SurinameWetboek van Strafrecht, Hacking and Denial of Access (arts. 187b-187c)
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not gain access to a computer system, or part of one, without authorization; access counts as unauthorized if it was obtained by breaking through security, a technical intervention, false signals or a false key, or by assuming a false identity.NIST AI RMFMAP 4.1
- If access to a system was unlawfully obtained, do not go on to copy, intercept, or record the data it holds, use its processing capacity for your own or another's benefit, or pivot through it to a third party's system.NIST AI RMFMAP 4.1
- Do not hinder another person's access to or use of a computer system by flooding it with data.no control in the NIST AI RMF
- Reading a public, unauthenticated page without defeating any access control has not itself been shown to meet this law's unlawful-access test.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of up to one year and/or a third-category fine (up to SRD 25,000) for basic unauthorized access (art. 187b(1)); imprisonment of up to four years and/or a fourth-category fine (up to SRD 50,000) for aggravated hacking that goes on to copy, intercept, or record the accessed data, or to pivot to a third party's system (art. 187b(2)-(3)); imprisonment of up to one year and/or a fourth-category fine for intentionally and unlawfully hindering access to or use of an automated work (art. 187c).
Penalty structure
Article 187b(1)'s cap for basic unauthorized access (hacking). Aggravated hacking under article 187b(2)-(3), and hindering access under article 187c, carry a fourth-category fine of up to SRD 50,000 instead, with imprisonment of up to one year for basic hacking and for hindering access, and up to four years for aggravated hacking.
- Rule
- Fixed only
- As of
- Currency
- SRD
- Fixed cap
- 25,000
What it makes you log
Logging duty
Articles 187b and 187c punish hacking (intentional and unlawful access to an automated work) and the intentional, unlawful hindering of access to or use of an automated work by sending it data. Article 187b(2) and (3) treat taking over, tapping or recording data after unlawful access as an aggravation. None of these articles requires anyone to create, keep, produce or review a log or record, and they carry no territorial clause.
- Kind
- None
- As of
What this law does
Article 187b(1) punishes intentionally and unlawfully gaining access to an automated work, or part of one, as hacking, with imprisonment of up to one year and a third-category fine (up to SRD 25,000), or either penalty; access is in any case deemed unlawful where it was obtained by breaking through a security measure, a technical intervention, false signals or a false key, or by assuming a false identity.
Article 187b(2)-(3) raises the penalty to up to four years and a fourth-category fine (up to SRD 50,000) where the offender, having gained unlawful access, then takes over, taps or records the data held on the system, uses its processing capacity for unlawful gain, or pivots through it to a third party's system.
Article 187c separately punishes, with up to one year and a fourth-category fine, intentionally and unlawfully hindering another person's access to or use of an automated work by offering or sending data to it. Because article 187b(1) deems access unlawful in any case when it is obtained by one of those four means, without limiting unlawfulness to them, the text does not settle whether reading a public, unauthenticated page without such circumvention is unlawful access.
The law provides that it takes effect the day after its promulgation in the Staatsblad. De Nationale Assemblee's own legislative record lists this law under Staatsblad 2015 no. 44 and the date . No source stating the resulting day has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .