An accusation of a computer crime can arise from accessing an account, using corporate credentials, a disputed digital payment, stolen files, or the analysis of a phone and server. The fact that the episode occurs online does not make the legal response automatic: it is necessary to distinguish who could enter a system, what they actually did, which data were acquired, and whether the digital evidence retains reliability and relevance.
In this guide, I want to clarify what cybercrime means in criminal proceedings, why unauthorized access and computer fraud do not coincide, what effects the seizure of devices can have, and which choices deserve attention from the very beginning. Milan may be the place where you receive a notice, a search, or a summons, but the legal classification of the facts depends on the contested conduct and the elements gathered.
Computer crimes: the prosecution must indicate precise conduct
“Computer crime” is not a single offense. It is an expression that encompasses different offenses, each with its own prerequisites. Unauthorized access concerns unauthorized entry or permanence in a protected system; computer fraud instead requires a manipulation of the system or an intervention without right on data, information, or programs, accompanied by unfair profit and harm to others.
Therefore, it is not enough for an activity to have been carried out via computer, smartphone, email, or cloud platform. A contested payment may depend on the unauthorized use of an account, the deception of a person, an operational error, or data alteration. These are hypotheses that can lead to different legal classifications and require identifying with precision the technical step and human behavior attributed to the suspect.
Law no. 90 of 2024 has strengthened the criminal regulations of various computer crimes and the financial consequences linked to certain offenses. For facts occurring in different periods, the applicable discipline also requires attention to transitional rules and the principle that a harsher criminal law does not apply retroactively. The text of the reform is available in Law no. 90 of June 28, 2024.
The accusation is not proven by the IP address alone. A network address, an account registered to a name, or a device found in a place may constitute investigative elements, but they do not solve the central question by themselves: who performed the action and with what access powers. For example, concrete availability of credentials, logs, shared use of the device, corporate authorizations, and the chronological sequence of operations can take on significance.
Unauthorized access: when access exceeds permitted limits
Unauthorized access protects control over the system. Article 615-ter of the Italian Criminal Code concerns anyone who unlawfully introduces themselves into a computer or telecommunications system protected by security measures, or remains there against the will, whether expressed or tacit, of the person entitled to exclude them. The point is not merely bypassing a password: what matters is whether access was concretely permitted and within the limits in which it was carried out.
An authentic credential does not always equal unlimited authorization. Anyone with a personal account, corporate profile, or technical access may be enabled only for certain functions, archives, or operating bands. The limit of authorization may result from assignments, IT policies, service rules, assigned roles, or revocation communicated to the user. Even the use of passwords received in the past must be read in context: material availability of the code and the right to use it are not the same thing.
The system must be genuinely protected
Security measures play a decisive role. Passwords, multi-factor authentication, authorization profiles, network restrictions, and access controls are elements that can demonstrate system protection. It is not necessary to imagine only sophisticated infrastructures: even an email box or a cloud archive can fall within the notion of a computer system if they are organized and protected.
If instead the data was freely accessible, hasty conclusions must be avoided. The absence of a technical barrier can affect the charge of unauthorized access, but does not automatically eliminate any other possible criminal relevance. Reading, copying, disseminating, or subsequently using information can pose different problems, which must be separated from the initial question of how one entered the system.
Entering, remaining, using data: distinct steps
The timeline of actions changes the defense. An initial unauthorized entry may be contested; in other cases, access begins legitimately and becomes problematic because it continues after revocation; in still others, the main theme is the use of the obtained data. Confusing these steps makes it harder to understand both the charge and the proof necessary to support it.
A message revoking authorizations, the termination date of an assignment, permission configurations, and system logs can therefore take on concrete importance. It is not enough to state that the account was available: one must understand whether the contested use fell within the assigned functions and whether any prohibition was knowable by the person who accessed it.
Computer fraud, altered data, and access tools
Computer fraud requires harm and profit. Article 640-ter of the Italian Criminal Code does not punish every improper use of a computer. The offense requires the alteration of the functioning of a system or an intervention without right on data, information, or programs, from which an unfair profit and damage to another party derive. A money transfer or modification of digital credits may be relevant, but the mechanism and concrete economic effect must be reconstructed.
The current Article 640-ter also provides an aggravated offense when fraud involves theft or improper use of digital identity to the detriment of one or more people. Digital identity must be connected to the specific conduct: its use, the conduct affecting the system or data, the unjust profit and the damage must be established. An account bearing another person’s name does not by itself replace that assessment.
Damaging data is not always equivalent to stealing it. Deletion, deterioration, or rendering data, programs, or systems unusable may fall under computer damage regulations. Cases in which tools, codes, or credentials prepared or disseminated to unlawfully access protected systems are contested are different. The law distinguishes the conduct of those who enter, those who compromise data, and those who provide means suitable for access: the defense must remain adherent to the actual charge.
The purpose attributed to the conduct matters. A remote administration program, script, or password can have a legitimate use in an authorized technical context and take on a different meaning if used outside assigned powers. For this reason, in reconstructing the fact, the name of a computer tool is not sufficient: the way it was used, the environment in which it operated, and the relationship between that use and the contested event are needed.
Digital evidence and seizures: the device does not coincide with its data
A seized smartphone contains much more than the contested fact. Messages, photographs, credentials, authentication apps, health data, personal relationships, and professional activities can coexist on the same device. For this reason, in criminal proceedings it is necessary to distinguish the material asset, such as the phone or computer, from the data that the authorities intend to acquire and analyze.
The regulations introduced by Law no. 48 of 2008 require technical measures in computer searches aimed at preserving original data and preventing alteration. For data held by service providers, Article 254-bis of the Italian Code of Criminal Procedure allows acquisition in copy with a procedure ensuring compliance with the original and immutability, with obligations to preserve original data. The text of the amendments can be consulted in Law no. 48 of March 18, 2008.
The forensic copy serves to preserve the data. In simple terms, it is a duplication performed with methods suitable for documenting that the examined content corresponds to that acquired and has not been modified. However, it does not automatically transform every file, chat, or log into decisive proof. The origin of the data, the completeness of the acquisition, the selected time frame, the traceability of the account, and the link between the content and the contested fact remain to be verified.
Technical assessments and defense participation
Certain operations may be unrepeatable. When the public prosecutor orders technical assessments on things, persons, or places whose state is subject to modification, Article 360 of the Italian Code of Criminal Procedure provides for notices to the suspect, the victim, and defense counsel, with the right to appoint technical consultants. The discipline is recalled in the current text published by Normattiva on the amendment of Article 360 of the Italian Code of Criminal Procedure.
Not every digital analysis follows the same path. The classification of the act depends on its nature and the risk of data modification or loss. Once a notice concerning technical operations is received, it is important to immediately understand what will be extracted, on which medium, with what object, and with what possibilities of participation. The issue is not only technical: it concerns adversarial proceedings, i.e., the possibility for the parties to confront each other on the formation of evidence.
Control over seizure can remain relevant even after restitution. The Italian Supreme Court of Cassation reaffirmed, in a specific case, the illegitimacy of a new acquisition of the same data via computer inspection after the annulment of the evidentiary seizure and before the restitution of the forensic copy. The decision shows how the measure, its limits, and the sequence of acquisitions can affect the usability of data: Criminal Cassation, ruling no. 31180 filed on July 30, 2024.
The first choices after a notice, search, or seizure
Do not modify data or devices involved. Deleting messages, reinstalling an operating system, changing passwords to shield an account from analysis, or altering technical logs can worsen the situation and make it harder to correctly reconstruct the facts. Preserving what is already in one's availability does not mean disclosing third-party data or carrying out invasive initiatives: it means avoiding interventions that change potentially relevant material.
