Open Decision Ledger · Criminal law
Entering a logged-in account as network intrusion under the Information Communication Network Act
Supreme Court, Nov. 14, 2024, 2021Do5555 (judgment)
No holding summary · checked against points at issue. The official text publishes no summary of the holding for this decision. The quotation and factors in this record are copied verbatim from the points at issue; the evidence for each axis is taken from the points at issue, the order and the reasons.
Case name: 정보통신망이용촉진및정보보호등에관한법률위반(정보통신망침해등)
Official text on the National Law Information Center
Question
Does Article 48(1) of the former Act on Promotion of Information and Communications Network Utilisation and Information Protection cover entering a network by dishonest means, such as using another person's identifier or entering an improper command, even where no damage to the protective measures accompanies it, and by what standard is a third party's access authority judged?
Holding
Yes. The provision covers intrusion by dishonest means even where no damage to the protective measures accompanies it, and because it protects the stability of the network and the reliability of its information, the subject that grants access authority or sets the permitted scope is the service provider, so a third party's authority is judged by what the provider granted. Here Google had granted only the spouse access to the photo album by identifier, and the accused, taking advantage of the state in which the account was already logged in, entered a command to reach it without any permission from the spouse or Google; that was intrusion without lawful authority.
Points at issue, verbatim
구 정보통신망 이용촉진 및 정보보호 등에 관한 법률 제48조 제1항에서 금지하는 ‘정당한 접근권한 없이 또는 허용된 접근권한을 넘어 정보통신망에 침입’하는 행위에 그 보호조치에 대한 침해나 훼손이 수반되지 않더라도 부정한 방법으로 타인의 식별부호를 이용하거나 보호조치에 따른 제한을 면할 수 있게 하는 부정한 명령을 입력하는 등의 방법으로 침입하는 행위가 포함되는지 여부(적극)
Unofficial English translation
Whether the act of "intruding into an information and communications network without due access authority or beyond permitted access authority" prohibited in Article 48 (1) of the former Act on Promotion of Information and Communications Network Utilization and Information Protection includes an act of intruding by such means as using another person's identifying code by wrongful methods or inputting a wrongful command that enables one to evade the restrictions imposed by a protective measure, even where no infringement of or damage to that protective measure is involved (affirmative)
Disposition
Partly reversed and remanded Stated in the decision
원심판결 중 무죄 부분을 파기하고, 이 부분 사건을 수원지방법원에 환송한다.
Unofficial English translation
The judgment of the court below is reversed with respect to the not guilty part, and this part of the case is remanded to the Suwon District Court.
Form of the test
Elements stated Stated in the decision
위 규정에서 접근권한을 부여하거나 허용되는 범위를 설정하는 주체는 서비스제공자이고 따라서 서비스제공자로부터 권한을 부여받은 이용자가 아닌 제3자가 정보통신망에 접속한 경우 그에게 접근권한이 있는지 여부는 서비스제공자가 부여한 접근권한을 기준으로 판단하여야 한다
Unofficial English translation
the subject that grants access authority or sets the scope of permitted access under the said provision is the service provider, and therefore, where a third party who is not a user granted authority by the service provider accesses the information and communications network, whether that person has access authority must be determined on the basis of the access authority granted by the service provider
Factors
- 그 보호조치에 대한 침해나 훼손이 수반되지 않더라도
- 부정한 방법으로 타인의 식별부호를 이용하거나 보호조치에 따른 제한을 면할 수 있게 하는 부정한 명령을 입력하는 등의 방법으로 침입하는 행위가 포함되는지 여부(적극)
- 위 규정에서 접근권한을 부여하거나 허용되는 범위를 설정하는 주체(=서비스제공자)
- 서비스제공자로부터 권한을 부여받은 이용자가 아닌 제3자가 정보통신망에 접속한 경우
- 제3자에게 접근권한이 있는지 판단하는 기준
Unofficial English translation
• even where no infringement of or damage to that protective measure is involved
• whether an act of intruding by such means as using another person's identifying code by wrongful methods or inputting a wrongful command that enables one to evade the restrictions imposed by a protective measure is included (affirmative)
• the subject that grants access authority or sets the scope of permitted access (i.e., the service provider) under the said provision
• where a third party who is not a user granted authority by the service provider accesses the information and communications network
• the criteria for determining whether the third party has access authority
Relation to precedent
Follows earlier decisions Stated in the decision
대법원 2005. 11. 25. 선고 2005도870 판결, 대법원 2021. 6. 24. 선고 2020도17860 판결 등 참조
Unofficial English translation
See Supreme Court Decision 2005Do870 decided November 25, 2005, Supreme Court Decision 2020Do17860 decided June 24, 2021, etc.
Decisions referred to
대법원 2005. 11. 25. 선고 2005도870 판결(공2006상, 71), 대법원 2021. 6. 24. 선고 2020도17860 판결
Burden of proof
Not addressed Not in the decision
Open question and revisit condition
How great must the risk of harming the stability of the network or the reliability of its information be before merely browsing material in an already logged-in account amounts to intrusion?
The retrial judgment of the Suwon District Court will show how the criterion of the provider's grant is applied to facts of this kind. Any amendment to Article 48(1) or to the penalty provision, renumbered as Article 71(1)(xi) by the amendment of 23 January 2024 (Law No. 20069), or a later decision changing the two cited precedents, calls for this entry to be read again.
Cross-family AI independent reading & axis check
7 of 8 axes matched GPT-6 Astra (OpenAI, codex CLI) · 2026-10-25
A reader from another model family (GPT-6 Astra), given the official text but not the primary reading, agreed on 7 of the 8 axes; the readings differed on axis 8 (open question and revisit condition).
