Sierra LeoneCyber Security and Crime Act, 2021, unauthorised access
Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), s. 33 (Unauthorised Access)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- User location, Place of effect
- Audit expectation
- none
What it requires
- Do not cause a computer system to perform a function to gain access to a computer system, program, or data without authorisation, including by exceeding the level of access a person entitled to grant it has consented to.
- Reading a public, unauthenticated page without exceeding any consented scope of access has not itself been held to fall within this section's definition of unauthorised access.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fine of not less than Le 100,000,000 and not more than Le 250,000,000, or imprisonment of not less than 2 years and not exceeding 5 years, or both, on conviction; a corporation, partnership, or association faces a fine of not less than Le 500,000,000 and not exceeding Le 1,000,000,000 (s. 33(1)).
Penalty structure
Fine stated in the old Sierra Leonean Leone, the currency in circulation when this 2021 Act was passed (Sierra Leone redenominated to a new Leone in 2022). The same subsection also allows imprisonment of not less than 2 years and not exceeding 5 years instead of or in addition to the fine, and sets a separate, higher fixed range of Le 500,000,000 to Le 1,000,000,000 for a corporation, partnership, or association.
- Rule
- Fixed only
- As of
- Minimum
- 100,000,000
- Currency
- SLL
- Fixed cap
- 250,000,000
What it makes you log
Logging duty
Section 33 creates the offence of intentionally and without authorisation causing a computer system to perform a function to secure access to a computer system, with fines and imprisonment, and states no duty to create, keep, produce or review a log or record. Section 17 gives the High Court jurisdiction where the offence was committed within Sierra Leone or caused damage to a person who was in Sierra Leone at the time; those two limbs are the hook, and the limb that turns on a computer system situated in Sierra Leone has no value in the vocabulary and is not coded. Outside this row, Part IV lets an enforcement officer require preservation of computer data and traffic data by written notice for up to 30 days, extendable by a High Court judge, and lets a judge order real-time collection of traffic data or content data for not more than 30 days.
- Kind
- None
- As of
What this law does
Section 33(1) prohibits intentionally and without authorisation causing a computer system to perform a function with intent to secure access to the whole or a part of a computer system or to enable such access to be secured.
Section 33(3) defines unauthorised, for the purposes of this section, by reference to a person who has been authorised to access specific data and, without lawful excuse, causes the system to perform a function other than what was authorised, and section 33(4) confirms that the absence of authority includes a case where general authority exists but a specific type, nature, or method of access does not.
The Act's general interpretation section separately defines unauthorised access as access by a person who is either not entitled to access the computer system, program, or data at all, or who does not have or exceeds the level of authorisation consented to by the person entitled to grant it. Neither definition requires infringing a technical security measure to gain access, though both turn on there being a scope of consented access to exceed.
On conviction, an individual faces a fine of not less than Le 100,000,000 and not more than Le 250,000,000, or imprisonment of not less than 2 years and not exceeding 5 years, or both, and a corporation, partnership, or association faces a fine of not less than Le 500,000,000 and not exceeding Le 1,000,000,000.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .