사물인터넷 환경 발전에 따른 규제 쟁점과 대응방안 연구 = The Development of IoT Systems: Regulatory Issues and Directions

다국어 초록 (Multilingual Abstract)

The Internet of Things (IoT)―which can generally be defined as a dynamic network comprised of numerous kinds of devices that can connect, interact and exchange information and data―is rapidly becoming employed in an array of fields. IoT enables independent objects to exchange information and data with other objects, humans and systems in real time. IoT is therefore promoting the realization of a hyper-connected society in which objects, humans, things, and the offline and online worlds are all connected via digital technologies.
Currently, together with the development of sensor technologies (technologies that collect data from the human body, location and the environment via sensors), networking technologies (technologies that exchange data on the network through communication chips) and interface technologies (software technologies that collect, process, and interpret data, and deliver it to connected devices), the utilization of and demands on IoT are steadily increasing. For instance, IoT has been used in home appliances (smart homes, remote metering), public safety (CCTV security systems, disaster management), healthcare (digital medical devices, telemedicine) and various industries (smart factories, smart buildings), and has added value to products and services.
IoT can improve customers’ ability to use products and services, thereby increasing satisfaction and convenience. By using IoT, businesses can also reduce costs, as IoT can help to optimize business activities such as inventory management, product tracking, equipment maintenance and repair, and energy management. The utility and value added by IoT are believed to be further increased by combining data and information generated and collected through IoT systems, with technologies such as big data and artificial intelligence.
However, increased adoption of IoT by customers and businesses is also raising concerns, both about accidents due to the malfunction of IoT-enabled devices and about privacy in case of the leakage of personal information or security breaches. Accidents can cause serious damage not only in cyberspace but also in real life. For example, if a hacker is able to break into an IoT-enabled vehicle, he/she could arbitrarily control the vehicle and harm the driver and passengers. Furthermore, drivers and passengers using vehicles with the same IoT system might potentially be exposed to the same danger. Similarly, malfunctions caused by device failures, such as the malfunction of an IoT-enabled drug injector, can cause serious problems that might be life-threatening for patients. Therefore, proper security and safety measures are essential to fully enjoy the benefits of IoT, and it is crucial to realize that policymakers need to consider not simply the cyber dimension of IoT, but also the cyber-physical dimension in broad and complex ways when dealing with IoT-related issues.
With the proliferating use of IoT and the growth of related industries, many countries have made efforts to develop policies and strategies to lead the global IoT market. In Korea, the government has adopted a two-track strategy. The first track focuses on eliminating legal and institutional obstacles that impede the promotion of IoT. The second track is an effort to implement security regulation that promotes a safe and secure IoT environment. The Korean government's IoT policy mixes aspects of deregulation for the promotion of IoT-related industries and strengthens regulations to minimize the potential risks of IoT. The two-sided nature of IoT regulatory policy is inevitable because the government needs to consider both the industrial development potential of IoT and the various uncertainties and risks inherent to IoT. The problem is not the two-track strategy, but the determination of an appropriate balance between deregulation in order to activate IoT-related industries and regulation to minimize safety and security risks. We cannot afford to risk people’s lives and privacy to encourage IoT-related industries, and we cannot institute regulations that prevent every possible risk.
Hence, the question is how we can determine an appropriate level of regulation for IoT. This study aims at providing some answers to this question. The main objective of the study is to suggest regulatory alternatives for IoT development that balance minimization of IoT-related risks with promotion of IoT implementation. For this purpose, we conduct a risk assessment of the risks related to an IoT-enabled vehicle (i.e., smart car) and investigate whether the intensity of current regulations is appropriate with relation to the corresponding risks.
More specifically, this study first develops various scenarios of anticipated threat events during use of an IoT-enabled vehicle before evaluating the probability and impact of each threat event. From the evaluation, this study determines a risk level for each threat event and compares this level with the intensity of the corresponding regulation. The study then suggests a regulatory response strategy for each threat event. More particularly, if the intensity of the current regulation is too weak to appropriately deal with the high risk caused by a specific threat event, the study proposes strengthening the regulation’s intensity or establishing a new, stronger regulation. In contrast, if the intensity of a current regulation is strong and the related threat has a low risk, this study suggests reducing the intensity level of the current regulation by abolishing or relaxing it.
The authors believe that the introduction of a regulatory response system based on risk assessment can contribute to the development of optimal regulatory strategies that balance the minimization of IoT-related risks and promotion of IoT development. We also believe that this study can be applied when policymakers create strategies for the development of a new technology and industry that must take both growth and risk reduction into account.