Unauthorised access to another person’s account is unlawful

Email services, social networks, messaging applications and educational platforms store private correspondence, documents and other important information. Accessing them without the owner’s consent or another lawful basis may violate privacy and the confidentiality of communications. Personal boundaries and rights must also be respected in the digital environment.

Knowing someone’s password, temporarily using their phone or finding their account open on a shared computer does not amount to permission to use it. Friendship, familiarity or a family relationship does not authorise secretly reading private messages. It is important to distinguish between the technical ability to access an account and the legal right to do so.

Copying correspondence, deleting information, changing passwords or sending messages in the owner’s name can cause serious harm. Explanations such as “it was a joke”, “I was only checking” or “I did not take any money” do not prevent a legal assessment. The person’s actions, fault, purpose and the resulting consequences must be examined.

Article 278² of the Criminal Code of the Republic of Uzbekistan establishes liability for unlawful, or unauthorised, use of computer information. Applying this article requires establishing the statutory elements, including destruction, blocking, alteration, copying or acquisition of information, or disruption of a system, resulting from the unlawful use. Each case must therefore be assessed individually. Depending on the circumstances, penalties may include a fine, deprivation of a specified right or correctional labour; qualifying circumstances may lead to restriction of liberty or imprisonment. 

Even where an account owner permits access for assistance, that permission has limits. For example, authorisation to resolve a technical problem does not automatically permit reading private messages or copying files for personal use. If another person’s account is accidentally left accessible, stop viewing its contents and notify the owner or responsible staff member.

Protect accounts with a separate, long password for each service and enable two-step verification. Do not share SMS verification codes or recovery codes. Review connected devices and active sessions, and sign out after using a shared computer. Multifactor authentication provides additional protection, including when a password becomes known to an outsider. 

If unauthorised access is discovered, change the password from a secure device, terminate unfamiliar sessions and check recovery details. Preserve sign-in notifications, correspondence and screenshots. Contact the service’s official support team and, where necessary, the internal affairs authorities. Protecting personal accounts and respecting other people’s digital rights are essential to a safe educational environment.