Administrative and criminal liability for breaches of cybersecurity in digital public facilities - an analytical study in light of Iraqi legislation

Abstract

This research addresses the legal challenges arising from the transition of public administration to the digital environment, along with the associated risks that threaten the information infrastructure and citizens' personal data. The problem of the study stems from the legislative vacuum in Iraq, the absence of regulations governing institutional cybersecurity, and the inadequacy of traditional penal and disciplinary provisions to encompass crimes of technical negligence. Through an analytical-foundational approach, the research concludes that leaving systems unprotected or disclosing passwords constitutes a contemporary application of "gross negligence," which warrants criminal and administrative accountability. The study recommends the necessity of decoupling cybercrimes from administrative information security, enacting an "Information Security Governance" law that imposes proactive disciplinary sanctions, and amending the State Employees Discipline Law to classify cyber negligence as a gross occupational violation.