STATUTORY INSTRUMENTS

SUPPLEMENT No. 20                                                                                 6th August, 2007

STATUTORY INSTRUMENTS SUPPLEMENT

to The Uganda Gazette No. 40 Volume C dated 6th August, 2007 Printed by UPPC, Entebbe, by Order of the Government.

STATUTORY INSTRUMENTS 2007 No. 35. The Public Finance and Accountability (Amendment) Regulations, 2007.

(Under section 46 of the Public Finance and Accountability Act, 2003,

Act No.6 of2003)

In exercise of the powers conferred on the Minister responsible for finance by section 46 of the Public Finance and Accountability Act, 2003, these Regulations are made this 6th day of July, 2007.

1. Title.

These Regulations may be cited as the Public Finance and Accountability (Amendment) Regulations, 2007.

2. Commencement.

These Regulations shall be deemed to have come into force on 1st day of July, 2007.

3. Amendment of S.I. No. 73 of 2003.

The Public Finance and Accountability Regulations, 2003 in these Regulations referred to as the principal Regulations are amended in regulation 2, as follows—

1. by inserting immediately before the definition of “Accountant General” the following—

“"access" in relation to an application or data, means rendering that application or data, by whatever means, in a form that would enable a person, at the time when

it is rendered or subsequently, to take account of that application or data; and includes using the application or data or having it output from the computer system in which it is held in a displayed or printed form or to a storage medium or by means of any other output device, whether attached to the computer system in which the application or data are held or not;”;

2. by inserting immediately after the definition of “Act” the

following—

“"application" means a set of instructions that, when executed in a computer system, causes a computer system to perform a function; and includes such a set of instructions held in any removable storage medium which is for the time being in a computer system;”;

3. by inserting immediately after the definition of “commitment”

the following—

“"computer" means an electronic, magnetic, optical, electrochemical or other data processing device or a group of such interconnected or related devices, performing logical, arithmetic or storage functions; and includes any data storage facility or communications facility directly related to or operating in conjunction with such device or group of such interconnected or related devices, other than—

1. an automated typewriter or typesetter;
2. a portable hand held calculator;
3. a similar device which is non-programmable or

which does not contain any data storage facility; or

4. such other device as the Minister may, by notice in

the Gazette, prescribe;

“computer programme” means data representing instructions or statements that, when executed in a computer, cause the computer to perform a function;

"computer service" includes computer time, data processing and the storage or retrieval of data;”;

4. by inserting immediately after the definition of “currency point”

the following—

“"data" means representations of information or of concepts that are being prepared or have been prepared in a form suitable for use in a computer;”;

5. by inserting immediately after the definition of “department”

the following—

“"electronic", "acoustic", "mechanical" or "other device" means any device or apparatus that is used or is capable of being used to intercept any function of a computer;”;

6. by inserting immediately after the definition of “financial year”

the following—

“"function" includes logic, control, arithmetic, deletion, storage, retrieval and communication or telecommunication to, from or within a computer;”;

7. by inserting immediately after the definition of “instruction” the

following—

“"intercept" in relation to a function of a computer, includes listening to or recording of a function of a computer or acquiring the substance, meaning or purport of a function;”.

4. Amendment of regulation 47 of principal Regulations.

Regulation 47 of the principal regulations is amended by revoking the words “electronic funds transfer”.

5. Insertion of new regulation 51A.

The principal Regulations are amended by inserting immediately after regulation 51 the following—

“51A. Acceptance of payment by electronic funds transfer.

Payment by electronic funds transfer of moneys due to Government shall be recognised and acknowledged only after the authorised Government of Uganda bank account has been credited”.

6. Insertion of new regulations 74A, 74B, 74C, 74D and 74E.

The principal Regulations are amended by inserting immediately after regulation 74 the following—

“74A. Offences related to computer-based systems.

1. A person who intentionally accesses or intercepts any data without authority or permission to do so commits an offence.
2. A person who intentionally and without authority to do so, interferes with data in a manner that causes that data to be modified, destroyed or otherwise rendered ineffective, commits an offence.
3. A person who unlawfully produces, sells, offers to sell, procures for use, designs, adapts for use, distributes or possesses any device, including a computer program or a component which is designed primarily to overcome security measures for the protection of data or performs any of those acts with regard to a password or access code with the intent to unlawfully utilise that item to contravene this regulation commits an offence.
4. A person who utilises any device or computer program specified in subregulation (3) in order to unlawfully overcome security measures designed to protect that data or access to the data commits an offence.
5. A person who commits any act specified under this regulation with intent to interfere with access to any information system so as to constitute a denial including a partial denial, of service to legitimate users, commits an offence.
6. The intent of a person to commit an offence under this regulation need not be directed at—

1. any particular program or data;
2. a program or data of any particular kind; or
3. a program or data held in any particular computer.

7. A person who commits an offence under this regulation is liable on conviction to imprisonment not exceeding three months.

74B. Unauthorised modification of computer material.

1. A person who—

1. does any act which causes an unauthorised modification of

the contents of any computer; and

2. at the time when he or she does the act, he or she has the

requisite intent and the requisite knowledge,

commits an offence.

2. For the purposes of subregulation (1)(b), the requisite intent is an intent to cause a modification of the contents of any computer and by so doing—

1. to impair the operation of any computer;
2. to prevent or hinder access to any computer program or

data held in any computer; or

3. to impair the operation of any such computer program or

the reliability of any data.

3. The intent under subregulation (1)(b) need not be directed

at—

1. any particular computer;
2. any particular computer program or data or a computer

program or data of any particular kind; or

3. any particular modification or a modification of any

particular kind.

4. For the purposes of subregulation (1)(b) the requisite knowledge is knowledge that any modification that a person intends to cause is unauthorised.
5. It is immaterial for the purposes of this regulation whether an unauthorised modification or any intended effect of it of a kind specified in subregulation (2) is or is intended to be permanent or temporary.
6. A person who commits an offence under this regulation is liable on conviction to imprisonment not exceeding three months.

74C. Unauthorised use or interception of computer service.

1. Subject to subregulation (2), a person who knowingly—

1. secures access without authority to any computer for the

purpose of obtaining, directly or indirectly, any computer service;

2. intercepts or causes to be intercepted without authority,

directly or indirectly, any function of a computer by means of an electro-magnetic, acoustic, mechanical or other device; or

3. uses or causes to be used, directly or indirectly, the

computer or any other device for the purpose of committing an offence under paragraph (a) or (b),

commits an offence.

2. For the purposes of this regulation, it is immaterial that the unauthorised access or interception is not directed at—

1. any particular computer program or data;
2. a computer program or data of any kind; or
3. a computer program or data held in any particular

computer.

3. A person who commits an offence under this regulation is liable on conviction to imprisonment not exceeding three months.

74D. Unauthorised obstruction of use of computer.

1. A person who, knowingly and without authority or lawful excuse—

1. interferes with or interrupts or obstructs the lawful use of,

a computer;

2. impedes or prevents access to or impairs the usefulness or

effectiveness of any computer program or data stored in a computer,

commits an offence.

2. A person who commits an offence under this regulation is liable on conviction to imprisonment not exceeding three months.

74E. Unauthorised disclosure of access code.

1. A person who knowingly and without authority, discloses any password, access code or any other means of gaining access to any computer program or data held in any computer, commits an offence if he or she does so—

1. for any wrongful gain;
2. for any unlawful purpose; or
3. knowing that it is likely to cause wrongful loss to any

person.

2. A person who commits an offence under this regulation is liable on conviction to imprisonment not exceeding three months.”

DR. EZRA SURUMA, Minister of Finance, Planning and Economic Development.