問27
頻出度★★★
不正アクセス禁止法に関する記述のうち, 正しいものはどれか。
平成23年度 秋期 ITパスポート試験 問27
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 27
Incorrectア
What this Act protects is a computer that is connected to a telecommunications line and has an access control function, and it is not limited to corporate servers. An intranet (an in-house LAN) is also a telecommunications line, and a personal-use PC with an access control function is likewise protected as it is. Therefore, gaining unauthorized access to a personal PC via an intranet is a violation, so saying that it does not constitute a violation is wrong.
- イ
正解 What the Unauthorized Access Prohibition Act prohibits is the act of unauthorized access itself; whether actual harm such as peeking at information or destroying data occurred is not asked. The violation is established at the moment you use someone else's ID and password without permission, or exploit a security hole, to break through an access control function and put the computer into a usable state that should not have been available to you (this is what is called a conduct crime). Therefore イ, which states that even if no actual damage occurs, merely committing an unauthorized access act constitutes a violation, is correct. A good way to remember it: even if you log out without doing anything after breaking in, the mere fact of the intrusion is subject to punishment.
Incorrectウ
The Act prohibits not only the act of unauthorized access itself but also, as a separate offense, providing another person's ID and password (identification code) to a third party without a legitimate reason, treating it as an act that facilitates unauthorized access. If you tell them to someone who knows how to use them, you can be in violation as a facilitating act even without breaking in yourself, so saying that merely telling them is not a violation is wrong.
Incorrectエ
What the statute stipulates is access carried out through a telecommunications line, and it is not limited to the Internet. An in-house LAN, an intranet, a leased line and the like are covered in the same way as long as the access goes over a network. A statement that narrows the type of line down to the Internet alone is wrong.
ここがポイント
- The Unauthorized Access Prohibition Act defines a conduct crime — the violation is established the moment an access control function is broken through and the computer is put into a usable state; the occurrence of actual harm is not a requirement.
- Its scope covers unauthorized access over telecommunications lines in general (not only the Internet but also intranets and in-house LANs, and not only corporate servers but also personal PCs), and the facilitating act of providing identification codes to a third party without permission is prohibited as well.
用語