The charge must be read word for word. A search or seizure decree, an information notice, a summons, or a notice of conclusion of investigations indicate, with varying levels of detail, the hypothesized fact and procedural phase. The recalled rules, the date of the fact, the devices involved, and the object of acquisition help understand whether the hypothesis concerns access, fraud, data damage, or a different crime.
Speaking immediately is not an automatic obligation. The choice to make statements requires knowing the charge and available documents, because a partial technical explanation can be interpreted out of context. At the same time, waiting does not replace the protection of procedural faculties when terms are set to react to a measure. The useful strategy depends on the phase, the content of the documents, and the presence of technical data to clarify.
For those filing a report, the problem is also preserving the trace. If you believe you have suffered an access or fraud, isolated screenshots and forwarded chats may not suffice to reconstruct what happened. It is useful to keep received communications, security notifications, dates, operation identifiers, and relations with the service provider without altering the account or deleting notices. Proceedibility may vary based on the crime and any aggravating circumstances: it is not prudent to take for granted that a formal complaint is always necessary or always excluded.
Criminal defense and technical clarification: two levels that must dialogue
Technical competence does not replace criminal defense. A consultant can explain the functioning of a log, the origin of a file, the meaning of an IP address, or the methods by which a copy was created. However, the proceedings also require verifying whether that data was legitimately acquired, whether it is relevant to the fact, and whether it truly proves what the prosecution attributes to it.
The technical explanation must remain verifiable. Saying that an account was compromised, that a device was shared, or that an operation is automated can be relevant only if concrete data exists to compare the hypothesis with. Configurations, timelines, logs, authorizations, and communications can take on different weight according to the contested fact. A credible reconstruction distinguishes what is documented from what remains merely possible.
Seizures and operational continuity are distinct problems. For those who use digital tools for professional or business activities, the temporary loss of a device can create immediate difficulties. This does not authorize intervening on the data subject to acquisition, but makes it important to understand whether the need concerns the material asset, specific documents, access to essential services, or copies of data extraneous to the investigation. These are different requests and do not automatically produce the same result.
The decisive point is avoiding hasty labels. “Hacking,” “online scam,” or “identity theft” often describe initial fear, not yet the legal category. A useful criminal defense starts from the contested conduct, the limits of authorization, any damage, and the quality of digital evidence. If you have received an act or suffered data acquisition, you can contact me to frame the measure and the choices compatible with the phase of the proceedings.
Frequently Asked Questions
Can I be accused of unauthorized access if I knew the password?
Yes, that can happen. Knowing a password does not prove that access was authorized at the moment and for the purpose it occurred. It is necessary to verify whether the system was protected, what limits you had, whether authorization had been revoked, and whether those limits were knowable. The password can be a technical element, not an unconstrained permit.
Is a chat found on my phone enough to prove computer fraud?
No, it is not enough by itself. A chat must be placed in its context: authenticity, date, interlocutors, completeness, and link with the contested operation. For computer fraud, it is also necessary to verify conduct on the system or data, unfair profit, and damage to others. A fragment of a conversation does not replace this reconstruction.
If the computer is returned, are the copied data deleted?
Not automatically. The return of the computer concerns the material asset; a copy of the data may have been acquired and remain in the file. It is necessary to read the measure, understand which data were extracted, and verify their relevance. Restitution can thus solve an operational problem without closing the evidentiary issue.
Can I delete personal files before handing over a device?
No, it is a risky choice. Deleting or modifying data that can be the object of investigation can negatively impact your position and make it harder to reconstruct even favorable elements. If the device is involved in a search, seizure, or authority request, the prudent conduct is not to alter its content and immediately understand the measure received.
Can I file a formal complaint for access to my account?
You can evaluate reporting or filing a complaint, but procedibility depends on the crime. Some hypotheses require the victim's complaint, while others are prosecutable ex officio in the presence of specific circumstances. Before acting, it is useful to identify the contested access, keep available communications and security notices, and not confuse a technical suspicion with already formed evidence.