Explain the basic principles set out in the Cybersecurity Basic Act and the responsibilities it places on the national government, local governments and others.
Explain which acts the Unauthorized Access Prohibition Act forbids and what conditions a computer must meet to be covered by it.
Explain the rules for those who send advertising email, and what the Penal Code offense that punishes handling viruses and other malicious programs covers.
The Cybersecurity Basic Act (サイバーセキュリティ基本法) is a law that lays down the basic principles (基本理念) for defending the whole country against cyberattacks and similar threats, and the responsibilities (責務) of the national government, local governments and others.
Enacted in 2014, it sets the direction on which individual measures are built. Under this act, a body that pulls together and drives the national strategy was set up within the Cabinet. Besides the national and local governments, it also asks operators of critical infrastructure and the public to play their part from their own positions.
AnalogyThink of crime prevention for a whole apartment building: it resembles the house rules that spell out what the residents' association, each household and visiting contractors are each responsible for.
How to remember"Basic Act" in a law's name marks a type of law that sets the basic policy for a field and guides the specific laws and measures within it (the Basic Environment Act is another example).
Exam points
ExamThe Cybersecurity Basic Act (サイバーセキュリティ基本法) sets out the basic principles for advancing defensive measures nationwide and the roles of the national and local governments, and it also created a government body to lead the effort.
ExamAlongside the duties of the national and local governments, this act asks citizens to make efforts as well. The state's basic measures go beyond protecting the government itself and extend to laying the groundwork for measures across society.
The Unauthorized Access Prohibition Act (不正アクセス禁止法) is a law that forbids entering, over a network and without permission, a computer protected by an access control function (アクセス制御機能), as well as acts that help someone do so.
Prohibited act
Description
Unauthorized access
Entering and using someone else's ID and password (identification code) without permission, or exploiting a weakness to get around restrictions
Facilitating it
Passing someone else's ID and password to another person without the owner's consent
Wrongful obtaining or storing
Obtaining or noting down someone else's ID and password for use in unauthorized access
Wrongful requests for input
Posing as a genuine screen to get people to enter their ID and password
An access control function (アクセス制御機能) is a mechanism by which the person managing a computer, the access administrator (アクセス管理者), checks users with an identification code (識別符号) such as an ID and password and lets only permitted people in. Besides entering someone else's identification code without permission, getting around the restrictions by exploiting a weakness in the OS or software, known as a security hole (セキュリティホール), also counts as unauthorized access. A 2012 amendment added wrongfully obtaining or storing someone else's identification code, and trying to get people to enter it on a fake screen, to the prohibited acts.
AnalogyIt is like a rule that bans both giving someone else's PIN over the phone to handle their bank account and telling that PIN to a third person without permission.
How to rememberThe core is not "access" but "breaking through a control." A door with no lock (access control) falls outside what this law protects.
Exam points
ExamWhat the law protects is a computer that is connected to a network and has an access control function (アクセス制御機能); unauthorized access (不正アクセス行為) is a violation the moment it is carried out.
ExamTelling someone else's ID and password to another person without the owner's consent is banned as facilitating unauthorized access. Obtaining or noting down that information for use in unauthorized access is prohibited too.
Mix-upThe Cybersecurity Basic Act (サイバーセキュリティ基本法) sets the principles and structure for defending the country, while the Unauthorized Access Prohibition Act (不正アクセス禁止法) bans individual intrusions and help given to them, and attaches penalties.
The Act on Regulation of Specified Electronic Mail (特定電子メール法) is a law that sets the rules senders must follow for email sent to advertise or promote, known as specified electronic mail (特定電子メール).
Get consent in advance, as a rule
Keep a record of consent
Send with the required details shown
Stop when the recipient refuses
Once someone asks to stop, send them nothing more.
4 / 4
The basic rule is opt-in (オプトイン): advertising email goes out only after the recipient has agreed in advance, though the law sets some exceptions. Senders must show their name, a contact for refusing further mail and other required details in the message. Keeping records that show consent was obtained, and sending nothing more to anyone who has refused, are also duties of the sender.
