Cybercrime charges in Italy and digital evidence

Who receives a computer-crime notice and does not see why

The notice often arrives after a long silence. An employee who opened a colleague's mailbox to find a file is told that the access was unauthorised. A former partner who kept using a shared streaming or cloud account is accused of intruding. A freelancer who used credentials supplied by a client for a purpose the client did not intend is reported. A person who published a harsh review, a comment or a message in a group learns that it has been charged as defamation, which in Italy is a crime and not only a civil wrong. Somebody who created an account under another person's name or photograph, as a joke or to monitor a relative, finds that the matter is criminal.

Others come with a device that has been taken. Police arrive with a warrant and leave with a phone, a laptop and a hard drive. The person has no access to messages, work files or banking, and a letter explains that the content will be copied. A different group are victims, whose accounts were opened, messages read or images shared, and who want to know whether to report and what the process will demand of them.

What links them is the width of Italian law in this area. Unauthorised access to a protected system does not require hacking: using credentials you were legitimately given, for a purpose outside the authorisation, can be enough. Penalties in this area were increased by recent legislation. This page explains how to protect your position in the opening days.

What a seized phone or a computer charge does to work and home

A device seized for copying takes the working life with it. Calendars, contacts, banking applications, authentication codes and photographs are all on the phone. Without it the person cannot confirm a payment, join a meeting, reach a client or log in to an account protected by a code sent to the lost handset. A self-employed worker may be unable to operate. A student may lose notes and submissions.

Employers react quickly. A person accused of accessing company systems may be suspended or dismissed before any court has looked at the case, and the employer may report the matter itself. Regulated professions have their own bodies, and an accusation can lead to questions even where nothing is proven. A person working abroad for an Italian company, or in Italy for a foreign company, may find that each employer wants an explanation.

Family and social life are touched as well. Private messages are copied and read by officers, and details of relationships, health and money can come into the file. A person whose image was shared without consent faces exposure that is difficult to reverse, and the process of reporting involves describing what happened to several officials. Advice from a lawyer about how to preserve evidence, request removal and protect accounts should come early. Plan for access to banking and communication by other means while the device is away.

Choices after a search, a device seizure or a report

The decisions arrive quickly, and each has a price.

• Giving passwords. Officers may ask for passcodes at the time of the seizure. Giving them opens everything on the device and in the linked accounts, including material unrelated to the case. Refusing may lead to forensic extraction by other means. Ask what the basis is, ask for a record of the request and decide with counsel.
• Explaining the access. The natural account is that the access was routine, permitted or accidental. It is also a statement that the access happened, with the reason and the purpose. Give it when a lawyer has seen the evidence.
• Asking for copies of the data. The person may ask for a copy of what was taken, for work or for the defence. The request is useful and should go through the lawyer, with a focus on what is needed.
• Contesting the seizure. A seizure can be challenged, particularly where the whole device was taken for a narrow purpose. A challenge takes time but can limit what is examined.
• Reporting as a victim. A report starts a process. Preserve evidence, then decide with counsel how to present it.

The right order is nearly always to protect the position, then speak. If you are unsure whether a step counts as protecting or as tampering, ask before taking it.

What to save, and how, before anything else changes

Digital cases turn on logs, timestamps and context. Collect what you can, in a form that cannot be altered.

• Screenshots and exports of the messages, emails or posts at issue, with dates and sender details, taken on a device that is not the device seized.
• The terms of use, employment contract, policy or instruction that defines what you were allowed to open or use.
• Messages or emails showing who asked you to do the task, who approved it and why.
• Account recovery emails, login alerts and device lists, which show who accessed what and when.
• For fake-profile cases, the history of the account: when it was created, from which email, and any reports made by the platform.
• For defamation, the exact words, the audience, the context and any earlier exchange that explains them.
• The warrant or order for the search, the list of items taken and the record of any request for passwords.
• Backups of your own data, stored away from the seized device and from the accounts at issue.
• Contact details of the colleague, platform or service involved, noted for the lawyer only, without contacting them.
• A list of the devices and accounts you use, with the names of cloud services, so that nothing relevant is missed when copies are requested.

Do not log in to the accounts at issue to check what is there. Each access changes the record.

Questions about intent, authorisation and the device

These questions are specific to computer and online matters.

• Which offence is alleged: unauthorised access, computer fraud, interception, damage to data, false identity or defamation?
• Does the offence require a particular purpose, such as profit or harm, and what does the file say about mine?
• If I had credentials legitimately, how can use of them be unauthorised?
• Are the messages I received protected as correspondence, and what does that mean for how they are used?
• What exactly will be copied from my device, and how are unrelated and privileged materials separated?
• Can I get the device or a copy back, and by when?
• Is the offence prosecuted on complaint or on the authorities' own motion?
• If an image or a message was shared, what steps exist for removal?
• Could a civil claim follow, and should I prepare for that?
• If my phone was copied, can I see the list of what was extracted and challenge anything outside the warrant?
• Does it matter that the access took place during working hours, or from a company device?
• If a post was removed, does that change the position on defamation?
• Can I use an exchange of messages with the other party in my defence, and how?

Ask the lawyer to put the answers in a short note you can keep and update.

When the servers, the platform or the people are abroad

Online conduct crosses borders without any journey. A mailbox on a server in another state, a social media platform that keeps data elsewhere and a counterpart in a different country are normal features of these files. Each location has its own rules about what a provider will disclose, and the delay in getting records can be long.

Investigators in Italy may request data from a foreign provider through formal channels, and the defence may need to ask for the same material. Ask early which records matter, and keep a log of requests. Platform support desks rarely understand legal urgency, so written requests with dates are better than calls. Documents such as terms of service, privacy notices and employment contracts in other languages need accurate translation, because a mistranslated permission can change the meaning of an access.

A person abroad who is under investigation in Italy needs a lawyer where he lives, who can explain local obligations and handle any parallel inquiry. The Italian lawyer coordinates with that counsel so that statements to different authorities do not conflict. Time zones matter when a provider has to be reached in a hurry, and a weekend can lose a log that would have been retained. Consulates can help with interpreters and replacement documents but have no role in the evidence.

How the firm handles an online or device case from the opening message

Send the notice, the record of seizure or the complaint to avvmassimoromano@gmail.com, with photographs of every page. The telephone number is on this page, and messages are answered at any hour. If your phone has been taken, use another device or ask a relative to write for you. If a search is under way when you write, say so in the opening line, and the lawyer will respond straight away.

The opening call establishes what is alleged, what was taken and what you said. The lawyer asks about accounts, passwords, backups and the people involved, and about any earlier dispute behind the case. The call ends with a plan for the next hours: what to save, whom not to contact and what to do about access to banking and work.

Work is conducted in English, and Italian documents are explained in plain terms. For technical questions, such as the extraction of data or the reliability of logs, the firm works with a forensic expert chosen with you. Offices in Rome, Milan and Naples allow attendance at searches and hearings in different regions. Where servers or people are abroad, a correspondent is asked for records or statements. The engagement is confirmed in writing, with the scope and the way of reporting set out, and short written updates follow each step.

Mistakes that deepen a digital case

Each of these has appeared repeatedly, with the reason.

• Do not delete messages, accounts or apps. Deletion is visible in logs and can look like concealment.
• Do not log in again to check what was accessed. Every login adds to the record.
• Do not change passwords on the accounts at issue without advice. A change at the wrong moment can be read as hiding something.
• Do not message the other person to explain. The message becomes evidence.
• Do not hand over passcodes casually. Access to a device usually gives access to others.
• Do not repeat a comment or a post to prove a point. A repeat turns a misunderstanding into a pattern.
• Do not use a borrowed device to continue the same activity. It brings a friend into the file.
• Do not post about the case. The post is read by the same officers who hold your phone.
• Do not wipe the phone or reset it to factory settings. A reset is visible and the content may be recoverable anyway.
• Do not contact the platform to delete logs. Requests to remove records look like concealment.
• Do not use another person's account to continue the discussion. It repeats the very conduct at issue.
• Do not discuss the case in a group chat with colleagues. Members can be asked what was said.

Terms found on warrants, copies of data and complaints

Some of these come from the page and some from Italian files on the same subject.

• Accesso abusivo — unauthorised access, entering or remaining in a protected system against the holder's will.
• Frode informatica — computer fraud, altering a system or intervening on data to obtain a profit.
• Intercettazione illecita — unlawful interception of computer communications.
• Sostituzione di persona — false identity, taking another person's name or quality to gain an advantage or cause harm.
• Dolo specifico — the particular purpose, such as profit or harm, that some offences require.
• Induzione in errore — deceiving a person, which is an element of the false-identity offence.
• Digital evidence — material taken from phones, computers and accounts, which must be copied and examined with safeguards.
• Correspondence — messages received, which the Constitution protects and which can be used only in limited ways.

If another term appears on your paper, send it to the lawyer exactly as written. The Italian words for these offences are long, and a translation often shortens them to a few words. Ask the lawyer for the Italian name of the offence next to the English name, since the legal label controls which arguments are available. Keep a short list of the terms that appear in your papers and tick them off as they are explained.