應用資訊管理預防警察洩露個人資料違法之研究

Information Management and Police Data Leak Prevention

王文鍵(Wen-Jian Wang)

指導教授 ： 周愫嫻

國立臺北大學/社會科學學院/犯罪學研究所/碩士(2011年)

摘要

科技的發展與警察機關偵察權力為警察創造了一個更方便、容易的違反個資法之客觀環境。本研究目的之一是探討警察洩漏個人資料案件的樣態，其二是探討如何降低與阻礙警察洩密案件，最後，提出警察機關在面對日新月異的電子科技發展時，如何因應並建構未來警察內部管理機制。
本研究以20件判例分析員警洩漏民眾個人資料之原因與態樣，續選定兩縣市之10名警察實務機關承辦人員深入訪談，藉以瞭解員警違法洩密之技術、管理、教育訓練問題。
本研究發現員警洩密之主要態樣為：1.以自己之帳號、密碼查詢2.以辦理案件為由委請他人代查3.無查詢權限利用不知情之他人代為查詢4.「公務家辦」導致個資無意外洩5.利用電話轉接至警用內線電話謊稱警務人員代為查詢6.假藉辦案為由夾帶查詢他人個人資料7.謊稱帳號、密碼被鎖定因為查處案件為由請他人代為查詢8.任意將警用查詢電腦交付他人代為尋找績效導致個資外洩9.利用M-Police警用行動載具非因公務任意查詢個人資料。主要原因則為警察資訊安全觀念薄弱，相關主管機關未能重視且力求改善，這也是所有洩露個人資料事件發生主因所在。其他問題還包括人員配置不佳遴選未符合專業化取向、未能落實代理人制度、人事制度缺陷未專才專用人才流失與工作士氣低落、單位主官資安意識欠缺與態度輕忽、未落實存取控制管理、雖有制定機敏資料作業流程但未落實執行「機密工作不使用連線電腦」原則、內部資安稽核流於形式均為事後稽核而非事前預防、教育訓練不足資訊人員未持續在職訓練強化專業性、資訓安全宣導制式化未採多元且生動的方式來呈現、未能體認建立警察之資訊安全觀念將可降低洩密事件的發生及未採用新技術來協助資訊人員管控與促進警察機關之資訊安全等。
本文最後建議警察機關應採用新技術如目錄管理系統、內容加密系統、流量監控系統及電腦終端防護系統等，加強監控作為來管理與嚇阻所屬員警，關於警察機關之內部資訊安全稽核，現行作為採事後稽核方式，除了未能產生嚇阻作用外實無任何效益，已流於形式，建議開發建置「電腦查詢紅旗示警機制系統」與「電腦查詢紀錄檔分析系統」協助資安管理預防於機先確有其必要性。

關鍵字

警政資訊安全 ； 警察洩密違法 ； 資訊管理

並列摘要

Technological development and the capacity of police surveillance powers create an easier environment for violation of personal data. One of the purposes of this study is to explore the modes of personal information divulged by police. The second purpose is to explore how to reduce and impede such leakage.
In this study, we use 20 cases to analyze the causes and modes of leakage of personal information, and then select 10 police personnel in two counties to conduct in-depth interviews. Through these processes, we seek to understand why/how the police breach confidentiality.
The findings reveal the modes of police breach of confidentiality: 1. Make inquiries of password by using their own accounts 2. Assign others to make a check under the pretext of handling the case 3. Without permission, make use of others who have no knowledge of the inquiry 4. Make use of public affairs to fit personal purposes 5. Use false call forwarding to the police officers' internal phone lines to make inquires, 6. Make inquires about personal information under the pretext of handling the case 7. Tell a lie that the account number, password is locked, and because of the case investigation, ask others on behalf to make inquiries 8. Give a police computer for inquiries to others, resulting in the leakage of personal information 9. Use M-Police action carriers for non- public purposes to access personal information.
The leakage of personal information occurs mainly because the concept of police security is weak, and the relevant authorities fail to stress its importance and they do not strive for improvement. Other problems also include poor staffing selection, lack
of professional orientation, failure to implement a good agent system, defects in the personnel system, short of dedicated professionals, leading to brain drain and low morale; there are also associated problems, i.e. unit officers' lack of security awareness and attitudes of ignorance, and lack of oversight by management. Although the data processes for confidential information has been enacted, they do not fully implement the principle that "confidential data shall not be accessible in computers". In addition, the internal information security audit is a mere formality, rather than a real preventive strategy. Relevant education and training programs are not sufficiently provided for personnel. There is a need to have on-the-job training and education to strengthen professional judgment and ethics, and information security education has be presented in diverse and lively ways. There is also a need to realize the establishment of the concept of information security, which may reduce the incidence of leakage. In addition, new technologies are required to help IT staff in control promote the idea of information security.
In conclusion, this research makes proposals to police institutions that they should adopt new technologies, such as directory management system, content encryption, flow monitoring system and computer terminal protection system, etc., to strengthen their monitoring system to make management more effective as well as deter leakage. The current auditing method fails to deter and is a mere formality. Consequently, the research specifically proposes that the "Red Flag warning mechanism to make queries in a computer system" and "computer inquiry/search analysis system" is used to assist in building up the necessary information security management framework.

並列關鍵字

police information security ； police breach of confidentiality ； information management

參考文獻

王演芳、謝麗珠、樊國楨、廖菊芳、黃健誠，2010，＜政府機關（構）以運作中之營運機制建立資訊安全系統的研究＞。《電腦稽核期刊》，（22），頁23-36。

江衍勳，2010，＜資訊系統委外之資訊安全管理＞。《資訊安全》，46（7）：19-21。

吳彥霆，2010，＜XSS術分析與防禦＞。《資訊安全通訊》，16（3）：127-143。

吳啟文，2010，＜政府資通安全技術服務與防護管理＞。《資訊安全》，46（7）：14-18。

林宜隆、花俊傑，2010，＜資安攻防人才核心知識領域之探討＞。《電腦稽核期刊》，（22）：79-87。