VenezuelaLey Especial contra los Delitos Informáticos, unauthorized access and sabotage of systems (Arts. 6-11)
LECDI, Gaceta Oficial N° 37.313, 30/10/2001, arts. 6-11
In force.
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, intercept, interfere with, or use a computer system without authorization or in excess of the authorization obtained.NIST AI RMFMAP 4.1
- The penalty is a third to a half higher where the system holds personal or patrimonial data, or serves a public function.
- Do not import, distribute, sell, or use equipment or programs meant to defeat a system's security measures.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 6 (unauthorized access): imprisonment of one to five years and a fine of ten to fifty tax units. Article 7 (sabotage): imprisonment of four to eight years and a fine of four hundred to eight hundred tax units, rising to five to ten years and five hundred to one thousand tax units if a virus is used. Article 9 raises any of these penalties by a third to a half where the system holds personal or patrimonial data or serves a public function. Article 10 (circumvention tools): imprisonment of three to six years and a fine of three hundred to six hundred tax units. Article 11 (improper obtaining or disclosure): imprisonment of three to six years and a fine of three hundred to six hundred tax units, raised where done for profit or where it endangers state security.
What it makes you log
Logging duty
Articles 6 to 11 of the Special Law Against Computer Crimes make it an offence to access, intercept, interfere with or use an information-technology system without due authorisation or beyond it (article 6), to destroy, damage or disable a system or its data (article 7, with the negligent form in article 8 and the aggravation in article 9), to supply tools meant to defeat a system's security (article 10), and to obtain or reveal data held in a system (article 11). None of them requires anyone to create, keep, produce or review a log or record. Article 3 applies the Law to an offence committed abroad where the act had effects within the Republic, which is the effects hook. The row cites only articles 6 to 11.
- Kind
- None
- As of
What this law does
Article 6 punishes any person who, without due authorization or exceeding the authorization obtained, accesses, intercepts, interferes with, or uses a system that uses information technology. Article 7 punishes intentionally destroying, damaging, modifying, or otherwise altering or disabling such a system or its data, with a heavier penalty where a virus or similar program is used, and article 8 reduces the penalty by half to two-thirds where the same conduct is merely negligent.
Article 9 raises every penalty in this chapter by a third to a half where the system affected is protected by security measures, serves a public function, or holds personal or patrimonial data of a natural or legal person.
Article 10 punishes importing, manufacturing, distributing, selling, or using equipment or programs meant to defeat a system's security, or offering services to that end, and article 11 separately punishes improperly obtaining, revealing, or disseminating data or information held in a system, with the penalty raised where done for profit or where it endangers state security or an affected institution's reliability.
Article 6 is the offence framed on acting without due authorization or exceeding the authorization obtained. Article 7 turns on intent to destroy, damage, modify or disable a system or its data, and states no authorization element. Article 10 turns on the purpose of defeating or removing a system's security, and states no authorization element. Article 11 turns on obtaining, revealing or disseminating a system's data or information improperly (indebidamente).
No provision, and no reported Venezuelan decision, addresses whether reading a public, unauthenticated page falls within the authorization requirement of article 6. Article 32 brings the Law into force thirty days after its publication in the Gaceta Oficial. No notice stating the day the Law came into force has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .