機密資訊安全防護風險評估之研究

近年經監察院調查發現，公務單位有濫行核定機密、檔案遺失或未經核准而銷毀等情，係因對機密資訊之管制措施，雖已訂定相關規定，惟所屬單位機密處置流程不當，部分人員仍存有便宜行事心態，或僅做形式化之文書報表，未具保密警覺之危機意識，造成單位機密資訊安全維護不易，帶來相當程度的衝擊與妨礙。我國在洩密罪的管制作為上，於國家機密保護法、刑法、陸海空軍刑法、國家安全法與政風機構維護公務機密作業要點等法令規範中，皆有訂定機密維護措施、處置流程與相關罰則預防，然而在處理過程中易衍風險，如何有效降低風險，成為重要議題。本研究以作業風險管理軟體(Operational Risk Management Integration Tools, ORMIT)針對現行機密資訊管控機制進行風險評估問卷調查，藉以發揮其管控效能，降低失效風險發生，從「處理、分發、傳送、保管、清查及銷毀」等6項機密處置流程評估，提出「定期保密安全教育、嚴密機密檔資管理、科技輔助複式稽核、嚴查洩密違規事件、嚴密人員考核管理與定期實施風險評估」等建議方案，供政府及企業實務管制參考。

關鍵字

機密資訊；處置流程；風險評估

並列摘要

In recent major incidents involving the disclosure of confidential information, such as the Bradley Manning, Andrew Snowden, and Panama Papers incidents, the leakage channels were individual employees who were members of the internal staff. The incidents have resulted in international panic, disputes, and reflection. A series of leakage incidents have taken place in Taiwan, including the leakage of confidential information by government officers and the stealing of corporate secrets by company employees. These incidents caused have major damage to many organizations, imposing a threat to national security and overall industrial competitiveness. With regard to the management and control of leakage offenses in Taiwan, the confidentiality protection measures, management procedures, and related penalty provisions are stipulated in the Classified National Security Information Protection Act, Criminal Code, Criminal Code of the Armed Forces, National Security Act, and Regulations for Protection of Confidential Business Operations by Government Mechanisms. However, various risks are likely to occur in the management process and the efficient reduction of risks is an important issue. Operational Risk Management Integration Tools (ORMIT) were used to conduct a questionnaire survey regarding the risk assessment aspects of current confidential information management mechanisms in order to explore management efficiency and reduce failure risks. The secrets disposal procedure was evaluated according to six components, including ＂processing,＂＂distribution,＂＂delivery,＂＂protection,＂＂verification,＂ and ＂destruction,＂ and based on this, a model was proposed which included the performance of processing by a responsible personnel, effective reduction of personnel familiar with the confidential information, distinction of confidentiality levels for delivery, improvement of protection, regular inventory and inspection, and regular disposal of expired secrets. The proposed model provides a reference for governmental and corporate management.

並列關鍵字

Official Secrets ； Risk Assessment ； Operation Risk Management(ORM)

參考文獻

盛美元 (2006). 偵查不公開原則-兼論與洩密罪之關係, 臺灣大學法律學研究所學位論文.

Google Scholar

劉國棟(2003). 妨害國家機密罪(上), 軍法專刊, 35(9), 39

Google Scholar

國家機密保護法, 全國法規資料庫, 2017年11 月1 日,取自http://law.moj.gov.tw/Law/LawSearchResult.aspx?p=A&t=A1A2E1F1&k1=%E5%9C%8B%E5%AE%B6%E6%A9%9F%E5%AF%86%E4%BF%9D%E8%AD%B7%E6%B3%95