KenyaComputer Misuse and Cybercrimes Act, 2018, unauthorised access
Computer Misuse and Cybercrimes Act, 2018 (No. 5 of 2018), s. 14 (unauthorised access)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- User location
- Audit expectation
- none
What it requires
- Do not gain access to a computer system by infringing a security measure, knowing the access is unauthorised, including to copy, transfer or output data from it.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate this section.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fine of up to KES 5,000,000 or imprisonment of up to three years, or both, on conviction (s. 14(1)).
Penalty structure
Fine only; the same subsection also allows imprisonment of up to three years instead of or in addition to the fine.
- Rule
- Fixed only
- As of
- Currency
- KES
- Fixed cap
- 5,000,000
Who enforces it
Settledness
- As of
- Open questions
- Does reading a public, unauthenticated page amount to 'infringing security measures' under section 14(1), and does 'not entitled to control access of the kind in question' in section 14(2)(a) turn on a site's terms of use or a robots.txt directive?
What it makes you log
Logging duty
Section 14 makes causing a computer system to perform a function by infringing security measures, with intent to gain access known to be unauthorised, an offence punishable by a fine of up to five million shillings or imprisonment of up to three years. It imposes no duty to create, keep, produce or review a log or record. The Act's investigation provisions on preserving, disclosing and collecting traffic and content data lie outside the cited section and are not read into this row.
- Kind
- None
- As of
What this law does
Section 14 prohibits causing a computer system to perform a function, by infringing a security measure, with intent to gain access, knowing the access is unauthorised, and defines access broadly to include copying, transferring, altering or outputting data. The offence carries a fine of up to KES 5,000,000 or imprisonment of up to three years, or both.
Because the offence's trigger is infringing a security measure, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .