In brief. Cybercrime — or “computer crime” — is the body of offences committed through or against computer and telematic systems, governed in the Italian legal system principally by L. 547/1993 (which introduced computer crimes into the Criminal Code), by L. 48/2008 (ratifying the Budapest Convention on Cybercrime of 2001) and, more recently, by L. 90/2024 (the latest reform of computer crimes and cybersecurity). ILA represents both individuals and companies — as injured parties and as suspects — in proceedings for computer crimes.

In brief

  • Cybercrime comprises offences committed through or against computer systems: unauthorised access, computer damage, computer fraud, unlawful interception, impersonation, possession of access codes.
  • The main offences are in the Criminal Code: artt. 615-ter, 615-quater, 615-quinquies, 617-quater, 617-quinquies, 635-bis et seq., 640-ter, 491-bis c.p.
  • The Budapest Convention of 2001 (ratified in Italy by L. 48/2008) is the principal international reference.
  • L. 90/2024 (in force since 17 July 2024) updated the rules on computer crimes with increased penalties (for aggravated unauthorised access, art. 615-ter c.p., the penalty rose from one-to-five to two-to-ten years) and new procedural tools.
  • Proceedings often have a transnational dimension: international letters of request, cooperation with foreign authorities, collection of digital evidence stored on cloud servers.
  • Computer crimes are predicate offences for corporate liability under Legislative Decree 231/2001 (art. 24-bis D.Lgs 231/2001).

Definition: what cybercrime means

Cybercrime is a criminological category grouping two broad families:

  • Computer crimes in the strict sense: their object is the computer or telematic system itself (unauthorised access, computer damage, interception of computer communications). Without the technology, the offence would not exist.
  • Computer crimes in the broad sense (so-called computer-related crimes): traditional conduct carried out through computer means (online fraud, impersonation, money laundering through cryptocurrencies, dissemination of unlawful content). Technology is the instrument, not the object.

The distinction matters because only computer crimes in the strict sense were created to address the digital phenomenon; the others are adaptations of long-standing offences to the new context.

In Italy the rules have been built up in successive layers: the original core in L. 547/1993 (introducing computer crimes into the Criminal Code); the ratification of the Budapest Convention by L. 48/2008 (which revised and expanded the catalogue); subsequent reforms on computer fraud, cyberbullying and personal-data rules; and L. 90/2024, the most recent intervention, which strengthened the criminal-law safeguards by increasing the penalties for computer crimes.

The Budapest Convention of 2001

The Council of Europe Convention on Cybercrime (the Budapest Convention, 23 November 2001) is the first international instrument dedicated to computer crime. It has three objectives: to harmonise criminal offences among signatory States, to regulate investigative and procedural powers in proceedings involving digital evidence, and to strengthen international cooperation.

Italy ratified the Convention by L. 48/2008, which at the same time amended the Criminal Code and the Code of Criminal Procedure to align the legal system with its treaty obligations. The Convention remains the principal reference for international cooperation in computer crimes: cross-border investigations, exchange of digital evidence and the rapid preservation of data (“data preservation”).

Alongside it is the Second Additional Protocol (CETS 224, opened for signature on 12 May 2022) to the Budapest Convention, on enhanced cooperation and the disclosure of electronic evidence. Italy has signed but not yet ratified it.

  • L. 547/1993 — amendments to the Criminal Code and the Code of Criminal Procedure on computer crime.
  • L. 48/2008 — ratification of the Budapest Convention and amendments to the Criminal Code and the Code of Criminal Procedure.
  • L. 90/2024 — reform on computer crimes and cybersecurity (in force since 17 July 2024).
  • Budapest Convention on Cybercrime (Council of Europe Treaty 185, 23 November 2001).
  • Directive (EU) 2013/40 on attacks against information systems.
  • Regulation (EU) 2016/679 — GDPR.
  • D.Lgs 196/2003 (the Italian Privacy Code).
  • D.Lgs 65/2018 — implementing the NIS Directive.
  • D.Lgs 138/2024 — implementing the NIS 2 Directive, extending cybersecurity obligations to “essential” and “important” entities across 18 sectors.

The principal criminal offences

  • Art. 615-ter c.p. — unauthorised access to a computer or telematic system.
  • Art. 615-quater c.p. — unlawful possession, distribution and installation of equipment, codes and other means enabling access to systems.
  • Art. 615-quinquies c.p. — unlawful possession, distribution and installation of equipment designed to damage or interrupt systems.
  • Art. 617-quater c.p. — unlawful interception, obstruction or interruption of computer or telematic communications.
  • Art. 617-quinquies c.p. — installation of equipment designed to intercept, obstruct or interrupt computer communications.
  • Art. 635-bis c.p. — damage to computer information, data and programs.
  • Art. 635-ter c.p. — damage to computer information, data and programs used by the State or another public or public-utility body.
  • Art. 635-quater c.p. — damage to computer or telematic systems.
  • Art. 635-quinquies c.p. — damage to public-utility computer or telematic systems.
  • Art. 640-ter c.p. — computer fraud.
  • Art. 491-bis c.p. — electronic documents (extending the rules on documentary forgery).
  • Art. 494 c.p. — impersonation (frequent in cyber dynamics).

The main cybercrime offences

Unauthorised access to a computer system (art. 615-ter c.p.)

This is the “core offence” of cybercrime: it punishes anyone who gains unauthorised entry into a computer system protected by security measures, or who remains in it against the express or implied wishes of the person entitled to exclude them. The basic penalty (first paragraph) is imprisonment of up to three years; the aggravated forms (conduct committed by a public official, abuse of the status of system operator, violence on persons or things, damage to the system) are punished, after L. 90/2024, with imprisonment from two to ten years, while where the systems are of military, public-security, healthcare or otherwise public interest the penalty rises to three to ten years and, in the most serious cases, four to twelve years.

Case law has clarified that the notion of “security measures” is broad: it includes access credentials, encryption systems and administrative restrictions, but also documented organisational measures. The Joint Chambers (Sezioni Unite, the highest formation of the Court of Cassation) have ruled several times on the scope of the provision, in particular on the question of an authorised person who remains in the system for purposes other than those permitted (SS.UU. no. 4694/2012, Casani; SS.UU. no. 41210/2017, Savarese).

Unlawful possession of access codes (art. 615-quater c.p.)

This punishes anyone who, in order to make a profit or cause harm, unlawfully obtains, holds, produces, reproduces, distributes or communicates codes, passwords or other means enabling access to protected systems. It is an instrumental offence often charged together with art. 615-ter c.p. in cases of credential stuffing, the sale of stolen credentials and organised phishing.

Computer interception (art. 617-quater c.p.)

This punishes anyone who fraudulently intercepts, obstructs or interrupts communications relating to a computer or telematic system, or discloses them. It is the provision applicable, among other things, to man-in-the-middle attacks, unlawful packet sniffing, and the interception of e-mail and encrypted traffic.

Computer damage (artt. 635-bis et seq. c.p.)

A family of offences protecting the integrity of data and systems. Art. 635-bis c.p.: damage to computer information, data and programs. Art. 635-ter c.p.: an aggravated form for data of public interest. Art. 635-quater c.p.: damage to computer or telematic systems. Art. 635-quinquies c.p.: damage to public-utility systems. These are the provisions applicable to ransomware, wiper, defacement and DDoS attacks, and generally to all conduct that compromises integrity, availability or functioning.

Computer fraud (art. 640-ter c.p.)

This punishes anyone who, by altering in any way the functioning of a computer or telematic system, or by interfering without entitlement and by any means with data, information or programs contained in a system, secures for himself or others an unjust profit to the detriment of another. It is the provision applicable to frauds on home-banking systems, manipulation of payment systems, betting-system frauds and SIM swaps. The difference from fraud (art. 640 c.p.) is structural: in computer fraud there is no deception of a person, but an alteration of the system.

Electronic documents and forgery (art. 491-bis c.p.)

This extends to electronic documents all the provisions of the Criminal Code concerning forgery in public documents and private writings.

Recurring cases in practice

In operational terms, the firm regularly handles certain types of case:

  • Ransomware: encryption of corporate systems with a cryptocurrency ransom demand. This falls under artt. 635-bis/635-quater c.p., often together with artt. 615-ter and 615-quinquies c.p.
  • Data breaches and data leaks: a combination of unauthorised access (615-ter), possible damage (635-bis) and breaches of data-protection rules (with GDPR administrative penalties and notifications to the Data Protection Authority).
  • Insider threats: employees or collaborators who, holding credentials, export confidential data. Relevance of art. 615-ter c.p., with the well-known question of use for purposes other than those authorised.
  • Organised phishing: a combination of art. 640 c.p. (inducement into error), art. 640-ter c.p. (alteration of home-banking systems), art. 615-quater c.p. (access codes) and art. 494 c.p. (impersonation).
  • Online trading frauds and cryptocurrency investment scams: see also the dedicated pillar on online fraud.
  • Computer-enabled offences against the person: revenge porn, impersonation, cyberstalking. The relevant rules lie largely outside D.Lgs 196/2003 / the GDPR (which concern the administrative aspects of data protection) and within the specific offences of the Criminal Code.

Cybersecurity and the new obligations: NIS 2 and L. 90/2024

On the prevention side, the evolution of EU law has imposed growing obligations on essential and important operators. Directive (EU) 2022/2555 (NIS 2), implemented in Italy by D.Lgs 138/2024, has extended the range of entities required to adopt cybersecurity measures, to notify significant incidents and to manage cyber risks. The role of the National Cybersecurity Agency (ACN) has also been strengthened.

L. 90/2024 updated, in parallel, the rules on computer crimes (increased penalties — for aggravated unauthorised access the term rose from one-to-five to two-to-ten years — and new procedural safeguards) and introduced incident-reporting obligations for specific entities. The cumulative effect is a multiplication of the points of contact between companies and the authorities: a single cyber incident may simultaneously trigger the obligation to notify the Data Protection Authority (GDPR), the ACN (NIS 2 and L. 90/2024), a possible criminal complaint, and a 231 report to the supervisory body.

Investigations into computer crimes: how they unfold

Cybercrime proceedings have a technical and procedural specificity. The relevant police forces are the Postal and Communications Police (Polizia Postale) and the Special Unit for the Protection of Privacy and against Technological Fraud of the Guardia di Finanza. The typical investigative tools include:

  • Forensic acquisition of devices (bit-stream images, integrity hashes, chain of custody).
  • Acquisition of data retained by providers and operators (traffic logs, IP addresses, subscriber data), within the limits set by European case law on data retention.
  • Computer or telematic interceptions (art. 266-bis c.p.p.).
  • Evidential seizure of servers, devices and accounts; disclosure orders to providers.
  • International letters of request and cooperation under the Budapest Convention, through the “24/7 point of contact” provided for in art. 35.
  • Rapid preservation of data (“data preservation”) with foreign providers.

In evidential terms, the digital chain of custody is fundamental: every acquisition must be documented so as to guarantee its authenticity, integrity and reproducibility. Defects in the chain of custody are a classic battleground for the defence.

Defence strategies in cybercrime proceedings

The defence in computer crimes integrates criminal law with technical expertise.

Legal classification. Unauthorised access, damage, computer fraud, interception, impersonation and fraud carry different regimes. Correct classification can change the penalty, prosecutability, limitation period and jurisdiction.

Digital chain of custody. Verifying the chain of custody of digital evidence — from initial preservation to custody within the proceedings — is a classic technical battleground for the defence. Acquisition defects may render evidence inadmissible.

Party-appointed technical expert. The firm relies on IT forensic experts (forensic analysts) for independent analysis of devices, assessment of attributions (IP, geolocation, digital identities) and verification of the genuineness of forensic copies.

Mental element. Specific intent (“in order to make a profit” in frauds, “in order to cause harm” in other offences) is often a point of contention, particularly for professional roles (sysadmins, testers, security researchers) and in cases of compromised accounts.

Geography of the offence and jurisdiction. A computer offence may have perpetrators in one country, victims in another and servers in a third. Determining Italian territorial jurisdiction and any invocation of ne bis in idem are technical aspects to be managed.

Alternative procedures and mitigating factors. Plea bargaining and summary trial; repairing the harm (returning sums, restoring systems) may constitute a mitigating factor or an element of negotiation.

Cybercrime is a borderland that overlaps with other areas of criminal law. Online fraud (art. 640 c.p.): see the online fraud pillar. Money laundering of proceeds through cryptocurrencies: see money laundering. Privacy offences: the administrative aspects of the GDPR and specific offences (e.g. art. 167 D.Lgs 196/2003 — unlawful processing of data). White-collar crime: cyberattacks against companies overlap with allegations concerning cyber-risk management and the liability of directors. Corporate liability under Legislative Decree 231: computer crimes are predicate offences for corporate liability (art. 24-bis D.Lgs 231/2001), making it necessary to have compliance models that address cyber risk.

Case studies

Case 1 — Ransomware against a company. An Italian company was hit by ransomware encrypting its management systems, with a cryptocurrency ransom demand. The firm intervened from the first hours, coordinating: (i) the criminal complaint to the Postal Police and the judicial authority; (ii) the notification to the Data Protection Authority within the 72 hours required by the GDPR; (iii) the ACN notification under the relevant rules; (iv) the review of the 231 model and the liability profiles of the directors; (v) the criminal defence of the company’s senior management in relation to the issues arising from cyber-risk management. A parallel programme to strengthen security measures was started, to avoid allegations of negligence in related proceedings.

Case 2 — Unauthorised access by an insider. A company employee was charged under art. 615-ter c.p. for accesses to the management system carried out for purposes other than those of his role, with the export of data. The defence focused on the actual scope of the authorisation (the existence of policies, documented training, the perimeter of assigned privileges) and on the question — addressed several times by the Joint Chambers — of the criminal relevance of “authorised access for different purposes”.

Case 3 — Computer fraud on home banking. A client fell victim to computer fraud on a home-banking system, with significant sums withdrawn. The firm intervened by filing the criminal complaint, joining the proceedings as a civil party in the case brought by the Public Prosecutor and — in parallel — pursuing the action against the bank under D.Lgs 11/2010 (PSD2) for the unauthorised transactions, with proceedings before the ABF and subsequent court action.

FAQ

What is meant by cybercrime? These are offences committed through or against computer systems: unauthorised access, computer damage, computer fraud, unlawful interception, impersonation and possession of access codes. They are distinguished from computer crimes “in the broad sense”, which are traditional conduct carried out with digital tools (e.g. online fraud).

What is the difference between unauthorised access and computer fraud? Unauthorised access (art. 615-ter c.p.) punishes unlawful entry into a protected system. Computer fraud (art. 640-ter c.p.) additionally requires the alteration of the system’s functioning or interference with data in order to secure for oneself or others an unjust profit to the detriment of another.

What is the Budapest Convention? It is the Council of Europe Convention on Cybercrime of 2001, the first international instrument dedicated to computer crime. Ratified in Italy by L. 48/2008. It governs the harmonisation of offences, investigative powers and international cooperation, with the “24/7 point of contact” for emergencies.

What did L. 90/2024 change? L. 90/2024 (in force since 17 July 2024) updated the rules on computer crimes and the tools to combat them, with increased penalties (for instance aggravated unauthorised access, art. 615-ter c.p., rose from one-to-five to two-to-ten years’ imprisonment) and new procedural safeguards. The role of the National Cybersecurity Agency was also strengthened.

What should I do if my company suffers a cyberattack? Coordinate five actions in parallel: (1) technical containment of the incident; (2) notification to the Data Protection Authority within 72 hours (GDPR); (3) any ACN/CSIRT notifications under NIS 2 and L. 90/2024; (4) a complaint to the judicial authority and the Postal Police; (5) activation of the 231 model and the supervisory body. The firm coordinates all five flows.

Is the company liable for the computer crimes of its employees? Yes, where the imputation criteria of Legislative Decree 231/2001 are met (interest or advantage of the entity). Computer crimes are predicate offences for corporate liability under art. 24-bis of the decree. The compliance model must include a special section dedicated to cyber risk.

Does Italian jurisdiction apply even if the perpetrator is abroad? Yes, where the offence is committed against an Italian victim or where part of the conduct took place in Italy. Cooperation with foreign authorities — based on the Budapest Convention, bilateral conventions and art. 35 of the Convention (the 24/7 point of contact) — is a routine element of cybercrime proceedings.

How is a defendant in a computer-crime case defended? Through a combination of legal and technical analysis: legal classification, verification of the digital chain of custody, party-appointed forensic expert evidence on attributions (IP, devices, identities), assessment of the mental element and verification of territorial jurisdiction. The firm integrates criminal law with cyber expertise.

When to contact the firm

If your company has been hit by a cyberattack or you have suffered significant computer fraud, contact the firm in the first hours: the window for notifying the Data Protection Authority, filing a criminal complaint and preserving digital evidence is very narrow. If you have been served with a notice of investigation, a computer search or a seizure of devices in the context of a computer-crime investigation, acting immediately is the difference between a defence built and a defence endured.

Request a confidential consultation — response within 24 hours. A 24/7 line is available for cyber emergencies.