In brief. Unauthorised access to an IT or telematic system (accesso abusivo ad un sistema informatico o telematico) is the core Italian computer-crime offence, set out in art. 615-ter of the Italian Criminal Code (codice penale, c.p.). It punishes anyone who unlawfully enters a protected computer system, or who remains inside it against the express or implied will of the person entitled to exclude them. The offence was introduced by Law 547/1993, sits within the framework updated by Law 48/2008, which ratified the Budapest Convention on Cybercrime, and was most recently amended by Law 90/2024 (legge sulla cybersicurezza), which sharply increased the penalties.

What art. 615-ter punishes

Art. 615-ter c.p. criminalises two distinct forms of conduct. The first is unlawfully gaining access to a computer or telematic system that is protected by security measures. The second is remaining in the system against the will, whether express or tacit, of the person who has the right to exclude others. Both forms require that the system be protected by security measures (misure di sicurezza) — a password, an access credential, a firewall or any technical or organisational barrier signalling that access is reserved.

The Italian Supreme Court (Corte di Cassazione) has clarified that the offence protects the domestic peace of the IT system (domicilio informatico) — the right of the holder to control who enters and what they do there. A decisive line of authority, fixed by the Joint Chambers (Sezioni Unite) in the Casani judgment (no. 4694/2012) and developed in the Savarese judgment (no. 41210/2017), holds that the offence is committed even by a person who possesses valid credentials but uses them for purposes that breach the conditions and limits set by the system owner. In other words, an authorised user who exceeds the scope of their authorisation — for example, an employee who consults a database for private ends — can commit the offence.

Aggravating circumstances

The basic offence is prosecuted on complaint (querela) by the injured party. However, art. 615-ter foresees several aggravating circumstances (circostanze aggravanti) that make the conduct prosecutable ex officio and carry heavier penalties:

  • the offence is committed by a public official or a person providing a public service, by abuse of powers or breach of duties;
  • the offence is committed by someone who professionally operates as a private investigator, or with abuse of the operator’s status of the system;
  • the offender uses violence on persons or things, or is visibly armed;
  • the conduct causes the destruction or damage of the system, or the interruption of its operation, or the destruction or alteration of the data it holds.

A further, more severe band applies where the systems concerned are of military interest, or relate to public order, public security, public health or civil protection, or are otherwise of public interest. After L. 90/2024 the penalties for attacks on these systems are substantially higher.

Penalties after Law 90/2024

Law 90/2024 of 28 June 2024 (in force since 17 July 2024) restructured the penalty framework, sharply increasing the sentences for the aggravated forms to reflect the strategic importance of cybersecurity. Under the current text of art. 615-ter c.p.:

  • the basic offence (first paragraph) is still punished with imprisonment of up to three years;
  • where an aggravating circumstance applies (public official, abuse of the operator’s status, violence on persons or things, damage to the system), the penalty is now imprisonment from two to ten years (previously one to five years);
  • where the targeted system serves public interest, military interest or critical infrastructure, the penalty rises to imprisonment from three to ten years and, in the most serious cases, from four to twelve years.

The basic offence remains prosecutable only on complaint, while all aggravated forms are prosecuted ex officio. Law 90/2024 also introduced the new offence of computer extortion (art. 629, para. 3 c.p.) and increased the fines for companies under art. 24-bis of Legislative Decree 231/2001. For an English-speaking defendant, the practical consequence is that what might once have been a comparatively minor charge now exposes the accused to a genuine custodial risk and to pre-trial precautionary measures (misure cautelari).

Defences

A robust defence under art. 615-ter usually turns on one or more of the following technical pillars.

Absence of security measures. The offence presupposes that the system was protected by misure di sicurezza. If access was open, unprotected, or the credentials were freely shared, the constitutive element is missing and the conduct falls outside the scope of the offence.

Scope of authorisation. Following Sezioni Unite nos. 4694/2012 and 41210/2017, the question is whether the accused acted within or beyond the limits set by the system owner. Documentary evidence of the access policy, the employment contract, or the IT-use rules is often decisive in showing that the accused remained within the boundary of their authorisation.

Absence of intent. Art. 615-ter is a crime of intent (dolo): the accused must have been aware of, and have willed, the unlawful access or the unlawful continuation inside the system. Accidental access, technical error, or a genuine misunderstanding about the right to enter negates the subjective element.

Forensic challenge. Italian computer-crime prosecutions rest heavily on digital forensic evidence — log files, IP attribution, device imaging. The chain of custody and the integrity of the digital evidence must comply with the standards introduced by L. 48/2008 (art. 244 and 247 c.p.p. on the seizure and preservation of digital data). A flawed acquisition can undermine the entire case.

Jurisdiction. Where the conduct, the system or the accused are located in different countries, the question of Italian jurisdiction and of conflicting proceedings abroad becomes central — an area where ILA’s cross-border practice is decisive.

How ILA defends these cases

ILA acts for English-speaking professionals, executives and companies facing art. 615-ter proceedings in Italy, frequently in combination with charges of computer fraud, data damage or industrial espionage. The firm coordinates Italian criminal-defence counsel with independent digital forensic experts, scrutinises the lawfulness of the evidence acquisition, and where appropriate engages early with the prosecutor to limit precautionary measures. For the full overview of the firm’s computer-crime practice, see the pillar guide to cybercrime in Italy.

FAQ

Is unauthorised access a crime even if I had a valid password? Yes. Under the leading Supreme Court authority (Sezioni Unite nos. 4694/2012 and 41210/2017), a person who holds valid credentials still commits the offence if they enter or remain in the system for purposes that breach the conditions and limits set by the system owner. Authorisation is judged by purpose, not merely by possession of credentials.

What penalty does art. 615-ter carry now? The basic offence is punished with imprisonment of up to three years. After Law 90/2024 the aggravated forms are punished with imprisonment from two to ten years, and offences against systems of public, military or critical-infrastructure interest can reach three to ten years and, in the most serious cases, four to twelve years.

What if the system had no security measures? The offence requires that the system be protected by security measures. If access was open or unprotected, a key constitutive element is absent and the conduct generally falls outside art. 615-ter. This is often the first line of defence.

Contact the firm

If you or your company has been notified of an investigation or precautionary measure for unauthorised access to a computer system, contact ILA without delay. See the cybercrime pillar guide and reach us through the Contact page or our 24/7 line.