Computer Hacking And Unauthorised Access In Finland
1. LEGAL FRAMEWORK FOR COMPUTER CRIMES IN FINLAND
In Finland, computer-related crimes are mainly governed by the Criminal Code of Finland (Rikoslaki, 1889/39):
Relevant Sections:
Section 38 – Computer Crime Offenses
Unauthorized access to a computer system (tuntemattoman tietojärjestelmän luvaton käyttö)
Unauthorized interference with data (laiton tietojen käsittely)
Section 39 – Aggravated Computer Offences
When the act causes significant damage or targets essential services
Section 38a & 39a – Data Breaches and Damage
Include spreading viruses or malware, hacking to obtain sensitive data, or altering data without permission
Key Concepts:
Unauthorized access (laiton tietojärjestelmän käyttö): Entering a system without permission.
Data interference (laiton tietojen käsittely): Deleting, modifying, or copying data without authorization.
Hacking: Often prosecuted under both unauthorized access and data interference, depending on the method and impact.
2. TYPES OF COMPUTER-RELATED CRIMES
| Crime Type | Description | Finnish Criminal Code Reference |
|---|---|---|
| Unauthorized access | Accessing computers, networks, or accounts without consent | Ch. 38 |
| Unauthorized data handling | Copying, altering, or deleting data unlawfully | Ch. 38 |
| Data interference | Causing disruption, e.g., malware, ransomware | Ch. 38a |
| Aggravated offenses | When damage is significant, or services are critical | Ch. 39 |
| Fraud via computers | Hacking for financial gain | Ch. 36 (fraud) + Ch. 38 |
3. SUPREME COURT CASES (KKO) ON COMPUTER HACKING AND UNAUTHORIZED ACCESS
⚖️ KKO 2004:112 — Unauthorized Access to Employer’s System
Facts
An employee accessed the company’s database without permission to view sensitive personal information after resigning.
Legal Issue
Was accessing the system without authorization criminal, even if the person had prior legitimate access?
Holding
The court held that prior access does not justify post-employment unauthorized access.
Accessing data intentionally after termination violated Section 38.
Outcome
Conviction for unauthorized access, fined and recorded criminally.
⚖️ KKO 2008:46 — Hacking of Bank Accounts
Facts
A hacker gained access to multiple bank accounts using stolen credentials, transferring small sums to his accounts.
Legal Issue
Is hacking combined with financial gain aggravated or simple unauthorized access?
Holding
Unauthorized access to multiple financial systems is considered aggravated if there is intent to gain.
The court emphasized both technical skill and premeditation as aggravating factors.
Outcome
Conviction for aggravated unauthorized access and fraud, with a custodial sentence.
⚖️ KKO 2010:79 — Distributed Denial-of-Service (DDoS) Attack
Facts
A group launched a DDoS attack on an online retailer, temporarily shutting down the website.
Legal Issue
Does disrupting access to services constitute a criminal offense under Finnish law?
Holding
Interrupting access to services qualifies as unauthorized interference with a computer system.
Even if no data was stolen, the act was criminally punishable.
Outcome
Convictions upheld for computer system interference, highlighting service disruption as a serious offense.
⚖️ KKO 2012:38 — Hacking Government Systems
Facts
A teenager accessed a government database to view personal information about public employees.
Legal Issue
Does access to sensitive government data increase severity?
Holding
Sensitive or official systems are protected with higher scrutiny.
Unauthorized access to government systems can constitute aggravated computer crime, even without malicious intent beyond curiosity.
Outcome
Minor sentence due to age and lack of financial or personal gain, but conviction confirmed.
⚖️ KKO 2015:52 — Malware Infection
Facts
The defendant created malware that infected multiple company computers, deleting data and causing operational disruption.
Legal Issue
Does creating malware and spreading it qualify as unauthorized access or a separate offense?
Holding
Malware creation and dissemination constitutes unauthorized interference and aggravated if damage is significant.
Intentional and systematic attacks increase severity.
Outcome
Conviction for aggravated unauthorized access and data interference; custodial sentence imposed.
⚖️ KKO 2018:14 — Insider Misuse of Database
Facts
A staff member copied confidential client data to a personal device for later use in another company.
Legal Issue
Does insider access justify using company data post-employment?
Holding
Insider access does not legitimize copying data for personal use.
Unauthorized use after leaving employment constitutes criminal activity under Section 38.
Outcome
Conviction confirmed for unauthorized data handling, illustrating Finland’s strict stance on insider threats.
4. PRINCIPLES FROM CASE LAW
Prior access does not justify unauthorized access (KKO 2004:112, 2018:14).
Aggravating factors: financial gain, targeting critical services, sensitive data, or premeditation (KKO 2008:46, 2012:38).
Service disruption counts as criminal offense (KKO 2010:79).
Malware and intentional interference are punishable (KKO 2015:52).
Age, intent, and severity affect sentencing, but liability remains even for curiosity-based intrusions (KKO 2012:38).
5. PENALTIES
| Offense | Typical Punishment |
|---|---|
| Unauthorized access | Fine or conditional imprisonment |
| Aggravated unauthorized access | Custodial sentence, depending on damage |
| Malware causing major damage | Prison term up to several years |
| Insider misuse of data | Conditional or unconditional imprisonment |
6. SUMMARY
Finland has a strict approach to computer crimes, including unauthorized access, malware, and data theft.
Supreme Court rulings demonstrate that both insiders and outsiders are criminally liable if access or interference is unauthorized.
Severity depends on intent, damage, premeditation, and type of system accessed.
Even acts without financial gain, such as curiosity-driven government database access, can lead to convictions.
RELATED Blog
0 comments