Código Penal (Ley 151/2022), offenses against telecommunications and ICT security

Article 289 punishes violating legally established computer-security measures to use information technology media and affect the confidentiality, integrity, or availability of digital assets, with imprisonment of six months to two years or a fine of 200 to 500 cuotas, or both.

Article 290 punishes accessing or using, or letting another access or use, an information system, storage device, software, or database without due authorization, with the purpose of appropriating, using, knowing, disclosing, or disseminating the information it stores, transmits, or captures, with imprisonment of one to three years or a fine of 300 to 1,000 cuotas, or both; because the offense turns on lacking due authorization for a specific purpose rather than on defeating a technical access control, a scraper reading a public, unauthenticated page falls outside a plain reading of the provision unless it is shown to lack authorization for one of the stated purposes.

Article 291 punishes using equipment or procedures to obstruct lawful access to information systems, or scanning telecommunications and ICT services to detect security vulnerabilities, interrupt services, or obtain information about their operation or users, without authorization. Article 292 punishes any act intended to compromise the security of ICT-using systems and knowingly providing a service toward that end.

Article 293 punishes intercepting, manipulating, or interfering with an information or telematic system without authorization and with intent to cause damage, with an aggravated bracket where illegally obtained passwords or similar means are used. Article 294 punishes producing, trafficking, or introducing computer viruses or malicious code intended to disable ICT infrastructure.

Article 296 allows the sanction to be doubled where a grave harm results, an international or foreign system is affected, or a vital or strategic system is put at risk, and increased by half where the offender is an official or employee with custody of the affected system, and allows the accessory sanction of confiscation of property.

Each cuota's monetary value is fixed by the sentencing court between 10 and 200 pesos according to the convicted person's income, so the fine bracket named in each article above is not itself a single peso amount.

Cuba's separate telecommunications framework, Decreto-Ley 35/2021, and its implementing Resolución 105/2021 on cybersecurity-incident response (issued under the earlier Decreto 360/2019) impose incident-notification duties on network operators but create no distinct authorization or access regime for a third party reading data from a system.