BERLIN – German IT security researcher Lilith Wittmann, known for exposing sensitive data connected to Curaçao’s online gambling sector, has won a legal battle against the Malta Gaming Authority (MGA) over documents she obtained after gaining unauthorized access to the regulator’s systems earlier this year.
Wittmann announced the ruling on social media, publishing details of the German court’s decision in proceedings brought against her by the Maltese gambling regulator.
According to Wittmann’s account of the ruling, the court determined that she may continue to use documents obtained from the MGA systems for her public reporting. The decision is significant because the information was allegedly acquired through unauthorized access to the regulator’s digital infrastructure.
The court also rejected an attempt to prevent Wittmann from publicly associating the MGA with organized crime. According to Wittmann, she may continue using highly critical language linking the regulator to the facilitation of organized criminal activity.
The ruling represents a setback for the Malta Gaming Authority, which had sought restrictions on Wittmann’s use of the material.
The decision could also have broader implications for the more than 300 companies licensed by the MGA if confidential information concerning license holders is contained in the documents obtained by Wittmann.
The German case is particularly relevant to Curaçao because Wittmann has also been at the center of a major data leak involving the Curaçao Gaming Authority (CGA). She previously disclosed tens of thousands of documents obtained from the CGA’s online portal, including information connected to gambling companies and licensing procedures.
The CGA has said it is conducting a forensic investigation into the unauthorized access and has reported the matter to authorities in Curaçao and abroad. The Curaçao regulator has also indicated that it is considering legal action against Wittmann and is attempting to have leaked information removed from the internet.
The German judgment involving Malta does not determine the legality of Wittmann’s actions involving the Curaçao Gaming Authority and does not automatically apply to any future case involving Curaçao.
It does, however, demonstrate the legal difficulties regulators may face when attempting to prevent the subsequent journalistic or public use of information obtained through unauthorized access.
The full implications of the German ruling remain to be seen, particularly for the MGA and companies whose confidential information may be contained in the material obtained by Wittmann.
Photo credit: Martin Moerke