Loading Cyber Conduct…
Please wait while the page loads.
Loading Cyber Conduct…
Please wait while the page loads.
What does South African law mean when someone accesses a computer system or computer data storage medium without lawful authority?
Section 2 of the Cybercrimes Act 19 of 2020 creates an offence where a person unlawfully and intentionally accesses a computer system or computer data storage medium. Section 2 also covers certain unlawful and intentional acts that place a person in a position to commit specified further cybercrime offences.
So the question is not simply whether someone managed to get into a system. The circumstances, the nature of the access, whether it was lawful, and whether the conduct was intentional can all matter.
The Act gives specific meanings to access. For a computer data storage medium, access includes using data or a computer program stored on the medium, or storing data or a computer program on it.
For a computer system, the Act's definition includes using data or a computer program held in the system, storing data or a computer program on storage that forms part of the system, or instructing, communicating with or otherwise using the computer system.
A person may have the technical ability to access something without having permission to do so. Those are different questions.
For example, knowing another person's password, finding a device that is already logged in, or discovering an exposed system does not by itself establish that you are authorised to access it.
If someone gives you permission to use a particular account, computer or system, that does not automatically mean you have permission to access everything connected to it. The actual scope of the authorisation can matter.
Entering another person's account or system without the authority to do so can raise an unlawful-access issue. Having or discovering someone else's password does not automatically give you permission to use it.
The Act covers unlawful and intentional access to a computer system or computer data storage medium. The circumstances and any authorisation involved matter.
The Act's definition of access includes acts involving data or a computer program stored on a computer data storage medium.
Section 2 also deals with unlawful and intentional acts involving a computer system or computer data storage medium that place a person in a position to commit certain further cybercrime offences.
Being able to reach a system does not automatically answer whether the access was authorised. A person might remain logged into an account after their permission to use it has ended, or might use access granted for one purpose to reach information they were not authorised to access.
These situations can be fact-specific. Cyber Conduct therefore doesn't not treat every unexpected login, mistake or technical discovery as automatically being a crime.
Do not assume that an accidental discovery has the same legal consequences as deliberately accessing a system. Section 2 refers to intentional conduct, and the surrounding circumstances can matter.
If you unexpectedly gain access to a system or confidential data, stop interacting with it. Do not explore further, download or copy information, change anything, or share what you found. If the situation could have legal consequences, consider obtaining appropriate legal advice.
Access can be connected to other conduct covered by the Cybercrimes Act. The Act separately deals with matters including unlawful interception, interference with data or computer programs, interference with computer systems, certain password or access-code conduct, fraud, forgery and extortion.
This page is based on section 2 of the Cybercrimes Act 19 of 2020. Read the Act itself for the authoritative wording.
Read the Cybercrimes Act on justice.gov.zaCyber Conduct provides general educational information, not legal advice. The application of the law depends on the facts of an individual situation. If you are dealing with an actual criminal investigation, accusation or legal dispute, consider obtaining advice from a qualified legal professional.