Axis 8 (Open question and revisit condition): Primary “How great must the risk of harming the stability of the network or the reliability of its information be before merely browsing material in an already logged-in account amounts to intrusion?” vs Independent “Would the account holder's consent alone authorize a third party's access where the service provider restricts access to the account holder?”
The primary asks how great the risk must be before mere browsing in an already logged-in account counts as intrusion, while the independent asks whether the account holder's consent alone can authorize a third party where the provider limited access to the holder.
구 정보통신망 이용촉진 및 정보보호 등에 관한 법률 제48조 제1항에서 금지하는 ‘정당한 접근권한 없이 또는 허용된 접근권한을 넘어 정보통신망에 침입’하는 행위에 그 보호조치에 대한 침해나 훼손이 수반되지 않더라도 부정한 방법으로 타인의 식별부호를 이용하거나 보호조치에 따른 제한을 면할 수 있게 하는 부정한 명령을 입력하는 등의 방법으로 침입하는 행위가 포함되는지 여부(적극)Raw responses and comparison record: Protocol · Blind readings (JSONL) · Axis comparison (JSONL) · SHA-256 (JSON)
Lower-court contrast & scope of application
Lower-court reading vs. Supreme Court holding
Lower-court context: The Suwon District Court, in its judgment of 22 April 2021 (2020No4076), kept the first-instance acquittal. It held that whether the accused had access authority is judged by the authority the information communications service provider granted, not by the will of the account holder; that the spouse had entered the identifier and logged in, and the accused only browsed the photos while the account was already logged in, without entering the spouse's identifier himself; and that the act did not directly affect the stability of the network or the reliability of its information.
Supreme Court standard: The Supreme Court held that the provision covers intrusion by dishonest means even without damage to the protective measures, and that the service provider sets the authority. It found that the accused entered a command to access the spouse's photo album without any permission from the spouse or Google, that this was access against the provider's will without lawful authority and carried a risk of harming the stability of the network and the reliability of its information, so it fell within the conduct Article 48(1) prohibits. The court below had misapprehended the law on that provision, and the Supreme Court reversed the acquittal part and remanded the case to the Suwon District Court, in the unanimous opinion of the participating Justices.
Distinguishing conditions
- A case in which the service provider itself granted the person access authority to the same part of the network, since the criterion is the authority the provider granted.
- A case in which the person stayed within the scope of access the provider permitted, since Article 48(1) targets access without lawful authority or beyond the permitted scope.
Record verification notes
Set the file against the two points the Court rejected: that the accused never entered the spouse's identifier, and that browsing an already logged-in account leaves network stability and information reliability untouched. Then confirm which version of the Act applied, since the decision uses Article 71(1)(ix) of the former Act, now Article 71(1)(xi), before the amendment of 23 January 2024 (Law No. 20069).
From the official text
Points at issue
구 정보통신망 이용촉진 및 정보보호 등에 관한 법률 제48조 제1항에서 금지하는 ‘정당한 접근권한 없이 또는 허용된 접근권한을 넘어 정보통신망에 침입’하는 행위에 그 보호조치에 대한 침해나 훼손이 수반되지 않더라도 부정한 방법으로 타인의 식별부호를 이용하거나 보호조치에 따른 제한을 면할 수 있게 하는 부정한 명령을 입력하는 등의 방법으로 침입하는 행위가 포함되는지 여부(적극) / 위 규정에서 접근권한을 부여하거나 허용되는 범위를 설정하는 주체(=서비스제공자) 및 서비스제공자로부터 권한을 부여받은 이용자가 아닌 제3자가 정보통신망에 접속한 경우, 제3자에게 접근권한이 있는지 판단하는 기준
Unofficial English translation
Whether the act of "intruding into an information and communications network without due access authority or beyond permitted access authority" prohibited in Article 48 (1) of the former Act on Promotion of Information and Communications Network Utilization and Information Protection includes an act of intruding by such means as using another person's identifying code by wrongful methods or inputting a wrongful command that enables one to evade the restrictions imposed by a protective measure, even where no infringement of or damage to that protective measure is involved (affirmative) / The subject that grants access authority or sets the scope of permitted access (i.e., the service provider) under the said provision, and the criteria for determining whether a third party who is not a user granted authority by the service provider has access authority where such a third party accesses the information and communications network
Summary of the holding
The official text publishes no summary of the holding for this decision. The quotation and factors in this record are copied verbatim from the points at issue; the evidence for each axis is taken from the points at issue, the order and the reasons.
Order
원심판결 중 무죄 부분을 파기하고, 이 부분 사건을 수원지방법원에 환송한다.
Unofficial English translation
The judgment of the court below is reversed with respect to the not guilty part, and this part of the case is remanded to the Suwon District Court.
Provisions referred to
구 정보통신망 이용촉진 및 정보보호 등에 관한 법률(2024. 1. 23. 법률 제20069호로 개정되기 전의 것) 제48조 제1항, 제71조 제1항 제9호(현행 제71조 제1항 제11호 참조)
Read 2026-10-25 · Cross-read 2026-10-25. All quotes matched against the official text. The Chinese-character placeholders the court used for anonymised parties are given in their Korean readings, and parenthetical Chinese-character glosses are omitted.
Every entry is published only after all quotes have been matched character by character against the official text, and audited by an independent second reading from a different model family across all eight axes. Both agreed axes and text-grounded interpretive divergences are recorded openly. The ledger is a research record, not an assessment of the court or advice on any matter.
Back to the ledger