论网络“白帽子”的刑事合规保护

On the Criminal Compliance Protection of Cyber"White Hat"

网络“白帽子”运用网络爬虫技术爬取用于模拟测试的网络信息数据,目的在于查找网络漏洞,客观行为因符合非法获取计算机信息系统数据罪的构成要件而存在法律风险,主观意图因以维护网络安全为追求而具备合法空间。实务中对网络“白帽子”的刑事治理既存在难以界定爬取网络信息数据的非法界限而使网络“白帽子”不当入罪的问题,又存在无法划定爬取网络信息数据的合法空间而难以发挥网络“白帽子”网络安全维护作用的问题。学界对网络“白帽子”是否入罪存在不同观点,但均认可能够划定网络“白帽子”边界赋予行为空间。网络“白帽子”刑事治理领域应引入刑事合规理念,通过内部风险控制机制与外部司法指导机制实现网络“白帽子”合规保护,实现网络安全维护的同时消解潜在信息数据安全风险。

Cyber"White hat"uses the web crawling technology to gather online information data used for simulation testing,aiming to identify network vulnerabilities.The objective behavior,due to meeting the constitutive elements of the crime of illegally obtaining computer information system data,presents legal risks;however,the subjective intention,with the aim of maintaining network security,possesses a legitimate scope.In practice,the criminal governance of cyber"white hats"faces challenges in defining the illegal boundaries of web crawling activities,which can lead to improper criminalization of cyber"white hats."At the same time,there is an issue with identifying the legal scope for web crawling,making it difficult to leverage the role of cyber"white hats"in maintaining network security.The scholars have different views on whether cyber"white hat"should be criminalized,but they all agree that it is possible to define the boundaries of cyber"white hats"to provide a space for their activities.In the field of criminal governance concerning cyber"white hats",the concept of criminal compliance should be introduced.By implementing internal risk control mechanism and external judicial guidance mechanism,the compliance protection of cyber"white hats"can be achieved,thereby maintaining network security while mitigating potential information data security risks.