BelarusCriminal Code, Crimes Against Computer Security
Criminal Code No. 275-Z of , arts. 349, 350, 352, 354 and 355 (as amended to 2023)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer system or the information it holds by defeating or circumventing a protection or security measure, whether for gain or where doing so negligently causes substantial harm.NIST AI RMFMAP 4.1
- Do not copy, intercept, or otherwise unlawfully acquire computer information causing substantial harm, even without defeating a protection measure.NIST AI RMFMAP 4.1
- Do not develop, use, distribute, or sell a program or device known to be intended for defeating a protection system or for unauthorized access to, or destruction, blocking, or modification of, computer information.no control in the NIST AI RMF
- Reading a public, unauthenticated page without defeating any access control or security measure has not itself been shown to violate these articles.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 349(1): a fine, disqualification from certain positions or activity, arrest, restriction of freedom for up to two years, or deprivation of freedom for up to two years; article 349(2): restriction of freedom for up to five years or deprivation of freedom for up to seven years where the conduct negligently causes a crash, accident, casualties, or other grave consequences. Article 352(1) (unlawful acquisition of computer information): a fine, disqualification, arrest, restriction of freedom for up to three years, or deprivation of freedom for up to two years. Article 354(1) (malicious software or devices): a fine, arrest, restriction of freedom for up to three years, or deprivation of freedom for the same term.
What it makes you log
Logging duty
Articles 349, 350, 352 and 354 punish unauthorized access to computer information, its destruction or modification, its unlawful acquisition and the making or use of programs for those purposes, and article 355 punishes a person with lawful access who breaches the rules for operating a computer system or network and negligently causes substantial harm. None of these articles requires anyone to create, keep or produce a log or record; article 355 refers to operating rules set elsewhere and states no record duty. The Code's general territorial articles 5 and 6 are not invoked by the row's articles and are not read into it.
- Kind
- None
- As of
What this law does
Article 349(1) punishes unauthorized access to computer information accompanied by a breach of a protection system, committed for gain or negligently causing substantial harm, with a fine, disqualification from certain positions or activity, arrest, restriction of freedom for up to two years, or deprivation of freedom for the same term; article 349(2) raises the penalty to restriction of freedom for up to five years or deprivation of freedom for up to seven years where the same conduct negligently causes a crash, accident, casualties, or other grave consequences.
Article 352(1) separately punishes intentional unauthorized copying, interception, or other unlawful acquisition of computer information causing substantial harm, without requiring a breach of a protection system, at up to three years' restriction of freedom or two years' deprivation of freedom.
Article 354 punishes developing, using, distributing, or selling a computer program or device known to be intended for defeating a protection system or for unauthorized access, destruction, blocking, or modification of computer information, and article 355 punishes a person with lawful access who negligently breaches computer-system operating rules and thereby causes substantial harm.
Because articles 349(1) and 352(1) require a breach of a protection system, a corrupt purpose, or a resulting harm, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of these provisions.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .