Unauthorised access to a computer system under § 118a StGB

The provision first requires a computer system that the person accessing it may not control, or may not control alone. It also covers part of such a system. The relevant question is therefore who had authority over the system and what use was permitted at the relevant time.

Access must be obtained by overcoming a specific security measure. The assessment may concern the technical or organisational barrier in place, the way it protected the system and how access was obtained despite that barrier. Merely using another person’s username or password does not answer this question by itself.

The provision also requires a particular purpose. The person must intend to obtain access for themselves or for another unauthorised person. That purpose must relate to the access and to one of the purposes described by the statute. Mere technical curiosity does not automatically satisfy the wording of the provision.

The first statutory variant concerns personal data. The person must intend to obtain knowledge, for themselves or for another unauthorised person, of data whose disclosure infringes the affected person’s legally protected confidentiality interests. The content, attribution and sensitivity of the data are therefore relevant.

The second variant concerns causing a disadvantage. Access may fall within the provision where the person intends to cause another person a disadvantage by using stored data that was not intended for them or by using the computer system. The data, the authorised use and the intended disadvantage must be kept distinct.

Intent is assessed from the access and the subsequent use. Technical traces may be relevant. A login, an IP address or a single log entry cannot by itself replace a complete assessment of the authorisation and the person’s mental state.

§ 118a StGB treats unlawful access as a separate offence. The focus is access to another person’s computer system by overcoming a specific security measure. The article Cybercrime in Austria provides a broader overview of other computer offences.

Data damage under § 126a StGB concerns altering, deleting or rendering another person’s data unusable. § 126b StGB concerns serious disruption of the functioning of a computer system. Those offences may occur together with access, but they address a different centre of gravity.

Computer fraud under § 148a StGB requires manipulation of a data-processing operation, a financial loss and an intention to obtain an unlawful benefit. Data falsification under § 225a StGB focuses on creating false data with the intention of using it in legal dealings. Further information is available in the article Data falsification under § 225a StGB.

The basic form under § 118a Abs. 1 StGB carries a maximum sentence of two years’ imprisonment. The actual legal consequence depends on the circumstances of the case, culpability and the applicable statutory rules. The statutory maximum therefore does not predict the outcome in an individual case.

If the offence concerns a computer system that is an essential component of critical infrastructure under § 74 Abs. 1 Z 11 StGB, § 118a Abs. 2 provides for up to three years’ imprisonment. The special status of the system must be established in the case.

§ 118a Abs. 4 provides an additional increase where the offence is committed as part of a criminal organisation. The assessment then also depends on which basic form and which type of infrastructure are involved. A mere cooperation between several people does not by itself establish this qualification.

Under § 118a Abs. 3 StGB, the offence is prosecuted only with the authorisation of the injured party. The identity of the injured party and the question who controlled the protected system or the affected data therefore need to be clarified at an early stage. In a company, internal responsibilities and system ownership may be relevant.

Authorisation does not replace the assessment of the offence. Unlawful access, the specific security measure, the lack of authority and the statutory purpose still have to be established. Conversely, technical access alone is insufficient if the required authorisation has not been given.

A person affected by possible access should preserve the discovery timeline, the systems involved and the available logs. A person accused should have the file and the technical evaluations reviewed before making a statement.

The evidentiary question has several parts. It may be necessary to establish the system architecture, the security measures, the person’s permissions, the access event and the use that followed. Only the relationship between these elements shows whether the statutory requirements may be met.

Technical reconstruction may involve authentication records, timestamps, access logs, configuration states, permission lists and indications of the devices used. Their value depends on how the data was generated, stored and evaluated. A timestamp or IP address does not, without further assessment, identify a particular person.

The authorisation history is also important. A former access right, an administrative assignment, a test environment or shared use can change the central question. The relevant point remains the specific authority at the time of access and the purpose of the conduct.