問17
頻出度★★★
自社の給与マスタの更新権限をもつ社員が, 自身の給与を増額するよう給与マスタの内容を改ざんした。その事実が, 給与支給前に発覚した。データの改ざんを行ったこの社員を処罰する法律として, 適切なものはどれか。
平成26年度 秋期 ITパスポート試験 問17
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 17
- ア
正解 The correct answer is “ア Penal Code”. This employee had been properly granted update privileges for the payroll master data, so accessing the system itself was not unauthorized. The problem is the act itself of abusing that privilege to rewrite business data (an electromagnetic record) — the employee's own salary amount — into content that differs from the facts. Improperly creating an electromagnetic record with the aim of causing errors in a company's administrative processing is punished under the Penal Code as the crime of unauthorized creation and use of electromagnetic records (Article 161-2 of the Penal Code). In addition, if the increased amount is actually paid out, the Penal Code crime of computer fraud (Article 246-2) also becomes an issue. Here the act was discovered before payment, but in any case the law that directly punishes the tampering is the Penal Code, so ア is appropriate.
Incorrectイ
The Act on the Protection of Personal Information sets out the obligations of business operators handling personal information to acquire, manage, and provide personal information appropriately; its main targets are violations of those handling rules by operators (leaks, use beyond the stated purpose, improper provision to third parties, and so on). This question does not involve a leak or improper provision of personal information, but tampering — rewriting one's own salary amount — so it is not a case punished under this law.
Incorrectウ
The Telecommunications Business Act is a law that sets rules on the provision of telecommunications services, such as the registration and business operation of telecommunications carriers and the protection of the secrecy of communications. Updating a company's internal payroll master data has nothing to do with providing telecommunications services, so it falls outside the scope of this law.
Incorrectエ
The Unauthorized Access Prohibition Act punishes acts of improperly breaking through an access control function over a network — for example by using another person's user ID and password (identification code) without permission, or by exploiting a security hole. The employee in this question logged in with the privileges and ID legitimately granted to them, so the access itself was not unauthorized and this law does not apply. What is punished is the separate act of tampering with the data afterwards.
ここがポイント
- Tampering with data by someone who holds the privileges is not “unauthorized access”; it is a matter of the Penal Code crimes of unauthorized creation and use of electromagnetic records, and of computer fraud.
- The Unauthorized Access Prohibition Act targets “impersonation or unauthorized login using another person's ID or a vulnerability”; keep this distinction in mind — abuse after logging in with legitimate privileges falls outside its scope.
用語