Recently, Sina Weibo launched a new function that can publicly display the user's IP territory, and the country can be accurate to the province/region. Some netizens questioned the suspected invasion of user privacy, as of 16:00 on March 26, the number of reads of the topic of "recommending cancellation of Weibo IP address" has exceeded 20.8 million.
The ip address of the user. Image source @ Weibo administrator.
Nandu reporter noted that "showing the user's IP territory" has been reflected in the departmental regulations of the State Internet Information Office (still in the stage of soliciting opinions). It is required that the Internet user account service platform shall display the information on the territory of the account IP address on the Internet user account information page in a conspicuous manner, and domestic users should be marked to the province (district, city).
Some experts have analyzed that the function of Weibo's launch may be related to the above provisions of the Cyberspace Administration of China. As for whether disclosing the territory of IP infringes on privacy, he said that this practice is not a violation of privacy, but only involves the scope of personal information. At the same time, he believes that in the process of disclosing user information, Weibo should inform users when to disclose IP addresses, to what extent they are disclosed, and what remedies can be taken when problems arise after disclosure.
1
Weibo profile page added "IP territory"
Recently, Weibo users' "personal information page - personal information" column added "IP territory" information, showing Beijing, Shanghai, XX provinces and other content, and indicating that "IP territory is subject to operator information, if there is any problem, you can consult customer service".
Nandu reporter learned that Weibo issued an announcement on publicly displaying the territory of user IP as early as a week ago. The announcement mentioned that this function is to ensure the authenticity of relevant information in hot events.
On March 17, Weibo Community Management Official Weibo @ Weibo Administrator posted that recently, hot events have occurred frequently, causing netizens to pay close attention to the discussion. While strengthening the investigation and disposal of illegal information, the site found that there are still individual impersonating local netizens to publish and disseminate false information, in order to better maintain the order of communication, the site will launch the "user profile page to show the location of recent posts" function in the coming week on the basis of the previous function.
Specifically, the above feature will show the IP attribution of the last time a user posted a blog post or comment in the "Profile - Profile" in the "Profile". The IP attribution display rules are: domestic display to province/region, foreign display to country. "This feature is only open for some users during the testing phase, and the active on/off function is not currently open."
At about 17:00 on March 22, the Weibo administrator posted that in order to ensure the authenticity and transparency of the information in the China Eastern Airlines incident, from March 21, the platform opened the relevant function of displaying the home of the Weibo IP of some Weibo content involving the China Eastern Airlines incident.
At about 19:00 on the 22nd, Weibo posted again, "Domestic: Today will test the IP attribution of some users to display, after the test is normal, it will gradually open relevant functions to other users; foreign: The platform currently supports 15 overseas countries to display THE IP attribution as 'country name', and the unsupported countries are temporarily displayed as 'overseas'. It will continue to add 24 countries today and gradually expand in the future. ”
Image source @ Weibo administrator
After the launch of this feature, netizens have aroused heated discussion - as of 16:00 on March 26, the cumulative number of reads of the topic of "recommending cancellation of Weibo IP address" has exceeded 20.8 million.
Proponents argue that the move is "necessary". Opponents argue that Weibo's launch of this feature violates users' privacy rights, and users cannot choose whether to disclose their IP addresses. In addition, many netizens reported that some of the IP territories of big V were not disclosed, while their own IP territories were made public, so they questioned Sina Weibo's classification of people. However, according to Weibo's latest announcement, the feature is not yet available to all users.
On the afternoon of March 25, nandu reporters opened the Sina Weibo test and found that if they viewed their own information page, they could not see the IP territory and could not change it. However, if you use someone else's account to view your Weibo profile, you can see the IP territory. At the same time, after closing the Sina Weibo access location permission, the IP territory is still displayed.
(Left) Use someone else's account to view your Weibo profile page. (Right) If you look at your own profile page, you will not see the IP territory.
Why can Weibo still obtain IP territory after the user closes the location permission?
"Regardless of whether the user turns off the location permission, including Weibo software providers can know the user's IP address, IP address is like 'home address', if you don't know the IP address, equivalent to not knowing the house number at home, they can't send data to our computers, and they can't provide network services." Peng Gen, general manager of Beijing Hanhua Feitian Xinan Technology Co., Ltd., said.
He further explained that all Internet access devices are assigned an IP address, and each IP address has a home, that is, an IP territory. The platform knows the user's IP address, and through the IP address, it must be able to query the IP territory. Therefore, even if the user turns off the location permission, Weibo can still obtain the user's IP territory.
In addition, nandu reporters found that there is a method of using "proxy" technology to hide the real IP address circulating on the Internet. Peng Gen reminded that although this form can change the user's IP territory, there is a great information security risk. "This is equivalent to the user's information passing through a 'transit station', from the websites the user has visited to the chat history, it is possible to be obtained by the 'transit station'."
2
The Cyberspace Administration of China (CAC) proposes to stipulate that the platform displays the IP territory of the account
Nandu reporters combed and found that "showing the user's IP territory" has been reflected in the departmental regulations that the State Internet Information Office has solicited opinions. On October 26 last year, the Cyberspace Administration of China (CAC) issued the Provisions on the Administration of Internet User Account Name Information (Draft for Solicitation of Comments) (hereinafter referred to as the Draft for Comment), revising the version implemented in 2015.
Screenshot of the official website of the Cyberspace Administration of China.
