Earticle

미국에서 사이버보험은 보험회사별로 다양하게 존재하고 있는데, 본 논문에서는 영업범죄보 험(Commercial Crime insurance)의 한 영역에 해당하는 컴퓨터 사기 및 자금이체 사기 보험에 관해서 살펴보았다. 컴퓨터 사기 담보는 일반적으로 해커형 사건에만 적용된다. 자금이체사기 담보란 금융기관에게 피보험자의 전송계좌에서 인출하게 하거나 피보험자의 계좌에서 금전 또 는 증권을 교부 또는 전달하게 하는 사기 지시로부터 직접적으로 발생한 손실을 담보하는 보험 이다. 이러한 담보에는 여러 가지 예외가 있다. 즉, 컴퓨터 시스템에 엑세스할 수 있는 권한을 가지고 있는 자의 사기 입력 또는 변경으로 인한 손실, 각종 신용카드 사용으로 인한 손실, 교환 이나 구입과 관련하여 발생된 손실 등 다양한 면책사항을 두고 있다. 미국에서는 위와 같은 컴퓨터 사기담보 및 자금이체사기담보 관해서 판례를 통해 여러 가지 쟁점사항들이 다루어져 왔다. 우리나라의 경우 향후 크게 성장할 국내 사이버보험 시장에 대비하여 외국의 관련 법제, 관련 보험약관 그리고 특히 법원의 다양한 판례들을 적극 검토하여 사이버 범죄 피해보상에 적합한 보험상품 개발에 주력해야 할 것이다.

Following a recent 12-month survey of the worldwide financial services sector, PwC reported in 2014 that cyber fraud is now the fourth most common economic crime. These now prevalent computer fraud schemes－heft or data loss by hacking, phishing, pharming, computer viruses, etc.－take on an ever-increasing array of forms. Moreover, the damages they may leave behind impact a multitude of business facets; including asset depletion, creating liability exposures to customers, employees and other third parties, and causing regulatory exposures, reputational damages and related expenses. In America, through the “commercial crime policy” insurers routinely offer businesses some protection against losses resulting from cyber fraud. Most policies do this through the “computer fraud and funds transfer fraud” insuring clauses. Generally, computer fraud coverage applies to manipulation of computer data to perpetrate a fraud, while funds transfer fraud coverage applies to the specific fraud upon the insured’s bank, to send money from the insured’s account to a third-party. However, these coverage grants are not without stark limitations, and together with the exclusions that follow, are generally intended by insurers to be limited to the insured’s losses directly resulting from third-party acts comprising cyber fraud. To examine the trends of computer fraud coverage in America and look for suggestion, this paper reviews computer and funds transfer fraud coverage grants, exclusions, and related cases in America.

The Criminal Law of South Korea has needed to cope with new kinds of crimes such as the fraud by use of computer efficiently in a legislative way because the society has witnessed the rapid progress of the industrialization and informatization after established in 1953. As a result, the Criminal Law revised on December 29, 1995, created the regulations of the crimes related to fraud by use of computer, work disturbance, and secret piracy by using information processing units. The regulation stipulated in Clause 347, Article 2 of Criminal Law is the most typical one against the new crimes. However, the new regulation of fraud by use of computer, established and revised to supplement the lacking parts of the current rules of the punishment of fraud, limits its object to "any benefits to property." not to "property" itself, and so cannot achieve the purpose of the revision of the law. This paper aims to suggest a new legislative measure about the object of the regulation of fraud by use of computer to solve this kind of problem efficiently.

대상판례는 셀프세차장에서 결제시스템 하단 카드보관함에 들어있는 충전용 세차카드를 절취한 후, 셀프세차장에 설치된 세차기 결제시스템 단말기에 절취한 세차카드를 갖다 대어 세차요금을 결제한 사안이다. 1심법원은 셀프세차장 장비는 유료, 대가성이라는 표지를 갖추고 있어 유료자동설비에 해당하고, 컴퓨터등사용사기죄의 컴퓨터등정보처리장치에 해당하지 않는다고 해석하였다. 그리고 그 논거로 편의시설부정이용죄가 사문화되는 것을 막는다는 논거도 제시하였다. 그러나 편의시설부정이용죄가 컴퓨터의 보편화에 따라 많은 편의시설에서 사용됨에 따라 사문화되는 것을 막는다는 해석논거는 옳지 못하다. 특히 이에 따라 처벌의 흠결이 발생한다면 더욱 그러하다. 1심법원은 편의시설과 컴퓨터를 택일관계로 해석하였으나 이는 잘못된 것이다. 객체가 재산상의 이익인 경우, 즉 이득죄에 있어서 편의시설부정이용죄가 컴퓨터등사용사기죄의 보충관계에 있다고 보아야 하고, 이에 따를 때 대상판례 사안의 경우에는 컴퓨터등사용사기죄가 인정될 수 있다. 더 나아가 셀프세차기가 컴퓨터등 정보처리장치에 해당하지 않는다고 하여도 유료자동설비로서 편의시설부정이용죄가 검토되어야 할 것인데, 타인의 세차카드를 이용한 경우는 부당하게 대가를 지급하지 않은 것에 해당한다고 보아야 하고, 이러한 취지에 반하는 대법원의 기존 입장은 변경되어야 한다. 무인설비는 현재에도 많고, 앞으로도 계속 늘어날 것이다. 공유시대, AI 시대에 이러한 흐름은 당연하다. 이러한 시대변화에 따른 새로운 영역에 대하여 기존 구성요건을 통하여 범죄를 적절히 통제에 둘 수 있는 해석이 요구된다.

