KyrgyzstanCriminal Code, unauthorized access to computer information
Criminal Code of the Kyrgyz Republic, No. 127 (), Chapter 40, Art. 319
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://legislationline.org/sites/default/files/2025-03/KG_Criminal%20Code%202021_EN.pdfIn force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not gain unauthorized access to another person's protected computer information, electronic documents, information system, or telecommunications network, including by defeating an access control, where doing so destroys, blocks, or modifies data or disrupts a processing device.
- A more serious tier applies where the access is committed by a group, causes major damage, reaches critical information infrastructure, or is undertaken to intentionally destroy, alter, or disable the system.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate this article.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Base tier (Art. 319(1)): community service of 40 to 100 hours, deprivation of the right to hold certain positions or engage in certain activities for up to three years, correctional labor of two months to one year, or a fine of 200 to 500 calculated units. Aggravated tiers (Art. 319(2), (3), (4), covering group commission, major damage, critical infrastructure, or intentional destruction/disabling): a fine of 500 to 1000 calculated units or imprisonment of up to five years, with or without deprivation of the right to hold certain positions for up to two years. The statute states these amounts in calculated units rather than a fixed currency sum; no conversion to Kyrgyz som is stated in the source.
What it makes you log
Logging duty
Article 319 punishes unauthorized access to another person's protected computer information, an information system or a telecommunications network that destroys, blocks or modifies information or disrupts processing devices. It imposes no duty to create, keep, produce or review a log or record. The Code's general rules on where it applies are not invoked by the article, so no territorial hook is read from it.
- Kind
- None
- As of
What this law does
Art. 319(1), read in full, prohibits unauthorized access to someone else's protected computer information, electronic documents, an information system, or a telecommunications network, where the access results in destruction, blocking, or modification of information, or in disruption of processing devices, causing significant harm intentionally or through negligence; the base tier is community service, deprivation of the right to hold certain positions, correctional labor, or a fine of 200 to 500 calculated units.
Art. 319(2) raises the penalty to a fine of 500 to 1000 calculated units or imprisonment of up to five years where the act is committed by a group by prior agreement, causes major damage through negligence, or reaches critical information infrastructure.
Art. 319(3) sets the same 500-to-1000-unit or five-year tier for the same base conduct committed with intent to destroy, alter, block, or render unusable the information or to disable the system, and Art. 319(4) applies that tier's aggravating circumstances to the intentional form as well.
The same Chapter 40 separately criminalizes creating malicious software (Art. 320), cyber-sabotage (Art. 321), and unsolicited mass distribution of electronic messages that disrupts a system's operation (Art. 322), each read at the same source.
Because Art. 319's trigger is unauthorized access resulting in one of the listed harms, a scraper reading a public, unauthenticated page without defeating any access control, and without destroying, blocking, or modifying the page's information, falls outside a plain reading of the provision. Article 319 was set out anew by Article 11, point 1 of the Law of the Kyrgyz Republic of No. 4, On the Introduction of the Tax Code.
Article 23 of that Law brings it into force on , except Articles 19 and 20 of that Law and two Tax Code provisions, which start on .
When LexLint raises it
When your app profile says your app crawls the web, trains models or sends automated outreach.
Back to the example · Lint your app
Page updated .