問11
頻出度★★★
インターネットなどのネットワークを介してコンピュータを利用する場合において，不正アクセス禁止法で禁止されている行為はどれか。
平成21年度 秋期 ITパスポート試験 問11
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 11
- ア
正解 The Unauthorized Access Prohibition Act bans not only accessing a system yourself, but also giving another person's identification code (ID and password) to a third party, except for business purposes or other legitimate reasons; such an act is prohibited as an act that facilitates unauthorized access. Choice ア tells a third party another person's ID and password without that person's permission, which is exactly the provision of an identification code without a legitimate reason, so it falls under this ban on facilitating acts. Therefore ア is the correct answer. The phrase about the third party knowing how to use them is only a supplementary detail showing that the provided identification code could be used for unauthorized access right away; the core of the ban is the act of providing the identification code without a legitimate reason itself.
Incorrectイ
Obtaining an ID and password by peeking at how someone operates their PC is close to the acquisition of an identification code under the Unauthorized Access Prohibition Act, but the provision punishing acquisition requires the purpose of using it for an unauthorized access act, and this choice does not state such a purpose. In addition, the rules banning acquisition and storage were added by the 2012 amendment, so they did not exist in 2009 when this question was set. Hence this is not the choice to pick as a prohibited act here.
Incorrectウ
An e-mail address is not an identification code (such as an ID or password) used by an access control function to identify a user. So telling it to a third party without the person's consent does not amount to a facilitating act under the Unauthorized Access Prohibition Act. It may raise issues under personal information protection law or of etiquette, but it is not a prohibited act under the law this question asks about.
Incorrectエ
This choice is also about obtaining an e-mail address, not an identification code, so it is outside the scope of the Unauthorized Access Prohibition Act. That law regulates unauthorized use of computers that have an access control function and the handling of identification codes that leads to it; merely obtaining an e-mail address is not covered.
ここがポイント
- The Unauthorized Access Prohibition Act bans three main groups of acts: (1) unauthorized access, such as entering another person's identification code (ID and password) without permission; (2) facilitating acts, that is giving another person's identification code to a third party without a legitimate reason; and (3) illegally acquiring or storing identification codes, or improperly requesting their input (phishing), for the purpose of unauthorized access.
- What the law protects is the identification code (ID, password, and the like) and the access control function; a mere contact detail such as an e-mail address is not covered. The first point in sorting the choices is whether the choice deals with an identification code.
用語