Cybercrime in Austria: hacking, data offences and computer fraud

The StGB regulates computer offences in several provisions that cover different forms of attack.

Unlawful access to a computer system (§ 118a). It is punishable to obtain access to a computer system by overcoming a specific security measure. The penalty extends to up to two years, and to up to three years where critical infrastructure is involved. Prosecution takes place only on the authorisation of the injured party.

Violation of the secrecy of telecommunications (§ 119) and improper interception of data (§ 119a). These cover the unauthorised interception of messages or data. Both offences carry up to two years’ imprisonment and are prosecuted only on authorisation.

Data damage (§ 126a). Anyone who alters, deletes or renders someone else’s data unusable is punishable. The penalty rises with the amount of loss, the number of affected systems and where critical infrastructure is involved.

Disruption of the functionality of a computer system (§ 126b). This covers the serious disruption of a system, for example through overload attacks. Here too the penalty rises with the scale.

In addition to the actual attacks, the law also covers preparatory acts and particular forms of commission.

Misuse of computer programs or access data (§ 126c). Even producing, obtaining or possessing hacking tools or someone else’s access data can be punishable where there is the intent to use them to commit a computer offence. The law provides for a separate form of active repentance here.

Fraudulent misuse of data processing (§ 148a). This is computer fraud: anyone who, by manipulating a data-processing operation, causes a pecuniary loss in order to enrich themselves unlawfully is punishable. As with classic fraud, the penalty depends on the amount of loss, with the value thresholds of 5,000 and 300,000 euros.

Data forgery (§ 225a). Anyone who, by entering, altering or deleting data, produces false data with the intent to use it in legal dealings faces up to one year’s imprisonment or a fine of up to 720 daily rates.

From a legal perspective, with all these offences the inner intent is often the decisive point, because many acts are technically neutral and become punishable only through the intention.

Cyber proceedings are technically complex, which is precisely why a well-considered defence is important.

Silence and access to the file. Do not make a statement on the matter before you have sought legal advice and seen the file. A spontaneous technical explanation can unintentionally become incriminating.

Technical evidence. In cyber proceedings, log files, timestamps and the attribution of devices and accesses often decide the case. This evidence should be secured and examined at an early stage and by experts.

Intent at the centre. With many computer offences, intent is what matters. Whether a tool was used for legitimate purposes or with the intention to cause harm is often the decisive difference.

Victims of cyber offences also have several options.

Secure evidence. Keep screenshots, log files, emails and system messages. Digital traces are quickly lost, so acting quickly and carefully is important.

Complaint and authorisation. You can file a complaint. For some offences, such as § 118a or § 119, prosecution takes place only on your authorisation as the injured party. You should give this declaration deliberately and in good time.

Private participation. As an injured party, you can join the criminal proceedings and assert your loss. Good documentation of the loss makes enforcement easier.