COMPUTER CRIMES
Court of Cassation: abusive access to an IT system via preventing access to Dropbox.
Who is the actual owner of "Dropbox" space, the cloud service that allows file sharing, within a business or commercial relationship?
This question is sought to be answered by the Court of Cassation, in its ruling No. 27900/2023, upholding, with referral, the appeal of two people convicted of abusive access to a computer system for having changed the e-mail address connected to the account made available by them to the company for which they worked.
For the prosecution, such behavior undoubtedly integrates conduct of abusive access to the system, since "the operation is capable of prohibiting access to the system precisely to the owner of the system itself configuring ex se a violation of the limits imposed on third parties in possession of the passwords."
The Fifth Criminal Section takes a different view, according to which the territorial court will have to identify which subjects were actually entitled to exclusive access to the "Dropbox" space.
It appears undisputed, continues the reasoning of the Supreme Court, that the "Dropbox" space was created by the defendants to facilitate their work activities in favor of the company and, in this perspective, made available by them to the company, which allowed them to connect to it, for access, an account, distinguished by a telematic address traceable to the company. Similarly, it is clear that the plaintiffs were entitled to access the virtual space and enter therein data or information related to the projects developed in the interest of the company.
If this is true, the decision continues, since the incriminated conduct consisted in the change of the telematic address, which did not allow the "company" to use the "Dropbox" space created by the defendants, "it becomes decisive to ascertain what was the discipline of use of the "Dropbox" space applicable in concrete terms when the said change was made."
In other words, it is a question of whether the "Dropbox" storage space:
1) was of exclusive pertinence to the defendants, its creation having to be traced back to them, and being granted by them momentarily in use to the "company", pending their employment relationship, without such availability causing their power to modify the conditions of access to the space in question to be terminated, precisely because it was of their exclusive pertinence;
2) whether, on the other hand, once created, albeit at the initiative of the defendants, that space had become the exclusive pertinence of the "company," so that the plaintiffs' access to the system in order to modify their account by changing the telematic address, so as not to objectively permit its use by the "company" must be considered to have been carried out for reasons ontologically unrelated to those for which the power to access and maintain in the system had been attributed to them;
3) whether, finally, the "Dropbox" space was the subject of a sharing between the defendants and the "company," by virtue of which each of them could be considered to hold a ius excludendi alios, a sharing, however, which, due to the termination of the employment relationship and the creation of the new company by the plaintiffs, had to be considered to have ceased.
These are all profiles that do not appear to be sufficiently addressed by the Court of Appeal's conviction.
(Source: Federprivacy website, taken from Il Sole 24 Ore - Author: Francesco Machina Grifeo)
This question is sought to be answered by the Court of Cassation, in its ruling No. 27900/2023, upholding, with referral, the appeal of two people convicted of abusive access to a computer system for having changed the e-mail address connected to the account made available by them to the company for which they worked.
For the prosecution, such behavior undoubtedly integrates conduct of abusive access to the system, since "the operation is capable of prohibiting access to the system precisely to the owner of the system itself configuring ex se a violation of the limits imposed on third parties in possession of the passwords."
The Fifth Criminal Section takes a different view, according to which the territorial court will have to identify which subjects were actually entitled to exclusive access to the "Dropbox" space.
It appears undisputed, continues the reasoning of the Supreme Court, that the "Dropbox" space was created by the defendants to facilitate their work activities in favor of the company and, in this perspective, made available by them to the company, which allowed them to connect to it, for access, an account, distinguished by a telematic address traceable to the company. Similarly, it is clear that the plaintiffs were entitled to access the virtual space and enter therein data or information related to the projects developed in the interest of the company.
If this is true, the decision continues, since the incriminated conduct consisted in the change of the telematic address, which did not allow the "company" to use the "Dropbox" space created by the defendants, "it becomes decisive to ascertain what was the discipline of use of the "Dropbox" space applicable in concrete terms when the said change was made."
In other words, it is a question of whether the "Dropbox" storage space:
1) was of exclusive pertinence to the defendants, its creation having to be traced back to them, and being granted by them momentarily in use to the "company", pending their employment relationship, without such availability causing their power to modify the conditions of access to the space in question to be terminated, precisely because it was of their exclusive pertinence;
2) whether, on the other hand, once created, albeit at the initiative of the defendants, that space had become the exclusive pertinence of the "company," so that the plaintiffs' access to the system in order to modify their account by changing the telematic address, so as not to objectively permit its use by the "company" must be considered to have been carried out for reasons ontologically unrelated to those for which the power to access and maintain in the system had been attributed to them;
3) whether, finally, the "Dropbox" space was the subject of a sharing between the defendants and the "company," by virtue of which each of them could be considered to hold a ius excludendi alios, a sharing, however, which, due to the termination of the employment relationship and the creation of the new company by the plaintiffs, had to be considered to have ceased.
These are all profiles that do not appear to be sufficiently addressed by the Court of Appeal's conviction.
(Source: Federprivacy website, taken from Il Sole 24 Ore - Author: Francesco Machina Grifeo)
