信息安全研究 ›› 2019, Vol. 5 ›› Issue (2): 114-129.

• 学术论文 • 上一篇    下一篇

信息安全之Web劫持与流量劫持法律治理研究

范江波   

  1. 西南财经大学网络安全与信息化办公室
  • 收稿日期:2019-02-14 出版日期:2019-02-15 发布日期:2019-02-14
  • 通讯作者: 范江波

Research on Information Security Web Hijacking and Traffic Hijacking Legal Governance

  • Received:2019-02-14 Online:2019-02-15 Published:2019-02-14

摘要: 网络安全事关党的长期执政,事关国家长治久安,事关经济社会发展和人民群众切身利益.习近平总书记强调指出,没有网络安全就没有国家安全,没有信息化就没有现代化.数据安全与个人隐私受到了前所未有的挑战,各种新奇的攻击技术层出不穷.运营商的各种劫持、频繁的广告弹窗、访问特定网站被重定向到了非法网站、常用网页被篡改、输入法弹出广告、WiFi共享劫持、网络“爬虫”、Web“钓鱼”、“人肉搜索”、反射放大劫持等现象,均可能与Web劫持或流量劫持有关(Web劫持与流量劫持并不等同,但拟用Web劫持这一概念来替代两者).无论是Web劫持还是流量劫持,究其本质是对数据的控制(用户自身的数据、用户需要访问的数据和传输中的数据);通过控制数据的流向,可以获得巨大的财产利益.如何界定数据控制行为的合法性,控制行为的边界,需要通过什么路径来进行有效治理,以及需要由谁来承担责任,承担什么责任;拟从技术和法律2个层面对互联网核心系统(DNS)与HTTP劫持对互联网安全所产生的重要影响尝试进行.试图从法律角度(民事侵权与违约、刑事犯罪以及公益诉讼角度)提出一些解决办法.劫持本质还是数据安全问题,如何才能更好地保护我们的数据安全和个人隐私,这关乎国家安全,需要我们全社会的高度重视,共同参与.

关键词: Web劫持, 流量劫持, 法律治理, 公益诉讼, 刑事责任, 民事责任

Abstract: Cybersecurity is related to the long-term ruling of the party. It is related to the long-term stability of the country and the economic and social development and the vital interests of the people. General Secretary Xi Jinping emphasizes that there is no national security without cybersecurity, and there is no modernization without informatization. Data security and personal privacy have been challenged as never before, and a variety of novel attack technologies are emerging. Various hijackers of operators, frequent advertisement popups, access to specific Websites were redirected to illegal Websites, common Web pages were tampered with, input method pop-up advertisements, WiFi sharing hijackings, network “crawlers”, Web “fishing”, “human flesh” search, reflection and amplification hijacking, etc., may be related to Web hijacking or traffic hijacking (Web hijacking is not the same as traffic hijacking, but this article intends to use the concept of Web hijacking instead of both). Whether it is Web hijacking or traffic hijacking, its essence is the control of data (user's own data, data that users need to access and data in transit); by controlling the flow of data, huge property benefits can be obtained. How to define the legitimacy of data control behavior, control the boundaries of behavior, what path is needed for effective governance, and who needs to take responsibility and assume responsibility; this paper intends to address the security issues involved in DNS (Internet core system) HTTP hijacking attempts to analyze the two types of behaviors, whether users or Web application service providers, from both technical and legal levels, trying to propose some solutions from a legal perspective (for civil infringement and breach of contract, criminal offences and public interest litigation). The nature of hijacking believes that it is still a data security issue. How can we better protect our data security and personal privacy? This is related to national security and requires the high attention and participation of our entire society. Inappropriate, please axe.

Key words: Web hijacking, traffic hijacking, legal governance, public interest litigation, criminal liability, civil liability