<report>
IS4234
Research Report - Messaging Applications Industry

 
Group 14
 
Name 
Student ID 



























1. Introduction	2
2. Motivation	2
3. Current state of the art	3
3.1 Current governance methods	3
3.2 Current regulation condition	4
3.3 Current RegTech used	6
4. Current challenges and issues in this area (System Reliability)	7
5. Current challenges and issues in this area (Privacy)	7
6. Potential solutions	7
7. Future trend	7





































Introduction
Motivation




























Current state of the art
3.1 Current governance methods
Compliance with International Standards and Frameworks
ISO/IEC 27001: Information Security Management: Many instant messaging companies follow the ISO/IEC 27001 standard, which outlines the requirements for an information security management system (ISMS). This framework is designed to help organizations manage the security of assets such as financial information, intellectual property, employee details, and third-party information. Messaging platforms implementing this standard focus on risk management practices, ensuring that information remains secure from unauthorized access or breaches.
ISO/IEC 27018: Cloud Privacy Protection: For platforms that rely on cloud infrastructure, ISO/IEC 27018 specifically addresses the protection of personal data in the cloud. This standard is particularly relevant for instant messaging services that store user data in the cloud, as it provides guidelines for managing privacy risks and securing sensitive personal information.
General Data Protection Regulation (GDPR) Compliance: Although not an "ISO" framework, the GDPR (General Data Protection Regulation) has become the global standard for data privacy and protection, particularly in Europe. Companies such as WhatsApp, iMessage, and Telegram align with GDPR’s provisions, ensuring users' rights to data access, correction, and deletion, as well as implementing technical measures like encryption to protect user data.
Internal Governance Structures
Data Protection Officer (DPO) A critical element of governance for instant messaging platforms is the appointment of a Data Protection Officer (DPO). The DPO ensures that the company complies with relevant privacy laws, monitors data handling practices, and acts as a liaison between the company and regulatory bodies. This role is mandated under GDPR and other regional data protection laws.
Risk Management Frameworks Instant messaging companies often implement comprehensive risk management frameworks, which include:
Risk Assessment and Audits: Regular audits and assessments help identify potential vulnerabilities and mitigate risks associated with data breaches and security threats.
Incident Response Plans: To address potential data breaches or security incidents, instant messaging companies prepare predefined response protocols to limit damage, investigate breaches, and notify regulators and users when required.
Security and Privacy Standards
End-to-End Encryption (E2EE) Security remains a top priority for instant messaging platforms. Leading companies such as WhatsApp, Telegram, and Signal adopt End-to-End Encryption (E2EE), which ensures that only the sender and the intended recipient can access the content of a message. This standard aligns with ISO/IEC 27001's objectives, preventing unauthorized access and ensuring privacy.
Regular Security Audits and Penetration Testing These platforms conduct penetration testing and regular security audits to identify vulnerabilities within their systems. They may also work with external security firms to conduct independent assessments of their platforms' security posture.
Transparency and Reporting
Transparency Reports Companies like WhatsApp and Telegram provide transparency reports that detail government data requests, user data handling practices, and compliance with local laws. These reports enhance trust and allow users to understand how their data is managed and when it may be shared with authorities.
Internal Privacy Policies and Ethical Guidelines Internal governance is also shaped by clear privacy policies and ethical guidelines. These policies govern how user data is collected, stored, and shared, ensuring that platforms are transparent about their practices and compliant with regulatory standards.
3.2 Current regulation condition 
Global Regulation Approach
As the digital ecosystem grows, there is a notable diversity in the regulatory approaches adopted by different regions. Key players include the European Union (EU), the United States, the United Kingdom, and China, each introducing their own set of rules to govern platforms, including instant messaging services.
European Union: The EU has taken a proactive stance with its Digital Services Act (DSA) and Digital Markets Act (DMA), which impose stringent requirements on online platforms. These include measures to ensure the safety of minors, protect users from illegal content, and promote transparency in content moderation. Messaging platforms are required to implement risk assessments, provide content moderation tools, and take swift action against harmful content.
United Kingdom: The UK’s Online Safety Bill (2024) sets a new global standard for regulating online platforms, including instant messaging services. The Bill imposes a duty of care on platforms to protect users from harmful content, such as child sexual abuse material and terrorism. For platforms like instant messaging apps, the legislation mandates age verification mechanisms and requires companies to address risks associated with private communications.
United States: In the U.S., there is currently no single federal law regulating instant messaging platforms. However, regulations like the Communications Decency Act Section 230 provide platforms with immunity from liability for user-generated content. The regulatory landscape is dynamic, with ongoing discussions about updating Section 230 to better address issues related to online harm.
China: China has implemented stringent regulations through laws like the Cybersecurity Law and Personal Information Protection Law, which place heavy obligations on tech companies to control content, ensure data protection, and maintain national security. The government mandates extensive monitoring and content filtering by instant messaging platforms operating in the country.
Key Regulatory Measures
Several core principles are emerging as common threads across global regulations for instant messaging platforms:
Content Moderation and Safety: Platforms are required to address illegal content proactively, including child exploitation materials, hate speech, and terrorist propaganda. The regulations often mandate robust systems for detecting and removing such content, alongside creating mechanisms for users to report harmful activities.
Data Protection and Privacy: With growing concerns over data breaches and privacy violations, countries are enhancing regulations around user data. The General Data Protection Regulation (GDPR) in the EU, for example, imposes strict guidelines on how personal data is collected, processed, and stored. Instant messaging platforms are required to obtain explicit consent from users for data processing and to provide clear mechanisms for data access and deletion.
Age Verification and Protection of Minors: Many jurisdictions, including the EU and the UK, are enforcing measures to protect minors from accessing inappropriate content. Age verification systems are being implemented to ensure that children cannot access platforms unsuitable for their age.
Transparency and Accountability: Platforms, particularly those with large user bases, are required to disclose their content moderation practices and report on their efforts to combat harmful content. Transparency reports are becoming a key requirement for compliance, helping to hold companies accountable for their actions.
Enforcement and Penalties
Enforcement of these regulations is a critical aspect of ensuring compliance. In several regions, regulators have been empowered to impose heavy fines and penalties on non-compliant platforms:
United Kingdom: Ofcom, the UK’s communications regulator, can fine platforms up to £18 million or 10% of their annual global turnover for failing to meet regulatory requirements. This includes non-compliance with content moderation standards and failure to protect users from harm.
European Union: The EU’s Digital Services Act imposes similar penalties for non-compliance, with platforms facing significant fines for failure to act on illegal content or provide adequate user safety protections.
China: In China, tech companies face severe penalties, including service suspensions or shutdowns, for failing to comply with content regulation and cybersecurity laws.

