Computer Crime Under Georgian Law — Articles 284 to 286
Computer crimes are among the most sensitive risks for organizations and individuals, because a single mistake in a technical environment can lead a person to criminal liability. The corresponding chapter of the Criminal Code of Georgia governs these offenses through Articles 284, 285 and 286: unauthorized access to a computer system, unlawful use of computer data and, or, a computer system, and interference with data and, or, a system. This page explains what each of these norms establishes, which penalties they provide, and where a defense in such cases begins.
Article 284 — Unauthorized Access to a Computer System
Under the first part of this article the crime is unauthorized access to a computer system, punished by a fine or corrective labor for a term of up to two years, or imprisonment for the same term. The second part punishes the same act committed by a group with prior conspiracy, through use of an official position, more than once, or causing significant damage — the penalty being a fine or corrective labor for a term of up to two years, or imprisonment for a term of two to five years. The third part addresses the same conduct committed against a subject of a critical information system and contemplates imprisonment only — for a term of three to six years. The concept of a computer system is broadly defined in this chapter: it is any device or mechanism, or a group of them connected together, which automatically processes data by means of a program — a personal computer, any device with a microprocessor, and even a mobile telephone.
Article 285 — Unlawful Use of Data and, or, a System
The second norm addresses what is often called a tool offense. The unauthorized making, acquisition, storage, sale, distribution or otherwise making available of a computer program and, or, another device, as well as of a password, access code or other similar data required for entering a computer system, is a crime when carried out for the purpose of committing an offense provided for by this chapter or by certain other norms of this Code. The first part provides a fine or corrective labor for a term of up to two years, and, or, imprisonment for a term of up to three years. The second part punishes the same conduct committed by a group with prior conspiracy, through use of an official position, more than once, or causing significant damage — a fine or corrective labor for a term of up to two years, and, or, imprisonment for a term of three to six years. The third part concerns the same conduct committed against a subject of a critical information system and provides imprisonment for a term of four to seven years.
Article 286 — Interference With Data and, or, a System
The third norm protects the integrity of data and the operation of systems. Under the first part the crime is unauthorized damaging, deletion, alteration or suppression of computer data — punished by a fine or corrective labor for a term of up to two years, and, or, imprisonment for the same term. The second part also covers the case where unauthorized insertion or transfer of computer data caused a deliberate significant disruption of the functioning of the system — a fine or corrective labor for a term of up to two years, and, or, imprisonment for a term of up to three years. The third part punishes such conduct committed by a group with prior conspiracy, through use of an official position, more than once, or causing significant damage — a fine or corrective labor for a term of up to two years, or imprisonment for a term of three to five years. Under the fourth part, where conduct provided for by this article is committed against a subject of a critical information system, the penalty is imprisonment for a term of four to seven years.
Common Definitions — Significant Damage and Repetition
In this chapter, significant damage means damage exceeding 2000 GEL, except for a case provided for by another norm of the Code. A crime provided for by this chapter is considered committed more than once if it was preceded by the commission of any crime under the same chapter. Unauthorized means unlawful, and also the situation where the holder of the right has not transferred the right, directly or indirectly, to the person committing the act. The concept of a subject of a critical information system is defined by the Georgian Law on Information Security. Every one of these definitions requires separate establishment in the case — none of them can simply be presumed, and this is exactly where the main defense arguments open: the calculation of damage, the existence of access rights, the establishment of purpose, the confirmation of statuses.
Liability of Legal Entities
For the conduct provided for by these articles, a legal entity is punished by a fine, by deprivation of the right to carry out activity, or by liquidation and a fine. This means that a computer operation carried out in a company's name or in its interests can be imputed to the organization itself, and assessing and preventing that risk — through internal rules, access management and compliance controls — is an essential element of doing business.
Defense Directions in Computer Crime Cases
The first direction is verifying the qualification: the three articles govern different conduct, and the prosecution often conflates them. The second is the elements of the offense: lack of authorization, purpose, damage, the significance of a disruption, repetition — each of these must be established separately by the prosecution. The third is evidence: obtaining and evaluating technical logs, devices and electronic correspondence requires specialized knowledge, and the lawfulness of that evidence is reviewed separately. The fourth is the selection of the penalty: its forms and rules of application are defined by other norms of the Code and are assessed separately in each case. Contact us — we will review your situation in confidence.