LexLint.ioBeta

Know the law your code answers to.

Law / Lithuania

Criminal Code Arts. 196-198 and 198-1, Computer Misuse and Unauthorised Access Offenses

BK arts. 196, 197, 198, 198-1

In force since .

A computer misuse rule binding public and private bodies.

Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not connect to an information system in Lithuania, or a part of it, by breaching its security measures (Criminal Code Art. 198-1(1)). Do not unlawfully connect to an information system of strategic significance for national security or great significance for the state governance, the economy or the financial system, or a part of it (Art. 198-1(2)).
  • Do not destroy, damage, delete, alter, or otherwise restrict the use of electronic data on a system in Lithuania without authorization, or disrupt the system's operation (Criminal Code Arts. 196 and 197). Do not unlawfully observe, intercept, acquire, hold, or disseminate non-public electronic data (Art. 198).

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Criminal Code Art. 198-1(1) punishes unauthorized connection to an information system by breaching its security measures with up to two years' imprisonment, and Art. 198-1(2) punishes unauthorized connection to a system of strategic significance for national security or great significance for state governance, the economy or the financial system with up to three years; Arts. 196-197 punish unlawful interference with electronic data or an information system's operation with up to two years (six years aggravated); Art. 198 punishes unlawful interception and use of non-public electronic data with up to four years (six years aggravated). A legal entity is also liable under each article.

Who enforces it

Settledness

As of
Open questions
  • Does a rate limit or CAPTCHA on a public page count as 'informacinės sistemos apsaugos priemones' (protection measures of the information system) under Article 198-1 paragraph 1?
  • Does 'neteisėtai prisijungė' (unlawfully connected) in Article 198-1 paragraph 1 reach an automated client that connects to a public page against the operator's terms of use?

What it makes you log

Logging duty

Articles 196, 197, 198 and 198-1 define the offences of unlawful interference with electronic data and information systems, unlawful interception and use of non-public electronic data, and unlawful connection to an information system. They impose no duty to create, keep, produce or review a log or record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 198-1(1) punishes unlawfully connecting to an information system or part of it by breaching that system's security measures, up to two years' imprisonment, and is keyed to breaching a security measure, so a crawl of a page with no security measure to breach is not reached by it.

Article 198-1(2) punishes unlawfully connecting to an information system or part of it that has strategic significance for national security or great significance for state governance, the economy or the financial system, up to three years.

Articles 196 and 197 punish unlawfully destroying, damaging, deleting, or altering electronic data, or disrupting an information system's operation, causing damage, up to two years, rising to six years where the act reaches many systems or a system of strategic or great significance, uses another person's personal data, or causes great damage.

Article 198 punishes unlawfully observing, recording, intercepting, acquiring, holding, disseminating, or otherwise using non-public electronic data, up to four years, rising to six years for such data of strategic significance for national security or great significance for state governance, the economy or the financial system. A legal entity is also liable for each offense.

When LexLint raises it

When your app profile says your app crawls the web.

Back to the example  ·  Lint your app

Page updated .