Article 32 — Unauthorised Access to State Digital Systems

1. 1.

   A person commits an offence who, without authorisation or in excess of authorised access, gains access to any Kaharagian digital system, register, platform, or database.

2. 2.

   A person commits an offence who, without authorisation, obtains, copies, or extracts data from a State digital system.

3. 3.

   A person commits an offence who, without authorisation, does any of the following in relation to authentication credentials for State digital systems, including passwords, tokens, and cryptographic keys:

   1. Obtains such credentials.
   2. Uses such credentials.
   3. Distributes or makes available such credentials to another person.
4. 4.

   A person commits an offence who provides false credentials or bypasses security measures for the purpose of gaining access to a State digital system.

5. 5.

   Unauthorised access is classified as a serious offence.

6. 6.

   Unauthorised access is classified as a grave offence where any of the following aggravating circumstances is present:

   1. Sensitive personal data or State security information is accessed, within the meaning of the Data Protection Code.
   2. The access is used to commit or facilitate another offence under this Code.
   3. The access causes disruption to the operation of State services.
7. 7.

   The sanctions applicable to unauthorised access are:

   1. A fine of $5,000 to $50,000 in accordance with Article 12, or a fine of $50,000 to $500,000 where the offence is classified as grave.
   2. Public censure.
   3. Exclusion from State digital systems for a period determined by the competent authority.
   4. Forfeiture of the instrumentalities used in the commission of the offence.
8. 8.

   The prescription period for offences under this Article is governed by Article 14.