Italian Supreme Court of Cassation, Criminal Division VI, Judgment No. 37343/2026, filed on 26 October 2026
Possessing valid access credentials does not, in itself, exclude liability for unauthorized access to a computer system under Article 615-ter of the Italian Criminal Code. What matters is not only compliance with the formal limits of authorization, but also the purpose for which access privileges are actually exercised.
The Supreme Court reiterated this principle in Judgment No. 37343/2026, concerning an employee of a Lotto betting outlet who used its electronic terminal to place numerous personal bets without paying the corresponding amounts. The Court upheld convictions for unauthorized access and embezzlement by a person entrusted with a public service, emphasizing the system’s purpose of collecting public lottery bets and accurately recording the amounts due.
The ruling follows the approach adopted by the Joint Criminal Divisions in Judgment No. 41210/2017, Savarese. Under that approach, a public official or person entrusted with a public service may commit unauthorized computer access even when using properly assigned credentials, if access is exercised for purposes fundamentally unrelated to the institutional functions for which those privileges were granted.
The central issue is therefore the misuse or diversion of access authority (sviamento di potere). Not every breach of organizational rules, nor every improper use of information obtained through a system, automatically constitutes an offence under Article 615-ter. It is necessary to establish whether accessing or remaining within the system amounts to exercising authority in a manner incompatible with the function that justified granting it.
In this case, the Court identified that incompatibility in the systematic registration of bets without collecting payment, treating such conduct as foreign to the public-service function of accepting and accounting for lottery bets.
The judgment has significant implications for criminal defence. Distinguishing unauthorized access from a separate unlawful act committed through otherwise legitimate access requires a concrete examination of the scope of authorization, the operator’s duties and the nature of the transactions performed. The pursuit of personal gain cannot, by itself, replace proof of the statutory elements of the offence.
The decisive question is therefore when the improper use of a computer system constitutes a diversion of authorized functions and when access remains lawful, notwithstanding a separate unlawful act.
