DjiboutiDigital Code, Book VI: Fraudulent Access to Information Systems
Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Sixième, Arts. 555 à 559
In force.
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not access or attempt to access an information system, or a part of one, without authorization.NIST AI RMFMAP 4.1
- Do not remain, or attempt to remain, within an information system after having fraudulently entered it.NIST AI RMFMAP 4.1
- Do not introduce, or attempt to introduce, data into an information system without authorization.no control in the NIST AI RMF
- Reading a public, unauthenticated page without defeating an access control or a technical measure protecting the system is not on the face of these articles an offence.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Fraudulent access or continued presence in an information system draws up to three years' imprisonment and a fine of up to 10,000,000 Djiboutian francs (Articles 555 and 556), rising to up to five years and a fine of up to 25,000,000 francs where it results in the deletion or modification of data (Article 557); fraudulently introducing data or disrupting a system's operation each separately draw up to five years' imprisonment and a fine of up to 25,000,000 francs (Articles 558 and 559).
Penalty structure
Graduated by offence: fraudulent access or continued presence in a system (Arts. 555, 556) caps at 10,000,000 francs and three years' imprisonment; aggravated access or continued presence that deletes or modifies data (Art. 557), fraudulent data introduction (Art. 558), and disrupting a system's operation (Art. 559) each cap at 25,000,000 francs and five years' imprisonment.
- Rule
- Fixed only
- As of
- Currency
- DJF
- Fixed cap
- 25,000,000
Who enforces it
Enforcement body
Public prosecution (Ministère Public), under the ordinary Djiboutian criminal-procedure framework
What it makes you log
Logging duty
Articles 555 to 559 of Book VI define the offences of fraudulent access to, and fraudulent persistence in, an information system, the aggravated form where data is deleted or modified, fraudulent introduction of data, and disruption of a system's operation, with their penalties. None imposes a duty to create, keep, produce or review a log or record, and none states a territorial test, so the hook is empty. Other parts of the Code that may set record or retention duties are outside the cited articles and are not read into the row.
- Kind
- None
- As of
What this law does
Article 555 punishes anyone who has accessed or attempted to fraudulently access all or part of an information system with a maximum of three years' imprisonment and a maximum fine of 10,000,000 Djiboutian francs, or either penalty alone. Article 556 punishes fraudulently remaining, or attempting to remain, within all or part of a system after having entered it fraudulently, with the same maximum penalties.
Article 557 raises both offences to a maximum of five years' imprisonment and a maximum fine of 25,000,000 francs where the fraudulent access or continued presence results in the deletion or modification of data held in the system. Article 558 separately punishes fraudulently introducing, or attempting to introduce, data into an information system, with a maximum of five years' imprisonment and a maximum fine of 25,000,000 francs or either penalty alone.
Article 559 punishes disrupting, altering or falsifying, or attempting to disrupt, alter or falsify, the operation of an information system on the same terms as Article 558. Each offence is drafted around unauthorised access or interference with a system rather than around the reading of a page that requires no authorisation, so a scraper confined to public, unauthenticated pages is not on the face of these articles caught by them.
The Digital Code was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force. Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. No notice or register stating the day the Digital Code came into force has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .