Unauthorized access to a computer system: commentary on Judgment No. 2905 of 2024

Judgment No. 2905 of October 23, 2024 provides important clarifications regarding unauthorized access to computer or telematic systems, addressing the issue of the necessary security measures for their protection. This topic is particularly relevant given the exponential increase in cybercrime and the growing need to protect sensitive data.

The case and the legal context

In the judgment in question, the Court examined a case where the defendant, D. G., was accused of unauthorized access to a computer system, specifically the Galileo system, reserved for members of the Agency for Internal Information and Security (AISI). The Court reiterated that the configurability of the crime does not depend solely on technical security measures but may also include organizational measures.

  • Technical security measures: access controls, firewalls, encryption.
  • Organizational measures: internal regulations, staff training, access procedures.
  • Court's resolution: the Galileo system was protected by adequate measures for its purpose.

The established legal principle

Unauthorized access to a computer or telematic system - Security measures put in place to protect the system - Organizational measures - Configurability of the crime - Existence - Case. For the purposes of configurability of the crime of unauthorized access to a computer or telematic system, the protection of the system can also be adopted through organizational measures that regulate the access methods, allowing it exclusively to authorized individuals for specific purposes or for achieving business objectives. (In application of the principle, the Court correctly qualified the Galileo system as a computer or telematic system protected by security measures, although it could also be used for conducting research on open sources, as it is reserved for AISI members for carrying out the Agency's own purposes).

The Court has thus confirmed that the protection of a computer system can also be ensured through organizational measures. This is a crucial aspect, especially for companies and organizations that handle sensitive data. Organizational measures must be clear and well-defined, establishing who can access which information and under what circumstances.

Conclusions

Judgment No. 2905 of 2024 represents an important step forward in understanding the measures necessary to protect computer systems. The Court of Cassation clarified that it is not enough to implement technical solutions; it is also essential to adopt organizational procedures capable of ensuring controlled and secure access. Awareness and training of personnel are therefore key elements in preventing the crime of unauthorized access, making organizations more resilient in the face of cyber threats.

Bianucci Law Firm