Korea Now Scans Every Image Uploaded to Its Big Forums. The Man Running One of Them Can't Tell You If It Has Ever Worked.

In June, the co-chief executive of 루리웹 (Ruliweb) — one of Korea's oldest and largest gaming and general-interest forums — posted the filter logs for the previous year.

The system had logged 1,615 blocks. Strip out the test files that the detection service pings itself with, and 46 were real. Strip out the ones where a user, having had an upload rejected, simply tried again and got counted twice, and it comes down to roughly 33.

Thirty-three, out of everything uploaded to a major Korean forum in a year.

Then the part that matters more than the number. He cannot tell you whether any of those thirty-three were what the system is looking for. Not because he did not check — because checking is not available to him. Retaining a flagged file in order to examine it would itself put him on the wrong side of the law. The filter tells him it stopped something. It does not tell him what, and he is not permitted to keep a copy to find out.

That is the situation Korean platforms have been in since 1 July, when the same machinery was extended from video to still images.

What the law is, and why nobody sane argues with its purpose

The provision is 전기통신사업법 제22조의5 — Article 22-5 of the Telecommunications Business Act — and it does not date from this year. It was passed by the National Assembly on 20 May 2020 and promulgated that June, written directly in response to the n번방 case, in which women and girls were coerced into producing sexual material that was then sold through Telegram chatrooms.

The law's object is 불법촬영물: images and video made or shared without the consent of the person in them. Nobody serious in Korea argues the state should be indifferent to that, and this article is not going to. The question here is narrower and entirely mechanical: the country has built a machine, and it is worth asking whether the machine does the thing.

The obligation works like this. Platforms above a certain size must pass user uploads through detection technology that compares them against a government-held database of known illegal material, and block a match before it is posted rather than removing it after a report. Video filtering became mandatory for large communities in December 2021.

What changed this year is scope. Presidential Decree No. 36281, in force from 28 April 2026, extended the technical-measures obligation from video to images — every photograph, screenshot, meme and drawing. Operators were formally notified on 30 April, and the obligation bit on 1 July.

Who is caught by it

The threshold is in the enforcement decree, and it is not high:

• prior-year revenue from value-added telecommunications services of ₩1 billion or more, or
• 100,000 daily average users, measured across the three months to the end of the previous year.

Either one, not both. Logs of what the filter did must be kept for three years.

That catches Naver and Kakao, and it also catches DC Inside, 더쿠, Ruliweb — the ordinary furniture of the Korean internet. Reporting on the rollout has named Google, Meta and X as being within the threshold too.

The regulator is the 방송미디어통신위원회 — the Broadcasting Media Communications Commission, which replaced the old 방송통신위원회 on 1 October 2025 after seventeen years. That renaming is worth noting because a good deal of English-language writing on this subject still refers to the body by a name it no longer has.

There is a six-month grace period on penalties, running to the end of December. It is worth being precise about what that means: it protects operators from being fined. It does not delay the filter. The filter has been running, and rejecting uploads, since July.

What the filter actually caught

On 15 July, two weeks into the image regime, Ruliweb's co-chief executive 진인환 published a second set of numbers. In roughly a day, the system had flagged 11 images — 8 once duplicates were removed.

He listed what they were. Bikini images of 3D game characters. Lingerie photographs of the kind that circulate from adult-film publicity. Swimwear drawings. Four images of Chinese adult models. Some selfies of several women together.

In his assessment, not one was an illegal recording.

His post also contains the "98%" figure that has travelled furthest in coverage of this story, and it deserves to be handled more carefully than it has been. His actual words are "기관에서 이야기 하기를 정확도가 98% 정도였던 것 같은데요" — the agency said the accuracy was around 98 per cent, I think. That is a hedge inside a recollection of something said aloud at a briefing in June. It is not a published government statistic, and we could not locate one. It should be quoted as what it is: an operator's memory of a verbal claim.

The thing that cannot be measured

Put the two datasets side by side and the shape of the problem is not really the false positives. It is that there is no denominator anybody can see.

No official statistics have been published on how many images the filter has processed, how many it has blocked, how many of those blocks were correct, or how many people appealed. The only numbers in public are the ones an operator chose to publish about his own site. And that operator, by his own account, cannot audit his own numbers, because the evidence he would need to audit them is evidence he is not allowed to hold.

So the system has a curious property. It produces a count of interventions and no way to evaluate them. If it were working perfectly, the logs would look like this. If it were catching nothing at all, the logs would also look like this. A machine that cannot be wrong in any way you could demonstrate is not a machine anybody can improve.

The forum that was never required to do this, and did it anyway

In mid-August a second large community, 아카라이브 (Arca.live), switched filtering on without warning its users.

The interesting thing is that, as far as we can establish, it did not have to. Arca.live is operated by a Paraguay-registered company, which puts it outside the reach of Korean enforcement. It appears to have adopted the filter voluntarily. We could not establish why — advertiser pressure, payment processors and the general chill of a separate site-blocking regime are all plausible, and we are not going to pick one without evidence.

Its users have since reported the filter deleting things that are not remotely what the law describes: streamer replay footage, and — the example that has travelled around Korean forums — an Overwatch "Play of the Game" clip. We should be straightforward that these accounts are from forum and wiki posts, not from any news organisation. We searched for press coverage of the Arca.live episode and found none. Treat them as what users say is happening on their own site, which is worth something and is not the same as verified reporting.

The nickname the communities have settled on is 사이버 계엄 — cyber martial law. It is a heavy phrase in a country where actual martial law is inside living memory, and we quote it as their word, not ours.

Where the line is actually drawn

The asymmetry people complain about is real, but it is usually described wrongly.

The common version is that the law binds Korean forums while Telegram and Discord — where the crimes it was written for actually happened — go untouched, because they are foreign. That is not the mechanism. Google, Meta and X are within the threshold despite being foreign-headquartered.

The line in the statute is public versus private. The obligation attaches to material publicly disclosed and circulated through a service. Private messages and closed channels sit outside it by design.

Which produces the uncomfortable summary: the case that prompted this law was conducted in private, paid Telegram rooms. The regime it produced applies to publicly posted images on open forums. There is also a second, separate problem — that foreign operators are simply hard to compel regardless of what the statute says — and it is worth keeping the two apart, because one is a drafting decision and the other is a limit of jurisdiction.

What it costs to comply

The only detailed cost breakdown in public comes from Ruliweb, and we should label it accordingly: it is one mid-sized operator's own estimate, relayed through reporting, not an industry survey.

On that estimate, running the required detection costs somewhere around ₩78–122 million a year — servers, an engineer's salary, bandwidth — with one-time hardware quoted anywhere from ₩18 million for a minimum build to about ₩130 million from a major vendor, against a government specification calling for sixteen-plus CPU cores, 128GB of memory and two high-end GPUs.

For Naver this is a rounding error. For a forum run by a handful of people it is a salary, and it is the reason the phrase that keeps recurring in operator posts is not about censorship at all. It is about whether a mid-sized Korean community can afford to keep existing.

What it says

Korea has a recent, specific and entirely understandable reason to want this. The n번방 case was a national trauma, the state's earlier record on digital sex crime was poor, and the demand that platforms stop being neutral pipes for it was not unreasonable.

What was built in response is a pre-publication filter running on a large fraction of the country's public internet, and it has arrived at a place where its purpose is unarguable and its performance is unknowable. The people best placed to evaluate it are the operators, and the law has removed their ability to do so. The regulator has not published figures. The only numbers in circulation were volunteered by someone who is careful to say he cannot verify them.

This is the same instinct we described in Korea's long love affair with ActiveX and mandatory certificates — a real problem, a mandated technical fix applied to everyone at once, and a decade of living with the fix. The difference is that when the certificate regime failed, everybody could see it failing. Here, nobody can see anything, and that is written into the design.

The filter has been running since July. It will keep running. In December the fines start.

For the other Korean technology story where the state's answer arrived as a mandate, see ActiveX and the certificate system, explained. For a Korean app built by one person that did the opposite — solved a problem by publishing open data rather than restricting it — see the student who mapped Seoul's shade.

Images. All three are charts we built ourselves — the funnel from 1,615 logged blocks down to the roughly 33 that survive de-duplication and the zero that can be verified; the timeline from the 2020 statute to this year's extension from video to images; and the two thresholds that decide who is covered. There are no photographs, and there is no screenshot of the filter in operation. That is deliberate: the only images anyone can show you of this system working are images it flagged, and those are precisely the files nobody is permitted to keep.

Reported from primary Korean sources: the statute and enforcement decree as published on 법제처's 국가법령정보센터, and two posts by Ruliweb's co-chief executive 진인환 dated 19 June and 15 July 2026, which we read directly rather than through secondary coverage. Supplemented by Korean reporting on the rollout, including SBS's 20 June piece on the threshold and the platforms in scope.

Deliberately excluded, and why. We have not described, linked to or characterised any of the underlying illegal material, and we have not adjudicated whether the law should exist — this piece is about whether the mechanism functions, and it takes the law's purpose as legitimate. We do not use the Cloudflare figure that appears in several write-ups of this story: it is 1.5 million URLs rather than 150 million, and it belongs to an entirely separate site-blocking regime, not to this filter. The Arca.live false positives, including the Overwatch clip, are sourced only to forum and wiki accounts and are labelled as such in the text; we found no press coverage of them. The "98% accuracy" claim is presented as one operator's hedged recollection of a verbal briefing because that is the only form in which it exists. The compliance-cost range is a single operator's estimate, not an industry figure. We could not find a published schedule of fines for non-compliance, so we do not state one, and we could not obtain the full official schedule of covered service types, so the list of named platforms is drawn from reporting rather than from the decree's own annex. Where a source called the regulator 방송통신위원회, we have corrected it to 방송미디어통신위원회, which has been its name since 1 October 2025.