Computing and the Law

Rules about stealing, lying and spying are thousands of years old. Why does computing need new ones? Because computers changed what is easy:

• Copying costs nothing. A photo, a song or a program can be copied a million times in a second, perfectly. Old rules about copying books never imagined that.
• Distance doesn’t matter. Someone in another country can break into a computer in Nepal without ever coming here.
• Data piles up. Every tap, payment and search is recorded somewhere (Grade 8’s data about you), and records put together reveal a whole life.
• Machines make decisions. Programs now decide what you see, what you pay and, more and more, who gets a job or a loan.

A law is a rule that everyone in a country must follow, made by its legislature (in Nepal, the Federal Parliament) and enforced by the courts. A law made by Parliament is called an Act. Above every Act is the Constitution: no law may go against it. Under an Act, the government may make more detailed rules, called regulations (नियमावली) or directives, but only as far as the Act allows. A policy is something different: a government’s plan, saying what it wants to happen and what it will do. A policy can lead to new laws, but on its own it punishes nobody.

Nepal’s main laws on computing came one at a time, as each problem appeared (Figure 10.2).

Why is this rule here?

Every law has a rationale: the reason it exists, the harm it is meant to prevent or the right it is meant to protect. To judge a law or a policy, don’t ask only “what does it say?”. Ask five questions:

1. The problem. What harm does it prevent, or what right does it protect?
2. Who gains, who pays. Whom does it protect? Who carries the cost: money, time, freedom?
3. Clear. Can an ordinary person tell what is allowed and what isn’t?
4. Enforced. Can it really be enforced, and is it? A law nobody follows changes nothing.
5. Proportionate. Does it go only as far as the problem needs? A rule is proportionate when its costs fit the harm it prevents: closing a whole road because one car once crashed on it is not.

You will use these five questions all through this unit.

Until the 2000s, a promise in business counted when it was written on paper and signed in ink. An email was not proof of anything, and the law had no name for breaking into a computer. To fix both, Parliament passed the Electronic Transactions Act, 2063 in 2006 (it was signed into law on 22 Mangsir 2063, 8 December 2006). It has two jobs.

Making electronic records count

The first job is to make digital things count in law. Under the Act, an electronic record (an email, a file, a record in a database) can count as a written document, and a digital signature, the kind you met in Unit 6, can count as a signature in ink. The Act also sets up a Controller of Certification, an office that licenses the certifying authorities that issue the certificates linking a public key to a person or a company. Without this part of the law, an online form, a digital contract or a tax return sent over the internet would mean nothing in court.

Crimes involving computers

The second job is Chapter 9, on crimes involving computers. Here are the main ones, with the most the court can give for each.

Three more parts make the chapter work. Someone who helps commit an offense as an accomplice gets half the punishment (Section 54). An offense that involves a computer in Nepal can be tried in Nepal even when it was committed from abroad (Section 55). And the computers and devices used for an offense can be taken away (Section 56).

What the offenses protect

Read the table again with Grade 7’s three things to keep safe in mind Grade 7: Keeping Data Safe. Section 45 protects confidentiality: only people with permission may see. Section 46 protects integrity and availability: data stays correct and usable. Section 52 protects people’s money, and the whole Act protects trust: people use online services only if they believe a crime online will be punished like a crime anywhere else. That is the Act’s rationale.

A law that is hard to read: Section 47

Section 47 shows why the five questions matter. Its rationale is sound: words and videos online can stir up hatred and even violence, and Nepal is a country of many peoples, languages and religions living together.

But look at its words: material “contrary to public morality or decent behavior”. Who decides what is against public morality? The words are wide enough to cover almost anything someone in power dislikes. For years, journalists and rights groups in Nepal have said that the section has been used to arrest people for social media posts that criticized officials, and that the fear of it makes people afraid to speak. Supporters answer that without it, there would be little to stop hate speech and online harassment. Most agree on one thing: a rule about speech must be clear, so that people know what they may say. The Constitution protects freedom of opinion and expression (Article 17), and allows the law to limit it only for listed reasons, such as harmony between communities, decency, or defamation.

