LexLint.ioBeta

Know the law your code answers to.

Law / Costa Rica

Código Penal, artículo 231, Espionaje informático

Codigo Penal (Ley No. 4573), art. 231, segun reforma por Ley No. 9048

In force since .

A computer misuse rule binding public and private bodies.

Criminal exposure
Yes
Private right of action
No
Criminal exposure note
Imprisonment of three to six years on conviction (Codigo Penal art. 231).
Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not use a computerized manipulation to appropriate, copy, or transmit information of economic or commercial value without the authorization of the system's owner or the party responsible for it.
  • Reading a page the operator has made public and unauthenticated has not itself been held to violate this article.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

What it makes you log

Logging duty

Article 231 defines the offence of computer espionage (taking, copying, transmitting, modifying or using commercially valuable information by computer or technological manipulation without the owner's authorization) and sets a prison term. It imposes no duty to create, keep, produce or review a log or record, and states no territorial test, so the hook is empty.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 231, added by Ley No. 9048, punishes with three to six years of imprisonment a person who, without the authorization of the owner or the party responsible, and by means of any computerized or technological manipulation, appropriates, transmits, copies, modifies, destroys, uses, blocks, or recycles information of value to the economic traffic of industry and commerce.

The offense's trigger is the absence of authorization from the system's owner or responsible party rather than the circumvention of a specific technical access control, so a plain reading leaves open whether reading a page an operator has made publicly and unauthenticated available is conduct the owner has thereby authorized.

The Legislative Assembly approved Ley No. 9048 on and the President signed it on ; the pgrweb consolidated text states it takes effect on publication.

When LexLint raises it

When your app profile says your app crawls the web or trains models.

Back to the example  ·  Lint your app

Page updated .