쥬스재킹(Juice Jacking)에 대한 형사법적 규율과 입법적 개선방안 -미국·EU·중국 법제 비교를 중심으로-

초록

Recently, “Juice Jacking,” a cybercrime in which personal data is stolen or malicious code is installed via public USB charging stations, has emerged as a new threat. This offense exploits a user’s voluntary charging behavior to gain unauthorized access to a device, making the application of existing Korean criminal law and information and communications statutes—which presuppose network-based intrusion—limited. This study analyzes the United States’ Computer Fraud and Abuse Act (CFAA), the European Union’s General Data Protection Regulation (GDPR), and China’s Cybersecurity Law, Data Security Law, Personal Information Protection Law (PIPL), and relevant criminal provisions, comparing them with the Korean legal framework to assess the feasibility and limitations of regulating Juice Jacking. The analysis reveals that foreign jurisdictions tend to combine preventive controls with administrative sanctions while imposing security management obligations on public infrastructure operators. In contrast, Korea lacks provisions that directly encompass Juice Jacking, and the ambiguity in legal application makes effective response difficult. Accordingly, this study proposes legislative measures, including the introduction of an “Unauthorized Access Offense” in the Criminal Act, the imposition of security obligations on public charging facility operators, aggravated penalties for sensitive data breaches, and the enactment of an integrated cybersecurity law.

키워드