問24
頻出度★★★
不正アクセス禁止法において違法となる行為はどれか。
平成21年度 春期 ITパスポート試験 問24
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 24
Incorrectア
Failing to display the business operator's name and other required information in an internet mail-order advertisement is a violation of the Act on Specified Commercial Transactions (the duty to display information in mail-order advertising). It breaks a labeling rule meant to protect consumers, and it has nothing to do with breaking into a computer using someone else's ID, so it is not covered by the Unauthorized Access Prohibition Act.
Incorrectイ
Copying and selling music CDs without permission infringes copyright (the right of reproduction and the right of transfer), so it violates the Copyright Act. What is protected there is the copyrighted work itself, not an access control function or identification codes, so this is a matter for the Copyright Act rather than the Unauthorized Access Prohibition Act.
Incorrectウ
Selling a directory containing personal information to a list dealer without the consent of the people concerned is a violation of the Personal Information Protection Act (the restriction on providing data to third parties). That law regulates how personal data is handled, not illegal logins over a network, so the Unauthorized Access Prohibition Act does not apply here.
- エ
正解 The correct answer is エ. The Unauthorized Access Prohibition Act (Act on Prohibition of Unauthorized Computer Access) mainly targets the act of entering another person's identification code (such as an ID and password) without permission over a network, getting around the access control function, and thereby making a computer or service usable when you have no right to use it. In エ, another person's ID is used without permission to log in to an internet auction site, and then items are listed and bids are placed — operations that only the owner of that ID should be able to perform. This is exactly an act of unauthorized access, so it is illegal. The key point is that the offense is established at the moment of logging in with the stolen ID; whether financial damage occurred afterwards is not a requirement.
ここがポイント
- The acts prohibited by the Unauthorized Access Prohibition Act are: (1) entering another person's identification code (ID and password) without permission and breaking through an access control function over a network; (2) attacks that exploit security holes; and (3) facilitating acts such as illegally obtaining, storing, or providing another person's identification code. It becomes illegal at the moment the login succeeds, regardless of whether any actual damage occurred.
- For IT-related laws, memorize them by sorting out which law covers which area: violating an advertising display duty = Act on Specified Commercial Transactions; copying and selling a copyrighted work without permission = Copyright Act; providing personal data to a third party without permission = Personal Information Protection Act; logging in with another person's ID without permission = Unauthorized Access Prohibition Act.
用語