ChileLey 21.459, art. 2, acceso ilícito a un sistema informático
Ley 21.459, art. 2 (acceso ilícito)
In force since .
A computer misuse rule binding private bodies.
- Audit expectation
- none
What it requires
- Do not defeat a technical barrier or technological security measure (a login, a paywall, an access token) to reach a computer system without authorization; doing so is a criminal offence regardless of what is then done with the data.
- Crawling a public, unauthenticated page that carries no such barrier is not itself an offence under this article.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Acceso ilícito (art. 2) carries presidio menor en su grado mínimo or a fine of 11 to 20 unidades tributarias mensuales; the penalty rises where access is committed with intent to appropriate or use the system's information.
Who enforces it
Settledness
- As of
- Open questions
- Does a crawler that keeps reading a public site after the operator blocks its address, or that rotates addresses to continue, commit the conduct of "superando barreras técnicas o medidas tecnológicas de seguridad" (overcoming technical barriers or technological security measures) under Article 2?
What it makes you log
Logging duty
Article 2 defines the offence of unauthorized access to a computer system by overcoming a technical barrier or security measure, and sets its penalty. It requires no one to create, keep, produce or review a log or record. The paragraph the article carries from Ley 21.663 (art. 55 no. 1) exempts a security researcher from criminal sanction only if the researcher is entered in the Agencia Nacional de Ciberseguridad's registry, informed the Agency beforehand and reported the access and any vulnerability found to the system's controller and the Agency; those are conditions of the exemption, not a record the crawler or the researcher must keep, and the register is the Agency's own. The offence states no territorial test (the exemption mentions a system whose controller is domiciled in Chile, which limits the exemption only), so the hook is empty.
- Kind
- None
- As of
What this law does
Article 2 criminalizes accessing a computer system without authorization, or exceeding held authorization, only where the actor also defeats a technical barrier or technological security measure protecting that system.
Both elements are conjunctive on the statute's own text, so crawling a page that carries no such barrier, a public, unauthenticated page, does not by itself satisfy this offence; accessing a system behind a login, a paywall, or another technical access control without authorization does.
The offence carries presidio menor en su grado mínimo (a short custodial term) or a fine of eleven to twenty unidades tributarias mensuales, rising where the access is committed with intent to appropriate or use the system's information (art. 2, second paragraph, not quoted here). This statute repealed and replaced Ley 19.223 to align Chile with the Budapest Convention on Cybercrime.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .