South Korea Bus Outdoor Temperature Screening Endangers Public

These $80,000+ South Korea bus stations have gained world-wide attention but IPVM verified they use cheap temperature tablets outdoors, endangering the public.

This is the fifth in an ongoing series of flawed fever camera deployments adding to reports in Argentina, Chile, and Colombia (1, 2).

• Bus Station Deployment Overview
• EHOO Temperature / 'Fever' Tablets
• What Is Wrong With the Deployment
• Data Privacy Rights Impact In Korea
• "Common Practice," [Data Protection] "Requirements Are Not Applicable" Says Lawyer
• "Highly Likely to Violate the PIPA," "Ridiculous" Says Activist

Inside this report, IPVM discusses the background behind this implementation and the problems with it and also shares comments from a South Korean lawyer and an Internet rights activist regarding its legality.

Bus Station Deployment Overview

With more than half of South Korea's population of 50 million, Seoul, the national capital, is one of the world's 10 largest metropolitan/urban areas.

Given Seoul's size, it is no surprise that French-, German-, Italian-, Russian- and Spanish-language media have reported this month on an internationally trending story out of one of Seoul's 25 districts, or boroughs.

On August 7 The Korea Herald was the first to report in English on the rollout of 10 smart bus shelters in Seoul's Seongdong district, each with a sticker price of $80,000+.

The smart bus shelters, which are ostensibly aimed at assisting the district and city in the fight against COVID-19, feature numerous anti-virus features, as The Korea Herald reports:

The district is the first to introduce a bus shelter equipped with ultraviolet light air sterilizers for preventing transmission of airborne viruses. The air sterilizer breaks up 96 percent to 99 percent of virus particles, according to Song Jun-myoung, a chief of policy managing division at the office who managed the project. [emphasis added]

Additionally, outside of the shelter, would-be commuters with high temperatures are blocked from entry by a "thermal imaging camera":

An automatic screen door blocks people with a high fever from entering the booth after checking their body temperature with a thermal imaging camera. A digital signage screen installed inside the shelter provides information on bus and subway services. An uninterruptible power supply system enables the booth to run with emergency backup power from a solar panel on its roof when the input power source fails. [emphasis added]

EHOO Temperature / 'Fever' Tablets

As shown at 0:11 in this video from AFP, the "thermal imaging camera" installed on these smart bus shelters is an EHOO ENP-FT207 AI Facial Recognition Temperature Measurement Camera.

The EHOO ENP-FT207 AI Facial Recognition Temperature Measurement Camera:

South Korea-based EHOO dates back to 2017, claims 11-50 employees on its LinkedIn profile, and describes its business as:

Specializes in manufacturing CCTV equipment and AI-based facial recognition and temperature measurement cameras.

Nonetheless, EHOO's AI Facial Recognition Temperature Measurement Camera has the same physical construction as PRC-based Longse's FK02GYW Face Recognition Terminal.

What Is Wrong With the Deployment

The cameras' flawed setup will cause a significant number of errors.

1: Temperature Tablets Measurement Flawed In IPVM Testing

While EHOO has not responded to request for comment, IPVM has tested eight temperature tablets and has found consistent problems with measuring elevated temperatures, even in ideal, climate-controlled conditions. The fundamental problem is these devices use super low-resolution sensors (ranging from 16 × 12 to 80 × 60, most commonly), which make it even more difficult to detect fine differences in temperature (e.g., between 36°C and 37°C). In our testing, tablets have even greater accuracy issues outdoors.

2: Screening Not Performed Under Indoor Environmental Conditions

Per international standards ISO/TR 13154:2017 and IEC 80601-2-59:2017, screening should be performed under indoor environmental conditions. This is clearly not the case in Seoul as photos and videos clearly show passengers being screened while outdoors:

3: Faces Obscured

Also violating standards, the below images from local media show Seoul commuters walking up to the EHOO tablet with their faces obstructed by facemasks, umbrellas, glasses, etc.:

4: Long Bangs

EHOO's own product specifications state that temperature detection is measured from the forehead:

While it does not state that bangs affect temperature measurement, the specifications clearly state that "glasses and short bangs do not affect recognition." Nonetheless, Seoul commuters with long bangs are having their temperatures screened by the EHOO 'fever' tablets, as shown below:

Data Privacy Rights Impact In Korea

While a South Korean technology law expert argues that body temperature measurement in front of specific premises is covered under an urgent need exemption clause, a Seoul-based internet activist asserts that the public use of these devices at bus shelters violates Koreans' data privacy.

Similar to GDPR in Europe, the data privacy of South Koreans is protected by the country's Personal Information Protection Act (PIPA).

IPVM sent out requests for comment to a range of journalists, lawyers, activists, and human rights organizations in South Korea and received numerous responses, including from lawyer Kwang Bae Park of law firm Lee & Ko and an activist from the Korean Progressive Network Center ‘Jinbonet’.

"Common Practice," [Data Protection] "Requirements Are Not Applicable" Says Lawyer

Kwang Bae Park is a partner at South Korean law firm Lee & Ko with over 30 years' experience in the legal profession. Mr. Park is bar admitted in both the Republic of Korea and the State of New York and released the following statement to IPVM:

With regard to the temperature measuring practices, it is common practice in Korea after COVID-19 surged in Korea from early this year. Generally, to collect, use or transfer the personal data, a controller needs to obtain specific consents from data subjects under the PIPA. However, such requirements are not applicable in case of temporary processing of personal data and such processing is urgently needed for the public quarantine or other public safety and wellness purposes under the Article 58 of PIPA.

In most cases, I believe that the body temperature measuring in front of specific premises (e.g. building, shop etc) could satisfy such exemption clause considering recent COVID-19 situation. [emphasis added]

"Highly Likely to Violate the PIPA," "Ridiculous" Says Activist

The Korean Progressive Network Center ‘Jinbonet’ advocates for open Internet and information human rights in South Korea and released the following statement to IPVM:

The bus shelter is highly likely to violate the PIPA.

Before the "Smart Bus Shelter", the Seongdong District Office purchased and installed “facial-recognition body temperature cameras (tablets)” at the entrance of the district office and public library, etc. For this camera, the system is the same as the tablet-type one installed in the "Smart Bus Shelter."

A few months ago, we filed a complaint with Seongdong district and made an open inquiry. Seongdong district responded that the system is not subject to PIPA regulation as per Article 58 (Partial Exclusion of Application): (1) 3, "Personal Information that is temporarily processed in case of urgent need for public safety and well-being, such as public health."

According to the response from Seongdong district and the vendor’s manual, the camera can be used for personal identification and authentication, not just face/temperature detection. But it is only that they are not using facial recognition database currently.

This is ridiculous; it cannot be a suitable reason. The case is not required to be dealt with "urgently necessary" and the PIPC (Personal Information Protection Commission) also decided in its previous decision that even firefighters' processing of personal information for emergency rescue and rescue activities during the spread of COVID-19 should have other legal grounds. Additionally, the Ministry of the Interior and Safety’s PIPA guidelines explain that this is limited to cases where personal information is difficult to process in accordance with legal standards, and also to temporary processing of personal information to prevent abuse. However, the system installed by Seongdong district does not have any other legal regulations and safeguards.

Since then, we have filed a public complaint with the National Human Rights Commission of Korea and the PIPC. The National Human Rights Commission of Korea is in the process of investigating whether there are grounds for human rights violations, and in the case of the PIPC, it is in the process of deliberating and deciding whether the justification for non-regulation under Article 58 (1) 3 is correct.

Also, assuming that the data captured by the cameras (i.e. tablets) is covered under PIPA correctly, the custodians of the system shall obtain separate consent for collecting and processing body temperature and facial recognition templates. Personal information such as health and biometric information is considered "sensitive information" in accordance with the Enforcement Decree of the PIPA (biometric information is now considered sensitive information, pursuant to amendments dated August 5, 2020), and safety measures based on the law should be taken. [bold emphasis added]

Conclusion

Whether the sanitation features of the shelter help is beyond the scope of IPVM. However, the usage of a temperature tablet outdoors to control entering a shelter will not work properly, creating a false sense of safety for those who enter it.