It is worth noting that the 2015 version first proposed the "network real-name system", that is, requiring Internet information service providers to register accounts after passing real identity information authentication in accordance with the principle of "background real name and front desk voluntariness".
Compared with the 2015 version, the Draft for Comments in October last year added relevant provisions on IP territoriality: "The Internet user account service platform shall display the information on the ip address territory of the account on the Internet user account information page in a conspicuous manner." The territorial information of the IP address of the domestic Internet user account should be marked to the province (autonomous region, city), and the territorial information of the IP address of the overseas account should be marked to the country (region). ”
Under the premise that the Current Draft for Comments has not yet been formally implemented, is this function of Weibo online related to it? On the morning of March 26, Nandu reporters contacted Sina Weibo. As of press time, no response has been received.
According to The Director of the Digital Economy and Legal Innovation Research Center of the University of International Business and Economics, if the Draft for Comments has come into effect, Weibo may be in order to "fulfill its statutory obligations" in order to fulfill the provisions of the Cyberspace Administration of China without seeking the consent of users, but at present, the Draft for Comments has not yet taken effect, "It is difficult to say that Weibo discloses IP addresses on the main grounds of fulfilling statutory obligations, but it does not rule out the possibility that the regulatory authorities have issued clear instructions, which is still unclear." ”
Zuo Xiaodong, a professor at the School of Public Affairs of the University of Science and Technology of China, believes that "Weibo is most likely to prepare for the implementation of the Draft for Comments." However, this document has not been formally implemented after all, and the final situation needs to be observed. He mentioned that in the process of fulfilling individual consent, the Personal Information Protection Law gives individuals the right to choose, "but in principle, for the sake of the public interest, it is possible to make an exception to consent, that is, to process personal information without the consent of users, and there is no choice." ”
Specifically, according to the Personal Information Protection Law, the consent of the individual shall be obtained for the processing of personal information, but it is not necessary to obtain the consent of the individual in order to perform the statutory duties or legal obligations, and otherwise provided by laws and regulations.
"If there is no document stipulating, it is true that users should be given the right to choose whether to disclose the ip territory on their own. However, if laws and regulations provide otherwise, follow those provisions. If the Draft for Comments comes into effect, and the disclosure of IP ownership is mandatory, the user does not have the right to choose. Zuo Xiaodong said.
3
Is it necessary for the IP territory to be precise to the province?
In response to the core question questioned by netizens - whether the disclosure of IP territory violates privacy, we must first clarify whether the IP territory belongs to personal information or privacy.
It is worth noting that the national standard "Information Security Technology Personal Information Security Specifications" identifies IP addresses as personal information, but the laws and regulations with higher legal effect do not have a direct definition. IP territories cover a wider geographical range than IP addresses.
"The question of whether an IP address is personal information was initially controversial because IP addresses can be faked and that string of numbers doesn't necessarily have a clear meaning. Ordinary people see IP address information and may not matter. However, in the case of telecom operators, because of their technical conditions, the IP address is not fundamentally different from the physical location of the individual, which is of course very sensitive personal information. Zuo Xiaodong said.
He believes that IP addresses are sensitive personal information and certainly cannot be directly disclosed, but in this case, Weibo discloses THE IP territory, not as detailed as the IP address, "Under the premise of affirming its public interests and risk control orientation, this treatment is also appropriate, and the "Draft for Comments" does provide for the provincial level." ”
The Personal Information Protection Law stipulates that the handling of personal information shall have a clear and reasonable purpose, and shall be directly related to the purpose of processing, and shall be adopted in a manner that has the least impact on the rights and interests of individuals.
In the view of licensing, whether or not the IP territory is disclosed in order to fulfill the statutory obligation, there is no need to go into detail at the provincial level, and it is enough to show that it is enough to achieve the goal of public supervision at home or abroad, "which has exceeded the scope of our necessary treatment." ”
"It makes sense that the publisher is located at home and abroad, and there is no legal difference as to whether you are in Beijing or Shanghai." He pointed out that due to the implementation of the online real-name system on the mainland, every netizen may be accurately traced back – which also means that if something goes wrong, measures can be taken through post-event administrative regulatory measures, without the need to disclose the geographical location in advance.
However, Zuo Xiaodong believes that the publication of IP territory actually needs to consider whether it is for the benefit of other entities other than the user itself and what kind of interests it is.
"Even if it is reasonable to publish the territory of the IP, is it protecting the user's personal information to the greatest extent?" At the end of the day, it's a matter of balance, not black and white. Judging from the Weibo matter, the publication of IP territory has reasonable needs such as fraud prevention (such as foreign criminals pretending to contact public prosecutorial and legal organs to contact users), and it is convenient for users to identify false information (such as domestic users disguising themselves as people outside the country to make remarks), which can be said to have considerations of public interest and risk control considerations of enterprises, which is reasonable. Of course, even if it is reasonable, the consent of the user must be obtained, unless it is a statutory obligation. ”
As for whether Weibo's practice of disclosing the territory of user IP violates user privacy, Permission believes that this practice does not infringe on privacy and only involves the scope of personal information. At the same time, if the user's IP address is disclosed in order to fulfill a legal obligation, it must be subject to corresponding restrictions.
He also pointed out that in the process of disclosing user information, Weibo should establish a complete and systematic notification procedure and relief procedures, including informing users when to disclose the IP territory, to what extent, and what remedies can be taken when problems arise after disclosure.
Written by: Nandu reporter Sun Chao Fan Wenyang Intern Ji Hanya