The case in question involves a situation where an individual stole a car wash card from a storage compartment at a self-service car wash payment system and used the stolen card to pay for a car wash service by placing it on the payment terminal of the car wash machine. The first-instance court ruled that the equipment at the self-service car wash was a paid facility, with a clear indication of its commercial nature, and thus fell under the category of paid automatic devices, but did not fall under the scope of “computers or other information processing devices” for the purpose of computer fraud. The court also argued that interpreting this as preventing the obsolescence of the crime of improper use of convenience facilities was a valid reasoning. However, the argument that the crime of improper use of convenience facilities should be preserved due to the widespread use of computers and the increasing presence of such facilities is not correct. Particularly, if this interpretation leads to a gap in the punishment, it becomes even more problematic. The first-instance court incorrectly interpreted convenience facilities and computers as an either-or relationship, but this is a mistaken view. If the object constitutes a property benefit, in other words, in the case of a crime of obtaining benefits, the crime of improper use of convenience facilities should be regarded as supplementary to the crime of computer fraud, and in the case of the precedent in question, the charge of computer fraud can be applied. Furthermore, even if the self-service car wash machine is not considered a computer or an information processing device, the crime of improper use of paid automatic equipment should still be considered. If a person uses another’s car wash card without paying for the service, this can be seen as unlawfully receiving a service without compensating for it. The Supreme Court’s existing stance on this issue, which contradicts this interpretation, should be revised. Unmanned facilities are widespread now and will continue to increase in the future. This trend is natural in the era of shared resources and AI. As these changes unfold, there is a need for a legal interpretation that can properly regulate crimes within the new scope using the existing legal framework.

In this article, we analyze the decision of the Supreme Court in Korea with respect to the unauthorized modification of information and the immediacy of property disposal in a computer fraud critically. In the mentioned case, the defendant was charged with unlawful behavior to change the information by installing a hacking program on electronic bidding system of an administrative office. The author evaluated the defendant‘s conduct at issue not as an unauthorized change of information, but as an input of false information or illegal command input for computer. In terms of the immediacy of property disposal, this paper contends that we can’t say that computer fraud doesn’t hold, without exception, if a person involved in the property disposal process. In order to determine whether the computer fraud is established, we have to analyze the contents of the involved individual’s action in detail.

Korea Criminal Act(KCA) Art. 315 (Interference with Auction or Bidding) reads as follows: "A person who interferes with the impartial conduct of an auction or a bid through fraudulent means or by the threat of force or by other means, shall be punished by imprisonment for not more than two years or by a fine not exceeding seven million won." So when a person(or a bidder) unlawfully manipulates computer programs of the agency calling for bids in order to obtain information about a minimum bidding price so that he can win the contract for sure. In the present case handed down by the Suprem Court of Korea, the defendants(bidder and manipulators) are found not guilty of Fraud by Use of Computer, etc(Art. 347-2 KCA) because a directness between a data processing and a property taking. The present paper agrees with the opinion of the Court, and moreover denies the violation of Fraud(Art. 347 KCA) in that the conduct does not make pecuniary loss to the agency. A bid-rigging is punishable by the Art. 315, and a violation of the Korean Anti-monopoly law and Construction law as well.

종래 보이스피싱 범죄에 관해 사기죄를 적용할 수 없는 사안에 컴퓨터등사용사기죄를 적용하고, 피해금을 인출한 후 ‘쪼개기 송금’ 방법으로 다른 계좌에 입금한 행위에업무방해죄를 적용한 태도는 보이스피싱 범죄를 엄단해야 한다는 사회적 요청에 부응하기 위한 것이었다. 그러나 변종 보이스피싱 범죄에 컴퓨터등사용사기죄를 적용하면금융정보를 탈취당하거나 알려준 금융정보의 주체가 아닌 입력되는 명령 내지 정보가처리되어 발생하는 재산상의 이익을 관리하는 자를 피해자로 해석해야 하고, 실행의착수시기를 명령 또는 정보 입력시기로 해석해야 하여 보이스피싱 범죄의 실체에부합하지 않고, 공동정범의 성립범위를 지나치게 축소시키는 문제점을 야기한다. 따라서이러한 문제점을 해소한 통신사기피해환급법을 적용하는 것이 타당하다. 한편, ‘쪼개기송금’에 관해 업무방해죄를 적용하는 것은 위계 개념에 상대방의 오인, 착각, 부지를일으키게 할 것을 요구하는 대법원의 일관된 입장과 부합하지 아니한다. 따라서 컴퓨터등사용사기죄를 적용하는 것이 법리적으로 타당하고, 오히려 업무방해죄보다 법정형이 더 높고, 미수범도 처벌할 수 있어 형사정책적으로 바람직하다.

Conventionally, voice phishing crimes have been categorized as ‘Fraud by Use of Computer, etc.’ and the act of withdrawing money from the victim’s account and transferring it to other accounts in piecemeal fashion as ‘Interference with Business,’ in order to ensure stringent crackdowns on voice phishing. However, if variant voice phishing is deemed ‘Fraud by Use of Computer, etc.’, the entity that is defrauded of his/her financial information or that is lured into revealing his/her financial information to the offender cannot be deemed the victim, while the timing of executing commands or inputting information is to be regarded as the timing of initiating the action, which is not compatible with the true nature of the crime. In addition, the scope of the establishment of accomplices will be excessively narrowed. As such, a more appropriate approach would be to apply the ’Special Act on the Prevention of Loss Caused by Telecommunications-based Financial Fraud and Refunds for Loss’. Meanwhile, classifying ‘piecemeal transfers’ as ‘Interference with Business’ is against the Supreme Court’s consistent stance on the definition of fraudulent means. Thus, it appears only reasonable to apply the crime of ‘Fraud by Use of Computer, etc.’ to piecemeal wire transfers, due to the heavier statutory punishment vis- -vis ’Interference with Business’ and the ability to punish attempted crimes