EthiopiaComputer Crime Proclamation
Proclamation No. 958/2016 (Federal Negarit Gazette, 22nd Year No. 83, )
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction, Security
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not secure access to the whole or any part of a computer system, computer data, or network without authorization or in excess of authorization; access includes viewing, receiving, moving or copying data from a computer system.
- Do not intercept non-public computer data or a data-processing service without authorization.
- Do not, without authorization or in excess of authorization, hinder, impair, interrupt or disrupt the proper functioning of the whole or any part of a computer system by inputting, transmitting, deleting or altering computer data.
- Do not, without authorization or in excess of authorization, alter, delete or suppress computer data, or render it meaningless, useless or inaccessible to authorized users.
- Do not falsify computer data, make false computer data or make use of such data to injure the rights or interests of another or to procure an undue right or advantage.
- Do not fraudulently cause a person to act to the prejudice of his own rights or those of a third person by distributing misleading computer data, and do not cause economic loss to another person, with fraudulent intent of procuring a benefit, by changing, deleting or otherwise damaging computer data.
- As a service provider, remove or disable access to illegal content data disseminated by a third party through your systems once you obtain actual knowledge of it or a notice from a competent authority.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Illegal access carries simple imprisonment up to three years or a fine of Birr 30,000 to 50,000 for the base offence, rising through two tiers to rigorous imprisonment of five to ten years and a fine of 50,000 to 100,000 where the target is critical infrastructure (art. 3). Illegal interception carries rigorous imprisonment up to five years and a fine of 10,000 to 50,000 for the base offence, rising to ten to fifteen years and a fine of 100,000 to 200,000 against critical infrastructure (art. 4). Interference with a computer system carries rigorous imprisonment of three to five years and a fine up to 50,000 for the base offence, rising in a serious case against critical infrastructure to fifteen to twenty years and a fine of 200,000 to 500,000 (art. 5). Computer data damage carries rigorous imprisonment up to three years and a fine up to 30,000 (art. 6), computer-related forgery simple imprisonment up to three years and a fine up to 30,000 (art. 9), and computer-related fraud rigorous imprisonment up to five years and a fine up to 50,000 (art. 10). A service provider's criminal liability under art. 16 is measured by reference to arts. 12 to 14 of the Proclamation. Where an offence under Part Two is committed by a juridical person, art. 20 fixes a fine of Birr 50,000 to 500,000 for a crime punishable with fine, and a fine scaled to the term of imprisonment otherwise, up to the same general maximum.
Penalty structure
Against a natural person the Proclamation's stated fine figures run from Birr 30,000 to 50,000 for the base illegal-access offence (art. 3(1)) up to Birr 200,000 to 500,000 for a serious case of interference with critical infrastructure (art. 5(2)(b)). Where the offender is a juridical person, art. 20(1) fixes a fine of Birr 50,000 to 500,000 for a crime punishable with fine, and art. 20(2) scales the fine to the term of imprisonment, from Birr 50,000 for simple imprisonment up to three years to the general maximum of art. 20(1) for rigorous imprisonment exceeding ten years. Art. 20(3) separately provides that where fine is expressly provided as punishment for a crime, it shall be five fold; the text does not say how that multiplier combines with the figures above.
- Rule
- Fixed only
- As of
- Currency
- ETB
- Fixed cap
- 500,000
Who enforces it
Enforcement body
Ministère public (ordinary criminal courts)
Settledness
- As of
- Open questions
- Does "without authorization or in excess of authorization" in Article 3(1) reach a person who retrieves content from a computer system that any visitor can request without a login, given that Article 2(10) counts viewing and copying data among the acts of access and the Proclamation does not define "authorization"?
- In Article 3(1), what fixes the limit of "authorization" or "in excess of authorization": the system owner's technical measures, its published terms of use, or an individual instruction to the person who "intentionally secures access"?
What it makes you log
Who may demand the log
Court
What the log must hold
Event time, Access record
Log retention
One year, with no start date stated in article 24(1).
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 1
- Minimum value
- 1
Logging duty
Article 24(1) requires any service provider to retain the computer traffic data disseminated through its computer systems, or the traffic data relating to data processing or a communication service, for one year. Article 2(6) defines traffic data as data showing a communication's origin, destination, route, time, date, duration, size or type of service. Article 24(2) keeps the data secret unless the court orders disclosure. Articles 30 and 31 let the investigatory organ order a person to preserve specified data for three months, extendable once, and apply to a court for an order to obtain it. The row's offences impose no record duty of their own. Article 40(2) extends the territorial reach of articles 13 and 17(1)(b) of the Criminal Code to computer crimes, but the conditions of those two articles are not in the text read, so no territorial hook value is given.
- Kind
- Explicit
- As of
- Provision
- Proclamation No. 958/2016, art. 24 (retention of computer traffic data for one year, kept secret unless a court orders disclosure), with art. 30 (order to preserve computer data) and art. 31 (order to obtain computer data)
- Trigger
- all_systems
What this law does
Article 2(10) defines access to include to view, receive, move or copy data from a computer system. Article 3 punishes intentionally securing access to the whole or any part of a computer system, computer data, or network, without authorization or in excess of authorization, with simple imprisonment up to three years or a fine of Birr 30,000 to 50,000.
Where the target of an Article 3 offence is a system, data or network destined exclusively for a legal person, the penalty rises to rigorous imprisonment of three to five years and a fine of 30,000 to 50,000. Where the target of an Article 3 offence is critical infrastructure, the penalty rises to rigorous imprisonment of five to ten years and a fine of 50,000 to 100,000.
Article 4 punishes intentionally intercepting non-public computer data or a data-processing service, without authorization or in excess of authorization, with rigorous imprisonment up to five years and a fine of 10,000 to 50,000. Where the target of an Article 4 offence is data or a data-processing service destined exclusively for a legal person, the penalty rises to rigorous imprisonment of five to ten years and a fine of 50,000 to 100,000.
Where the target of an Article 4 offence is critical infrastructure, the penalty rises to rigorous imprisonment of ten to fifteen years and a fine of 100,000 to 200,000.
Article 5 punishes intentionally hindering, impairing, interrupting or disrupting the proper functioning of the whole or any part of a computer system by inputting, transmitting, deleting or altering computer data, without authorization or in excess of authorization, with rigorous imprisonment of three to five years and a fine of up to Birr 50,000.
Where the target of an Article 5 offence is a computer system destined exclusively for a legal person, the penalty rises to rigorous imprisonment of five to ten years and a fine of 50,000 to 100,000. Where the target of an Article 5 offence is critical infrastructure, the penalty rises to rigorous imprisonment of ten to fifteen years and a fine of 100,000 to 200,000, or in a serious case fifteen to twenty years and a fine of 200,000 to 500,000.
Article 6 punishes intentionally altering, deleting or suppressing computer data, or rendering it meaningless, useless or inaccessible to authorized users, without authorization or in excess of authorization, with rigorous imprisonment of up to three years and a fine of up to Birr 30,000. Where the target of an Article 6 offence is data destined exclusively for a legal person, the penalty rises to rigorous imprisonment of three to five years and a fine of 30,000 to 50,000.
Where the target of an Article 6 offence is critical infrastructure, the penalty rises to rigorous imprisonment of five to ten years and a fine of 50,000 to 100,000. Article 9 punishes falsifying computer data, making false computer data or making use of such data to injure the rights or interests of another or to procure an undue right or advantage.
Computer-related forgery under Article 9 carries simple imprisonment of up to three years and a fine of up to Birr 30,000, or in serious cases rigorous imprisonment of up to ten years and a fine of 10,000 to 100,000.
Article 10(1) punishes fraudulently causing a person to act in a manner prejudicial to his own rights or those of a third person by distributing misleading computer data, misrepresenting his status, concealing facts he had a duty to reveal or taking advantage of the person's erroneous beliefs, with rigorous imprisonment of up to five years and a fine of up to Birr 50,000.
Article 10(2) punishes causing economic loss to another person, with fraudulent intent of procuring a benefit, by any change, deletion or other damage of computer data, with rigorous imprisonment of up to five years and a fine of 10,000 to 50,000, or in serious cases rigorous imprisonment of up to ten years and a fine of 10,000 to 100,000.
Article 16 makes a service provider criminally liable for illegal content data that a third party disseminates through the provider's own computer systems, but only where the provider directly participated in disseminating or editing the content, or, on obtaining actual knowledge that the content is illegal or a notice from a competent administrative authority, failed to take measures to remove or disable access to it.
Article 17 punishes a person's failure to cooperate with an investigative obligation imposed under specified articles of the Proclamation with simple imprisonment up to one year or a fine up to Birr 10,000. Article 17 also punishes intentional hindrance of a computer-crime investigation with rigorous imprisonment up to five years and a fine up to Birr 50,000.
Where an offence under Part Two of the Proclamation is committed by a juridical person, Article 20 fixes a fine of Birr 50,000 to 500,000 for a crime punishable with fine. Where the penalty is imprisonment, Article 20(2) caps the fine at Birr 50,000 for simple imprisonment of up to three years, Birr 100,000 for simple imprisonment of up to five years, Birr 150,000 for rigorous imprisonment of up to five years and Birr 200,000 for rigorous imprisonment of up to ten years.
For rigorous imprisonment exceeding ten years the cap on a juridical person's fine is the general maximum of Birr 500,000 stated in Article 20(1). Article 20(3) adds that where fine is expressly provided as punishment for a crime, it shall be five fold. None of these provisions exempts a publicly accessible, unauthenticated page from the definition of unauthorized access.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .