LibyaLaw No. 5 of 2022 on Combating Cybercrimes, unauthorised access and system interference
Law No. 5 of 2022 Concerning Combating Cybercrimes, arts. 10-16
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not breach a website's or information system's protection measures to access it without authorization, in whole or in part.
- Do not delete, alter, disclose, or copy data, or disable or deface a system, once inside it without authorization.
- Do not intercept an information system to obtain digital data, and do not possess or distribute a tool prepared to reveal passwords or break protection measures.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Base unauthorized access (art. 12) carries up to one year's imprisonment and a fine of 100 to 500 Libyan dinars; access intended to delete, alter, disclose, or copy data, disable a system, or deface or impersonate a website's owner carries at least one year and 500 to 5,000 dinars; access that disables an information system or disrupts a network's operation carries imprisonment and a fine of no less than 10,000 dinars with no stated ceiling. Interception (art. 13) carries at least one year and 1,000 to 5,000 dinars, and possessing or distributing password-breaking tools (art. 14) carries at least one year and 1,000 to 10,000 dinars.
Penalty structure
Article 14's 1,000 to 10,000 dinar range for possessing or distributing password-breaking tools is the highest ceiling stated among the computer-misuse offences; article 12's system-disruption tier sets only a floor of no less than 10,000 dinars with no stated ceiling in the text, so exposure for that specific offence is not capped by this figure.
- Rule
- Fixed only
- As of
- Currency
- LYD
- Fixed cap
- 10,000
Who enforces it
Enforcement body
National Authority for Information Security and Safety; ordinary criminal courts
Settledness
- As of
- Open questions
- Does Article 11, which makes access to a website unlawful "if the protection measures are intentionally breached, wholly or partially, without authorisation or violating authorisation", apply where a page has no protection measure, given that Article 5 prohibits "unauthorised access, deletion, destruction, disabling, alteration, transfer, or copying" of a website's data without the owner's consent?
- Does Article 3 reach an operator outside Libya who retrieves pages from a Libyan-hosted website, and what makes the act one whose "results and effects extend within Libya"?
What it makes you log
Logging duty
Articles 10 to 16 define offences (influencing an electronic system, unlawful access when protection measures are intentionally breached, interception, possession of decoding programs, damaging an information system for financial benefit, falsifying data) and fix their penalties. None of them requires anyone to make, keep, produce or review a log or record. The act as read has no territorial clause for these articles, so the hook is left empty.
- Kind
- None
- As of
What this law does
Article 11 of Law No. 5 of 2022 makes accessing a computer system, information system, information network, or website unlawful only where its protection measures are intentionally breached, wholly or partially, without authorization or in violation of an authorization.
Article 12 punishes unauthorized access with up to one year's imprisonment or a fine of 100 to 500 Libyan dinars, rising to at least one year and 500 to 5,000 dinars where the access deletes, alters, discloses, or copies data or disables or defaces a system, and to imprisonment and a fine of no less than 10,000 dinars where the access disables an information system or disrupts a network's operation.
Article 10 separately prohibits influencing an electronic system, network, or record by obtaining, disclosing, transmitting, or publishing a password, code, or other confidential data with intent to gain an unauthorized benefit or harm another.
Article 13 punishes intercepting an information system to obtain digital data with at least one year's imprisonment and a fine of 1,000 to 5,000 dinars, and article 14 punishes possessing or distributing a device or program prepared to reveal passwords or access codes or to break protection measures with at least one year's imprisonment and a fine of 1,000 to 10,000 dinars.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .