Cabo VerdeCybercrime Law, Unauthorised Access to a Computer System
Lei n.º 8/IX/2017, art. 6.º (acesso ilícito), de 20 de Março (Lei do Cibercrime)
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer system without legal permission or authorization from its owner or another rights holder, and do not produce, sell, distribute, or introduce a device, program, or code intended to produce that unauthorised access.
- Reading a page a system's own operator has made available without defeating a security measure has not itself been located as a violation of this article.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Base unauthorised access draws up to one year's imprisonment or a fine of up to 120 days (Article 6(1)); access achieved by violating security rules draws up to three years' imprisonment or a fine (Article 6(3)); access through which the agent learns a commercial or industrial secret, legally protected confidential data, or obtains a considerably high benefit draws one to five years' imprisonment (Article 6(4)). These are day-fine terms; the statute does not itself state the escudo value of a day-fine unit, so the fine cannot be stated in escudos.
Who enforces it
Enforcement body
Ministério Público (public prosecution), through the ordinary criminal courts; Article 6(6) makes the base offence dependent on a complaint
What it makes you log
Logging duty
Article 6 defines the offence of unlawful access to a computer system (including producing or distributing devices or code meant for it, access by violating security rules, and access that reveals a commercial or industrial secret), and makes the base offence depend on a complaint. It imposes no duty to create, keep, produce or review a log or record, and states no territorial test, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 6(1) punishes with imprisonment of up to one year or a fine of up to 120 days anyone who, intentionally and without legal permission or without being authorised for that purpose by the owner or another rights holder of the system or part of it, in any way accesses a computer system.
Article 6(2) punishes the same conduct where a person produces, sells, distributes, disseminates, or introduces into one or more computer systems a device, program, executable set of instructions, code, or other computer data intended to produce that unauthorised access.
Article 6(3) raises the penalty to up to three years' imprisonment or a fine where the access is achieved through violation of security rules, and Article 6(4) raises it to one to five years' imprisonment where the agent thereby learns a commercial or industrial secret or legally protected confidential data, or obtains a considerably high patrimonial benefit or advantage.
Article 6(5) makes an attempt punishable, and Article 6(6) makes criminal proceedings for the base offences under paragraphs 1, 3 and 5 dependent on a complaint. Article 2 defines a computer system as any device or interconnected set of devices carrying out automated processing of computer data, together with the network supporting communication between them and the data stored, processed, retrieved, or transmitted by them.
The Law was approved by the Assembleia Nacional on , promulgated by the President of the Republic on , and published in the Boletim Oficial of ; its own Article 33 provides that it enters into force 30 days after publication. It was published in Boletim Oficial n.º 13, I Série, of . No notice stating the day on which the thirty days ended has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .