Unauthorised computer access: assessing a criminal allegation

What exactly Article 138ab requires

Article 138ab of the Criminal Code concerns the intentional and unlawful intrusion into an automated work or part thereof. The provision mentions various ways in which access can be gained, including breaking security, technical intervention and use of a false key. What matters to the defense is what conduct is actually charged. The general term hacking is too vague to determine what the Public Prosecution Service must prove and to which part a concrete response is required.

Distinguish between gaining access, viewing data, copying data, and redistributing data. These actions may have different legal meaning and the indictment may contain more than one fact. An explanation about the password alone leaves possible follow-up accusations undiscussed. Therefore, ask the lawyer which parts of the file would support which element. This makes it clear whether the discussion is about the identity of the user, the scope of the consent, the method of intrusion or actions that would have been carried out after access.

An authorization has limits in terms of time and function

Consent can be linked to a work order, a specific system part, a limited period or specific data. An administrator who once created an account has not necessarily given permission for every subsequent purpose. Examine the original assignment and changes to it. A written access policy can be relevant, but also actual agreements and communication about the end of a collaboration. Treat unclear consent as a research question. Do not automatically fill the gap with the desired conclusion that technical ability equals legal permission.

Conversely, a general complaint about unwanted use does not automatically make any previous contact punishable. The Public Prosecution Service must prove the relevant conduct and required circumstances. It must therefore remain clear which moment and which system part are discussed. An employee may have had a limited task one day while access to other data fell outside that task. Create a timeline with assignments, revocations, role changes and concrete actions. The assessment becomes more accurate when broad statements of authority are translated into those individual moments.

An old account was not a free pass in a real case

The Supreme Court dealt with a case in ECLI:NL:HR:2023:610 about a former accountant and access to a company server. The suspect collected information for the dismissal procedure of a former employee. The Supreme Court accepted the ruling on unlawful entry with a false key, given the established circumstances and the unmistakable will of the rightful owner. The fact that the suspect may have performed other lawful accounting work did not automatically make specific access for that other purpose permitted.

Also read the rest of the decision: the cassation appeal led to a reduction of the sentence due to the reasonable period, not to the disappearance of that assessment of access. Nor is the judgment a rule that every violation of an internal work instruction automatically constitutes computer intrusion. Our conclusion is more limited: old access data and remaining assignments must be linked to the concrete access that is the subject of the case. Anyone who simply says that their account has never been closed may be ignoring the most important legal investigation into consent and unlawfulness.

An account name is the start of research

A log line can show that an account has been used, but the step to a specific person requires context. Was the account personal, shared, or linked to an automated process? Which devices were in use and how was registration secured? An IP address can provide direction, but in itself does not tell every detail about the user behind a connection. Let an expert explain what the available data does support and what additional information is needed before drawing a firm conclusion.

An alternative scenario must be concrete enough to investigate. A general comment that any system can be hacked is of little help without connection to this file. At the same time, a suspect does not have to produce a fabricated explanation for every technically unknown point. Make a note of which people actually had access, what agreements existed about this and which documents can confirm this. Have questions about registration or sharing asked through the lawyer. Approaching others to agree on a joint story can actually disrupt the view of original memories and independent information.

Time, completeness and meaning deserve separate control

Digital timestamps can reflect different time zones, daylight savings time, or system settings. A registration can also describe a session start, file transfer or background activity without these concepts being equivalent. Ask what event the rule used registers and whether the explanation follows from documentation or research. A table with a hundred lines is not automatically evidence of a hundred separate human choices. Conversely, a short registration can record an important action. The meaning lies in the technical context and the link with other facts.

Also investigate which period is missing and why. An export may contain only part of the source material, while earlier or later lines provide relevant context. Do not ask for all data from an organization in a targeted manner; formulate what demarcation is necessary for the disputed point. Consider the distinction between failed and successful logins, an actually opened file and an automatically created referral. An expert question should be precise. This makes the answer more testable and prevents technical words from acquiring independent persuasive power without substantive explanation.

