問29
頻出度★★★
公開することが不適切な Web サイトa～cのうち, 不正アクセス禁止法の規制対象に該当するものだけを全て挙げたものはどれか。 a スマートフォンからメールアドレスを不正に詐取するウイルスに感染させる Web サイト b 他の公開されている Web サイトと誤認させ, 本物の Web サイトで利用する ID とパスワードの入力を求める Web サイト c 本人の同意を得ることなく, 病歴や身体障害の有無などの個人の健康に関する情報を一般に公開する Web サイト
平成31年度 春期 ITパスポート試験 問29
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 29
Incorrectア
The option is“a, b, c”, but a and c are not subject to the Unauthorized Access Prohibition Act. The virus infection in a falls under the crime concerning unauthorized commands to electronic or magnetic records in the Penal Code (the crime of creating or providing a virus), and the unauthorized disclosure of health information in c is a matter for the Personal Information Protection Act (handling of Special Care-Required Personal Information); neither falls under this Act.
- イ
正解 The Unauthorized Access Prohibition Act regulates unauthorized logins that misuse another person's identification code (ID and password), as well as the phishing acts added in the 2012 (Heisei 24) amendment (illegitimately obtaining or storing another person's identification code, and illegitimately prompting entry of an identification code by making the user mistake the site for a legitimate one). Site b makes the user mistake it for another publicly available Web site and prompts the user to enter the ID and password used on the genuine Web site, which is exactly a phishing act, so it is regulated by this Act. Therefore the option that lists the regulated sites completely and without excess is“イ”, which indicates only“b”, and it is the correct answer.
Incorrectウ
The option is“b, c”, but c should not be included. Site c publicly discloses health information such as medical history or the presence of physical disabilities (Special Care-Required Personal Information) without the person's consent, which is subject to the Personal Information Protection Act and has nothing to do with the Unauthorized Access Prohibition Act.
Incorrectエ
It lists only“c”, but c is not covered by the Unauthorized Access Prohibition Act; it is a matter for the Personal Information Protection Act. Conversely, site b, which is phishing, should be subject to this Act yet is not included, so it is wrong on both counts — both omission and excess.
ここがポイント
- The Unauthorized Access Prohibition Act covers unauthorized logins that misuse another person's ID and password, and phishing acts (illegitimately obtaining or storing an identification code, or prompting its entry).
- Dividing the laws: distributing a virus is handled by the Penal Code (the crime concerning unauthorized commands to electronic or magnetic records), while the unauthorized disclosure of Special Care-Required Personal Information such as health information is handled by the Personal Information Protection Act.
用語