Public Threats Using Proxy IPs on the Rise... Regulatory Loopholes for VPN Providers

12 Public Threat Reports and 4 Arrests in Gwangju This Year
Bomb Threats at Department Stores and Schools Surge Since August
Only 8 Suspects Apprehended Out of 72 Cases Nationwide
VPN Providers Not Obligated to Retain or Share IP Records
"Illegal Use of Proxy IPs Continues... Institutional Reforms Needed"

Recently, public threats targeting unspecified individuals at multi-use facilities have been repeatedly reported nationwide, but authorities are facing significant difficulties in apprehending suspects. In most of these cases, disposable proxy IP addresses provided by VPN companies are being used. However, since these companies are not obligated to retain proxy IP records or cooperate with investigations, there is an urgent need for institutional improvements.

According to the Gwangju Metropolitan Police Agency on October 21, the Gwangju police received 12 reports this year of public threats with the intent to cause harm to unspecified individuals at multi-use facilities. Of these, investigations were launched into nine cases, including overlapping incidents, and so far, suspects have been apprehended in four cases for public threat charges and all have been referred to the prosecution.

Among the four cases where suspects were apprehended, two were confirmed to be crimes committed online. On March 22, a man in his 50s, identified as Mr. A and residing in Seoul, posted a comment on an article about a wildfire in South Gyeongsang Province, stating, "I hope both Gyeongsangnam-do and Gyeongsangbuk-do burn down. I will massacre the residents of Gangnam."

In another case, a woman in her 30s from Gyeonggi Province, identified as Ms. B, posted on her social media account that she would "commit a mass shooting at the Yeouido Fireworks Festival." The police tracked her internet protocol (IP) address and apprehended her.

In both cases, the suspects resided outside the Gwangju area, but since the initial reports were filed with the Gwangju Metropolitan Police Agency, the Gwangju police conducted the investigations. However, a series of false bomb threats targeting unspecified individuals at department stores and schools in Gwangju have been difficult to solve, as suspects have used virtual private networks (VPNs) to disguise their IP addresses, making apprehension challenging.

Previously, at 12:09 p.m. on October 17, a report was received via text message to emergency services claiming that explosives had been installed at Geumdang Middle School in Nam-gu, Gwangju. Sixteen firefighters and five vehicles were dispatched, and together with the police, students were evacuated and a search for explosives was conducted, but no explosives were found.

Geumdang Middle School was one of three schools in Gwangju that received bomb threat emails on October 13. At 12:55 p.m. that day, a total of four schools-including Gyeongsin Girls' High School in Buk-gu, Dongsung Girls' High School, Daekwang Girls' High School, and Geumdang Middle School in Nam-gu-received emails stating that explosives had been installed. Upon investigation, all were found to be false reports. At the time, the threatening emails were believed to have been sent via a proxy IP address based in Japan.

In August, a fax threatening to "blow up the department store" was sent to Gwangju Shinsegae and Lotte Department Store, prompting the police to deploy detection dogs and equipment for a full-scale search.

Nationwide, bomb threat reports have been increasing since August, but the number of suspects apprehended remains extremely low.

According to data submitted by the National Police Agency to Assemblyman Chae Hyunil of the Democratic Party of Korea, a member of the National Assembly's Public Administration and Security Committee, there were 99 bomb threat posts this year. Of these, 72 were posted between August and October 15, accounting for 72.7% of the total. Only eight suspects responsible for posting threats have been apprehended.

In response to continued false and prank reports, the police have established a four-stage bomb response guideline based on the level of risk to minimize the waste of public resources. However, there are calls for more effective measures to apprehend suspects in order to eradicate the crime of false public threats itself.

Some have pointed out that the legal loophole regarding VPN companies makes investigations difficult and exacerbates the problem. Under the current Protection of Communications Secrets Act, telecommunications operators are required to cooperate with police requests for information, but there is no provision for penalties if they refuse. Even if a warrant is issued, companies may provide users with disposable IP addresses, and there is no obligation to keep records of which user was assigned which IP address, making investigations limited in scope.

Regarding this, a local police official stated, "If a crime is committed using a proxy IP, cooperation from the VPN provider on which IP was assigned is essential for immediate tracking, but under current law, such cooperation is difficult to obtain. VPN companies are not required to retain records of which IP was provided to whom and at what time, making investigations challenging."

The official added, "Telecommunications operators are legally required to provide numbers when activating mobile phones and to retain communication records for a certain period, but there are no such regulations for VPN companies, leaving a blind spot. Proxy IPs are being used for various illegal activities such as investment scams and gambling sites, so institutional improvements are needed."