NauruCybercrime Act 2015, illegal access to a protected computer
Cybercrime Act 2015 (No. 14 of 2015), s. 6 (illegal access)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://ronlaw.gov.nr/nauru_lpms/files/acts/a59d9691f5a195412b877493a2a95e8b.pdfIn force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access the whole or part of a protected computer, meaning one connected to the Republic's security, defence, or international relations, a confidential law-enforcement source, communications, public-utility, or public-key infrastructure, or public safety and essential emergency services, without a lawful excuse.
- Reading a public, unauthenticated page that is not a protected computer of that kind has not itself been held to violate this section.
- Do not obtain electronic data that is specially protected against unauthorised access and not meant for you.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Wilfully accessing a protected computer without lawful excuse is punishable on conviction by imprisonment for a period not exceeding 7 years (s. 6(2)); no fine is provided as an alternative.
What it makes you log
Logging duty
Section 6 makes it an offence wilfully and without lawful excuse to access the whole or any part of a protected computer, with a presumption of knowledge where a warning was shown. It imposes no duty to create, keep, produce or review a log or record. The preservation and traffic-data provisions in Part 3 (for example section 27) arise only on a police or court order and are not cited by this row. Section 4 treats an offence under the Act by a person outside the Republic as committed within it and applies the Act as if the accused, or the computer, program or data, was in the Republic; only the limb that turns on the accused being in the Republic is set as a hook, and the limb that turns on where the computer or data sits is not.
- Kind
- None
- As of
What this law does
Section 6 makes it an offence, punishable by imprisonment for up to seven years, for a person to wilfully and without lawful excuse access the whole or part of a 'protected computer'. The section defines a protected computer as one the offender knew, or ought reasonably to have known, is used directly in connection with the security, defence, or international relations of the Republic, or a confidential source of information relating to the enforcement of a criminal law.
It also reaches a computer used directly in connection with communications infrastructure, public utilities or public-key infrastructure, or the protection of public safety including systems related to essential emergency services. Because the offence's trigger is accessing a protected computer of that kind rather than any computer generally, a plain reading does not extend it to scraping an ordinary public, unauthenticated website that is not connected to those categories.
Section 9 separately criminalises data espionage, obtaining electronic data not meant for the offender that is specially protected against unauthorised access, which could reach scraping conducted behind a technical access control even where section 6 does not apply.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .