JapanAct on Prohibition of Unauthorized Computer Access, prohibition of unauthorized access
In force.
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not operate a computer connected to a telecommunications line, where it carries an access control feature, by inputting another person's identification code, or by inputting other information or a command designed to evade that feature, without the access administrator's or the authorized user's permission.
- Reading a public, unauthenticated page that carries no access control feature to defeat has not itself been held to violate this Act.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Violating the prohibition on unauthorized computer access (Art. 3) is punished by imprisonment for not more than three years or a fine of not more than 1,000,000 yen (Art. 11); violating the identification-code, facilitation, storage, or impersonation provisions (Arts. 4, 6, 7, 9(3)) is punished by imprisonment for not more than one year or a fine of not more than 500,000 yen (Art. 12), and violating the code-supply provision (Art. 5) alone is punished by a fine of not more than 300,000 yen (Art. 13).
Penalty structure
The Art. 3 prohibition on unauthorized computer access carries the Act's highest tier: a fine of up to 1,000,000 yen or imprisonment for up to three years, or both (Art. 11). Lesser offences under the Act cap at 500,000 yen (Art. 12) or 300,000 yen (Art. 13).
- Rule
- Fixed only
- As of
- Currency
- JPY
- Fixed cap
- 1,000,000
What it makes you log
Logging duty
Articles 2(4), 3 and 11 define the prohibited act of unauthorized computer access and its penalty (imprisonment with work for up to three years or a fine of up to 1,000,000 yen); they impose no duty to create, keep, produce or review a log or record. Article 8, outside the cited articles, asks an access administrator to endeavor to inspect the effectiveness of its access control feature, and Article 9 describes the police commission's assistance after an incident; neither is read into this row. Article 14 applies Article 4-2 of the Penal Code to the Article 11 offence, which carries no connecting factor that the hook vocabulary can express.
- Kind
- None
- As of
What this law does
Article 2(4) defines an act of unauthorized computer access as operating a specified computer that carries an access control feature, in a way the feature restricts, by inputting via a telecommunications line another person's identification code associated with that feature, or other information or a command designed to evade the feature.
Article 3 prohibits any person from engaging in such an act; violating it is punished under Article 11 by imprisonment for not more than three years or a fine of not more than 1,000,000 yen. The Act also prohibits obtaining, storing, or supplying such an identification code for that purpose, and impersonating an access administrator to solicit one (Arts. 4 through 7), each punished less severely under Articles 12 and 13.
Because every prohibited act requires defeating an access control feature the target computer already carries, reading a public, unauthenticated page that carries no such feature falls outside a plain reading of the Act. The sections this entry groups came into force on different days.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .