网络安全漏洞挖掘的法律规制研究

发布时间：2018-05-30 23:38

本文选题：网络安全漏洞 + 善意黑客　；参考：《暨南学报(哲学社会科学版)》2017年05期

【摘要】：网络安全漏洞的挖掘、披露、交易、修复日益成为各国网络安全治理的中心议题。"袁炜案"直接表明了我国现行法对网络安全漏洞挖掘行为的否定性态度,《刑法》第二百八十五条前两款对善意黑客的漏洞挖掘行为构成了不当限制,应当通过《网络安全法》第二十六条对其在漏洞挖掘领域的适用进行严格的限缩解释,并围绕《网络安全法》从立法论的角度重塑漏洞管理机制。在充分考虑网络安全漏洞自身动态性、复杂性、开放性的基础上,从国家安全的高度把握漏洞挖掘治理,健全漏洞挖掘立法体系;完善漏洞库并配套漏洞评级机制;明确公私合作框架,对挖掘主体进行备案;在遵循现有实践的基础上对挖掘行为分级授权,并进一步强化漏洞的跨境流动应对。
[Abstract]:The excavation, disclosure, transaction and repair of cyber security vulnerabilities have increasingly become the central issue of cybersecurity governance in various countries. " Yuan Wei's case "directly shows the negative attitude of the current law to the exploitation of network security vulnerabilities, and the first two paragraphs of Article 285 of the Criminal Law unduly restrict the exploitation of vulnerabilities by bona fide hackers." The application in the field of vulnerability mining should be strictly interpreted by Article 26 of the Network Security Law, and the mechanism of vulnerability management should be rebuilt from the angle of legislative theory around the Network Security Law. On the basis of considering the dynamic, complex and open nature of network security vulnerabilities, we should grasp the governance of vulnerability mining from the perspective of national security, perfect the legislative system of vulnerability mining, perfect the vulnerability library and complete the vulnerability rating mechanism. Make clear the framework of public-private cooperation, record the main body of mining, and further strengthen the cross-border flow response of loopholes on the basis of the existing practice.
【作者单位】：北京航空航天大学法学院;
【基金】：中国法学会部级项目《安全防范信息的采集与利用相关法律问题研究》(批准号:CLS(2016)C13) 国家社会科学基金重大项目《信息法基础》(批准号:16ZDA075)
【分类号】：D922.16;TP393.08

【参考文献】