Germany · de.indymedia · · 2h
Malta versus Lilith Wittmann: Court ruling strengthens freedom of expression and freedom of the press
Deutsch (original) · Auto-translated to English
Symbolbild · Katharina Höffler / CC BY-SA 4.0 · Wikimedia Commons
The IT security expert Lilith Wittmann forwarded data from the Maltese gaming authority to the media and investigative authorities, according to which it allegedly enabled illegal gambling. The authorities then took legal action against Wittmann. Now there is a ruling that strengthens freedom of expression and freedom of the press.
How much tax does the German state lose through illegal gambling? IT security expert Lilith Wittmann is researching this question, among other things, and was drawn to the Maltese gaming authorityhttps://www.mga.org.mt/">MaltaGaming Authority(MGA), attentive. She obtained documents and passed them on to the media and investigative authorities. The MGA then applied for an interim injunction against Wittmann at Regional Court II in Berlin.
This essentially consisted of two demands: Firstly, Wittmann should not be allowed to create a cover account in the MGA web portal again and should no longer be allowed to gain access to documents stored there. These include annual financial statements, financial reports and tax documents. The MGA also demanded that Wittmann not be allowed to pass these documents on to third parties such as journalists.
Secondly, according to the MGA's injunction application, Wittmann should no longer be allowed to say publicly that the MGA supports "organized crime networks" and has "created structures that enable organized crime" ("organized crime enabling schemes you created"). Wittmann posted this on LinkedIn in March.
The court ruled on September 24th. It confirms the interim injunction in part: Wittmann is therefore not allowed to “hack” the MGA web portal again. The court has partially revoked the order: Wittmann is allowed to pass on the documents to the press and investigative authorities. And she can express herself about the MGA the way she did on LinkedIn.
Company location Malta
Wittmann researches illegal gambling. She has parts of her researchhttps://blog.lilithwittmann.de/wie-lottoland-milliardenunternehmen-wurde...her blogandhttps://plus.rtl.de/extra-p_10151">inCooperation with RTL Extrapublished. In a TV magazine article broadcast in July, Wittmann reported on her research into the Lottoland group. The group offers so-called secondary lotteries in Germany via the websites lottoland.com and lottohelden.de. Here, players place bets on the drawing of the lottery numbers, so they do not bet the lottery numbers themselves. Secondary lotteries arehttps://www.lottoindeutschland.de/presse/eugh-judg-gluecksspiel-c-4402...Germany https://www.tagesschau.de/wirtschaft/gluecksspiel-losen-eugh-100.html...
It is not immediately obvious to them that players are taking part in illegal gambling. Since the websites are similar to those of the state lottery, among other things, they seem serious at first glance. Users can also only see from the small print that they are betting instead of taking part in a lottery.
The imprint of both websites states the “German Lotto & Toto Agency” and Malta as the company location. The MGA logo can also be found at the bottom of the website. The authority has awarded the gaming license to Lottoland.
What is in the documents?
The Lottoland Group's business practices would have deprived the German state of around 400 million euros in tax revenue between 2019 and 2023,https://blog.lilithwittmann.de/wie-lottoland-milliardenunternehmen-wurde...Wittmann etches. It relies on internal documents such as the annual financial statements of Malta-based European Lotto and Betting Limited, which operates Lottoland's German business. Wittmann was able to extract the documents from the Maltese Gaming Authority portal. They contain figures on the sales that Lottoland generated in Germany.
German investigative authorities have apparently had Lottoland in their sights for some time. In order to be able to take tax action against the companies behind the offer, there has so far been no evidence of the income generated in Germany, says Thomas Dünchheim in the RTL article. He is a lawyer and expert in gambling law. This information is important in order to be able to determine the amount of taxes that Lottoland would have had to pay.
It remains unclear whether the MGA was aware of the Lottoland Group's actions. When we asked, the authority simply stated that “tax liabilities arising in Germany fall within the jurisdiction of the responsible German authorities”. No judgment has been made in this matter so far.
–––
The hut is on fire! We're going in.
We oppose fascisation. We fight for a free, open and solidarity-based society. We defend basic rights for everyone.https://netzpolitik.org/spenden/?via=rss">Thisonly possible with your support.
–––
In the spirit of freedom of the press
"The MGA, as the plaintiff, wanted to implement a ban that was as comprehensive as possible. They initially succeeded in doing so through a resolution," says Jonas Kahl to netzpolitik.org. After the public hearing, little remained of it. The lawyer from the law firm Spirit Legal represented Wittmann in court.
“The court now makes it clear in its judgment that all of Lilith Wittmann’s challenged statements are permissible expressions of opinion and not untrue statements of fact,” says Kahl. Wittmann is also relieved. “I can say that the MGA may enable organized crime and that is extremely important for reporting,” the security expert told netzpolitik.org.
The MGA also failed to achieve another key goal that it sought to achieve with its preliminary injunction. According to the ruling, journalists are allowed to use the documents that Wittmann extracted from the authority's system.
The Maltese Gambling Authority had argued that hacking also includes giving third parties - such as journalists - access to documents. The court now makes it clear: allowing third parties access to documents is not the same as allowing third parties access to the system.
Security expert remains stuck with the costs
From the perspective of lawyer Jonas Kahl, the MGA was indirectly successful in one respect. “The other side’s approach suggests that they are not primarily concerned with enforcing their rights, but rather that they want to make things as difficult as possible for Lilith Wittmann and incur a lot of procedural costs,” says Kahl. They will probably amount to 15,000 to 20,000 euros.
In addition to legal fees, there are also costs for the proceedings at the civil chamber. Due to the special nature of civil law proceedings, Wittmann bears most of these costs herself, even if the court's ruling was partly in her favor.
Further costs would be added if the MGA were to appeal. When asked, the authority did not want to comment on whether it was pursuing such plans. From Wittmann's point of view, the agency's actual goal is "to prevent me from further researching and reporting. That's why I don't assume that they will let me go."
MGA called in the detective agency
In advance of the injunction, the MGA hired a detective agency to observe Wittmann. A report from the detective agency is attached to the case files. Upon request, the MGA justified the commission to netzpolitik.org by saying that it wanted to determine Wittmann's “physical address” in order to be able to deliver “relevant legal documents”.
The detective agency also held discussions with Wittmann's former employers. “When you suddenly see a report spanning several pages where someone has spoken to your old employers and checked out your old addresses – that’s intimidating,” says Wittmann.
Complain to intimidate
They and their lawyers assume that the MGA's action is SLAPP.
SLAPP refers to the procedure when companies, for example, prevent journalists from doing their work with complaints that are unfounded. The abbreviation stands for “strategic lawsuit against public participation”. In order to protect journalists from such lawsuits, the EU has thehttps://eur-lex.europa.eu/eli/dir/2024/1069/oj/eng">Anti-SLAPP Directive...decided.
–––
The work of netzpolitik.org is financed by donations from our readers.
Become part of this unique community and support our public interest-oriented, advertising- and tracking-free journalismhttps://netzpolitik.org/spenden/?via=rss">nowwith a donation.
–––
The directive provides that defendants can have potential intimidation claims examined by a court at an early stage. The plaintiff must then justify why the proceedings must be continued. The directive also protects against high procedural costs and is intended to deter parties from SLAPP lawsuits by threatening sanctions.
However, Wittmann and her lawyers could not rely on the directive because it has not yet been implemented into national law in Germany. German courts could not yet easily apply the provisions contained therein.
The MGA rejects the SLAPP accusation compared to netzpolitik.org. The aim of her preliminary injunction is to protect the information entrusted to her from unauthorized access.
Of public interest
According to the court, the way in which Wittmann obtained information from the authority can be viewed as a violation of the so-called hacker paragraph 202a of the Criminal Code. Such a breach occurs when a person has to overcome security hurdles to gain unauthorized access to an IT system.
In order to get the documents in the MGA portal, Wittmann pretended to be a different person. And she happened to find an interface that gave her access to the MGA organizations, where she could then download documents. The security expert describes the procedurehttps://blog.lilithwittmann.de/heise-entschied-sich-leider-kurzszeitig-d...a blog post. The MGA has now closed the security gap.
Wittmann justifies her approach by saying that the documents are of public interest. She refers to the “https://journaistikon.de/wallraff-guenter/">LexWallraff", which is named after the investigative journalist Günther Wallraff. Wallraff was employed by the Bild newspaper for research using a fake identity. According to a decision by the Federal Court of Justice, journalists are allowed to obtain and disseminate information using prohibited means in justified individual cases, provided that the aim is to uncover grievances that harm the public. In such cases, freedom of the press outweighs the interests of those affected, according to the Federal Court of Justice.
Is this hacking?
The Regional Court II in Berlin considers the “security precautions” that the MGA has taken for its website to be “sufficient”. If the portal is used “properly,” access to organizations and documents is not possible. In contrast, Wittmann's lawyers argue that the system was open and did not meet the EU law requirements for IT security. “Authorities must protect their systems by law,” says Peter Hense, who is also Wittmann’s lawyer. Since the MGA processes personal data, it is subject to the General Data Protection Regulation, which sets strict requirements in this regard.
This assessment is supported by an audit report from the consulting firm PricewaterhouseCoopers from 2024, which the MGA submitted. From the perspective of Wittmann's lawyers, the largely blacked out report leads to the conclusion that the MGA did not adequately protect its IT system from unauthorized access.
–––
The work of netzpolitik.org is financed by donations from our readers.
Become part of this unique community and support our public interest-oriented, advertising- and tracking-free journalismhttps://netzpolitik.org/spenden/?via=rss">nowwith a donation.
Read the full story at the source
Source: de.indymedia