In Unit 7 you learned to spot a fake shop and to check a parcel when it arrives Grade 9: Shopping online safely. Behind that advice there is now a law. For years, anyone could sell online in Nepal from a page with no name, no address and nobody to complain to. In March 2025 Parliament passed the Electronic Commerce Act, 2081, and it came into force in April 2025. It covers anyone who sells goods or services to people in Nepal over the internet, on a website, an app or a social media page, even a seller abroad (Section 1).

Here is what it asks of an online seller:

• Be listed. Register on the online portal of the Department of Commerce, Supplies and Consumer Protection, with the business’s registration, its owner, its PAN or VAT number and how to contact it (Section 5).
• Say who you are. Show on the shop’s page its name, address, registration and PAN or VAT numbers, phone and email, and the person who handles complaints (Section 4).
• Describe each thing honestly. Give its details, the final price with tax, any delivery charge, when it will arrive, how to pay, the warranty, who made it, the country it comes from if it is imported, and whether and how it can be returned (Section 6).
• Take it back when it isn’t as described. If what arrives is not what the page described, the buyer may return it, unused and undamaged. The seller must take it back without conditions, and give either another thing of the same price, if the buyer wants one, or the whole price back, tax included (Section 10).
• Keep buyers’ details private. A seller may share a buyer’s personal details only with those who complete the sale and delivery, or as the law requires, and must let buyers correct their details and close their account (Section 12).
• Answer complaints. Record each complaint, tell the buyer at once that it was received, and decide within 15 days, giving the reasons in writing if it can’t be put right (Section 33).
• No fake reviews. A seller may not review its own products while pretending to be a customer, or get someone else to do it (Section 16).

A seller who isn’t listed, or doesn’t show these details, can be fined Rs 20,000 to Rs 1 lakh (Section 22). A seller on a shopping site who posts fake reviews, or won’t take back a wrong, faulty or late item and refund it, can be fined Rs 50,000 to Rs 5 lakh, or sent to prison for six months to three years, or both (Section 23). Anyone can complain to the Department, online too, and ask for their name to be kept secret (Section 28). For everything else, such as quality, labels, prices and compensation, the Consumer Protection Act, 2075 (2018) applies to online buying just as it does in a shop (Section 31).

Why these rules?

Use the five questions. The problem: online, you can’t see the seller or touch the thing before you pay, so a buyer has only the page to trust. The Act turns the page into a promise: the seller must be findable, and the description becomes what the seller has to deliver. Who pays: every seller, down to a student selling handmade cards on a social media page, must register and keep details up to date, which takes time; the Act lets a small home business sell through someone else’s platform instead of building its own (Section 4). Enforced: a fake shop that never registers, takes money and vanishes is still breaking the law, and it is still hard to catch, so Unit 7’s checks still matter.

In Grade 8 you met the core of Nepal’s privacy law: the Constitution of Nepal (2015) makes privacy a fundamental right (Article 28), and the Privacy Act, 2075 (2018) says that people must agree before their personal data is collected, and that data may be used only for the purpose it was collected for Grade 8: What Nepal’s law says. The Act goes much further than data. It protects the privacy of a person’s body, family, home, property, documents, letters and messages, and character, and it has a chapter on electronic means. Here are the rights that matter most in a digital life.

There are exceptions. The police and courts may get information when they investigate a crime, by a written demand or an order (Sections 12 and 26). The official phone number and email of a person in a public post are not their personal information (Section 24). And journalists may publish what is in the public interest, and anyone may fairly comment on what a public figure does in public (Section 34).

When your privacy is broken

Breaking most of these rules is a crime: up to three years in prison, a fine of up to Rs 30,000, or both (Section 29). For most of them, the person harmed must complain to the District Court within three months of what happened (Section 30), and may also ask the court for compensation, money for the harm done (Section 31). For a few, such as using a drone to spy or collecting personal information without a legal right, the government brings the case itself, like any other crime. When a crime online also involves threats, fraud or a hacked account, report it to Nepal Police’s Cyber Bureau as well.

A law on paper is not the same as protection in practice. To see how well Nepal’s law protects data, compare it with the strongest data protection law in the world, the European Union’s General Data Protection Regulation (GDPR), in force since 25 May 2018, and with India’s Digital Personal Data Protection Act, passed in 2023. As of 2026:

(India’s law comes into force in steps: most of its duties for companies apply from May 2027.)

Some of the gaps matter a lot. A fine of Rs 30,000 is nothing to a big company. With no office whose job is to check, a law works only when a person who was harmed finds out, finds a lawyer and goes to court within three months. And when a company’s data leaks, nothing in the law makes it tell the people whose data it was.

A stronger law has costs too, and a fair debate weighs them:

• For a stronger law: big companies change only when the fines are big; an independent office can act without waiting for a victim to go to court; people deserve to know when their data leaks; and data about Nepalis held abroad needs Nepal’s law to reach it.
• Against, or for going slowly: the GDPR costs companies a great deal to follow, and a small Nepali startup may not manage it; a new office needs money and trained staff; consent pop-ups that everyone taps through protect nobody, however strict the law; and a law that can’t be enforced is worse than a smaller one that is.

In Grade 6 you learned what copyright is, and in Grade 8 you chose Creative Commons licenses for your own photos and videos Grade 8: Creative Commons in practice. You know how long copyright lasts in Nepal, and that credit is not permission. Now look at it as a programmer.

Code is a work

Nepal’s Copyright Act, 2059 (2002) lists the kinds of work it protects: books, music, films, photos, maps, and, last on the list, computer programs (Section 2). So the code you write is protected from the moment you write it, like a story or a song.

But copyright protects how you wrote something, its expression, not the idea behind it. The Act says that copyright does not cover any thought, concept, principle or method of operation, even when it is written down in a work (Section 4). For code, that means:

• The algorithm is free. Anyone may write their own merge sort, binary search or nearest-neighbor model. Ideas like these belong to everyone.
• The code is not. Copying someone’s program, line by line, is copying their work. Changing the variable names or the spacing doesn’t make it yours, any more than changing a few words makes a copied story yours.

Who owns it?

Usually the person who wrote it, the author (Section 6). But not always:

• Code written by several people together is a joint work, owned together, unless each part is clearly one person’s and can be used on its own.
• Code written for someone who pays for it belongs to the person who paid (Section 6(2)(c)), unless a written agreement says otherwise. If a shop pays you to make its website, the shop owns the code. If you want to keep the right to reuse it, say so in the agreement before you start.

The author also has moral rights, which stay with them even after the code is sold: above all, the right to have their name on the work wherever it is used publicly, and to stop it being mangled in a way that harms their reputation (Section 8). So in Nepal, naming the author is not only good manners. It is the author’s right in law.

What you may do without asking

The Act allows a few uses without the owner’s permission, as long as they don’t harm the owner’s right to earn from the work. Using works in a few such fair ways is called fair dealing:

• copying some parts of a published work for your own personal use (Section 16);
• quoting parts of a work, naming its source and its author (Section 17);
• copying small parts for teaching and learning in class, naming the source and the author (Section 18);
• making one copy of a program you got legally, as a backup or to replace a lost one (Section 21).

Fair dealing is narrow. It covers parts, not whole works, and it doesn’t cover publishing or selling. Copying a whole program, or putting someone else’s code in an app you share, needs permission, or a license that gives it. (The United States has a wider idea, fair use, judged case by case by courts. It is American law, not Nepal’s.)

Breaking copyright (infringement) can bring a fine of Rs 10,000 to Rs 1 lakh, up to six months in prison, or both, more for a second time, and the infringer must pay for the loss caused (Section 27).

Most software comes with a license: the owner’s permission, saying what you may do with it. There are two big families.

A proprietary license (from “property”) keeps most rights with the owner. When you buy an app or a game, you don’t buy the program; you buy permission to use it, on the owner’s terms. These terms, the end-user license agreement you tap “Agree” to, usually forbid copying it, sharing it, or taking it apart to see how it works. The source code stays secret. Some proprietary programs are given away for nothing (freeware), but free of price is not free to copy or change.

An open-source license does the opposite. The source code is published, and anyone may use the program, study how it works, change it and share it, their own changed version too. Programmers call such programs free software or open-source software: free as in freedom, not only as in price.

Permissive and copyleft

Open-source licenses differ in what they ask in return. A permissive license asks almost nothing: keep the author’s copyright line and the license with the code, and do what you like, even put it inside a program you sell and keep secret. A copyleft license asks more: if you share a program built from the code, you must share your whole program’s source code, under the same license. Copyleft keeps the code, and everything built from it, open forever. It is the same idea as Creative Commons’ ShareAlike (SA).

