LexLint.ioBeta

Know the law your code answers to.

Law / Finland

Rikoslaki Chapter 38, Tietomurto and törkeä tietomurto (Computer Break-in and Aggravated Computer Break-in)

Rikoslaki (39/1889) 38 luku 8-8a sec, as amended by 10.4.2015/368

In force since .

A computer misuse rule binding public and private bodies.

Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not gain access to a computer system, or a separately protected part of one, by using an access code that does not belong to you or by otherwise breaking a protective measure, and do not obtain data from such a system without hacking into it by a special technical device, by bypassing a protective arrangement, by exploiting a vulnerability or by other clearly fraudulent means, under Rikoslaki 38 luku 8 sec.
  • Reading a public, unauthenticated page without defeating any access control has not itself been established as a computer break-in under this section.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Tietomurto (computer break-in, Section 8): fine or imprisonment for at most two years. Torkea tietomurto (aggravated computer break-in, Section 8a), committed as part of an organized criminal group or in a particularly methodical manner, and aggravated also when assessed as a whole: fine or imprisonment for at most three years.

Who enforces it

Enforcement body

Ordinary Finnish criminal courts, on public prosecution.

Settledness

As of
Open questions
  • Does a client that gets past a rate limit, IP block or bot challenge on a publicly served page break a 'turvajärjestely' (security arrangement) within the meaning of 8 § 1 momentti, so that the entry is a tietomurto?
  • Does 'oikeudettomasti' (without right) in 8 § 1 momentti turn on a site operator's terms of use that forbid automated access, or only on a technical safeguard that is broken?

What it makes you log

Logging duty

Sections 8 and 8 a define the offences of computer break-in and aggravated computer break-in. They impose no duty to create, keep, produce or review a log or record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 8 punishes unlawfully hacking into a computer system where data is processed, stored, or transmitted electronically, or into a separately protected part of such a system, by using an access code that does not belong to the offender or by otherwise breaking a protective measure, and separately punishes obtaining data from such a system without hacking into it, by a special technical device or by other technical means that bypass a protective arrangement, exploit a vulnerability or are otherwise clearly fraudulent, both as a computer break-in (tietomurto) punishable by a fine or imprisonment for at most two years; the section applies only where a more severe penalty is not provided elsewhere.

Section 8a raises the penalty to a fine or imprisonment for at most three years for an aggravated computer break-in, committed as part of an organized criminal group or in a particularly methodical manner, where the offense is also aggravated when assessed as a whole.

When LexLint raises it

When your app profile says your app crawls the web or trains models.

Back to the example  ·  Lint your app

Page updated .