A helpful motive does not automatically allow access

Someone may think they are helping a colleague, proving a mistake or safeguarding their own work. Such motives must be carefully distinguished from permission to use the chosen means. The said Supreme Court case also contained discussion on justification and disclosure of data. This does not imply general permission to collect company information as soon as someone believes that injustice is taking place. Have a possible justification legally assessed based on the actual facts and the available alternatives. A moral conviction is no substitute for that investigation.

The practical choice after a conflict therefore deserves attention. Please retain existing correspondence that you lawfully possess and seek advice on a legal route to obtain missing information. Do not re-enter an account to quickly gather evidence for the defense when jurisdiction is uncertain. Such a new action can create a separate problem and complicate the timeline. A lawyer can help determine which data can be safely requested via a request, procedure or expert, without the suspect having to push the boundaries again.

The defense needs legal and technical questions

A technical expert can investigate the operation of registrations, but cannot independently decide whether the legal concept has been unlawfully fulfilled. A lawyer can make legal definitions, but should not explain away uncertainties about system behavior without investigation. Align both perspectives. Start with a small number of decisive questions and describe what material is required. For example, ask whether the registration actually proves the alleged transfer, what authorization existed at the time and whether the account used was attributable to one person.

This includes paying attention to privacy and confidentiality. A completely copied company archive may contain data from many third parties that have nothing to do with the accusation. Share material only via an appropriate secure route and discuss the necessary scope in advance. Do not delete or modify files on your own initiative because they appear unfavorable or may be confidential. Maintain the existing condition and let the lawyer indicate how storage, research and possible return should be arranged. Care in defense also involves handling information from others.

Fictional example: still accounting, no private archive

In a fictitious situation, Daan ends a collaboration, but still helps with the final invoices for one week. His account remains active. At the same time, a former colleague asks him to look for information for a private conflict with the director. Daan therefore opens folders that he does not need for the invoices and forwards documents. He later says he still worked for the company. That general explanation does not answer what access was allowed, what he actually opened and for what purpose he was acting at that time.

The lawyer collects the agreements about the completion, the actual access rights and the original communication with the colleague. An expert assesses what the logs actually show. This can clarify both incriminating and exculpatory facts. The fictional case is separate from the real judgment and does not predict an outcome. She makes visible why one account can simultaneously be part of permitted activities and a discussion about unauthorized actions. The analysis must take place per action and cannot be replaced by a general assessment of the entire employment relationship.

Seven components of an auditable access story

Create a rule for each disputed moment in which authority and registration stand side by side. Use original documents as attachments and clearly note when a fact comes only from your own memory. The overview does not have to become a technical report. Above all, it should show where a specific question remains unanswered and who can investigate it. Take into account the date of changes: the current account policy does not automatically indicate which policy applied on the day on which the alleged event allegedly occurred.

• System: which work or part is mentioned and what data is there?
• Person: Who actually had access to account, device or shared workspace?
• Authorization: assignment, role, permission, restrictions and relevant changes with date.
• Action: notification, consultation, acquisition or distribution, with a distinction between determination and suspicion.
• Registration: source, time zone, selection, technical meaning and any missing period.
• Context: complete messages, completion of work and the purpose of the specific access.
• Investigation: targeted questions for lawyers and experts, with lawful acquisition and safekeeping of evidence.

The question is who was allowed to do what and when

Our conclusion is that a computer trespass case should be read more carefully than the label hacking suggests. A successful login does not automatically indicate that access was lawful, while a recognizable account does not automatically prove every human action. The quality of the file arises where legal permission and technical findings meet. This requires openness about unfavorable data and restraint regarding unknown technical details. A strong defense makes the decisive differences visible, instead of subsuming every point under the same general story about a working password.

Use the explanation of the criminal file to discuss the available documents and missing parts. When investigating a seized device, the page about a seized telephone can also help you understand the procedure. Make additional requests related to the indictment and the technical questions. This increases the chance that research will answer the real discussion: which access and follow-up action have been proven, who carried it out and why would it fall within or outside the authority? (criminal file · phone seized)