독일의 사이버 보안법- 정책ㆍ거버넌스ㆍ법률 -

As modern society is being transformed into a ‘hyper-connected society’, new legal problems are emerging. Cyber security is one of the most important examples. As for cyber security, the following problems are arising: Is a new integrated legal regulation for cyber security necessary, how to build a governance system for cyber security, how to strengthen information sharing on cyber security, and how to prepare preventive measures for cyber security? There have been various discussions on those problems, but still fail to find a satisfactory solution. In this context, this article looks at what kind of law policy is being pursued by Germany, which has had a great impact on our legal system. At this point, this article focuses on policy, governance and law. First, this article examines the cyber security strategies in Germany (II), and next, analyzes the major organizations related to cyber security (III). The ‘Bundesamt für Sicherheit in der Informationstechnik’ and ‘Bundesnetzagentur’ are the main subjects of the analyzing. Then, this article analyzes the current status of Cyber Security Act in Germany (IV): “Gesetz zur Erhöhung der Sicherheit informationstechnischer Systeme” (IT-Sicherheitsgesetz), “Directive on Network and Information Security” (NIS Directive), “Gesetz zur Stärkung der Sicherheit in der Informationstechnik des Bundes”, “Gesetz über das Bundesamt für Sicherheit in der Informationstechnik”, “Telekommunikationsgesetz” and “Telemediengesetz” are analyzed here. From these discussions, finally, this article provides meaningful implications for our cyber security law policy (V). This article draws the following implications: First, Germany has its own governance system dedicated to cyber security. This is the ‘Bundesamt für Sicherheit in der Informationstechnik’. Second, Germany gives ‘Bundesamt für Sicherheit in der Informationstechnik’ strong authority on cyber security. Third, Germany intensifies interactive cooperation between public and private sectors for cyber security. Fourth, ‘information sharing’ and ‘technical and managerial measures’ are being strengthened for cyber security.