Licenses for code are not the only ones a programmer meets. Pictures, sounds and text usually come with Creative Commons licenses (Grades 6 and 8), which are made for creative works; Creative Commons itself advises against using them for code, except CC0, which gives up all rights. Fonts often come with the SIL Open Font License, and maps and data with licenses of their own, such as the Open Database License that OpenStreetMap uses.

The standard asks more than knowing the rules: when you build something, you must apply them. Here is how programmers give credit, which is called attribution.

In the code. At the top of each file, say who wrote it, its license, and where any borrowed part came from, right beside that part. A reader, or you a year from now, should see at once which parts are yours.

# heritage_quiz.py: a quiz about Bhaktapur's temples# Copyright 2026 Grade 9 A, Shree Bal Kalyan Secondary School# License: MIT (see the LICENSE file)## Credits:# - The question list was checked against the Bhaktapur Municipality#   website, on 12 October 2026.# - ask() is adapted from Sunita Rai's "Quiz maker" (Grade 9 B),#   used with her permission. Changed: it now ignores capital letters. def ask(question, answer, given):    """Return True if the answer given matches, ignoring capitals and spaces."""    return given.strip().lower() == answer.strip().lower() print(ask("Which temple has five roofs?", "Nyatapola", " nyatapola "))

True

(The school and the student are made up, to show the pattern.)

With the project. Put a file named LICENSE beside your code with the license’s full text, so everyone knows what they may do with it. Here is the MIT License, the most common on code-sharing sites, with your name and year in it:

MIT License Copyright (c) 2026 Grade 9 A, Shree Bal Kalyan Secondary School Permission is hereby granted, free of charge, to any person obtaining a copyof this software and associated documentation files (the "Software"), to dealin the Software without restriction, including without limitation the rightsto use, copy, modify, merge, publish, distribute, sublicense, and/or sellcopies of the Software, and to permit persons to whom the Software isfurnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in allcopies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS ORIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THEAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHERLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THESOFTWARE.

For the people who use it. An app or a website lists what it is built from on a credits or About screen: every library, photo, sound and font, with its maker and license. Big apps call this their third-party notices.

For code from a chatbot. An AI assistant can write code in seconds, but it learned from other people’s code and sometimes repeats it closely, without its license. Check what it gives you as you would any code, make sure you understand every line, and say that you used it, as Grade 8 asked for schoolwork Grade 8: Generative AI: “ask() was first written with the help of an AI chatbot, then tested and changed by me.”

Laws are not the only rules about computing. Every program that ranks, chooses or decides has rules inside it, and somebody chose them.

A video app has to decide which video to show you next. Its programmers tell it to choose the videos you are most likely to keep watching: it optimizes for watch time (Grade 7, You and Your Screen). They could have told it to choose videos you rate as worth your time, or to stop after an hour. A map app choosing the fastest route may send hundreds of cars down a narrow lane past a school; it could have been told to avoid such lanes, at the cost of a slower trip. In each case, what the algorithm optimizes is a choice about what matters. That choice is a value built into the algorithm, and the people who chose it decided, for millions of others, what counts.

Rules written, rules learned

In Unit 9 you met two kinds of algorithm that decide: rules written by people, and models that learn from data Grade 9: Which kind of AI?. Values get into both, in different ways.

• In a rule-based algorithm, the values are written down: “the highest marks win”, “one in three places for girls”. Anyone can read them, argue about them and change them.
• In a data-driven algorithm, a model learns from past decisions, and it learns the values in them too, without anyone writing them down. If a company’s past hiring favored men, a model trained on it favors men Grade 9: Unit 9. Leaving a column out doesn’t always help: a student’s district or school can stand in for their family’s wealth, or their caste or ethnicity. A feature that stands in for another like this is called a proxy.

When an algorithm treats some groups of people unfairly, again and again, because of how it was made, that is algorithmic bias.

Who gets the scholarship?

A school has three scholarships and eight students who applied. A program will rank them. The program is easy to write: give each student a score, sort, take the top three. The hard part is the score. What should count?

