問30
頻出度★★★
不正アクセス禁止法が禁じている行為はどれか。
平成22年度 春期 ITパスポート試験 問30
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 30
Incorrectア
Publishing images that violate public order and morals on a blog is a problem of inappropriate content; it is not an act of breaking through access control with someone else's ID and password. It therefore falls outside the Unauthorized Access Prohibition Act, and is instead dealt with under the Criminal Code as public display of obscene material, or as a violation of the terms of use of the provider or the service. Note that the law that applies changes depending on whether the problem is inappropriate content or impersonating someone to break in.
Incorrectイ
Sending a large volume of e-mail so that a mail server fails (a mail bomb, a kind of DoS attack) is an act that obstructs a service, not an act of breaking an access control function and getting inside, so it is not the unauthorized access that this Act directly prohibits. Obstruction of this kind is punished under the Criminal Code, for example as obstruction of business by damaging a computer, or as obstruction of business by fraudulent means. The key point is to distinguish an attack that harms availability from intrusion by impersonation.
Incorrectウ
Using another person's copyrighted work on your own homepage without indicating the source infringes the reproduction right or the right of public transmission, or is a use that fails the requirements for quotation (such as showing the source), and it is regulated by the Copyright Act. Here the login itself is not illegal; what is at issue is how a work you are entitled to view is used, so the Unauthorized Access Prohibition Act does not apply. The IT Passport exam often tests whether you can keep the scope of the Copyright Act and that of the Unauthorized Access Prohibition Act apart.
- エ
正解 The correct answer is (エ) Logging in over a network to a password-protected server using another person's ID and password. The Unauthorized Access Prohibition Act (formally the Act on Prohibition of Unauthorized Computer Access) prohibits entering another person's identification code (ID and password) without permission, over a network, into a computer that has an access control function (a mechanism that checks users by ID, password, etc. and restricts use), thereby making usable the functions you are not supposed to be able to use - in other words, unauthorized access by impersonation. Choice エ meets all three requirements: (1) the server is password-protected, so an access control function exists; (2) the act is carried out over a network; and (3) another person's ID and password are used. It is exactly the typical case this law forbids. Keep in mind as well that even if you merely look at the data inside and break nothing, the violation is established the moment you log in.
ここがポイント
- The unauthorized access prohibited by the Unauthorized Access Prohibition Act (the Act on Prohibition of Unauthorized Computer Access) means entering another person's identification code (ID and password) without permission, over a network (a telecommunications line), into a computer that has an access control function - that is, impersonation - or exploiting a security hole to make restricted functions usable. Acts that facilitate such access are also prohibited: illegally obtaining or keeping another person's ID and password, or providing them to a third party without permission. Note as well that operating a standalone computer directly on the spot does not meet the over-a-network requirement.
- In questions on IT-related laws, the key skill is telling which law governs a given act. Logging in by impersonation and illegally obtaining IDs and passwords fall under the Unauthorized Access Prohibition Act; using another person's copyrighted work without permission falls under the Copyright Act; obstructing a server or destroying data falls under the Criminal Code (for example obstruction of business by damaging a computer); and publishing obscene information also falls under the Criminal Code. Organizing typical cases against the matching law is a good way to remember them.
用語