AnalogyIt is like a store rule that free samples go, as a rule, to people who ask for them, with a note kept of who asked and when.
How to rememberIts full name is the Act on Regulation of Transmission of Specified Electronic Mail. As the name says, its rules are aimed at the sender, not the recipient.
Exam points
ExamUnder the Act on Regulation of Specified Electronic Mail (特定電子メール法), the duties fall on whoever sends the advertising email, and they include being able to show later that consent was obtained.
ExamRunning mail on the basis that you stop only once someone refuses follows the opt-out (オプトアウト) approach, and can breach this law, which makes prior consent the rule.
The Crime Concerning Unauthorized Commands Electromagnetic Records (不正指令電磁的記録に関する罪) is an offense under the Penal Code (刑法) that punishes handling, without a legitimate reason, programs such as computer viruses (コンピュータウイルス) that make a computer act against its user's intentions.
Punishable act
Description
Creating, providing
Making a malicious program or handing it to someone
Deploying
Putting it where it can run on someone else's computer
Obtaining, storing
Getting hold of a malicious program or keeping it on hand
Unauthorized commands electromagnetic records (不正指令電磁的記録) is a legal term for data carrying instructions that make a computer do something its user does not want. The punishable acts go beyond creating and providing to include deployment (供用), which means putting the program where it can run on someone else's computer, and even obtaining and storing it. The offense was created by a 2011 amendment to the Penal Code, and every act presupposes the absence of a legitimate reason.
AnalogyIt is like a rule on poison that covers not only making it but also handing it over, mixing it into food and secretly keeping it.
How to remember"Electromagnetic record" is the legal word for data. Read the name as "data carrying unauthorized commands" and the shape of a virus comes into view.
Exam points
ExamThe Crime Concerning Unauthorized Commands Electromagnetic Records (不正指令電磁的記録に関する罪) is an offense set out in the Penal Code (刑法), and it covers not only making a malicious program without a legitimate reason but also obtaining and storing one.
Mix-upThe Unauthorized Access Prohibition Act (不正アクセス禁止法) deals with misusing other people's identification codes (識別符号) and breaking in over a network, while the Crime Concerning Unauthorized Commands Electromagnetic Records (不正指令電磁的記録に関する罪) deals with viruses and other malicious programs themselves.
Virus Creation Crime (ウイルス作成罪) is the common name for the Penal Code's Crime Concerning Unauthorized Commands Electromagnetic Records (不正指令電磁的記録に関する罪).
Although the name says "creation," it refers to a group of Penal Code offenses that punish providing, deploying, obtaining and storing as well as creating. Every act presupposes the absence of a legitimate reason, so legitimate work such as handling samples for antivirus research or product development is not covered.
Exam points
ExamEven though its common name mentions creation, the offense is not limited to making something. Obtaining a virus and keeping it on hand without a legitimate reason can also fall under the same offense.
The Cybersecurity Basic Act (サイバーセキュリティ基本法) sets the basic principles of national defense, the duties of the national and local governments and the structure for carrying them out, and asks businesses and citizens to take part as well.
The Unauthorized Access Prohibition Act (不正アクセス禁止法) covers computers that are connected to a network and have an access control function (アクセス制御機能), and bans using identification codes (識別符号) without permission and breaking in through weaknesses.
The Unauthorized Access Prohibition Act also bans giving out other people's identification codes without permission, obtaining or storing them wrongfully, and asking for input on fake screens.
The Act on Regulation of Specified Electronic Mail (特定電子メール法) makes opt-in (オプトイン) the rule and requires senders to keep records of consent and to show who they are and a contact for refusing mail.
The Crime Concerning Unauthorized Commands Electromagnetic Records (不正指令電磁的記録に関する罪), commonly called Virus Creation Crime (ウイルス作成罪), is a Penal Code offense that punishes creating, providing, deploying, obtaining or storing a malicious program without a legitimate reason.