Article 286 – Infringement of Computer Data and/or a Computer System
Article 286 of the Criminal Code of Georgia protects the sphere of information security. Under this article the unauthorized damaging, deletion, alteration or suppression of computer data is punished, as well as the unauthorized insertion or transmission of computer data that has caused a deliberate significant disruption of the functioning of a computer system. In the conditions of a digital economy this norm finds wide practical application – from corporate data to personal accounts.
The article unites two kinds of object: computer data and the functioning of a computer system. The first part concerns actions directly related to data – damaging, deleting, altering or suppressing them; the second adds the unauthorized insertion or transmission of data and the deliberate significant disruption of the system's functioning. The fourth part separately protects subjects of critical information systems.
What the Prosecution Must Prove and Where the Defense Begins
The prosecution must prove the fact of the act – the damaging, deletion, alteration, suppression, insertion or transmission of data; the absence of authorization – that the act was performed without the consent or legal basis of the person holding the corresponding right over the data or the system; and the result – in the case of part 2, a deliberate significant disruption of the system's functioning, and in one of the forms of part 3, significant damage.
The defense position is built mainly on the absence of authorization: it is often contested whether the person had a lawful right of access – for instance, within the scope of an official authority. The scale of the result is also contested: what counts as a significant disruption or significant damage, and whether it is confirmed by evidence. These evaluative categories depend on concrete factual circumstances, and it is precisely there that the defense's opportunities unfold.