問27
頻出度★★★
不正アクセス禁止法において, 規制されている行為はどれか。
平成25年度 秋期 ITパスポート試験 問27
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 27
Incorrectア
Sending email to the company from a virus-infected PC and thereby spreading the virus is neither access using another person's ID and password nor the obtaining or providing of an identification code, so it is not regulated by the Unauthorized Access Prohibition Act. Deliberately creating or supplying a virus would raise the Penal Code offense concerning unauthorized commands in electromagnetic records (the so-called virus creation offense), but a case like this one, where the person did not notice the infection and the virus spread as a result, is handled as a matter of in-house security management and anti-malware measures.
Incorrectイ
Accessing the company's server with the access rights you were granted, copying work data onto a USB memory stick and taking it home does not involve using someone else's identification code without permission, so it does not fall under the Unauthorized Access Prohibition Act. If taking the data off-site is a problem, it is a violation of internal rules (the information security policy), or, should a leak occur, a matter under the Personal Information Protection Act or the Unfair Competition Prevention Act (trade secrets) — a separate framework from the law this question asks about.
Incorrectウ
Learning of an illegal act by the company and disclosing that information on the bulletin board of a website run by a third party involves neither unauthorized access to a network nor any exchange of identification codes, so it is outside the scope of the Unauthorized Access Prohibition Act. Whistleblowing of this kind can, if the requirements are met, be protected under the Whistleblower Protection Act, so listing it as a regulated act is not appropriate.
- エ
正解 The Unauthorized Access Prohibition Act (the Act on the Prohibition of Unauthorized Computer Access) is a law that mainly regulates acts of accessing a system over a network by misusing another person's ID and password, that is, their identification code. The Act prohibits not only the actual break-in, called an act of unauthorized access, but also acts that come one step before it. One of these is the act of providing an identification code in a way that facilitates unauthorized access: without any legitimate reason such as a business need, giving another person's ID and password to a third party who has no access rights (telling them orally, writing it down and handing it over, posting it online, and so on). Choice エ describes telling a third party without access rights another person's network access ID and password without that person's permission, which amounts to providing an identification code to a third party with no legitimate reason, so it is exactly the act this law regulates. The key point is that it becomes a regulated act at the moment you tell them, regardless of whether the third party actually broke in. Therefore the correct answer is エ.
ここがポイント
- The Unauthorized Access Prohibition Act regulates only acts that revolve around another person's identification code (ID and password) and break-ins that exploit security holes. Specifically: the act of unauthorized access, illegally obtaining an identification code, providing it to a third party without a legitimate reason (facilitating unauthorized access), storing it illegally, and phishing that improperly requests entry of an identification code.
- Merely telling a third party someone else's ID and password without that person's permission is already illegal; whether a break-in actually happened is not one of the requirements. Conversely, spreading a virus, taking data off-site, or disclosing information belong to other laws (the Penal Code virus offense, the Unfair Competition Prevention Act, the Whistleblower Protection Act, and so on) or to internal company rules — remember them as separate from this Act.
用語