問4
頻出度★★★
不正アクセス行為の禁止等に関する法律で禁止されている行為はどれか。
平成24年度 春期 ITパスポート試験 問4
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 4
- ア
正解 The core of what the Act on the Prohibition of Unauthorized Computer Access (the Unauthorized Access Prohibition Act) forbids is the act of putting another person’s computer, which is protected by an access control function, into a state where it can be used without authorization, via a telecommunications line. There are two typical forms: one is impersonating a person by misusing their identification codes (ID and password), and the other is the security hole attack, which is what choice ア describes. Choice ア is “an act of attacking security weaknesses present in an OS or the like via a telecommunications line to illegally use a computer”, and it satisfies both conditions: it goes through a network, and it evades the restriction imposed by access control so as to illegally use a computer that should not have been usable. In other words, even without stealing a password, breaking in by exploiting a vulnerability (security hole) in an OS or software is by itself an unauthorized access act prohibited by this Act. Therefore the correct answer is ア.
Incorrectイ
What regulates the theft of trade secrets and business know-how is the Unfair Competition Prevention Act. That Act protects, as a trade secret, information that is kept under secrecy management, is useful for business activities, and is not publicly known, and it prohibits improperly acquiring, using, or disclosing such information. What it protects is “the property value of information”, not “the right to access a computer”, and this is where it differs from the Unauthorized Access Prohibition Act. Note that if trade secrets were stolen by breaking in over a network, both the Unauthorized Access Prohibition Act and the Unfair Competition Prevention Act could be violated, but the wording of choice イ itself contains no element of unauthorized access.
Incorrectウ
Posting content that defames or slanders another person on a web page, bulletin board, or the like is a matter of the crimes of defamation and insult under the Penal Code, and in civil law a matter of damages for tort; as a remedy procedure for the victim, a request for disclosure of sender information under the Provider Liability Limitation Act may also come into play. This is an act of writing from a screen that the person is authorized to use, not an act of intruding into another person’s computer without authorization. Even when the act takes place on the Internet, as long as no access control has been broken through, it does not become a target of the prohibitions in the Unauthorized Access Prohibition Act.
Incorrectエ
What prohibits obtaining personal information by deception or other improper means while concealing the purpose of use from the individual is the Act on the Protection of Personal Information. That Act requires personal information handling business operators to specify the purpose of use as clearly as possible and to notify or publicly announce it, and not to obtain personal information by improper means. What is protected here is the rights and interests of individuals, not the right to access a computer. If the means of acquisition were an unauthorized intrusion over a network, the Unauthorized Access Prohibition Act could also come into question, but the wording of choice エ merely states that the means of acquisition is improper, and it does not make up the elements of that Act (the Unauthorized Access Prohibition Act).
ここがポイント
- Scope of the Unauthorized Access Prohibition Act (the Act on the Prohibition of Unauthorized Computer Access): acts that, via a telecommunications line, make another person’s computer equipped with an access control function usable without authorization. There are two types: impersonation by misusing another person’s identification codes (ID and password), and the security hole attack that evades restrictions by exploiting a security hole. In addition, improperly obtaining, improperly storing, and improperly providing (facilitating the use of) identification codes, as well as requesting their input through phishing, are also prohibited.
- Telling confusable laws apart: theft of trade secrets and know-how falls under the Unfair Competition Prevention Act; posting defamatory or slanderous content falls under the crimes of defamation and insult in the Penal Code; obtaining personal information by improper means while concealing the purpose of use falls under the Act on the Protection of Personal Information. For IT-related illegal acts, identify the corresponding law by what is being protected (access rights / the property value of information / reputation / the rights and interests of individuals).
用語