On the creation of computer programs (hacker tools)
Article 269b § 1. Whoever creates, acquires, sells, or provides to others devices or computer programs adapted for the commission of a crime specified in Article 165 § 1 point 4, Article 267 § 3, Article 268a § 1 or § 2 in connection with § 1, Article 269 § 1 or 2, Article 269a, Article 270 § 1, or Article 270a § 1, as well as computer passwords, access codes, or other data enabling unauthorized access to information stored in an information system, telecommunication system, or telecommunication network, shall be subject to imprisonment for a period of 3 months to 5 years.
§ 1a. A person shall not be guilty of the offense specified in § 1 if they act solely to secure an information system, telecommunication system, or telecommunication network against the commission of a crime referred to in this provision or to develop a method for such security.
§ 2. In the case of a conviction for the offense specified in § 1, the court shall order the confiscation of the items referred to therein, and may order their confiscation even if they were not the property of the perpetrator.
Article 269b of the Penal Code regulates the crime of creating hacker tools. This provision implements Article 6 of the Convention on Cybercrime. The application of Article 269b of the Penal Code makes preparatory actions punishable.
Who can be the perpetrator of the crime of creating hacker tools, and what behaviors does Article 269b of the Penal Code refer to?
The perpetrator of the crime of creating hacker tools can be anyone who creates devices or computer programs designed to commit crimes. This provision applies only to tools that have been intentionally designed and adapted to commit a crime.
The amendment from March 2017 excluded criminal liability in cases of activities carried out within the framework of white hacking (also known as ethical hacking).
The discussed crime is characterized by intent.
What penalty is imposed for the crime of creating hacker tools?
The crime of creating hacker tools is punishable by imprisonment from 3 months to 5 years.
Section 2 of Article 269b of the Penal Code provides for the mandatory forfeiture of hacker tools. However, forfeiture is optional if these tools do not belong to the perpetrator or if their owner has not been identified. This crime is prosecuted upon public accusation.
Examples from the case law of Polish courts in cases involving the creation of hacker tools:
A. P. (P.), on an unspecified day and in an unspecified manner and without authorization, obtained a computer password allowing access to the website service (…) to the account of M. B. and D. P., and then on September 18, 2018, in M., ul. (…) at 9:19 AM, using this password and without authorization, gained access to the IT system (…) by using the client number of M. B. and D. P., from which he downloaded information stored in the system that was not intended for him, regarding the transaction history of that account. He then used this information as evidence before the District Court in Katowice in the case with his claim, case number XVII C 78/18. This act constituted an offense under Article 267 § 1 of the Penal Code and Article 269b § 1 of the Penal Code in conjunction with Article 11 § 2 of the Penal Code (Judgment of the District Court in Mikołów of March 30, 2021, case file No. II K 1/21).
M. P. was accused of, in the period from an unspecified day, but no later than June 6, 2013, at (…) Bank (…) at ul. (…) in T., with the intention of enabling an unknown person to obtain passwords for an internet account held by (…) S.A., and subsequently making unauthorized changes to the existing recipient account numbers on the bank account of the company (…) S.C. based in P., he provided his own bank account number (…) held by bank (…) in order to transfer money and gain a financial benefit of PLN 24,244.78 to the detriment of the company (…) S.C. in P. He thus assisted in committing the prohibited act. This act constituted an offense under Article 18 § 3 of the Penal Code in conjunction with Article 287 § 1 of the Penal Code in conjunction with Article 269b § 1 of the Penal Code in conjunction with Article 11 § 2 of the Penal Code (Judgment of the District Court in Toruń of January 8, 2015, case file No. IX Ka 579/14).
Legal status as of: February 3, 2022.
Cyberlaw by Judyta 