問13
頻出度★★★
インターネットに接続しているコンピュータ環境において, 不正アクセス禁止法で規制されている, 不正アクセスを助長する行為に該当するものはどれか。
平成26年度 春期 ITパスポート試験 問13
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 13
Incorrectア
Creating and distributing a program that fraudulently steals personal information such as addresses and names (malicious software such as spyware) falls under the Penal Code offense concerning unauthorized commands and electromagnetic records (commonly called the crime of creating or supplying computer viruses), and depending on how the stolen information is handled it may also raise issues under the Personal Information Protection Act. What is stolen here is personal information such as addresses and names, not the provision of an identification code used for access control, so it is not a facilitating act under the Unauthorized Access Prohibition Act.
Incorrectイ
Placing commercial music content on a blog so that an unspecified large number of people can download it puts a copyrighted work into a transmittable state without the copyright holder's permission, which infringes the right of public transmission (the right of making a work transmittable) under the Copyright Act. It involves neither breaking through access control nor handing over another person's identification code, so it is not regulated by the Unauthorized Access Prohibition Act.
- ウ
正解 The correct answer is ウ. The Unauthorized Access Prohibition Act (formally, the Act on the Prohibition of Unauthorized Computer Access) not only bans the act of unauthorized access itself, that is, using someone else's ID and password without permission to use a computer over a network, but also separately bans acts that help such access, calling them acts that facilitate unauthorized access. A facilitating act means providing another person's identification code tied to an access control function (for example, the combination of ID and password used to log in) to someone other than the access administrator or the legitimate user, except where there is a valid reason such as business necessity. Choice ウ, verbally telling a third party someone else's ID and password without the person's consent, is exactly the act of providing another person's identification code to a third party without permission, so it falls under this rule. The key points are that the means of providing does not matter, and that even if the provider does not personally commit unauthorized access, and even if the recipient never actually goes on to access the system, the act can already be subject to regulation at the moment the identification code is handed over. Not only email or a post on a bulletin board but also telling someone verbally counts as providing, and that is what this question is testing.
Incorrectエ
Posting a message on an electronic bulletin board that incites a large volume of access to a specific website can lead to denial of service (DoS) if the site goes down, and may raise issues such as the Penal Code offense of obstruction of business by deception. However, a large volume of access is not in itself an act of illegitimately breaking through an access control function, and no identification code of another person is provided, so it does not qualify as a facilitating act under the Unauthorized Access Prohibition Act.
ここがポイント
- The Unauthorized Access Prohibition Act bans: (1) acts of unauthorized access, meaning using another person's identification code without permission or exploiting a vulnerability to bypass an access control function; (2) facilitating acts, meaning providing another person's ID and password to a third party without a valid reason; and (3) illegitimately obtaining or storing another person's identification code, as well as illegitimately requesting entry of an identification code, as in phishing. A facilitating act can be subject to regulation regardless of the means of providing (email, bulletin board, spoken word, and so on) and regardless of whether unauthorized access actually took place.
- For illegal acts related to information, memorize them by sorting out which law covers which act: using or providing another person's ID and password without permission falls under the Unauthorized Access Prohibition Act; creating or supplying malicious programs and obstructing business fall under the Penal Code (offenses concerning unauthorized commands and electromagnetic records, and obstruction of business by deception or by damaging computers); uploading music or video without permission falls under the Copyright Act; and improper handling of personal information falls under the Personal Information Protection Act. This mapping is a typical exam pattern.
用語