問32
頻出度★★★
不正アクセス禁止法で禁止されている行為はどれか。
平成23年度 特別試験 ITパスポート試験 問32
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 32
Incorrectア
Listing a product that does not exist and swindling the payment out of the winning bidder amounts to fraud under the Penal Code. The problem is deceiving the other party to a transaction in order to obtain money; the person did not use someone else's ID and password without permission to break through access control, so this is not something the Unauthorized Access Prohibition Act prohibits.
Incorrectイ
Posting large amounts of slander on someone else's blog is a matter of defamation or insult under the Penal Code, or of a civil tort (a claim for damages), while removal of the posts is handled under the framework of the Provider Liability Limitation Act. The posting itself only uses a public comment function that anyone may use, under the person's own authority; no one else's identification code was used without permission to bypass an access control function, so the Unauthorized Access Prohibition Act does not apply.
- ウ
正解 The correct answer is ウ. The Unauthorized Access Prohibition Act (formally the Act on Prohibition of Unauthorized Computer Access) prohibits entering another person's identification code (such as a user ID and password) over a network without permission, thereby making usable a computer or service that one has no right to use — so-called impersonation. Choice ウ uses another person's user ID and password without permission to read that person's email, which is exactly an act of unauthorized access that abuses an identification code to bypass an access control function. Keep in mind that, in addition to the act of unauthorized access itself, the same law also prohibits providing another person's identification code to a third party without permission, illegally obtaining or storing such codes, and asking people to enter them through phishing and similar means.
Incorrectエ
Selling pirated music CDs made by illegal copying infringes the reproduction right and the transfer (distribution) right provided by the Copyright Act. What is protected is the copyrighted work, not the right to access a computer, and there is no element of using another person's ID and password over a network, so it is not an act prohibited by the Unauthorized Access Prohibition Act.
ここがポイント
- The core of the Unauthorized Access Prohibition Act is its ban on “using another person's identification code (ID and password) without permission, or attacking a security hole, over a network so as to bypass an access control function and make a computer one has no authority for usable”. Even before any information is actually viewed, logging in by impersonation is already illegal at that point. Illegally obtaining, providing, or storing identification codes is prohibited by the same law as well.
- For illegal acts related to information security, sorting out which law governs each one is a reliable source of marks. Fix these pairings in mind: logging in by impersonation → the Unauthorized Access Prohibition Act; fraud (swindling money through fictitious transactions) → fraud under the Penal Code; slander and defamation → defamation and insult under the Penal Code; copying and selling pirated goods → the Copyright Act.
用語