Synopsis:
Who is introduced abusively into a computer or telematic system by installing a Cryptolocker virus, altering it in any way, and requiring payment of a sum of money, even in Bitcoin, thus causing damage and interruption of the system, must be criminally accused, in competition and / or with the obligation of continuation, pursuant to articles 615 ter, 640 ter, 629, 615 quinquies, 635 bis, 617 cc and 648 cp.
Case:
Tizio, the owner of the small business Alfa, receives an e-mail message with a “refund for the repayment of unpaid sums” from a sender address apparently identical to that of his electricity distribution company.
In the message in question, the recipient is invited to open an attached file with extension.zip.
Tricked by the formal notes of the message, Tizio opens the attachment but does not see anything. However, once the file is opened and without knowledge of Tizio, the file installs a CryptoLocker type virus into the corporate network server, which produces encryption and therefore the loss of data stored on the computer.
After a few hours, in fact, Tizio finds it impossible to execute through his computer system any accounting operations, including billing and banking, and receives a message by which an unspecified software agent automatically confirms the computer attack and requires payment within 72 hours for decryption.
The anonymous sender points out that the payment for decrypting files and unlocking the computer is 10 Bitcoin (about $ 7,000 today), and adds that the private key will be permanently deleted and “nobody will ever restore the files”.
A computer consultant, subsequently interviewed by Tizio, finds that the system is blocking and considers the inevitable and difficult to repair quickly, informing him that the Cryptolocker virus is a form of ransomware, a type of malware that restricts access to the device which infects and always accompanies the demand for a ransom to be paid to remove the limitation.
After two days of business downtime, with the relative consequences for the company’s image and operation, Tizio orders to pay the ransom on a Bitcoin account and immediately receives the link to download the deciphering software with the private key the user already pre-loaded, thus releasing the system files.
After short investigations, the postal police track down and locate Caio, who is already an employee of Alfa, responsible for hacking, and transmits the crime report to the competent authority to initiate criminal proceedings.
Caio goes to his lawyer for consideration of any criminal liability profile arising from his conduct.
Quid iuris?