Sri LankaComputer Crime Act, unauthorised access, modification and dealing with unlawfully obtained data
Computer Crime Act, No. 24 of 2007, ss. 3-7
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.icta.lk/icta-assets/uploads/2016/03/ComputerCrimesActNo24of2007.pdfIn force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- User location, Place of effect
- Audit expectation
- none
What it requires
- Do not secure access to a computer or to information held in it without lawful authority; the test does not turn on defeating a technical control, so relying on a page being public and unauthenticated is not itself a defence and has not been tested by a Sri Lankan court.NIST AI RMFMAP 4.1
- Do not intentionally cause unauthorised modification or damage to a computer, computer system, or computer programme in the course of an automated collection process.no control in the NIST AI RMF
- Do not buy, receive, retain, download, upload, or copy information known or believed to have been obtained from a computer without lawful authority by someone else.NIST AI RMFMAP 4.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 3 (unauthorised access): a fine up to LKR 100,000, or imprisonment up to five years, or both. Section 4 (unauthorised access with intent to commit a further offence): a fine up to LKR 200,000, or imprisonment up to five years, or both. Section 5 (unauthorised modification or damage): a fine up to LKR 300,000, or imprisonment up to five years, or both. Section 6 (danger to national security, the economy, or public order): imprisonment up to five years, with no fine option stated. Section 7 (dealing with unlawfully obtained data): a fine of not less than LKR 100,000 and not exceeding LKR 300,000, or imprisonment of not less than six months and not exceeding three years, or both.
What it makes you log
Logging duty
Sections 3 to 7 make unauthorized access to a computer, access to commit a further offence, unauthorized modification or damage, acts endangering national security, the national economy or public order, and dealing with unlawfully obtained information offences. It imposes no duty to create, keep, produce or review a log or record. Section 2 sets the Act's reach: the person present in Sri Lanka or outside it, and loss or damage caused to the State or to a person resident in Sri Lanka; those two limbs are read as a presence test and an effects test. The limbs that turn on where the computer or the service sits are left out.
- Kind
- None
- As of
What this law does
Section 3 makes it an offence to intentionally secure access to a computer or to information held in it, knowing or having reason to believe there is no lawful authority for that access; section 4 raises the same conduct to a second offence where it is done with intent to commit a further offence.
Neither section requires infringing a security measure or defeating any technical control, so the provision's reach over a public, unauthenticated page turns entirely on whether the accessor had lawful authority, a question no reported Sri Lankan decision has tested against a scraping fact pattern. Section 5 separately criminalises causing a computer to perform a function that the person knows or has reason to believe will result in unauthorised modification or damage.
Section 6 criminalises intentionally causing danger or imminent danger to national security, the national economy, or public order. Section 7 criminalises buying, receiving, retaining, selling, downloading, uploading, copying or otherwise dealing with information known or believed to have been obtained from a computer without lawful authority by another person. The Act's own section 1 defers its commencement to a date the Minister appoints by Gazette Order.
The revised edition of the Laws of Sri Lanka gives as the Act's date of commencement. No notice of the Minister's Order has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .