22nd June 2025, Kathmandu
The Government of Nepal is making significant strides in its efforts to combat digital crime with the introduction of the “Information Technology and Cyber Security Bill, 2082.”
18 Types of Cybercrime Defined
Tabled in the House of Representatives on Jestha 27, 2082 (June 10, 2025), by Minister for Communication and Information Technology Prithvi Subba Gurung, this comprehensive bill aims to provide a robust legal framework to address and penalize a wide array of cyber offenses, reflecting Nepal’s commitment to securing its digital landscape.
The proposed legislation defines 18 distinct types of cybercrimes under Chapter 14 (Sections 80–98), each carrying specific penalties. This move is seen as a crucial step towards creating a safer online environment for Nepalese citizens and organizations alike.
Here’s a detailed look at some of the key provisions and their implications:
Protecting Nepal’s Digital Frontier: Key Cyber Offenses
The new bill categorizes cybercrimes into several critical areas, ensuring comprehensive coverage:
National Cybersecurity Threats (Section 80): Any act that obstructs or negatively impacts national cybersecurity and data systems through electronic means may lead to severe penalties, including up to 5 years’ imprisonment or a fine of up to NPR 1,000,000, or both.
Interference with Electronic Systems: Unauthorized entry, modification, transmission, or deletion of electronic data for personal gain is now punishable by up to 3 years imprisonment or a fine up to NPR 500,000, or both.
Information Theft: Deleting, altering, or stealing source code or data in electronic systems without permission is a serious cybercrime, with penalties of up to 3 years imprisonment or a fine up to NPR 500,000, or both.
Unauthorized Computer Access: Gaining unauthorized access to someone’s system to alter or delete data can result in up to 2 years imprisonment or a fine up to NPR 200,000, or both.
Obstruction to Users: Any attempt to prevent legitimate users from accessing a digital system is an offense, carrying penalties of up to 3 years imprisonment or a fine up to NPR 300,000, or both.
Deleting Another’s Data: Unauthorized deletion or damage of another individual’s electronic data is punishable by up to 3 years imprisonment or a fine up to NPR 300,000, or both.
Violation of Privacy: Collecting or sharing personal data without consent is a breach of privacy, with penalties of up to 2 years imprisonment or a fine up to NPR 300,000, or both.
Publishing False Certificates: Knowingly publishing or sharing forged digital certificates is a cybercrime, punishable by up to 2 years imprisonment or a fine up to NPR 200,000, or both.
Distribution of Obscene Content: Producing, publishing, or distributing obscene digital materials is strictly prohibited (unless for valid educational, legal, or medical purposes), with penalties of up to 2 years imprisonment or a fine up to NPR 200,000, or both.
Theft of Confidential Codes: Stealing login credentials (passwords, pins, tokens) via phishing or spoofing is criminalized, carrying penalties of up to 2 years imprisonment or a fine up to NPR 200,000, or both.
Sniffing: Interception or unauthorized access to data being exchanged over a network is defined as sniffing and is criminal, with penalties of up to 2 years imprisonment or a fine up to NPR 200,000, or both.
Installing Unwanted Applications: Unauthorized installation of apps or programs on someone’s device is punishable by up to 2 years imprisonment or a fine up to NPR 200,000, or both.
Denial of Service (DoS) Attacks: Disrupting or blocking public systems using DoS techniques is a cybercrime, with penalties of up to 2 years imprisonment or a fine up to NPR 200,000, or both.
Attacks on IoT Devices: Unauthorized interference with Internet of Things (IoT) devices is punishable under Section 93, with penalties of up to 2 years imprisonment or a fine up to NPR 200,000, or both.
Misuse of Identity or Passwords: Using someone else’s digital identity or credentials without consent for illegal purposes is an offense, carrying penalties of up to 1 year imprisonment or a fine up to NPR 100,000, or both.
AI-Based Offenses: Significantly, the bill includes provisions for crimes committed using Artificial Intelligence (AI) tools, which will be punishable as if committed directly by the person, recognizing the evolving nature of digital crime.
Accountability and Enforcement
Beyond defining cybercrimes, the bill also lays out a clear framework for accountability and enforcement:
Incitement and Accomplice Liability: Individuals who incite or aid in committing cyber offenses will face equal liability as the main offender, with accomplices facing half the punishment of the principal perpetrator.
Organizational Accountability: If a firm or organization commits cybercrimes, the individuals directly involved will be held liable. If no individual is identified, responsibility falls on executives such as the CEO, board members, or managing director.
Dual Penalty Clause: The bill includes a dual penalty clause (Section 99), allowing for separate legal actions if the same offense is punishable under other existing laws.
Compensation: Offenders will be required to compensate for any harm, loss, or inconvenience caused by cybercrime.
Government as Plaintiff: The Government of Nepal will act as the plaintiff in such cases.
Time Limit for Filing Cases: To ensure timely action, complaints must be filed within 6 months of discovering the crime to the Department of Information Technology or the National Cyber Security Center (Section 102).
Right to Appeal: Individuals have the right to appeal against penalties to the concerned District Court within 35 days of the decision (Section 103).
This new bill marks a crucial milestone in Nepal’s efforts to create a more secure and regulated digital environment, holding both individuals and organizations accountable for their online actions as the nation continues its digital transformation.
For more: 18 Types of Cybercrime Defined