the NFS.
The relevant agencies have held close discussions to secure meaningful AI performance while also protecting the rights of data subjects. As a result, they devised a plan under which the NFS converts about 21,000 call records into text, then safely de-identifies sensitive information such as victims' names and account numbers with advice from the PIPC and KISA, before providing the data to SKT. Pseudonymization and other processing are currently underway, and the data is expected to be completed and provided by June.
Once SKT receives the data, it plans to refine the model's performance through fine-tuning, verify it in a prototype, and then launch the service. It will also continue to receive data going forward to use in updating the model.
Focus on safely opening up and using call data
In addition, the PIPC has recently received requests from several companies, including telecommunications carriers, to review the development of voice phishing prevention AI services, and plans to hold close discussions with the FSC, MSIT, and other agencies going forward.
MSIT is planning and promoting an R&D project for next year to detect new types of voice phishing at an early stage, and is discussing with the PIPC ways to safely use the data needed for the technology development.
Until now, voice phishing call data reported by victims has been used only for after-the-fact investigative purposes. With this agreement, however, it can now also be used to develop AI for proactive prevention.
The relevant agencies plan to actively open up voice phishing call data to private companies that have reliable personal information protection and information security systems in place, when such companies need the data to develop technology aimed at preventing crimes that affect people's livelihoods.
0 Comments
No comments yet.