Persons, legal entities and organisations must not commit the offences listed in Article 8, namely disclosing another's specific computer access prevention measure without authorisation (Article 9), accessing a computer protected by such a measure or stealing commercial, financial, confidential or other information (Article 10), editing pictures, animation, audio or video to disseminate them to another's damage (Article 11), intercepting computer data in transmission (Article 12), interfering with a computer system by programs, viruses or messages with concealed sender addresses (Article 15), forging computer data including fake websites harvesting bank account, card or internet usage codes (Article 16), destroying computer data by deletion, editing or modification (Article 17), and developing, producing, importing, possessing, trading, advertising or distributing tools or programs for cyber crime (Article 18). They must also not destroy or damage electronic equipment and facilities used to exchange and transmit data (Article 39(3)) or ask for, offer or receive bribes (Article 39(5)). Deleting data in another's computer system without authorisation is also a fining ground (Article 60(3)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.