3.3 Current RegTech used 
Trends in RegTech for Instant Messaging Platforms
Real-Time Identity Verification: One of the primary advancements in RegTech for instant messaging platforms is real-time identity verification. Solutions like Trulioo provide a digital identity platform capable of verifying both individuals and businesses globally. This platform offers instant verification capabilities that improve processing speed and ensure compliance with identity verification regulations. According to Trulioo's latest update, their instant results capability has reduced the average onboarding time by 56% while maintaining verification accuracy. This speed and accuracy are crucial for instant messaging apps that process numerous transactions and interactions.
AI-Driven Compliance Monitoring: RegTech platforms have also harnessed artificial intelligence (AI) and machine learning (ML) to automate regulatory compliance processes. These technologies are particularly beneficial in instant messaging applications, which often require constant monitoring of user data and communication activities. For example, AI can help platforms automatically interpret financial regulations and detect anomalies in real-time, reducing human error and ensuring compliance with laws such as GDPR and CCPA. By continuously analyzing large datasets, AI can detect and flag potential non-compliance issues before they escalate.
KYC Automation via Bots: Know-Your-Customer (KYC) compliance is essential for platforms that engage in financial transactions. KYC bots, like those developed by AskLulo, have been integrated into instant messaging platforms to automate the client identification process. These bots guide users through KYC procedures directly within messaging apps, improving the efficiency of compliance and reducing user friction. The automation of KYC processes not only enhances the user experience but also ensures that businesses comply with anti-money laundering (AML) regulations.
Cloud-Based Compliance Tools: Cloud-powered RegTech solutions are another significant trend, especially for financial institutions using messaging apps for customer communication. ComplyFirst, for example, offers a cloud-based platform that automates regulatory reporting, streamlining the process from data collection to submission. The platform integrates legal workflows to ensure compliance with financial regulations, such as those set by the Financial Conduct Authority (FCA) in the UK. The cloud-based approach allows for better data management, cross-party collaboration, and real-time compliance monitoring, all of which are essential for global messaging platforms.








