Final yes on cybersecurity: heavy penalties and lengthened investigations

The cybersecurity bill passed the Senate definitively. The majority's 80 'yes' votes were joined by a large abstention (57) from the opposition, with three against. "Now," emphasises the undersecretary to the presidency of the Council, Alfredo Mantovano, who pushed the measure so hard, "the entire national security system, and in particular the cyber system, which has become the main front for attacks by hostile state actors, is finally equipped with more adequate operational tools to repel them.

The perimeter of the subjects required to strengthen their defences is enlarged; an alert and cooperation procedure with Acn, the cyber security agency, is identified for remedial actions; the modalities of intervention are defined when there are competing competences, e.g. of Acn and the judicial police; action against cyber crime is strengthened, with the identification of new criminal offences and the use of more effective investigation tools.
In particular, harsher penalties are introduced, especially for already existing offences (first and foremost, abusive access to a computer system, but also the interruption of digital communications) with the mechanism of aggravating circumstances; new offences such as cyber extortion are debuted; investigation times are lengthened and the use of wiretapping is encouraged; the centrality, for the most serious crimes, of the anti-mafia prosecution service is enhanced.
On the level of constraints for public administrations, the draft law imposes the obligation to equip themselves with dedicated structures and a contact person, as well as to report cyber attacks to the Agency within 24 hours, on a long list that includes, among others, metropolitan cities, municipalities with more than 100,000 inhabitants, their public transport companies, local health authorities, and in-house companies.

The punitive treatment of companies 'guilty' of computer crimes is also tightened, with a maximum that will reach 700 quotas, instead of the current 500. On the front of changes to the Code of Criminal Procedure, the draft law then includes major computer crimes in the catalogue of those for which the duration of preliminary investigations is set at the broader limit of two years.

The rules on wiretapping provided for organised crime offences were then extended, with different conditions from the ordinary ones (when there are sufficient indications of an offence, instead of serious indications; when wiretapping is necessary for the conduct of the investigation, instead of absolutely essential) to computer crimes referred to the coordination of the National Anti-Mafia Prosecutor (this concerns a total of six offences considered particularly serious).
In the same cases, environmental wiretapping is allowed in the home, or other private dwelling place, even if there is no reason to believe that criminal activity is being carried out there. The duration is 40 days, extendable for periods of 20 days.
By an amendment approved in the Chamber of Deputies, however, harshly contested by the oppositions as a form of undue government control over investigative activities, the powers of the Ministry of Justice inspectors have been extended. During their periodic and institutional visits to judicial offices, they will also have to expressly check the legitimacy of the accesses made by prosecutors to public databases.