[Kwon Byeon's Law] 76, Will "I Told You the Password" Serve as a Get-Out-of-Jail-Free Card?

*This content was translated by AI.View Original

Sharing an OTT account among family members or temporarily telling a colleague the password for a work system is no longer unusual. However, it occurs more frequently than expected for individuals to be investigated and found guilty after using a shared password to access another person's account.

Article 48, Paragraph 1 of the Information and Communications Network Act prohibits intruding into information and communications networks "without legitimate access authority or beyond permitted access authority," and violations may be punishable by up to five years in prison or a fine of up to 50 million won.

The core issue is who determines access authority. The Supreme Court views the service provider, rather than the account user, as the entity that determines this. In a case where an individual accessed military webmail using a superior's ID and password learned through work duties to send threatening emails, the Supreme Court ruled that there was no legitimate access authority unless exceptions applied, such as the third party being merely an errand runner or the service provider permitting such use, even if the user had consented (Supreme Court decision 2005do870, rendered on the 25th, 2005). This means that receiving a password does not make one the owner of the account.

Even those with authority cannot feel safe. In a case where a telecommunications agency contractor, whose access to the computer network was permitted only during activation, deactivation, or SIM card changes, accessed the system to manipulate mass text message sending, the Supreme Court recognized this as an intrusion beyond permitted access authority. A guilty verdict was also finalized in a case where an employee of a company that mediated academy account registrations directly accessed an academy account. Furthermore, a purchaser who bought a game account for money, despite terms prohibiting transfer, was not granted legitimate access authority.

However, the scope of punishment is not unlimited. In a case where an individual viewed the results of 51 colleagues by altering the last digit on a multi-faceted evaluation result page that opened with just the address without login, the Supreme Court overturned the guilty verdict, stating that "it is difficult to view access authority as restricted to the individual" based solely on the fact that the address was individually transmitted (Supreme Court decision 2023do1086, rendered on the 26th, 2023). This indicates that whether access is restricted should be judged by objective circumstances such as protective measures and terms of service.

Ultimately, this crime hinges on the factual relationship of "who permitted what scope." In actual cases, it is often found that the point where parties vaguely assumed everything was fine is precisely the boundary of punishment. Both the side lending the account and the side receiving it should consider the scope of that permission at least once. If already facing charges, calmly verifying the circumstances of consent, service terms, and the presence or absence of protective measures is the starting point for a response.

<© STARNEWS. All rights reserved. No reproduction or redistribution allowed.>

*This content was translated by AI.View Original