Current challenges and issues in this area (System Reliability)
Real Business Case Study(System Reliability)
5.1 Overview
Kakao, one of South Korea's leading IT companies, offers a wide range of services in various fields such as messaging, mobility, gaming, and payments, having a close impact on the lives of Korean citizens. On October 15, 2022, a fire broke out at the data center where Kakao's main software was operating, resulting in widespread disruptions to the digital services provided by Kakao. It took 127 hours and 33 minutes for Kakao's digital services to be fully restored, during which time Korean citizens faced significant inconveniences. Although the services were eventually restored, this incident highlighted the importance of digital service reliability in South Korea and served as a catalyst for the government to create new laws and regulations.
5.2 Cause of the Incident
Fire Incident: On October 15, 2022, a fire broke out in the battery room of the SK C&C Pangyo Data Center, where Kakao's main software was operating. During the firefighting process, the power to the entire building was cut off, and the operations of the data center were completely suspended.
The battery monitoring system, which automatically alerts administrators when the battery temperature rises, was not functioning properly. The Uninterruptible Power Supply (UPS) was not physically isolated, resulting in a complete power shutdown to all servers when the data center lost power.
There was a lack of specialized fire prevention manuals for the recently installed lithium-ion batteries. The structural integrity of the data center was insufficient, making it difficult to quickly identify the power cutoff switches in specific areas, and the UPS system was unable to function properly.
Additionally, there was a lack of specific action plans and training to effectively respond to a fire incident in the data center.
Redundancy System Failure: Kakao operated redundant servers in multiple regions to prepare for the potential failure of specific data centers. However, during the incident, the active-standby system between the Pangyo data center (active) and the other centers (standby) was not functioning properly.
 When the active server encountered issues, the tools necessary to activate the standby servers were not replicated across all data centers, leading to a significant delay in service recovery.
There was a lack of comprehensive recovery plans, training, and preventive education for scenarios where an entire data center in a specific region fails. Concentrating most of Kakao's core services in a single data center indicates a vulnerability in risk prevention.

5.3 Impact of  Incident
(Users) The messaging service KakaoTalk experienced disruptions, preventing 47.6 million users from accessing the messaging service. The mobility service Kakao T faced outages, leading to a suspension of ride-hailing services, which impacted 12.5 million users. The payment service Kakao Pay also experienced disruptions, halting mobile payments and transfers, affecting 23 million users.
(Company) The service disruption had an immediate impact on Kakao's stock price, resulting in a loss of 49.7 billion KRW for the quarter due to service outages and subsequent compensation. Customer loyalty declined as users switched to competitor services during the disruption. The CEO of Kakao publicly apologized for the lack of prevention and response measures and resigned.
Kakao's quarterly earnings



 (Society) Concerns have spread that disruptions in digital services, which play an essential role in daily life, can significantly impact society as a whole. As a result, discussions have begun regarding the establishment of governance and the introduction of reasonable regulations to ensure the stability of services provided by major digital companies
5.4 Changes Resulting from the Incident
Corporate Governance
A dedicated organization will be established to prevent and respond to incidents and disaster situations, and regular training will be conducted to prepare for worst-case scenarios. Recovery priorities and goals will be set for the company's key services and functions in preparation for incidents, along with a detailed response plan that includes failure detection, propagation, and recovery. Additionally, principles and criteria for user compensation in the event of service disruptions will be established.
Regulation
Following the incident, the government announced a plan to strengthen the stability of digital services, which includes enhancing the survivability of data centers, improving the resilience of digital services, and establishing a foundation for digital crisis management. Along with this, legal amendments were also initiated.
First, a legal amendment was made to mandate disaster management for major digital service providers. Previously, the disaster management obligations applied only to network infrastructure operators, but this has now been extended to include major digital service providers.
Existing Framework Act on Telecommunications Development
Amended Framework Act on Telecommunications Development
(Target) Major network infrastructure operators
 (Content) Prevention and response to network failures / Safety management of critical communication facilities / Operation of dedicated disaster response organizations / Conduct of simulation training
(Target) Expanded from existing major network infrastructure operators to include major digital service providers and major data center operators
 (Content) Similar to the existing provisions

Next, a legal amendment was made to require major digital service providers to regularly submit reports to the government on the status and plans for service stability measures.
Existing Telecommunications Business Act
Amended Telecommunications Business Act
(Target) Major digital service providers
 (Content) Must take necessary measures to provide stable digital services.
(Target) Major digital service providers
 (Content) Must take necessary measures to provide stable digital services / Report the status and plans for ensuring service stability to the government annually.

 






Current challenges and issues in this area (Privacy)
Potential solutions
Future trend
</report>

Given the above incomplete report, using your expertise on governance and other related fields, fill in a section on the potential solutions.