AfghanistanPenal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
What it requires
- Do not access a computer, program, or data belonging to someone else without authorization; the Penal Code's wording carries no exception for a public, unauthenticated page, and no reported case construes the term.NIST AI RMFMAP 4.1
- Do not alter, damage, destroy, disrupt, or otherwise interfere with a computer system, program, or data without authorization, including by installing a virus, hijacking a network connection, or forging or deceptively accessing a computer system.no control in the NIST AI RMF
- Do not disclose a password, access code, or other means of access to a program, computer system, or data without authorization.no control in the NIST AI RMF
- Do not produce, supply, distribute, or obtain software or a password intended for use in one of these offenses.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 852(1)'s unauthorized-access offense alone is punished by short imprisonment with no cash-fine alternative; Articles 853, 854, 856, 857, 858, and 859 each carry medium imprisonment or a cash fine of 60,000 to 300,000 Afghanis; Article 855's disclosure offense carries a cash fine equal to twice the benefit gained or loss inflicted.
Penalty structure
Cash-fine cap under Arts. 853, 854, 856, 857, 858, and 859 (unauthorized changes, destruction, hijacking, malware creation, forgery, and deception), each of which carries medium imprisonment as an alternative to the fine. Art. 852's own unauthorized-access offense is punished by imprisonment alone, with no monetary cap, and Art. 855's disclosure offense carries a cash fine equal to twice the benefit gained or loss inflicted rather than this fixed cap.
- Rule
- Fixed only
- As of
- Currency
- AFN
- Fixed cap
- 300,000
What this law does
Article 851 defines a cybercrime as a crime committed through modern information technology, electronic communications, or the internet in cyberspace.
Article 852 punishes a person who accesses a computer, program, or data of a computer system belonging to someone else without authorization with short imprisonment, with an additional penalty where the access causes physical, non-physical, or financial damage; the article states no requirement that the offender circumvent a security measure to gain access.
Articles 853, 854, 856, 857, 858, and 859 each punish, with medium imprisonment or a cash fine of 60,000 to 300,000 Afghanis, unauthorized alteration of a computer system's functionality (including installing a virus or unauthorized hacking of network traffic), unauthorized destruction of a computer system, program, or data, unauthorized hijacking that prevents data transmission, producing or supplying software or a password for use in one of these offenses, electronic forgery of a computer's original setting, and electronic deception to access a computer system, program, or data.
Article 855 separately punishes disclosing a password, access code, or other means of access to a program, computer system, or data without authorization, with a cash fine equal to twice the benefit gained or loss inflicted. Article 916 ties the Penal Code's entry into force to nine months after its publication in the Official Gazette. The Gazette published the Code as issue number 1260 on .
The Ministry of Justice's own chronological list of the Official Gazette records the Code as issue No. 1260, dated 1396/2/25 in the Afghan solar calendar, with the status in force and a commencement nine months after publication in the Official Gazette, and records an addition to Article 916 published in issue No. 1286.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .