Unauthorized Access to Computer Systems: Judgment No. 27900 of 2023 and the Dropbox Case

The judgment No. 27900 of February 22, 2023, by the Court of Cassation provides an important reflection on the issue of unauthorized access to computer systems, particularly concerning virtual storage spaces like Dropbox. This decision emphasizes the importance of identifying the subject holding the space and their “ius excludendi alios” regarding access before qualifying an access as unauthorized under Article 615-ter of the Penal Code.

The Legal Context

According to Article 615-ter, paragraph one, of the Italian Penal Code, unauthorized access to a computer or telematic system is a crime that requires a clear identification of the subject holding the right of access. The Court established that, in the specific case, it is necessary to verify whether the Dropbox folder in question was exclusively owned by the defendants or belonged to the company for which they worked.

Unauthorized access to a computer or telematic system – So-called "Dropbox" space – Case referred to in Article 615-ter, paragraph one, Penal Code – Identification of the subject holding the space and the related “ius excludendi alios” to access – Necessity – Existence - Case. In the matter of unauthorized access to a computer or telematic system, the case referred to in Article 615-ter, paragraph one, Penal Code, contested in relation to the so-called "Dropbox" storage space, requires the identification of the subject holding the space and the related "ius excludendi alios" for access to said application. (In this case, the Court annulled the decision with referral, deeming it necessary to verify whether the so-called "Dropbox" folder was exclusively owned by the defendants, who had created it and temporarily made it available to the company for which they worked, or belonged to the aforementioned company, since, only in the latter case, their access to modify the account, through the change of the telematic address, made after the termination of the employment relationship, could be considered unauthorized).

The Implications of the Judgment

This judgment represents an important precedent for Italian jurisprudence, as it clarifies that the notion of unauthorized access cannot be applied in a generalized manner. It is essential to establish who has the right to access virtual spaces and what the conditions of use are. The Court's considerations emphasize the need for a detailed analysis of the specific situation, avoiding superficial interpretations.

  • Identification of the space holder: who created the account?
  • Temporary use of the space by third parties: what rights remain?
  • The legal consequences of unauthorized access: what penalties are foreseen?

Conclusions

In conclusion, judgment No. 27900 of 2023 offers very relevant insights for those operating in the field of computer criminal law. The importance of accurately determining the holder of a computer system is crucial for the correct application of the regulations. Companies, in particular, must pay attention to how they manage virtual spaces and what access rights they grant to their employees to avoid incurring serious legal consequences.

Bianucci Law Firm