Translated material
Unauthorized access to computer information. Analysis of the article
If security forces believe that a person has illegally gained access to protected digital data, a criminal case may be opened against him under Article 272 of the Criminal Code. For example, programmer Sergei Savelyev was accused of “illegal access to computer information,” who, while serving his sentence and working in a prison hospital, collected and hid videos of torture of prisoners, and then handed them over to human rights activists.
What information is this? What does "illegal access" mean? What if I illegally gain access to information but don’t do anything with it? Let's look at the memo.
1
What is meant by “legally protected computer information”?
This is any information in digital form that is protected by law. That is, a special regime has been established for it: access is limited, there is an obligation to maintain confidentiality, and liability for disclosure is provided.
Such information includes official, personal, family or medical secrets, personal data, as well as information for which security measures have been established - for example, a password.
For illegally gaining access to state commercial, tax or banking secrets, liability is provided under separate articles - 283.1 and 183 of the Criminal Code of the Russian Federation.
Personal data includes almost any information about a specific person: full name, addresses of places of residence and stay, telephone numbers, email, document details. Special categories of personal data relate to race and nationality, political opinions, religious or philosophical beliefs, health and intimate life.
2
“Illegal” access – what is it?
Illegal access is considered to be by circumventing security measures, deception, or using someone else's credentials. For example:
- hacking the system to access the bank database;
- obtaining a person’s login and password from any service using phishing;
- an order to obtain information about a person from “punchers”;
- a hacker attack that caused a disruption in the company’s information system.
3
Can the very fact of access to information entail liability?
- The mandatory condition specified in Part 1 of Article 272 is the destruction, blocking, modification or copying of information, except for the cases specified in the article on the illegal collection and use of personal data. The maximum penalty is imprisonment for up to two years.
- Actions that caused major damage (the amount of which exceeds a million rubles) or were committed out of selfish interest may result in imprisonment for up to four years (Part 2 of Article 272).
- For actions committed by a group of persons by prior conspiracy or by an organized group or by an individual using their official position - up to five years in prison.
- If unlawful access to information resulted in grave consequences or created a threat of their occurrence, a sentence of up to seven years in prison may be imposed.
4
That is, if I illegally gain access to information, but do not do anything with this information, nothing will happen to me?
The Resolution of the Plenum of the Supreme Court states that it is necessary to establish intent to cause adverse consequences. That is, even if for some reason they did not occur, but there was intent, the crime is completed. If the consequences did not occur due to circumstances beyond the control of the person, then this is qualified as an attempt.
Sometimes access to personal data may result in liability under the article on “illegal collection and use of personal data” (Article 272.1 of the Criminal Code). There are also articles on violation of privacy (Article 137 of the Criminal Code) and violation of the secrecy of correspondence and telephone conversations (Article 138 of the Criminal Code) - according to them, liability can only arise for gaining access to personal data, even if you did not copy it, transfer it, use it for personal gain, etc.
“In fact, in our country, almost any information is protected by law, since in one way or another it relates to personal (family), medical, banking, commercial, tax and other secrets. Here you need to understand that any unauthorized access to someone else’s computer (the information contained in it) may well fall under Article 272 of the Criminal Code. Of course, a lot depends on the specific case,” says the First Department lawyer.
5
What is the difference between an article on “illegal access to computer information” and an article on “illegal collection and use of personal data”?
According to Article 272 of the Criminal Code, liability occurs when a person illegally penetrates a protected system (for example, hacks an account or uses someone else’s data) and causes harm to information or copies it.
Article 272.1 of the Criminal Code concerns only personal data, and also covers actions that precede or accompany illegal access: this is the acquisition, storage or distribution of logins, passwords, account databases or special programs designed for hacking. As well as the creation of services that provide data about a person.
"Both articles are quite 'rubbery'. In essence, liability may arise for gaining unlawful access to any digital information," says the First Department lawyer.