Nepal has argued about exactly this choice, on a much bigger scale. In government jobs, the Civil Service Act sets aside almost half of the posts filled by open competition for groups that were long left out: women, Adivasi Janajati, Madhesi, Dalit people, people with disabilities, and people from remote areas. The ranking inside each group is still by exam result. This is an algorithm with its values written into it, and it has been debated for years: whether the groups and shares are right, and whether it helps the people who need it most. The arguments are about values, not arithmetic, and that is exactly why they are argued out in public, by Parliament, and not hidden in a program.

Questions to ask any algorithm

When an algorithm decides about people, ask:

1. What does it optimize? Watch time, profit, speed, marks? Who chose that, and why?
2. Whose values does it carry? The company’s, the users’, the government’s, the past’s?
3. Who is left out or harmed? Look for groups it works worse for, and for proxies.
4. Can a person check and appeal? Can someone see why it decided, and can a person change the decision?
5. Who is responsible when it goes wrong: the programmer, the company, the user?

AI raises the same questions with more force, because it now decides about people’s lives at a huge scale, often without anyone able to see why. Countries have answered in different ways.

The European Union: rules by risk. The EU’s AI Act, which became law in 2024, sorts AI systems by how much harm they could do (Figure 10.4). A few uses are banned outright. High-risk systems, those that decide about people’s education, jobs, loans, or access to services, or that sit inside things like medical devices, must be tested, use good data, keep records, and have a person able to step in. Systems that talk to people or make realistic pictures must say they are AI. Most AI, such as a spam filter, gets no new rules.

China: rules for each use, and state control. China made separate rules for particular kinds of AI: for recommendation algorithms, for deepfakes, for chatbots and other AI that generates content. Companies must register their algorithms with the government, make sure what their AI produces follows the government’s rules on content, and label what AI made.

The United States: old laws first. The United States has no single national law on AI. AI is governed by existing laws (against discrimination, fraud or unsafe products), by orders from the President, which change with each President, and by states that have passed laws of their own, such as Colorado and California.

India: guidelines and existing laws. India decided not to pass a separate AI law for now, but to apply its existing laws, including its new data protection law, guided by national AI governance guidelines.

Nepal: a policy, not yet a law. Nepal has a National AI Policy, approved by the government in 2025, which plans how Nepal will build skills in AI and govern it. As a policy, it sets aims; it punishes nobody. A misuse of AI in Nepal today falls under the laws you met above: a deepfake meant to insult someone under the Privacy Act (Section 16), fraud with a fake voice under the Electronic Transactions Act (Section 52).

Between countries. In 2021, all 193 member countries of UNESCO, Nepal among them, adopted the Recommendation on the Ethics of Artificial Intelligence, the first worldwide agreement on what AI should respect: human rights, fairness, privacy, transparency, and human oversight. It is a recommendation, not a binding treaty. In 2024 the Council of Europe opened the first binding international treaty on AI and human rights for countries to sign.

Here is a real case to judge with the five questions, one that many students in Nepal remember. It led to events in which many people lost their lives, so read it calmly and keep to the facts.

People in Nepal use social media platforms run by companies abroad. When someone is harmed on one, by a scam, harassment or a fake account, it can be hard to reach anyone at the company who will act, and most of these companies had no office or representative in Nepal. In November 2023 (Mangsir 2080), the government issued a directive on the use of social networks, under the Electronic Transactions Act. It required platforms used in Nepal to register with the Ministry of Communication and Information Technology, and to name people in Nepal: a contact person, an officer to handle complaints, and an officer to check that the platform follows the rules.

By 2025, many large platforms still had not registered. In late August 2025, the government gave them seven more days. The 26 that had not registered were blocked from 4 September 2025, among them the apps most people used for messages, photos and videos. For many families these apps were how they talked to relatives working abroad, and for many small businesses, how they sold.

On 8 September, thousands of young people protested in Kathmandu and other cities, against the block and against corruption. During clashes between protesters and police that day, 20 people died. The block was lifted that night. The unrest grew the next day: many public buildings, including the Parliament building, were set on fire, and the Prime Minister resigned. By the count of a government committee (December 2025), 77 people died in all: 20 on 8 September, 37 on 9 September, and 20 in the days after. An interim government was formed, and a new House of Representatives was elected on 5 March 2026.