EstoniaKaristusseadustik (Penal Code) Section 217, Illegal Obtaining of Access to a Computer System
Karistusseadustik, RT I, 12.07.2014, 1, Section 217
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not eliminate or avoid a technical means of protection, such as authentication, to obtain access to a computer system; Section 217 does not reach access to a system that carries no such protective measure.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Up to three years' imprisonment or a pecuniary punishment for illegally obtaining access to a computer system by eliminating or avoiding a means of protection (subsection 1); up to five years' imprisonment or a pecuniary punishment where the act causes significant damage, reaches a computer system holding a state secret, classified foreign information or official-use-only information, or reaches a computer system of a vital sector (subsection 2). A legal person is punished by a pecuniary punishment (subsection 3).
Who enforces it
Settledness
- As of
- Open questions
- Does a login, a CAPTCHA or a rate limit count as a 'kaitsevahend' whose removal or circumvention ('kõrvaldamise või vältimise') gives illegal access under Section 217(1)?
- Does a person who holds a valid account and uses it against the operator's terms obtain access 'ebaseaduslikult' under Section 217(1)?
What it makes you log
Logging duty
Section 217 defines the offence of unlawfully gaining access to a computer system by removing or bypassing a protective measure. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Illegal obtaining of access to a computer system by elimination or avoidance of a means of protection is punishable by a pecuniary punishment or up to three years' imprisonment. The offense escalates to up to five years' imprisonment where the act causes significant damage, reaches a computer system holding a state secret or classified information, or reaches a computer system of a vital sector.
Because the base offense requires eliminating or avoiding an established means of protection, accessing a page that carries no such protection, the ordinary case of public-web crawling, does not fall within Section 217 on the text of the section alone.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .