Eurispes Cybersecurity Observatory – Short Report – Part 1 On the eve of the…
In an international context that has changed dramatically in recent years, the strategic distance of countries in matters of security and defence has greatly narrowed in comparison with geographical and political distance. And while a coincidence of interests has progressively replaced a commonality of values, the system of international law and the fora for the settlement of disputes and conflicts now appears unable, in the short and medium term, to guarantee safeguards and deterrence.
The action and leverage of nations in foreign and defence policy today find, even more than in the past, an indispensable strategic asset in industrial policy and, in particular, in the defence industry.
The increasingly pressing presence of armed conflicts with a twentieth-century character, yet fought with new weapons, with conventional capabilities able to overcome enormous geographical distances or with technical and technological capabilities capable of posing a concrete local threat, turns national borders into an anachronistic Maginot Line.
Hence the need to extend the concept of national defence and security within a stable perspective of international relations, also based on multilateral programmes and industrial cooperation in the defence sector, in a delicate balance between constitutional and legal compatibility and reliability among governments.
Peace in action is optimism of the will, a value that cannot be obliterated. However, the pessimism of reason requires us to consider that international stability, at this moment, also needs armed deterrence.
The impassable line is nevertheless represented by that set of human rights that can never be derogated from, even in the most severe armed conflicts, whose immanence is independent of geostrategic complexity and reasons of State which, if they have relativised conflict prevention in international law, cannot erase or circumvent the system of international criminal law and domestic criminal law in the face of war crimes, crimes against humanity and genocides, which are not protections of virtue but the conventional and natural discipline of human communities before they are international ones.
When a war is fought far away, it is easy also to perceive responsibility for what happens in those places as distant. On the contrary, when conflicts generate systematic atrocities, responsibility for those deaths and that devastation may also move back towards countries not directly involved in the conflict but which have fuelled the armaments system of belligerent countries. In the international arms trade, the distance between the place of conflict and the place of decision may in fact be only apparent: an explosive device used in a conflict may have been produced in Italy; a component may have left a domestic plant; a supply may have been preceded by a licence application, an end-user certificate, an administrative investigation, and an Italian assessment of the recipient country and of the risk of use.
It is within this sequence that the export of military equipment ceases to be merely an industrial, commercial or diplomatic matter. The existence of a strict authorisation regime is not accidental: it stems from a precise choice of principle within the Italian legal system, which in Article 11 of the Constitution repudiates war as an instrument of offence and of settlement of international disputes, and from the obligations undertaken by Italy at international and European level. The United Nations Charter prohibits the use of force except in cases permitted by international law; international humanitarian law requires the protection of civilians and civilian objects in armed conflicts; the Arms Trade Treaty and the European Common Position on military exports require States to deny or not authorise transfers where there is a risk that weapons, components or technologies may be used to commit or facilitate serious violations of human rights, international humanitarian law or international crimes.
This does not mean that every export to a crisis area is equivalent to participation in an international crime. It is nevertheless necessary to understand when the supply of weapons, components, technologies or services, even if formally authorised, may become relevant for Italian criminal law because it is inserted into a foreseeably unlawful chain of use.
The International Court of Justice and the International Criminal Court provide the framework within which, respectively, State responsibility and individual criminal responsibility are discussed for the most serious international crimes committed by those who choose to use armaments in violation of international law. But this framework does not exhaust the analysis of responsibilities. When part of the conduct takes place in Italy – in production, contracting, brokering, the request for or the granting of authorisation – the Italian criminal court may also be called upon to consider the relevance of what occurred before the war became a theatre of atrocities.
In order to understand whether and when this may occur, it is necessary to start from the most concrete fact: the weight of the Italian war industry, its international projection and the geography of export authorisations.
The first step is almost obvious, but necessary. For weapons produced in Italy, public sources do not provide a simple and immediate accounting comparable to that for other industrial products. Official reports, clearly, do not list how many individual bombs, individual missiles or components have left domestic plants. Instead, they provide the value of authorisations, the types of materials, the recipient countries and the structure of the transactions. This information is of great value for understanding the phenomenon: the arms trade is more correctly read through licences, final recipients and the political-military risk that accompanies every supply.
The Government Report for 2025[1] shows a further strengthening of the foreign projection of the Italian military industry. The total value of authorisations for movements of military equipment reached EUR 11.141 billion, up from EUR 8.44 billion in 2024; of these, EUR 9.164 billion concerned outbound movements from Italy. Individual export authorisations amounted to EUR 7.72 billion, with 2,576 measures issued, while the cumulative value of global project licences and global transfer licences was EUR 1.374 billion.
The main destination countries, by authorised value, were Kuwait, Germany, the United States, Ukraine[2], France, the United Kingdom, Turkey, NATO countries[3], India and Brazil. The most significant figure, however, is geographical: in 2025 the North Africa and Near and Middle East area once again became the main destination for Italian military exports, with 37.03% of the total, surpassing the area of EU countries and European NATO members, which stood at 31.73%. This distribution confirms that Italian arms exports are not merely an industrial phenomenon, but a segment of foreign and security policy projected into strategically sensitive areas. [4]
The international comparison helps to measure Italy’s weight more accurately. According to data from the Stockholm International Peace Research Institute (SIPRI) for the five-year period 2021-2025, the United States remains the world’s leading exporter of armaments, with 42% of international transfers, up from 36% in the 2016-2020 period. France ranks second, with 9.8% of global exports, while Germany has risen to fourth place, with 5.7%, partly as a result of supplies to Ukraine. In this context, Italy recorded particularly marked growth: its exports of major armaments increased by 157% compared with the previous five-year period, moving it from tenth to sixth place among world exporters. The most relevant figure for the purposes of the issue addressed here, however, concerns geographical destination: more than half of Italian exports in the period considered were directed to the Middle East, equal to 59% of the total, while 16% went to Asia and Oceania and 13% to Europe[5]. It should be noted, however, that the SIPRI figure does not measure the economic value of authorisations, but the volume of transfers of major weapons systems; it is therefore useful for placing Italy in the global market, but it is not perfectly comparable with the financial values in the Government Report.
The figure becomes even more significant when one looks at the composition of exports. In 2025 the category of “materials” continued to represent the main share, with EUR 4.491 billion, equal to 58.17% of the total, although with a lower weight than in 2024. By contrast, the item “services” grew sharply, reaching EUR 2.68 billion, equal to 34.71% of the total. As for the most relevant categories, exports mainly concerned aircraft, for EUR 3.214 billion; missile systems, for EUR 820 million; land vehicles, for EUR 783 million; ammunition, for EUR 604 million; weapons and weapons systems, for EUR 529 million; electronic equipment, for EUR 507 million; software, for EUR 359 million; and technologies for development and production, for EUR 264 million. These are not marginal supplies or simple technical small parts, but materials, services and technologies capable of directly affecting the operational, logistical and industrial capability of purchasers[6].
From here comes the inevitable move from numbers to responsibility. In the armaments sector, quantity is never merely quantity. It is an indicator of the degree of exposure to risk: the more significant the supply, the more necessary it becomes – in a democratic legal system – to ask who is buying, who the end user is, what guarantees have been offered and, above all, what use was concretely foreseeable at the time of authorisation and performance of the contract.
E ciò perché dalle risposte a tali interrogativi possono derivare delle responsabilità precise e anche molto gravi tanto di chi produce e vende, quanto di chi ha autorizzato e supervisionato la fornitura. Infatti, soprattutto nei periodi di tensioni e crisi geopolitiche, diventa particolarmente delicato il tema della possibile fornitura di materiale bellico (o funzionale ad impieghi bellici) a Paesi che lo utilizzano o possono utilizzarlo per commettere crimini internazionali, come crimini di guerra, contro l’umanità o crimine di aggressione.
In this context, it is appropriate to distinguish between the different types of authorisations for the supply of weapons that may be granted in our legal system. Without being able to analyse in detail here the highly complex general and implementing legislation, the aim will be to provide at least a useful reference framework for the reader, examining in particular Law No. 185 of 1990 (and the related implementing regulation), which governs control over the export, import and transit of military equipment and distinguishes between different types of authorisations[7].
An individual authorisation concerns a single transaction: the transfer (if the recipient is located in the European Union or the European Economic Area) or the export (if the destination is outside the EU) of a specific quantity and value of specific military equipment to an already identified recipient.
A global transfer authorisation is different: it operates within the EU/EEA area and permits the transfer of specific military equipment, without predetermined quantity and value, to authorised recipients located in one or more Member States. A global project licence is different again: it concerns operations included in broader programmes, namely joint intergovernmental programmes or industrial research, development and production programmes carried out with companies from EU, EEA or NATO countries with which Italy has signed specific agreements.
There are also general transfer authorisations, which allow suppliers established in Italy, when the relevant conditions are met, to transfer predetermined materials to recipients located in one or more Member States, and brokering activities, which do not necessarily coincide with the physical passage of materials through Italian territory, but include negotiation, the organisation of the transaction, purchase and sale, or transfer from one third State to another third State. The distinction is not only technical, but also affects how the data in the Government Report must be read: an individual authorisation captures a specific supply, whereas global licences and general authorisations may reflect industrial programmes, military cooperation or more complex ongoing flows[8].
However, one clarification is appropriate: Law No. 185 of 1990 does not cover the entire universe of exportable weapons. Its rules concern military equipment in the technical sense, including automatic weapons, medium- and large-calibre armaments, military ammunition, weapons systems, vehicles, aircraft, ships and equipment built for military use. By contrast, various common firearms, sporting and hunting weapons, related ammunition and non-automatic handguns remain outside its perimeter and follow the different regime of Law No. 110 of 1975. These weapons do not fall within the stricter regime of Law No. 185/1990 and may nevertheless be exported, circulate, be diverted and end up in contexts marked by internal repression or human rights violations[9].
Before entering into the merits, it is necessary to clarify that the aim here is not to reconstruct the system of international justice in full. The objective is instead to provide certain essential coordinates, needed to distinguish the role of the International Court of Justice from that of the International Criminal Court and, consequently, to understand what space may then remain for the Italian criminal court.
In public debate, the two Courts are often confused. The International Court of Justice and the International Criminal Court are both based in The Hague, but they respond to different logics and needs. The former decides disputes between States and gives advisory opinions to authorised United Nations organs; the latter judges natural persons accused of the most serious international crimes. In one case the issue is State responsibility; in the other, individual criminal responsibility. [10]
Italy participates in the system of the International Court of Justice because it is bound by the United Nations Charter and by the Statute of the Court itself, which is an integral part of the Charter. It follows that the Italian State may be a party to proceedings before the Court or may be involved, within the United Nations framework, in the functioning of that jurisdiction. [11]
The function of the International Criminal Court is different. The Rome Statute gives it jurisdiction over the crimes of genocide, crimes against humanity, war crimes and, under certain conditions, the crime of aggression. However, it is not a jurisdiction designed to replace States always and in any event: it operates according to the principle of complementarity and intervenes when the State that should proceed is unwilling or unable to do so. [12]
To give greater prominence to the current and concrete nature of the Courts’ work, the following cases may be considered.
The International Court of Justice has been seised of the proceedings Application of the Convention on the Prevention and Punishment of the Crime of Genocide in the Gaza Strip (South Africa v. Israel), brought by South Africa before the International Court of Justice for the alleged violation by Israel of the Genocide Convention in relation to military operations in the Gaza Strip[13]: “In the Court’s view, at least some of the acts and omissions alleged by South Africa to have been committed by Israel in Gaza appear to be capable of falling within the provisions of the Convention”[14].
Another recent example is the case Allegations of Genocide under the Convention on the Prevention and Punishment of the Crime of Genocide (Ukraine v. Russian Federation brought by Ukraine against the Russian Federation after the invasion of February 2022, concerning the use of the accusation of genocide as a justification for Russia’s armed intervention [15]: “The Court considers that the right of Ukraine that it has found to be plausible […] is of such a nature that prejudice to it is capable of causing irreparable harm. Indeed, any military operation, in particular one on the scale carried out by the Russian Federation on the territory of Ukraine, inevitably causes loss of life, mental and bodily harm, and damage to property and to the environment ” [16].
As stated, the International Court of Justice does not judge individuals, but verifies the international responsibility of the individual State.
On the other hand, a recent example of the exercise of the jurisdiction of the International Criminal Court is represented by the proceedings Situation in the State of Palestine (ICC-01/18)Dall’altro lato, un esempio recente di esercizio della giurisdizione della Corte penale internazionale è rappresentato dal procedimento Situation in the State of Palestine (ICC-01/18)[17] in which, on 21 November 2024, the ICC Pre-Trial Chamber issued arrest warrants for Benjamin Netanyahu, Yoav Gallant (respectively Prime Minister and Minister of Defence of Israel) and Mohammed Deif (commander of Hamas’s al-Qassam Brigades), finding that there were reasonable grounds to proceed in relation to war crimes and crimes against humanity committed in the context of the conflict that began on 7 October 2023: “the Chamber found reasonable grounds to believe that Mr Netanyahu […] and Mr Gallant, […] each bear criminal responsibility for the following crimes as co-perpetrators for committing the acts jointly with others: the war crime of starvation as a method of warfare; and the crimes against humanity of murder, persecution, and other inhumane acts. The Chamber also found reasonable grounds to believe that Mr Netanyahu and Mr Gallant each bear criminal responsibility as civilian superiors for the war crime of intentionally directing an attack against the civilian population”[18].
“The Chamber found reasonable grounds to believe that Mr Deif, […] at the time of the alleged conduct, is responsible for the crimes against humanity of murder; extermination; torture; and rape and other form of sexual violence; as well as the war crimes of murder, cruel treatment, torture; taking hostages; outrages upon personal dignity; and rape and other form of sexual violence”[19]. As regards the latter, the proceedings were closed following the news of his death[20].
Likewise, in the context of the Situation in Ukraine proceedings, in March 2023 the International Criminal Court issued arrest warrants for Vladimir Putin and Maria Lvova-Belova (respectively President and Commissioner for Children’s Rights of the Russian Federation) for the war crime of unlawful deportation and transfer of Ukrainian children from occupied territories to Russia. In this case too, the Court does not judge the international responsibility of the Russian Federation as a State, but the individual criminal responsibility of identified persons.
Italy signed the Rome Statute on 18 July 1998 and ratified it by Law No. 232 of 12 July 1999; it subsequently regulated cooperation with the Court through further legislative measures. Italy’s accession to the Arms Trade Treaty[21] also falls within the same horizon of accountability for military trade, requiring States to assess the risk that transferred materials may be used for serious violations of international humanitarian law or human rights.
From this perspective, the issue of the knowability of the risk cannot be confined to the domestic administrative investigation alone. In its report of 16 September 2025 (Legal analysis of the conduct of Israel in Gaza pursuant to the Convention on the Prevention and Punishment of the Crime of Genocide), the Independent International Commission of Inquiry on the Occupied Palestinian Territory, including East Jerusalem, and Israel recommended that Member States cease transferring weapons, equipment and other goods, including jet fuel, where there is reason to suspect their use in operations that have entailed or may entail – in that case – the commission of genocide. It also called on States to ensure that individuals and companies present in their territory or subject to their jurisdiction are not involved in the commission, assistance or facilitation of international crimes. [22]
The fact that the International Criminal Court is the judicial body intended to try the most serious international crimes does not mean that the Italian court must necessarily stop at the threshold of the Rome Treaty and cannot find itself judging the conduct of those – suppliers or national authorities – who knowingly contributed to the commission of those crimes.
Our legal system may intervene whenever even only part of the conduct takes place within the territory of the State. Pursuant to Article 6 of the Italian Criminal Code, it is not only the place where the final event occurs that is relevant, but also the place where the acts contributing to produce it are carried out.
Applied to arms exports, this criterion can change the perspective. One should not look only at the bombing carried out abroad, but also at the origin of the means used and therefore at the possible “Italian passages” in the sequence: the decisions of corporate top management, the licence application, interactions with the administrative authority, possible reticence regarding decisive information, and the continuation of supplies while the war situation worsens. Geographical distance, therefore, does not eliminate legal proximity.
The point, naturally, is not to assert that every sale to a crisis area automatically amounts to participation in an international crime. Such an automatic conclusion would be legally unsustainable and not in tune with the logic of legitimate defence and deterrence, especially in the current international situation. Instead, it is necessary to verify whether – in the presence of domestic and supranational prohibitions – the export was authorised or carried out despite a concrete risk of use in the context of serious violations of international law (for example against civilians) or in any event of destination to persons involved in such violations[23]. Alongside this step, it is appropriate to understand on what basis and for which offences liability may be found in respect of the persons who operated within our country.
The liability of producers, directors or intermediaries certainly does not arise from the fact, lawful in itself, of operating in the armaments market. It may arise, instead, from the knowing introduction of goods, components or services into a chain of use that is foreseeably unlawful (where the available elements signalled the risk and required a more serious check) or – worse still – certainly unlawful, with full knowledge of the probable destination and operational scenarios.
At the same time, a breach of the criteria governing the export of military equipment does not, in itself, determine criminal liability for international crimes, but it may constitute an autonomous criminal offence. First of all, it is necessary to verify whether the transaction was carried out without authorisation, in breach of the title issued, through untruthful representations, or despite the presence of prohibitions that would have required refusal or reassessment of the licence. In this first case, the special offences provided for precisely by Law No. 185/1990 come into consideration. 185/1990.
In particular, the first safeguard concerns the truthfulness of the documentation. Art. 23 punishes anyone who, in the documents produced, intentionally provides untrue indications relevant to obtaining authorisation for export, import, transit or renewal of the title: if authorisation is actually obtained, the penalty is imprisonment from two to six years, or a fine from one tenth to three tenths of the value of the contract [24].
Art. 24, by contrast, concerns non-compliance with administrative requirements: this is the case of those who carry out exports or transits in breach of the delivery or destination conditions indicated in the authorisation issued, punishable by imprisonment of up to five years, or by a fine from two tenths to five tenths of the value of the contracts.
The most serious conduct is punished by Article 25: the export, import or transit of military equipment without authorisation. In this case, the penalty is imprisonment from three to twelve years, or a fine from EUR 25,822.84 to EUR 258,228.45[25].
The framework is completed by Article 26, which requires the judicial authority proceeding for the offences referred to in Articles 23, 24 and 25 to notify the Ministers of Foreign Affairs and Defence immediately.
More delicate is the position of the public official who unlawfully grants the authorisation. As will be seen below, in the past Italian judges were able to base liability on the offence of abuse of office, when it was still in force, in relation to the granting or maintenance of export authorisations.
However, the repeal of that offence no longer allows it to be used as the natural residual offence for every unlawful authorisation. For subsequent facts, therefore, the liability of the public official will have to be brought within more specific offences, where applicable: falsity in the investigation or in the measure, corruption or other forms of undue influence, unlawful trading in influence, criminally relevant omissions where there is a specific duty to act, or participation in the unlawful transaction. In truth, it cannot be excluded that abuse of office may again be applicable in the future, in light of the obligation to criminalise the unlawful exercise of public functions provided for by the proposed Anti-Corruption Directive approved by the European Parliament in March 2026[26].
Finally, the most complex level remains that of possible participation in offences committed abroad, pursuant to Article 110 of the Criminal Code[27]: the producer, the intermediary or, in theory, the public official could be liable not because they materially committed the attack, but where they may have provided a causally relevant contribution to its realisation. In such cases, the difficulty is mainly evidentiary. It will therefore be necessary to prove that the specific supply, in the given context, strengthened or made possible the unlawful conduct of others, and that whoever exported or authorised was aware, at least in terms of dolus eventualis, of the destination, the concrete risk of use and the international framework within which the transaction was situated.
From this perspective, depending on the case, various serious ordinary offences may come into consideration – such as murder, bodily injury, massacre, devastation and looting – where the principal act may fall within provisions of our legal system, in which, moreover, at present there are no specific provisions that have directly and systematically implemented Articles 6, 7 and 8 of the Rome Statute (which govern the crime of genocide, crimes against humanity and war crimes). One exception – although it is a provision introduced before and independently of the Rome Statute – is the Italian legislation that punishes acts aimed at committing genocide under Law No. 962 of 9 October 1967 (Prevention and Punishment of the Crime of Genocide). Certain conduct referable to war crimes may also find a place in the Military Criminal Code of War, in particular in the provisions on offences against the laws and customs of war[28].
In this regard, supplies are referred to in general because the same reasoning may concern not only the finished weapon, but also components, technologies, software, maintenance services, technical assistance or so-called dual-use goods (products used in the civilian sphere but also usable for military applications). In these cases, alongside Law No. 185/1990, the European and national rules on dual-use products[29], as well as rules on embargoes and restrictive measures, may become relevant. Liability, therefore, does not depend on the category to which the good belongs, but on its concrete function in the military supply chain and on the knowability of the final destination.
On this point, a 2021 order of the Court of Rome is particularly significant today, concerning the case that involved a supply of components for explosive devices to the Saudi-led coalition in the Yemeni conflict[30], a proceeding that was then archived in 2023 following further investigations.
With the 2021 order, the Judge for Preliminary Investigations did not establish specific liability, but rejected the Public Prosecutor’s request for dismissal and ordered the entry in the register of reported offences of the pro tempore directors of UAMA (the Unit for Authorisations of Military Equipment of the Ministry of Foreign Affairs) and of the managing directors of the supplier company, ordering further investigations.[31]
The most relevant passage of the order concerned the knowability of the risk. According to the judge, as early as 2015 the conflict in Yemen and the possibility of unlawful use of the armaments could not be considered unknown or unforeseeable facts. Moreover, during the same authorisation procedure, the end user of the supply (the Saudi air force) was asked to provide an addition to the End User Certificate (the document issued by the government authorities of the recipient country certifying that the military equipment is imported for the end user’s own use and will not be re-exported without prior authorisation from the competent Italian authorities), consisting of an undertaking to use the armaments in compliance with the principles of international humanitarian law and human rights. UAMA had also expressed the intention to issue a licence broken down into annual supplies, so that the situation on the ground could be periodically reassessed.[32] According to the Judge, “There was therefore awareness of a potential risk of use of the armaments against civilian targets, a risk which, if it materialised, would have entailed, without any discretion, a clear violation of the rules of international humanitarian law”[33].
It was also, as reported in the same order, a conflict in respect of which there were several resolutions of the European Parliament and of the United Nations Security Council attesting to the involvement of civilians in attacks by the actors involved, including the recipient State of the supply.
Even if the war is fought abroad, therefore, the Italian court may verify the lawfulness of what occurred in Italy: how the authorisation procedure was formed, what information was available, what precautions were required, and what contribution the administration and the industrial supply chain made to the construction of the risk. Jurisdiction does not follow only the place of the explosion; it also follows the place where the supply was decided, authorised and made possible.
Outside Italy, the United Kingdom has also provided a significant example in a similar direction. In particular, the proceedings brought by Campaign Against Arms Trade concerning exports precisely to Saudi Arabia showed how judicial review can focus not on the authorisation decision as such, but on the quality of the investigation. In 2019, the Court of Appeal held that the Government’s decision to continue granting licences without an adequate assessment of previous violations of international humanitarian law by the Saudi coalition in Yemen was unlawful. Here too, the point was not an automatic link between the existence of a conflict and an export ban, but the duty to assess the risk seriously in light of the available information[34].
IIn Spain, in 2025, the investigation by the Audiencia Nacional into the company Sidenor hypothesised the liability of certain executives for smuggling and complicity in crimes against humanity or genocide, in relation to the sale of steel to an Israeli arms producer. The case is still open and has not yet resulted in a final finding, but it is of particular interest because, according to the judge’s initial approach, the material had allegedly been exported without the necessary authorisation and with awareness of its destination for the production of weapons in the context of the Israeli offensive in Gaza[35].
In the Netherlands, the Court of Appeal of The Hague ordered in 2024 the suspension of the export of F-35 components destined for Israel, finding a clear risk of their use in serious violations of international humanitarian law in Gaza. The Dutch Supreme Court, in 2025, then held that it was for the Government to carry out a new assessment, but the case remains significant because it shifts the focus from the sale of the complete weapon to the supply of components inserted into a complex international military supply chain[36].
In France, where, unlike Italy, the crimes of the Rome Statute have been codified (punishable also by life imprisonment)[37], in 2025 the Ligue des droits de l’homme filed a complaint with the Paris Court against the French company Eurolinks and the Israeli company IMI Systems, alleging complicity in war crimes, crimes against humanity and genocide in connection with alleged supplies of components intended for ammunition or weapons used in the conflict in Gaza. The matter arises from journalistic investigations and concerns, once again, not the sale of the complete weapon, but the supply of components inserted into a war supply chain[38].
At this point, the most delicate question remains: what happens if the sale has been formally authorised? The issue cannot be resolved by an automatic rule. The administrative licence cannot, by itself, become a safe conduct. First of all, because – as mentioned – the liability of the person who granted the authorisation may come into consideration: the order of the Court of Rome already cited, for example, considered it necessary to examine further the role of UAMA’s top officials in the authorisation sequence.
However, it must again be recalled that that measure was also situated on the terrain of Article 323 of the Criminal Code, now repealed; for subsequent facts, any liability of the public agent will therefore have to be brought within other offences that may be concretely applicable, at least until the possible future reintroduction of abuse of office. [39]
The principle, however, remains. If an authorisation is issued in breach of legal prohibitions, on the basis of an incomplete investigation, or despite subsequent information such as to require a reassessment, the administrative procedure too may become the subject of criminal inquiry. The intention is not to turn the criminal court into a judge of the political expediency of exports (on this point, the Court of Cassation recently excluded such a possibility with respect to the administrative court[40]), but to verify whether the legal prerequisites that permit, or conversely prohibit, the transfer of military equipment have been complied with. This is even more relevant in relation to crisis areas where the risk that serious international crimes may be committed is high – or at least cannot be excluded – and from which multiple responsibilities may arise: that of the Italian State and criminal liability (individual and corporate), both for offences relating to deficient investigations and for offences committed abroad whose commission or facilitation of commission occurred thanks to arms supplies from Italy.
The same applies to the company: on the basis of the approach that is slowly forming in European courts, the producer cannot rely on the mere formal existence of the licence if, by reason of its professional role and access to information, it knew or should have known of elements that made that supply problematic. Operators know what material they sell, to whom they sell it, through which intermediaries, with what declared end user, on the basis of what clauses in the End User Certificate and in what operational scenario that material may be used. If those very elements indicate that the licence should not have been granted, or that the situation required at least a new assessment, the authorisation does not exhaust the problem. On the contrary, the presence of requests for further clarifications by the competent authority may bring more clearly to light the presence of an anomaly, sometimes not curable by the end user’s assurances alone.
Pursuant to Article 1 of Law No. 185/1990, in detail, authorisation cannot be granted when the operation conflicts with the Constitution, with Italy’s international obligations, with UN or EU embargoes, or when it concerns countries in armed conflict in violation of the principles of Article 51 of the UN Charter[41], countries whose policy conflicts with Article 11 of the Constitution (which repudiates war as an instrument of offence against the freedom of other peoples and as a means of settling international disputes), or governments responsible for serious violations of international human rights conventions[42].
The question to be asked, therefore, certainly does not concern the presence of a licence that authorised the supplier. Instead, one must ask about the lawfulness of the operation in light of the qualified information available to that supplier. When the answer is negative, the administrative title becomes an element of context which – indeed – raises the further question of responsibility on the part of the public counterpart.
Naturally, criminal law cannot become the instrument through which every foreign-policy choice and every industrial relationship in the defence sector is reviewed. Export to a crisis area is not necessarily complicity in an international crime, nor is an error of assessment in itself an offence. At the same time, in the current world of tension, the opposite idea cannot hold either: namely, that the distance of the conflict, the complexity of the supply chain or the existence of an administrative measure are always sufficient to break the link between those who supply and the violations of international law that may be committed with the supplied material.
In a global armaments market, responsibility does not stop at the customs border and does not dissolve when the material leaves national territory. It may follow the path of the decision, knowledge, omission and accepted risk. For those who produce and sell, as for those who authorise, it is no longer sufficient to ask whether the operation may be formally permitted, but whether it is still legally sustainable when its possible unlawful (and dramatic) consequence is knowable, documented and foreseeable.
Prof. Avv. Roberto De Vita
Avv. Antonio Laudisa
References
[1] Presidency of the Council of Ministers, Report on authorised and completed operations for the control of the export, import and transit of military equipment, relating to the year 2025, Doc. LXVII, No. 4, 25 March 2026, https://www.senato.it/leggi-e-documenti/attivita-non-legislative/documenti-non-legislativi?documentoId=53552.
[2] As regards Ukraine, the Report specifies that supplies managed by the Ministry of Defence do not require
UAMA authorisation and therefore fall outside the reported statistics; see Report, p. 6. 6.
[3] The item “NATO countries” does not indicate a recipient State, but cumulative licences relating to cooperation programmes towards multiple countries of the Atlantic Alliance.
[4] Presidency of the Council of Ministers, Report on authorised and completed operations for the control of the export, import and transit of military equipment, relating to the year 2025, cited above.
[5] SIPRI, Global arms flows jump nearly 10 per cent as European demand soars, 9 March 2026,
[6] Presidency of the Council of Ministers, Report on authorised and completed operations for the control of the export, import and transit of military equipment, relating to the year 2025, cited above.
[7] In this regard, Bill C. 1730 is under discussion in Committee at the Chamber of Deputies (already approved by the Senate on 21 February 2024), precisely for better coordination of decision-making processes, through the reinstatement, “in forms updated to the new structure of Government, of the interministerial committee originally provided for by Law No. 185/1990”, as well as certain simplifications concerning companies’ documentary burdens. However, the last Committee sitting in which the bill was discussed dates back to 6 February 2025; see https://www.camera.it/leg19/126?leg=19&idDocumento=1730.
[8] Law No. 185 of 9 July 1990, Arts. 1, 2, 5, 9 et seq. and 13; Ministerial Decree No. 19 of 7 January 2013, https://www.esteri.it/mae/resource/doc/2016/10/dm_19_17gennaio2013.pdf ; Presidency of the Council of Ministers, Report on authorised and completed operations for the control of the export, import and transit of military equipment, Doc. LXVII, submitted annually to Parliament pursuant to Art. 5(1) of Law No. 185/1990. 185/1990.
[9] Precisely on this point, in 2024 a weakness in the Italian system was reported in the context of the UN Universal Periodic Review. The Asser Institute and Global Rights Compliance observed that the regime for firearms governed by Law No. 110/1975 would be less stringent than that for military equipment: control would not be concentrated with the central authority competent for military licences, with the support of ministerial assessments, but would pass through local authorities, customs and local bodies. According to that submission, there is no centralised assessment of the final recipient, the political context and the risk of diversion; consequently, control risks stopping at the formal regularity of the operation, without sufficiently verifying the actual use of the weapon once it has left national territory. See https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://uprdoc.ohchr.org/uprweb/downloadfile.aspx%3Ffilename%3D13678%26file%3DEnglishTranslation&ved=2ahUKEwjD1v2O29SUAxUb_rsIHTJTF48QFnoECBcQAQ&usg=AOvVaw32i4QXI-z5NV-KbF8FsN_9.
[10] United Nations Charter, Arts. 92-96; Statute of the International Court of Justice, Art. 1; International Court of Justice, How the Court Works and Contentious Jurisdiction, official websites.
[11] Law No. 848 of 17 August 1957, Art. 1, which implements the United Nations Statute as from 14 December 1955, the date of Italy’s admission to the UN.
[12] Rome Statute of the International Criminal Court, Arts. 5 and 17; International Criminal Court, Rome Statute and How the Court Works, official websites.
[13] The Court has not yet ruled on the merits and therefore has not established that genocide was committed; however, it has adopted provisional measures, ordering Israel to prevent acts contrary to the Convention, prevent and punish incitement to genocide, allow humanitarian assistance and preserve evidence of what is occurring; see Application of the Convention on the Prevention and Punishment of the Crime of Genocide in the Gaza Strip (South Africa v. Israel), Overview, https://www.icj-cij.org/case/192.
[14] Application of the Convention on the Prevention and Punishment of the Crime of Genocide in the Gaza Strip (South Africa v. Israel), Provisional Measures, Order of 26 January 2024, I.C.J. Reports 2024, p. 16, https://icj-web.leman.un-icc.cloud/sites/default/files/case-related/192/192-20240126-ord-01-00-en.pdf.
[15] It must be specified, in fact, that the case does not concern the ascertainment of genocide committed by Russia, but the use of the allegation of genocide as a justification for Russia’s armed intervention; see Allegations of Genocide under the Convention on the Prevention and Punishment of the Crime of Genocide (Ukraine v. Russian Federation), Overview, https://www.icj-cij.org/case/182.
[16] Allegations of Genocide under the Convention on the Prevention and Punishment of the Crime of Genocide (Ukraine v. Russian Federation), Provisional Measures, Order of 16 March 2022, I.C.J. Reports 2022, p. 211, https://icj-cij.org/sites/default/files/case-related/182/182-20220316-ord-01-00-en.pdf.
[17] Situation in the State of Palestine, https://www.icc-cpi.int/palestine.
[18] Situation in the State of Palestine: ICC Pre-Trial Chamber I rejects the State of Israel’s challenges to jurisdiction and issues warrants of arrest for Benjamin Netanyahu and Yoav Gallant, 21 November 2024, https://www.icc-cpi.int/news/situation-state-palestine-icc-pre-trial-chamber-i-rejects-state-israels-challenges.
[19] Situation in the State of Palestine: ICC Pre-Trial Chamber I issues warrant of arrest for Mohammed Diab Ibrahim Al-Masri (Deif), 21 November 2024, https://www.icc-cpi.int/news/situation-state-palestine-icc-pre-trial-chamber-i-issues-warrant-arrest-mohammed-diab-ibrahim.
[20] Deif, ICC, https://www.icc-cpi.int/defendant/deif.
[21] Adopted by the United Nations General Assembly on 2 April 2013 and entered into force on 24 December 2014, https://thearmstradetreaty.org/treaty-status; see also Law of 4 October 2013, Ratification and implementation of the Arms Trade Treaty, adopted in New York by the United Nations General Assembly on 2 April 2013, https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2013;118.
[22] Legal analysis of the conduct of Israel in Gaza pursuant to the Convention on the Prevention and Punishment of the Crime of Genocide. Conference room paper of the Independent International Commission of Inquiry on the Occupied Palestinian Territory, including East Jerusalem, and Israel , 16 September 2025, https://www.ohchr.org/sites/default/files/documents/hrbodies/hrcouncil/sessions-regular/session60/advance-version/a-hrc-60-crp-3.pdf.
[23] Law No. 185 of 9 July 1990, Art. 1; Council Common Position 2008/944/CFSP, Art. 2, https://eur-lex.europa.eu/legal-content/IT/ALL/?uri=CELEX:32008E0944; Arms Trade Treaty, cited above, Arts. 6 and 7.
[24] The same provision also sanctions, albeit differently, untrue information decisive for entry in the national register of companies or for the issuance of clearance for negotiations. See Art. 23(2), Law No. 185 of 9 July 1990, See Art. 23(2), Law No. 185 of 9 July 1990, https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1990;185
As regards, instead, the “illegal trafficking” of weapons of war, ammunition and explosives, the weapons-control legislation under Law No. 895 of 2 October 1967 may become relevant, https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1967-10-02;895.
[25] The same provision also sanctions, with imprisonment of up to four years or a fine from EUR 25,822.84 to EUR 258,228.45, negotiations carried out outside the prior communication and control system provided for contractual operations. Confiscation is also provided for military equipment intended for export when it is not accompanied by the required authorisations. See Art. 25(2), Law No. 185 of 9 July 1990, https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1990;185
[26] European Parliament legislative resolution of 26 March 2026 on the proposal for a directive of the European Parliament and of the Council on combating corruption, replacing Council Framework Decision 2003/568/JHA and the Convention on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union, and amending Directive (EU) 2017/1371 of the European Parliament and of the Council (COM(2023)0234 – C9-0162/2023 – 2023/0135(COD)), https://www.europarl.europa.eu/doceo/document/TA-10-2026-0094_IT.html.
[27] “When more than one person participates in the same offence, each of them is subject to the penalty established for that offence, without prejudice to the provisions of the following articles.”
[28] Military Criminal Code of War, Title IV, Arts. 165 et seq.
[29] In particular, Regulation (EU) 2021/821 (https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX%3A32021R0821) and Legislative Decree No. 221 of 15 December 2017 (https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2017-12-15;221!vig=).
[30] Save the children, Guerra in Yemen: origini ed evoluzioni di un conflitto che dura da anni, https://www.savethechildren.it/blog-notizie/guerra-yemen-origini-ed-evoluzioni-di-un-conflitto-che-dura-da-anni.
[31] Court of Rome, GIP section, order of 22 February 2021, proceeding n. 80418/2018 R.G.N.R. (filed on 23 March 2021), pp. 6-11, https://www.sistemapenale.it/pdf_contenuti/1620291779_-gip-roma-esportazione-armi-arabia-saudita-crimini-internazionali-abuso-ufficio.pdf.
[32] Court of Rome, GIP section, cited order, pp. 7-11.
[33] Court of Rome, GIP section, order of 22 February 2021, cited above, p. 8.
[34] Court of Appeal, R (Campaign Against Arms Trade) v Secretary of State for International Trade, [2019] EWCA Civ 1020, 20 June 2019, https://www.judiciary.uk/wp-content/uploads/2019/06/CAAT-v-Secretary-of-State-and-Others-Open-12-June-2019.pdf.
[35] I. Vega, E. Hernandez Ojeda, Un juez de la Audiencia Nacional imputa al presidente de Sidenor por complicidad con el genocidio de Gaza por vender acero a la industria militar israelí
[36] G. Wright, Dutch court orders halt to F-35 jet parts exports to Israel, BBC, 12 February 2024,
https://www.bbc.com/news/world-europe-68272233.
[37] Code pénal, https://www.legifrance.gouv.fr/codes/section_lc/LEGITEXT000006070719/LEGISCTA000006149876/
[38] A. Michel, France: La Ligue des Droits de l’Homme saisit la justice contre Eurolinks et IMI Systems pour complicité présumée de crimes contre l’humanité et de génocide à Gaza, 12 July 2025, https://www.business-humanrights.org/fr/dernières-actualités/france-la-ligue-des-droits-de-lhomme-saisit-la-justice-contre-eurolinks-et-imi-systems-pour-complicité-de-crimes-contre-lhumanité-et-complicité-de-génocide/.
[39] Court of Rome, GIP section, cited order, pp. 5-7 and 11; Law No. 114 of 9 August 2024, Art. 1(1)(b), which repealed Art. 323 of the Criminal Code.
[40] Court of Cassation, United Sections, order No. 34688 of 29 December 2025; for further detail, see L. Marilotti, Divieto di esportazione di armi in caso di violazioni del diritto umanitario e sindacato giurisdizionale. Nota a Cass., Sez. Un., ord. 29 dicembre 2025, n. 34688, Giustizia Insieme, 25 March 2026, https://www.giustiziainsieme.it/articolo/3901-divieto-di-esportazione-di-armi-in-caso-di-violazioni-del-diritto-umanitario-e-sindacato-giurisdizionale
[41] ““Nothing in the present Charter shall impair the inherent right of individual or collective self-defence if an armed attack occurs against a Member of the United Nations, until the Security Council has taken measures necessary to maintain international peace and security. Measures taken by Members in the exercise of this right of self-defence shall be immediately reported to the Security Council and shall not in any way affect the authority and responsibility of the Security Council under the present Charter to take at any time such action as it deems necessary in order to maintain or restore international peace and security.” “.
[42] ““The export, import and transit of military equipment, as well as the transfer of the related production licences, must comply with Italy’s foreign and defence policy. These operations are regulated by the State according to the principles of the republican Constitution, which repudiates war as a means of resolving international disputes.
Once, the epistemological relationship between truth and procedural truth was debated. The limits of the latter were accepted because it was destined functionally to regulate relations among members of society in the balancing between certainty and order. The truth produced by artificial intelligence is constant creative and perceptual falsification, which also modifies people’s autobiographical memory and the materiality of the “objective,” and alters the evaluation of evidence, thus rendering the category of procedural truth no longer part of reality, of truth, and of its knowability. The leviathan has become a demiurge. Precisely at the moment when digital evidence becomes the direct or indirect center of gravity of every criminal investigation (because man is part of a digital fabric with ever tighter meshes), crimes linked to generative AI also condition and suborn analog evidence. What we are witnessing (for the most part unconsciously) with crimes linked to AI and, in particular, deepfakes, phishing, and sextortion, is only a synecdoche of the crisis of evidence in the age of synthetic content.
Generative artificial intelligence has not only expanded the ability to produce content, but has undermined – perhaps definitively – one of the most fragile assumptions of digital coexistence: trust in the authenticity of what we see, hear, and read. Deepfakes, advanced phishing, sextortion, and artificial pornography show how deception no longer depends only on the falsity of the content, but on its plausibility, its extremely rapid dissemination, and its capacity to strike emotions, reputation, assets, and self-determination. In this scenario, the threat concerns not only the commission of new crimes or the enhancement of traditional ones, but also directly affects the solidity of audiovisual evidence, the credibility of digital relationships, the resilience of the procedural system, and the effectiveness of punitive responses. Generative AI, in fact, has not only multiplied the capacity to produce content, but has made it highly credible, difficult to verify, virtually free, and within everyone’s reach. The point is no longer to establish whether artificial intelligence can be used to commit crimes, but to understand how it is transforming the ways in which they are committed.
Statistics on crimes specifically linked to generative AI are still incomplete, because the main databases classify the facts by type – fraud, extortion, sexual exploitation, informational manipulation – and not yet by the technology used. Yet the available data are now too convergent to be dismissed as passing signs of change. Europol, in SOCTA 2025, describes AI as a factor transforming organized crime, a structural multiplier capable of increasing its efficiency, scale, and adaptability [1]. In the report Threat Landscape 2025, ENISA notes that cybercriminals are increasingly exploiting artificial intelligence to increase productivity and operational capabilities, and confirms that phishing remains the most widespread means of compromise, accounting for about 60% of the cases observed [2]. In the 2024 Internet Crime Report, the FBI recorded 859,532 complaints and 16.6 billion dollars in losses; phishing through “spoofing” alone [3] (a cyberattack using false identities) accounts for 193,407 reports, while “Business Email Compromise” generates losses of more than 2.77 billion dollars [4].
The picture becomes even more alarming with respect to crimes affecting minors. The National Center for Missing & Exploited Children (NCMEC) reports that in 2024 the CyberTipline [5] received 20.5 million reports, corresponding to 29.2 million distinct incidents; reports of “online enticement” (online solicitation), a category that includes sextortion, exceed 546,000, with an increase of 192% compared with 2023 [6]. In the same year, reports involving the use of Generative AI grew by 1,325%, rising from 4,700 to 67,000 [7]. In 2024, finally, the Internet Watch Foundation identified 245 reports containing AI-generated images of child sexual abuse, an increase of 380% over the previous year [8].
Generative artificial intelligence (or generative AI) is a branch of AI that enables computer systems to create new original content, such as texts, images, music, videos, or code, starting from existing training data. Unlike traditional AI models, designed to classify or recognize data, generative systems are capable of producing new content, which often proves indistinguishable from that created by human beings.
The functioning of generative AI is based on deep neural networks (deep neural networks), in particular on an architecture called the transformer (transformer), introduced in 2017 by a group of Google researchers [9]. This architecture underlies many advanced language models such as OpenAI’s GPT (Generative Pre-trained Transformer), Google’s PaLM, Anthropic’s Claude, or Meta’s LLaMA.
Generative models are usually pre-trained on enormous amounts of data, often taken from the web, and subsequently optimized to perform specific tasks (for example automated writing, image generation, or code creation). During training, the model learns the statistical and semantic structures of language or visual data, so that it can reproduce them in a credible way.
A very well-known example of generative AI is ChatGPT, developed by OpenAI, which can sustain complex conversations, write essays, answer technical questions, and even imitate literary styles. Other tools such as DALL-E or Midjourney generate realistic images starting from a simple textual description (prompt), while others, such as Synthesia, allow the creation of videos starting from linguistic inputs.
From a technical point of view, the core of generation consists in predictive autocompletion: the model calculates the probability that one word (or one pixel, or one musical note) will follow another, and generates coherent sequences on the basis of this calculation. For language models, for example, this happens word by word or token by token, choosing those that are statistically most plausible in relation to the context provided by the user.
As regards deepfakes, this technology often implies the use of a “neural network” for machine learning [10]. The neural network begins as a sort of tabula rasa, characterized by a nodal network controlled by a set of numerical parameters set at random [11]. Just as experience refines the brain’s neural nodes, examples train the neural network system [12]. If the network processes a wide range of training examples, it is then able to create increasingly accurate models [13]. It is through this process that neural networks classify audio, video, or images and generate realistic imitations or alterations.
In itself, the emergence of machine learning through neural-network-based methods heralds a significant increase in the ability to create false images, videos, and audio. But the story does not end there. “Generative adversarial networks,” GANs (Generative Adversarial Networks) enter the scene [14]. The latter, invented by Google researcher Ian Goodfellow, use two neural networks simultaneously: one, called the generator, draws from a dataset to produce a sample that imitates such data; the other, the discriminator, evaluates how successful the generator has been. Iteratively, the discriminator’s evaluations refine the generator’s work. The result far surpasses the speed, scope, and subtlety that human reviewers could achieve, so that the growing sophistication of the GAN approach will inevitably lead to the production of increasingly convincing deepfakes [15].
GenAI is often described as a “creative” technology. On the legal plane, however, its most relevant quality is another: the capacity to produce plausible outputs, adaptable to context and difficult to distinguish from human ones. Contemporary generative models descend from the evolution of deep-learning architectures, in particular transformers, introduced in 2017, which made it possible to process enormous sequences of textual, visual, and audiovisual data much more efficiently than previous models [16]. The OECD has observed that GenAI imposes on governments a new challenge: governing a technology capable of transforming information, markets, and social relations without sacrificing fundamental rights, reliability, and public trust [17].
If in the past the sophisticated manipulation of images, audio, and video remained largely confined to highly specialized actors, today commercial tools, often intuitive and relatively inexpensive, allow a much wider audience to produce synthetic content that is more or less dangerous. It is here that the issue ceases to be exclusively technological and enters real life, generating not only entirely new criminal offenses, but also giving a different offensive power to already known crimes such as fraud, extortion, defamation, identity substitution, and evidentiary manipulation, altering the assumptions of the credibility of deception [18].
An example that has by now become paradigmatic is the University of Washington experiment on Barack Obama’s face. Some researchers, using a neural-network-based tool they had created, showed how, given sufficient audiovisual material, it was possible to produce a video in which the former president uttered phrases he had never said [19]. That case had a demonstrative function. Today, however, the problem is no longer to establish whether this is possible, but to recognize that the same logic can now be used in romance scams, false statements, blackmail videos, voice clones, or pseudo-evidence. In other words, GenAI does not merely generate content: it creates plausible and credible situations [20].
It can happen on an international and serious organised crime scale, and it can happen in someone’s bedroom … You can think of any crime type and put it through an AI lens and say: “What is the opportunity here?” (Alex Murray, UK National Crime Agency) [21]
The first field in which GenAI has shown in a concrete way its criminogenic capacity is that of persuasive fraud. Phishing is a form of social engineering in which the perpetrator pretends to be a trusted contact and induces the victim to share sensitive information, such as passwords or banking data [22]. Traditional phishing was often recognizable because of grammatical errors, standardized formulas, and clumsy registers. GenAI reduces precisely these signals: it produces correct texts, imitates communicative styles, constructs plausible digital identities, personalizes messages for specific recipients, and imitates writing styles while circumventing controls, exploiting the vulnerabilities of email filters and users’ habits. The effect is not only quantitative, but qualitative: the false appears more credible because it increasingly resembles ordinary communication [23].
The Anti-Phishing Working Group (APWG) observed 1,130,393 attacks in the second quarter of 2025, the highest quarterly value since mid-2023 [24]; in the fourth quarter, moreover, the main targets were social media services and SaaS/Webmail, each accounting for 20.3% of the attacks observed, while smishing (phishing via SMS) continued to grow by 30-40% quarter by quarter [25]. In addition, ENISA notes that at the beginning of 2025 AI-supported phishing campaigns already represented more than 80% of the social-engineering activity observed [26]. Microsoft adds that AI-automated phishing emails reach click rates of 54%, as against 12% for standard attempts [27]. In the same direction is the FBI, according to which in the first seven months of 2025 AI appears in more than 9,000 reports, distributed across different forms of online fraud [28].
The FBI warned that criminals use GenAI to facilitate financial fraud on a larger scale, exploiting artificial images, convincing texts, cloned audio, and synthetic videos to make the deception more plausible [29]. The FTC, for its part, reported the growing risk posed by voice cloning systems, capable of reproducing the voice of a family member or a hierarchical superior and triggering an immediate emotional response in the victim [30]. The interesting element, from a legal point of view, is that AI does not intervene only in the final act of the fraud, but already in the construction of the context of trust: it creates the apparent relationship that induces the victim to believe, react impulsively, and lower their defenses.
It is therefore not surprising that the most recent examples are less and less “home-made” and more and more organized. In February 2025, the Hong Kong Police announced that it had dismantled two criminal organizations that used deepfakes and synthetic identities for online fraud, with 58 arrests and total estimated losses of about 400 million Hong Kong dollars [31]. But there are not only economic frauds in the classic sense. In 2025, the FBI issued an alert on so-called “virtual kidnapping,” in which criminals use altered images or videos as false “proof of life” in order to make extortion demands for non-existent kidnappings more credible [32]. The leap here is evident: GenAI makes it easier to simulate not only a message, but an entire emotional scene [33].
In this sense, generative phishing represents something more than a simple technological updating of social engineering. It is the emergence of a persuasive criminality, in which false content matters not so much for what it says, as for its capacity to insert itself into an already plausible relationship. It is precisely this element that explains why the response of the law cannot be exhausted in the repression of the completed act alone: when deception is automated, personalized, and scalable, prevention and transparency become part of the legal response as much as sanction [34].
If fraud shows the most economically visible side of GenAI, its most disturbing impact emerges in crimes that affect the sexuality and vulnerability of persons. Sextortion, already known before the explosion of generative AI, changes nature when the perpetrator does not merely threaten the dissemination of real material, but can create or alter sexually explicit content starting from innocent photographs, images found online, or simple identifying data. In this case, the threat no longer concerns only what exists, but what can be made credible in a few minutes [35].
This transformation is not exhausted, however, in the individual extortionate conduct or in the manipulation of a piece of content. As Internazionale [36], recently observed, drawing on an analysis by The Economist, artificial intelligence is reshaping the entire economy of digital pornography: from generators of explicit images to nudify apps, all the way to platforms that must decide whether to admit, monetize, or at least label synthetic content that appears authentic.
In this context, sextortion, pornographic deepfakes, and exploitation of another person’s image no longer appear as episodic deviations, but as the pervasive and exponentially growing scenario that is reshaping the very boundaries of pornography, of its enjoyment, and of the imagery connected to it, with disturbing and potential normalizations of illicit deviance in real life, especially as regards minors.
English NCMEC data, for example, confirm the scale of the phenomenon. In 2024, reports of “online enticement” (online solicitation) exceed 546,000, with growth of 192% compared with the previous year; the same organization reports receiving almost 100 reports a day of “financial sextortion” (that is, extortionate conduct carried out through the internet, characterized by the threat to disseminate sexually explicit images or videos depicting the victim, in order to obtain something from the latter), and being aware, since 2021, of at least 36 adolescents who took their own lives after having been victims of sextortion [37].
Moreover, 2024 closed with some striking judicial cases in the field of artificial intelligence. In particular, a twenty-seven-year-old from Bolton (UK), Hugh Nelson, was sentenced to 18 years’ imprisonment for having created, with artificial intelligence, images of child abuse, using as a basis photographs of minors who really existed [38]. It was the first trial of this kind in England.
Nelson had used Daz 3D, a computer program with an artificial intelligence function, to turn “normal” images into abuse images. In some cases, pedophiles had commissioned the images, directly providing photographs of minors with whom they had had contacts in real life.
From selling the images in various online chats he earned about five thousand pounds over a period of 18 months.
Sebbene ci siano state precedenti condanne per deepfake (nei quali spesso si sovrappone un volto alle azioni commesse da un altro corpo) la novità di questo caso è rappresentata proprio dalla creazione integrale di personaggi 3D da fotografie innocue[39].
In this direction, the Internet Watch Foundation reported in 2024 an increase of 380% in reports relating to AI-generated images of child sexual abuse [40].
Il danno non consiste soltanto nell’eventuale acquisizione abusiva di immagini autentiche, ma nella costruzione artificiale di una sessualità artefatta e non voluta, nella mercificazione del corpo rappresentato, nella minaccia reputazionale e nella capacità del contenuto artificiale di circolare come se fosse vero. È per questo che il dibattito normativo si sta spostando verso categorie più ampie, come quella dei contenuti intimi non consensuali, idonee a ricomprendere anche immagini e video generati o alterati artificialmente[41].
The growth in recourse to AI-generated images to satisfy the black market of abusers carries with it a challenge to the resilience of the relevant rules, conceived in a completely different era. Increasing relevance is therefore assumed by those rulings of the Italian Court of Cassation that, for some time now, have begun to classify comics and illustrations of erotic stories depicting minors as child pornography material, considering that everything capable of giving the viewer the idea that the object of the pornographic representation is a minor must be included within that notion [42].
The different types of deepfakes, from the simplest ones, such as face-swapping, to lip-syncing and puppet-mastery (respectively the exchange of faces, the synchronization of a video of a person speaking with a different audio track, and the animation of a non-existent subject), can be as complex to create realistically as they are difficult to distinguish from real images.
Although over time, in step with the evolution of generative technology, considerable progress has been made in the performance of deepfake detectors, there still exist significant limits that prevent complete and effective identification.
First of all, as always happens with AI technologies that need to learn in order to improve, access to large databases of deepfakes is a determining factor for the development of effective detection techniques. However, by analyzing the quality of the videos present in these datasets, various ambiguities emerge in relation to the manipulated content actually present on the Internet. The most common types in these databases are temporal flickering at some moments during speech, blurring around facial regions, excessive smoothness in facial texture or a lack of detail, the absence of head movements or rotations, the absence of objects obstructing the face (glasses, lighting effects, and the like), and sensitivity to variations in posture or gaze, for example with inconsistencies in skin color. The ambiguities mentioned derive from imperfections in the steps of the manipulation techniques. Moreover, low-quality content is hardly convincing or capable of creating a real impression. Therefore, even if detection methods prove effective on such videos, it is not guaranteed that they will maintain the same performance in real situations, with photos and videos created with more advanced techniques.
Moreover, deepfake detection methods are formulated as a binary classification problem, in which each sample is labeled as true or false. This type of classification is simpler in controlled environments, where techniques are developed and tested using audiovisual content whose origin is known – original or falsified. However, in field application, videos can be altered in ways other than deepfakes, so content not detected as manipulated is not necessarily authentic (e.g. Photoshop). In addition, a deepfake content item may present more than one type of alteration, both audio and visual, making a single label inaccurate. In content with multiple faces, usually one or more of them are manipulated by deepfake only in some sequences. Therefore, the binary classification scheme should be expanded to multi-category/multi-label classifications and to local classification/detection at the frame level, in order to make the analysis more effective.
The most elementary deepfake detection methods, therefore, are generally designed for batch analysis on large datasets. However, when such techniques are employed by journalists or law enforcement agencies, only a limited number of videos is often available. Moreover, a numerical score representing the probability that content is real or false has little value if it is not accompanied by an explanation justifying that score, but most detection methods, especially those based on deep-learning techniques, do not offer such explanations because of their “black-box” nature, that is, a black box whose functioning cannot be known from the outside [43].
A complete legal reflection on the subject must necessarily grapple with the impacts of Generative AI on the relationship between truth and procedural ascertainment: the effects of deepfakes, in fact, are not limited only to the dissemination of the false, but are such as to undermine trust in the true. Audiovisual evidence has traditionally benefited, in many contexts, from a sort of practical reliance: a video “shows,” a photograph “documents,” an audio recording “records.” Deepfakes overturn these assumptions and undermine precisely this basic trust, giving rise to one of the greatest threats of contemporary society [44].
The difficulty, however, is not only cultural but also technical. The structural limits of detection systems are known: datasets not fully representative, overly rigid binary classification, poor transparency of the models, vulnerability to race and gender bias, difficulty in dealing with multimodal content and local alterations. The forensic evaluation of deepfakes, moreover, must today confront the use of anti-forensics techniques [45], used precisely to make forensic reconstruction difficult and aimed at concealing the elements useful for ascertaining falsifications. For example, an AI-content detection tool may prove much less reliable when the same contents have been uploaded, compressed, reconverted, and disseminated through social platforms [46].
Social platforms such as Twitter, Facebook, or Instagram, which are the main online channels used to disseminate audiovisual content, in order to save network bandwidth strip such content of metadata, subject it to downsampling (a process of reducing definition), and compress it significantly before upload. These manipulations, commonly known as social media laundering, remove clues relating to any underlying falsifications and increase the rate of false positives in detections. Detection methods based on signal-level key points are particularly vulnerable to this kind of distortion. An effective measure to improve the accuracy of detectors on content “cleaned” by social media is to include such effects in the training data, while at the same time expanding evaluation databases with visual content manipulated through social networks.
Among the concerns about the malicious use of deepfakes, the possible role of this technology in manipulating the formation of evidence in trials, criminal and otherwise, stands out. As early as 2021, a European Commission study observed that deepfakes raised “serious concerns regarding the fundamental credibility and admissibility of audiovisual recordings as electronic evidence in courts” [47].
Indeed, the first consequence in public opinion of the widespread use of deepfakes is the erosion of trust in institutions and in the concept of truth, with evident damage to the credibility of the judicial system.
This technology, in fact, forces the viewer to reassess the level of trust placed in the videos and images with which they interact, particularly in the judicial field, precisely because they may appear extremely realistic but in reality be entirely false; and even when the viewer is aware of the falsity of the content, perception may nonetheless influence the subconscious. Their very existence undermines the “intrinsic” trust that is normally attributed to video and photographic evidence [48].
In most legal systems, moreover, the regulatory vacuum deriving from the novelty of the subject makes it difficult to choose under which criminal offense to frame the use of deepfakes. Abroad, it has been suggested that recourse be had to civil and criminal disciplines concerning copyright [49], which is, however, often limiting. On the contrary, the widespread introduction of new specific disciplines would be preferable, following (in the EU) the path already traced by the AI Act, as will be seen later [50].
The most critical aspect, in any case, concerns the value normally attributed to documentary evidence such as images and videos[51], often admitted without any kind of computer-based verification of their genuineness, provenance, and originality. Sometimes, the only guarantee of provenance is the mere integrity of the chain of custody of the files and devices in which they are contained, which, however, provides no guarantee at all of the genuineness of the content ab origine[52]. This “intrinsic” trust is further demonstrated by the fact that – in most legal systems – these examinations are carried out outside the courtroom, before the trial, usually during the investigations[53].
It is here that the technology produces perhaps its deepest effect on the law: the crisis of audiovisual evidence consists not only in the risk that a falsehood enter the proceedings, but in the fact that even the true ceases to appear immediately reliable. The damage, in other words, is not only epistemic, but institutional [54].
Let us consider, for example, one of the forms of evidence regarded as most significant in investigations and judicial proceedings: interceptions, whether they are “traditional” telephone wiretaps, environmental recordings, or those carried out through spyware. At present, their truthfulness and technical reliability are assessed on the basis of the proper method of using the tool, but the originality of the content is not examined from a technical and IT perspective. If we add to this shortcoming the growing spread of increasingly realistic and less detectable voice deepfakes, the result is a dialogue that has been correctly obtained and assessed procedurally, yet may in fact contain two or more voices, some of which have been generated by artificial intelligence. Interceptions, therefore, risk conferring certainty—with a formally correct method—on elements that are actually the product of artificial manipulation.
In this scenario, European law and Italian law are beginning to react not only with classical categories, but also with transparency obligations, removal tools, supervisory powers, and new targeted offenses [55].
The AI Act implements a governance of risk, transparency, and control of the technical supply chain. Precisely for this reason, however, it is also central for those dealing with crimes linked to artificial intelligence: because it defines the European perimeter of what the legislator considers intolerable or, at the very least, in need of reinforced safeguards [56].
On the one hand, Article 5 prohibits manipulative, exploitative, or incompatible practices with fundamental rights, including certain particularly invasive uses or uses harmful to dignity and individual autonomy [57]. Its value is above all systemic: it clarifies that the Union does not look at AI as a neutral instrument, but as a technology capable of amplifying deception, domination, and exploitation.
On the other hand, Article 50 is the provision most directly connected to deepfakes and synthetic content. The regulation imposes transparency obligations on content generated or artificially manipulated, requiring that deepfakes and certain textual contents disseminated to the public be declared as such, save for specific exceptions, for example for activities of prevention or repression of crimes. The cultural and legal significance of the rule is considerable: the Union does not prohibit synthetic content as such, but considers it unacceptable that it should circulate as authentic without the recipient being placed in a position to recognize its artificial nature [58].
Against this background, the debate, now open at the European level, on Article 4 of the AI Act concerning AI Literacy also becomes relevant: “Providers and deployers of AI systems shall take measures to ensure, to the greatest extent possible, a sufficient level of AI literacy of their staff and of any other person dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training, as well as the context in which the AI systems are to be used, and taking into account the persons or groups of persons on whom the AI systems are to be used.” In the phenomena considered here – generative phishing, deepfakes, sextortion, and pseudo-evidence – the vulnerability of the legal order also arises from a cognitive asymmetry: between those who, on the one hand, generate the content and those who, on the other, receive it, disseminate it, or are called upon to assess it. It is therefore significant that, in the discussion initiated with the so-called Digital Omnibus Package [59], there is debate as to whether providers and deployers should remain under an active obligation to adopt measures or whether that obligation should be downgraded to mere encouragement [60].
Even more relevant is the content of Articles 53 and 55, devoted to general-purpose AI models and to those with systemic risk. Here the Regulation moves beyond the logic of the individual malicious user and looks at the organizational responsibility of those who develop and place powerful models into circulation: technical documentation, information for those who integrate the model, copyright policy, public summary of training data, evaluation and mitigation of systemic risks, incident reporting, and cybersecurity obligations [61]. In other words, the AI Act shifts attention upstream of the criminal act, toward the design and distribution of the infrastructure that makes certain forms of offense possible [62].
If the AI Act mainly safeguards the transparency of non-authentic content and the governance of the technical supply chain, the Digital Services Act [63] intervenes on the different plane of the circulation of illegal content on platforms. And it is precisely this profile that recent cases, such as that of Grok integrated into X, make particularly evident: the harm derives not only from the generation of the deepfake, but from its immediate publication, from algorithmic visibility, and from the speed of its propagation. In this perspective, the “notice and action” mechanism under Article 16 DSA, the removal orders provided for by Article 9, the role of trusted flaggers under Article 22, and, for Very Large Online Platforms, the obligations to assess and mitigate systemic risks under Articles 34 and 35 become relevant. It follows that, in the context of sexual deepfakes and non-consensual intimate images, protection cannot be entrusted only to the subsequent criminal sanction or to the transparency obligations of the provider of the model, but must also be articulated through rapid procedures of notice, removal, disabling of access, and containment of dissemination.
In Italy, Law 23 September 2025, No. 132 does not merely “follow” the AI Act. It adopts it as a framework, but takes a further step, grafting into domestic law principles, authorities, delegations, and some criminal-law choices of considerable importance. Art. 3 establishes that the development and use of general-purpose AI systems and models must take place in compliance with fundamental rights, transparency, proportionality, security, data protection, accuracy, non-discrimination, monitoring, and human intervention; the same article further requires that the use of AI should not prejudice democratic debate through unlawful interference and that cybersecurity be ensured throughout the entire life cycle of systems and models [64]. Art. Article 4 adds, for the information sector, the principles of objectivity, completeness, impartiality, and fairness, in addition to transparency in the processing of personal data [65]. Taken together, these provisions already provide a robust interpretative key for phenomena such as political deepfakes, informational manipulation, and impersonation.
Art. Article 15 then intervenes directly on judicial activity, establishing that, even in cases involving the use of AI systems, every decision on the interpretation and application of the law, on the assessment of facts and evidence, and on the adoption of measures always remains reserved to the magistrate [66]. It is a clause of value not only symbolic, but systemic: it recognizes that AI may enter the organization of justice, but cannot replace human judgment at the most delicate point, that of ascertainment. Articles 20 and 24, moreover, designate the Agenzia per l’Italia Digitale (AgID) and the Agenzia per la Cybersicurezza Nazionale (ACN) as national authorities for artificial intelligence, attributing to them specific powers of supervision, inspection, and sanction, as well as the task of coordinating the national legal order with the European system, including the application of the measures and administrative sanctions referred to in Article 99 AI Act[67]. Article 24, moreover, delegates the Government to regulate cases of unlawful creation and use of AI systems, providing also for precautionary tools to inhibit dissemination and remove content generated unlawfully, as well as the possibility of introducing autonomous criminal offenses [68].
But perhaps the most significant datum is that the Italian law does not stop at future delegation. With Article 26 it already intervenes on the criminal code, introducing (in Article 61 no. 11-undecies) a common aggravating circumstance for crimes committed through AI systems when these have constituted an insidious means or have hindered the defense, and above all inserting the new Article 612-quater of the criminal code, entitled “Illecita diffusione di contenuti generati o alterati con sistemi di intelligenza artificiale” [69]. The offense punishes anyone who causes unjust harm by disseminating, without consent, images, videos, or voices falsified or altered by means of AI and capable of misleading as to their genuineness. This is a passage of great importance: for the first time in an explicit way, the Italian legislator recognizes that harm caused by synthetic content is not only a technological variant of falsehood, but an autonomous offense against the person, reputation, and self-determination.
The new criminal offense, moreover, does not exhaust the framework of remedies. Other offenses such as defamation, identity substitution, and unlawful processing of data remain applicable, where their conditions are met; but, above all, the victim’s effective protection depends on the capacity to coordinate the criminal-law response with the European tools for removal and containment of circulation. In cases in which manipulated images, videos, or voices are conveyed through large online platforms, protection does not involve only the ascertainment of the responsibility of the material perpetrator, but also the timely activation of procedures for notice, disabling of access, and mitigation of systemic risk. The response to sexual deepfakes thus appears not only repressive but increasingly multilevel: criminal, regulatory, and procedural, distributed among the author of the offense, the provider of the system, and the platform that makes its propagation possible.
However, the regulatory intervention still appears partial and with wide margins for improvement. In fact, it limits itself to considering conduct involving the creation and dissemination of material produced with artificial intelligence, without contemplating the further possibilities that the latter offers. Indeed, further criminal conduct could be integrated by the mere use of AI as a research tool, on the one hand because it enables the processing of enormous quantities of data for cataloguing purposes, including online content in ways that go beyond the lawful (for example, the profiling capacities regarding social-media users in order to determine vulnerability to scams). On the other hand, it does not take into consideration the possibility that publicly accessible AIs may be trained by users with false information, in order to condition their responses to future users.
With GenAI, therefore, there is no longer only a distinction between true and false, but between credible contents and verifiable contents. Fraud becomes more persuasive, sextortion more devastating, audiovisual evidence more fragile. In this scenario, the AI Act constructs the first great European perimeter of transparency, governance, and control of models.
The law, however, cannot limit itself to chasing technology, especially when its evolution follows exponential accelerations. It must learn to prevent deception where it today truly takes shape: in the design of content, in its dissemination, in its capacity to appear authentic, and in its fitness to produce harm even before it can be disproved. It is here that the true challenge of crimes linked to generative AI lies: not in the fascination of the perfect falsehood, but in the resilience of the legal order in the face of contents that, more and more often, ask to be believed even before they are verified.
Prof. Avv. Roberto De Vita
Avv. Marco Della Bruna
Avv. Giada Caprini
[1] Europol, EU SOCTA 2025, <https://www.europol.europa.eu/cms/sites/default/files/documents/EU-SOCTA-2025.pdf>, according to which AI and new technologies act both as catalysts of crime and as multipliers of operational efficiency.
[2] ENISA, Threat Landscape 2025,
<https://www.enisa.europa.eu/sites/default/files/2026-01/ENISA%20Threat%20Landscape%202025_v1.2.pdf>
[3] https://www.giustizia.it/giustizia/it/mg_2_5_12_1.page?contentId=GLM1144621#
[4] FBI, 2024 Internet Crime Report, <https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf>: 859,532 complaints and 16.6 billion dollars in losses; phishing/spoofing with 193,407 reports; Business Email Compromise with losses exceeding 2.77 billion dollars, and <https://www.europol.europa.eu/cms/sites/default/files/documents/EU-SOCTA-2025.pdf>
[5] <https://www.ncmec.org/gethelpnow/cybertipline/cybertiplinedata>
[6] NCMEC, CyberTipline Data 2024, <https://www.ncmec.org/gethelpnow/cybertipline/cybertiplinedata>: 20.5 million reports, equivalent to 29.2 million distinct incidents; more than 546,000 cases of online enticement, with +192% compared with 2023.
[7] NCMEC, 2024 in Numbers, <https://www.ncmec.org/blog/2025/ncmec-releases-new-data-2024-in-numbers>: an increase of 1,325% in reports involving Generative AI, almost 100 reports a day of financial sextortion, and at least 36 adolescents dead by suicide since 2021 after sextortion.
[8] Internet Watch Foundation, Annual Data & Insights 2024: <https://www.iwf.org.uk/annual-data-insights-report-2024/>: 245 reports relating to AI-generated images of child sexual abuse, with an increase of 380% compared with 2023; <https://www.iwf.org.uk/annual-data-insights-report-2024/data-and-insights/ai-generated-child-sexual-abuse/> and <https://www.iwf.org.uk/about-us/why-we-exist/our-research/how-ai-is-being-abused-to-create-child-sexual-abuse-imagery/>
[9] Vaswani et al., Attention is all you need, 2017, https://arxiv.org/abs/1706.03762.
[10] Danielle K. Citron & Robert Chesney, Deep Fakes: A Looming Challenge for Privacy , Democracy , and National Security , in 107 California Law Review 1753 (2019), <https://scholarship.law.bu.edu/faculty_scholarship/640>
[11] Larry Hardesty, Explained: Neural Networks, MIT NEWS (Apr. 14, 2017), <http://news.mit.edu/2017/explained-neural-networks-deep-learning-0414> [<https://perma.cc/VTA6-4Z2D>].
[12] Natalie Wolchover, New Theory Cracks Open the Black Box of Deep Neural Networks, WIRED (Oct. 8, 2017), <https://www.wired.com/story/new-theory-deep-learningimages> [https://perma.cc/9A8L-LFTQ].
[https://perma.cc/UEL5-69ND].[13] Will Knight, Meet the Fake Celebrities Dreamed Up By AI, MIT TECH. REV. (Oct. 31, 2017), https://www.technologyreview.com/the-download/609290/meet-the-fake-celebrities-dreamed-up-by-ai [https://perma.cc/D3A3-JFY4].
[14] Ian J. Goodfellow et al., Generative Adversarial Nets (June 10, 2014) (Neural Information Processing Systems conference paper), <https://arxiv.org/abs/1406.2661> [https://perma.cc/97SH-H7DD] (introducing the GAN approach)
[15] Cade Metz & Keith Collins, How an A.I. ‘Cat-and-Mouse Game’ Generates Believable Fake Photos, N.Y. TIMES (Jan. 2, 2018), <https://www.nytimes.com/interactive/2018/01/02/technology/ai-generated-photos.html>
[16] Ashish Vaswani e al., Attention Is All You Need (NeurIPS 2017),
[17] OECD, Initial policy considerations for generative artificial intelligence (2023), <https://www.oecd.org/content/dam/oecd/en/publications/reports/2023/09/initial-policy-considerations-for-generative-artificial-intelligence_1a9ab450/fae2d1e6-en.pdf> e <https://consumer.ftc.gov/consumer-alerts/2024/04/fighting-back-against-harmful-voice-cloning>
[18] <https://www.europol.europa.eu/cms/sites/default/files/documents/EU-SOCTA-2025.pdf>
[19] <https://www.washington.edu/news/2017/07/11/lip-syncing-obama-new-tools-turn-audio-clips-into-realistic-video/>
[20] <https://consumer.ftc.gov/consumer-alerts/2024/04/fighting-back-against-harmful-voice-cloning>
[21] Alex Murray, National Crime Agency, UK, https://www.theguardian.com/technology/2024/nov/24/ai-increasingly-used-for-sextortion-scams-and-child-abuse-says-senior-uk-police-chief.
[22] K. Martin, AI Cyber Attack Statistics 2025, TechAdvisors, 27 maggio 2025, <https://tech-adv.com/blog/ai-cyber-attack-statistics/#:~:text=There%20were%2019%25%20more%20deepfake,a%202%2C137%25%20increase%20from%202022>
[23] On the qualitative leap of generative phishing and on AI’s growing capacity to make fraudulent content more credible, v. ENISA, Threat Landscape 2025, <https://www.enisa.europa.eu/sites/default/files/2026-01/ENISA%20Threat%20Landscape%202025_v1.2.pdf>; FBI, 2024 Internet Crime Report, <https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf>; FBI, Criminals Use Generative AI to Facilitate Financial Fraud, <https://www.ic3.gov/PSA/2024/PSA241203>; <https://www.enisa.europa.eu/sites/default/files/2026-01/ENISA%20Threat%20Landscape%202025_v1.2.pdf>
[24] APWG, Phishing Activity Trends Report, 2nd Quarter 2025, <https://docs.apwg.org/reports/apwg_trends_report_q2_2025.pdf>
[25] APWG, Phishing Activity Trends Report, 4th Quarter 2025, <https://docs.apwg.org/reports/apwg_trends_report_q4_2025.pdf>:
[26] ENISA, Threat Landscape 2025, <https://www.enisa.europa.eu/sites/default/files/2025-11/ENISA%20Threat%20Landscape%202025.pdf>
[27] Microsoft, Microsoft Digital Defense Report 2025, <https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf>
[28] FBI, Don’t Let Scammers Ruin Your Holiday Season, 2025, <https://www.fbi.gov/news/press-releases/dont-let-scammers-ruin-your-holiday-season>
[29] FBI, Criminals Use Generative AI to Facilitate Financial Fraud, <https://www.ic3.gov/PSA/2024/PSA241203>, che segnala l’uso di contenuti generativi per rendere più convincenti le frodi finanziarie.
[30] Federal Trade Commission, Fighting back against harmful voice cloning, <https://consumer.ftc.gov/consumer-alerts/2024/04/fighting-back-against-harmful-voice-cloning>, sul rischio di clonazione vocale e sulle risposte di tutela del consumatore.
[31] Hong Kong Police Force, comunicato stampa del febbraio 2025 sul contrasto a sindacati criminali che usavano deepfake e identità sintetiche in frodi online, con 58 arresti e perdite stimate vicino a HK$400 milioni, <https://www.police.gov.hk/ppp_en/03_police_message/pr/press-release-detail.html?refno=P202502110002>
[32] FBI, 2025 alert on virtual kidnapping and the use of altered images as false “proof of life”: <https://www.fbi.gov/investigate/cyber/alerts/2025/criminals-using-altered-proof-of-life-media-to-extort-victims-in-virtual-kidnapping-for-ransom-scams#:~:text=The%20Federal%20Bureau%20of%20Investigation,virtual%20kidnapping%20for%20ransom%20scams>
[33] <https://consumer.ftc.gov/consumer-alerts/2024/04/fighting-back-against-harmful-voice-cloning>
[34] <https://www.europol.europa.eu/cms/sites/default/files/documents/EU-SOCTA-2025.pdf>
[35] Sul nesso tra GenAI, sextortion e creazione o alterazione di immagini sessualmente esplicite, v. NCMEC, CyberTipline Data 2024, <https://www.ncmec.org/gethelpnow/cybertipline/cybertiplinedata>; NCMEC, Generative AI, <https://ncmec.org/netsmartz/topics/generative-ai>; NCMEC, 2024 in Numbers, <https://www.ncmec.org/blog/2025/ncmec-releases-new-data-2024-in-numbers>
[36] The Economist, L’intelligenza artificiale sta rivoluzionando l’industria del porno, in Internazionale, 30 gennaio 2026,https://www.internazionale.it/notizie/2026/01/30/amp/intelligenza-artificiale-porno
[37] NCMEC, CyberTipline Data 2024, <https://www.ncmec.org/gethelpnow/cybertipline/cybertiplinedata>: 20.5 million reports, equivalent to 29.2 million distinct incidents; more than 546,000 cases of online enticement, with +192% compared with 2023; NCMEC, 2024 in Numbers,<https://www.ncmec.org/blog/2025/ncmec-releases-new-data-2024-in-numbers>:an increase of 1,325% in reports involving Generative AI and almost 100 reports a day of financial sextortion; at least 36 adolescents dead by suicide since 2021 after sextortion victimization.
[38] https://www.theguardian.com/uk-news/2024/oct/28/man-who-used-ai-to-create-child-abuse-images-jailed-for-18-years
[39] Crown Prosecution Service, caso Hugh Nelson, <https://www.cps.gov.uk/cps/news/man-who-used-ai-technology-create-child-sexual-abuse-images-jailed>: an 18-year sentence for the creation with AI and 3D software of child-abuse images starting from ordinary photographs.
[40] Internet Watch Foundation, Annual Data & Insights 2024, <https://www.iwf.org.uk/annual-data-insights-report-2024/> e <https://www.iwf.org.uk/annual-data-insights-report-2024/data-and-insights/ai-generated-child-sexual-abuse/>: 245 reports relating to AI-generated images of child sexual abuse, with an increase of 380% compared with 2023.
[41] <https://www.cps.gov.uk/cps/news/man-who-used-ai-technology-create-child-sexual-abuse-images-jailed>
[42] <https://www.devita.law/fumetti-pedopornografia-cassazione/>
[43] M. Kosinski, What is black box artificial intelligence (AI)?, IBM, 29 ottobre 2024, https://www.ibm.com/think/topics/black-box-ai
[44] UCL – London’s Global University, ‘‘Deepfakes’ ranked as most serious AI crime threat’,
https://www.ucl.ac.uk/news/2020/aug/deepfakes-ranked-most-serious-ai-crime-threat; Europol Innovation Lab, Facing reality? Law enforcement and the challenge of deepfakes ,<https://www.europol.europa.eu/cms/sites/default/files/documents/Europol_Innovation_Lab_Facing_Reality_Law_Enforcement_And_The_Challenge_Of_Deepfakes.pdf>; Europol Newsroom, <https://www.europol.europa.eu/media-press/newsroom/news/europol-report-finds-deepfake-technology-could-become-staple-tool-for-organised-crime>; <https://www.nist.gov/publications/guardians-forensic-evidence-evaluating-analytic-systems-against-ai-generated-deepfakes>
[45] For further discussion of anti-forensics, see R. De Vita, V. Guerrrisi, A. Laudisa, M. Della Bruna, La prova digitale nel processo penale, DEVITALAW, 2 maggio 2025, pag. 281 e ss.
[46] <https://www.nist.gov/publications/guardians-forensic-evidence-evaluating-analytic-systems-against-ai-generated-deepfakes>
[47] https://www.europarl.europa.eu/RegData/etudes/STUD/2021/690039/EPRS_STU(2021)690039_EN.pdf
[48] Freeman 2021
[49] Ruff, 2021
[50] Cover, 2022; Langa, 2021; Sloot & Wagensveld, 2022a
[51] Al-Mulla, 2022; Delfino, 2022; Fallis, 2021; Mullen, 2021; Ruff, 2022
[52] <https://www.nist.gov/publications/guardians-forensic-evidence-evaluating-analytic-systems-against-ai-generated-deepfakes>
[53] Cover, 2022
[54] <https://www.nist.gov/publications/guardians-forensic-evidence-evaluating-analytic-systems-against-ai-generated-deepfakes>
[55] Europol, EU Serious and Organised Crime Threat Assessment (SOCTA) 2025, <https://www.europol.europa.eu/cms/sites/default/files/documents/EU-SOCTA-2025.pdf>; Regolamento (UE) 2024/1689 (AI Act), <https://eur-lex.europa.eu/legal-content/IT/TXT/PDF/?uri=OJ:L_202401689> ; Legge 23 settembre 2025, n. 132, <https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg>
[56] Regolamento (UE) 2024/1689 del Parlamento europeo e del Consiglio del 13 giugno 2024, <https://eur-lex.europa.eu/legal-content/IT/TXT/PDF/?uri=OJ:L_202401689> e Legge 23 settembre 2025, n. 132, <https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/SG>
[57] AI Act, art. 5, <https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5>
[58] AI Act, art. 50, <https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50> on transparency obligations for content generated or artificially manipulated, including deepfakes.
[59] https://digital-strategy.ec.europa.eu/it/library/digital-omnibus-regulation-proposal
[60] AI Act, art. 4, <https://ai-act-service-desk.ec.europa.eu/it/ai-act/article-4>
[61] AI Act, arts. 53 and 55, on obligations for general-purpose AI models and GPAI models with systemic risk: <https://ai-act-service-desk.ec.europa.eu/it/ai-act/article-53> e <https://ai-act-service-desk.ec.europa.eu/it/ai-act/article-55>
[62] <https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-53>
[63] Regolamento UE 2022/2065.
[64] Law 23 september 2025, n. 132, Art. 3, <https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg>
[65] Law 23 september 2025, n. 132, art. 4, https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg >
[66] Law 23 september 2025, n. 132, art. 15, <https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg>, which always reserves to the magistrate the decision on the interpretation and application of the law, on the assessment of facts and evidence, and on the adoption of measures.
[67] Law 23 september 2025, n. 132, art. 20, which designates AgID and ACN as national authorities for AI, and art. 24(2), on the conferral of powers of supervision, inspection, and sanction and on coordination with Article 99 AI Act. <https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg>,
[68] Law 23 september 2025, n. 132, art. 24, commi 3-5, <https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg>, on the delegation to the Government to adapt and specify the discipline of cases of unlawful creation and use of AI systems, with tools for inhibiting dissemination, removing content, and possible autonomous criminal offenses.
[69] Law 23 september 2025, n. 132, art. 26, <https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg>, che introduce l’aggravante comune per reati commessi mediante AI e il nuovo art. 612-quater c.p. “Illecita diffusione di contenuti generati o alterati con sistemi di intelligenza artificiale”.
In the contemporary digital space, falsehood is no longer an anomaly: it is a technique of influence, an economic factor, and an instrument of power. Fake news, manipulated reviews, synthetic content, and deepfakes act in an increasingly pervasive way on the formation of public opinion, on consumer choices, and on the very reliability of the information ecosystem. Online falsehood does not merely distort the truth, but constructs credible alternative realities, capable of shaping consensus, reputation, and the market. In this scenario, artificial intelligence amplifies the quantity, speed, and sophistication of manipulation, making the boundary between authenticity and artifice more subtle. What is at stake concerns not only the correctness of information or commercial fairness, but also the resilience of essential values such as transparency, trust, and freedom of choice. Countering these phenomena therefore means committing to the creation of legal, technological, and cultural forms of protection: defending truth as a public good in an environment in which deception can now be produced, disseminated, and monetized on an industrial scale.
Digital disinformation has assumed an unprecedented quantitative and qualitative dimension. Statistical data in fact highlight converging trends: the growing sophistication of fake news, the increase in content manipulated through artificial intelligence tools, the difficulty for users in distinguishing between authentic and synthetic content, and the high exposure of younger segments of the population to digital information flows.
According to the Reuters Institute for the Study of Journalism’s Digital News Report 2025, 58% of respondents globally believe that distinguishing between true and false information online has become increasingly difficult. In the same report, overall trust in the media averages around 32%, with strong differences between countries, while concern about the spread of online disinformation remains high in most of the areas analyzed, exceeding 50% in several European contexts and in the United States[1].
Similar evidence emerges from an international survey conducted in 2023 by UNESCO in collaboration with Ipsos, which shows that a large majority of Internet users globally declare that they have come into contact with fake news on social networks, with perceived impacts particularly in the fields of political and health information. The study finds that over 85% of respondents fear the political impact of disinformation, while 53% identify artificial intelligence as a factor amplifying the phenomenon. A significant share of users also acknowledge having difficulty distinguishing authentic content from manipulated content, especially when this is generated through artificial intelligence techniques [2].
In the European context, several studies indicate an increase in perceived exposure to disinformation, with some countries being particularly vulnerable to information manipulation campaigns. Among these, Italy is also frequently mentioned, where the spread of disinformation content appears particularly high compared to the European average [3].
According to a 2025 European Union Report, 82% of the European sample (86% of the Italian sample) believe they have been exposed to disinformation and fake news often or at least sometimes in the previous seven days. And although just over six respondents out of ten feel confident that they can recognize disinformation when they encounter it (61%), around three respondents out of ten do not trust their own ability to recognize disinformation [4].
Among younger generations, the phenomenon is even more significant. Studies on digital literacy and news consumption habits among young people show that social networks and online platforms are increasingly the main access channel to information, but also the place where young users are most exposed to non-verified, decontextualized, or deliberately manipulative content. [5]
In the Italian context, recent reports by Censis and other research centers confirm a widespread perception of the seriousness of the problem, but also a persistent underestimation of its effects by part of the population. If on the one hand many citizens declare themselves concerned about the spread of fake news, on the other hand a significant share still considers disinformation a secondary phenomenon or believes itself able to recognize it easily, despite empirical evidence suggesting otherwise [6].
To this must be added the increasingly visible role of artificial intelligence in accelerating the production of manipulative content. Recent analyses show a significant increase in information sites generated wholly or largely through automated systems, as well as a growing use of synthetic images and videos in the digital environment [7].
At the global level, numerous analyses highlight a significant increase in disinformation produced through generative artificial intelligence tools: the use of automatic language and image generation models has reduced the production costs of manipulated content, making possible the large-scale creation of false but highly plausible articles, images, and videos [8].
Data reported by Agência Brasil in 2026 indicate, for example, that in the Brazilian context disinformation content generated through artificial intelligence more than tripled between 2024 and 2025 [9]. Further analyses have been conducted by independent organizations such as NewsGuard, which has documented the proliferation of hundreds of websites automatically generated through artificial intelligence tools and designed to graphically imitate reliable news outlets. Such sites publish automatically or semi-automatically generated content, contributing to amplifying the spread of manipulated or unverified information in the digital space [10].
At the same time, a growing number of economic studies highlight the relevance of the phenomenon in the context of the digital market and the online reputation of businesses. Empirical analyses show that even minimal variations in the ratings of review platforms can produce economically significant effects on business revenues, confirming the role of digital reputation as a strategic asset in the platform economy. [11].
According to some international estimates, between 10% and 30% of online reviews may be manipulated or inauthentic, with significant effects on consumer behavior. Some also indicate that an artificial increase in the rating of a product or service can generate revenue increases of up to 15–20%, highlighting how reputational manipulation may alter not only the flow of information, but also the competitive balance of the market. [12].
These dynamics are further amplified by the growing spread of automation and content generation tools through artificial intelligence in the digital marketing sector; an exponential growth has been recorded in automated systems for generating reviews and comments, often used to simulate consensus or to artificially alter the appeal of products and services [13].
The qualitative leap of the phenomenon emerges with particular clarity in its growing geopolitical dimension: in recent years, in fact, numerous investigations have documented the existence of coordinated disinformation operations aimed at influencing electoral processes and political debates in various countries. Among these, the so-called “Operation Doppelgänger” has been widely analyzed, attributed to pro-Russian propaganda networks and based on the graphic replication of European information websites, on the coordinated dissemination of manipulated content relating to the conflict in Ukraine and to electoral consultations in different countries of the European Union [14].
The Institute for International Political Studies (ISPI) has stressed how fake news, generative artificial intelligence, and foreign interference now constitute forms of hybrid threat to liberal democracies, capable of affecting simultaneously informational security, public debate, and institutional stability [15].
n this context, recent episodes — such as the disinformation campaigns identified between 2024 and 2025 in Moldova on the occasion of major electoral consultations — show how information manipulation can be used as an instrument of geopolitical pressure and strategic influence [16]. According to the IDMO (European Digital Media Observatory) and the Microsoft Threat Analysis Center, the use of generative artificial intelligence is further expanding the capacity for producing and disseminating propagandistic and manipulated content, making influence operations increasingly sophisticated and difficult to detect [17].
In the initial phase of Internet development, disinformation was generally interpreted as an episodic distortion of the information flow, attributable to individual actors or to specific propaganda campaigns. However, the evolution of digital platforms and of economic models based on attention has progressively transformed this phenomenon into a structural component of the contemporary communicative ecosystem.
Today disinformation no longer constitutes a marginal anomaly of the information system, but rather a systemic dynamic closely connected to the functioning of digital infrastructures. The architecture of online platforms is in fact based on recommendation algorithms, user profiling systems, and economic models oriented toward maximizing engagement. In this context, content that arouses intense emotional reactions — indignation, fear, conflict — tends to be more strongly amplified by mechanisms of algorithmic distribution, favoring the spread of polarizing or manipulative narratives [18].
To this dynamic is added the growing impact of generative artificial intelligence, which has further reduced the costs of producing and distributing content. Automatic generation systems now make it possible to produce on a large scale plausible texts, images, and audiovisual products, often difficult to distinguish from authentic ones. Disinformation thus becomes replicable, adaptable, and customizable, since it can be modeled according to the recipient and disseminated through highly targeted campaigns [19].
The result is a qualitative mutation of the information ecosystem in which information asymmetry no longer concerns only individual relations between sender and recipient, but tends to affect the entire digital public space, changing the conditions under which opinions, economic decisions, and political choices are formed. Thus, the phenomenon contributes to the erosion of trust in institutions and in authoritative sources of information and can deeply affect the quality of public debate and the stability of democratic systems.
From this dual impact there progressively emerges a composite legal interest, which may be identified in the integrity of the information ecosystem. Protection cannot be entrusted exclusively to the traditional instruments of information law or competition law. Rather, it requires a multi-level regulatory approach, capable of integrating normative interventions, responsibilities of digital platforms, instruments of algorithmic transparency, and policies of “digital literacy.” In this context, the regulation of the information ecosystem appears destined to become one of the main fields of development of digital economy law and of the governance of online platforms.
The most recent developments, in this field and beyond, are closely connected to the development of generative artificial intelligence systems, capable of producing increasingly realistic textual, visual, and audiovisual content.
Generative models based on deep learning techniques, such as large language models and audiovisual synthesis systems, now allow the automated production of articles, images, voice recordings, and manipulated videos with such a degree of verisimilitude as to make the distinction between authentic content and artificially generated content extremely complex. In this context lies the phenomenon of so-called “deepfakes,” namely synthetic audiovisual content created through artificial intelligence techniques that make it possible to alter or recreate a person’s image and voice in an extremely realistic way [20].
The spread of these technologies introduces a new dimension: whereas in previous phases informational manipulation was based mainly on the selection and reinterpretation of real content, generative artificial intelligence now allows the creation of completely artificial informational events, making possible the large-scale production of plausible but entirely fictitious narratives. Recent studies highlight how such tools can also be employed within actual information manipulation campaigns, further amplifying the capacity for disinformation to spread in the digital environment [21].
In particular, the possibility of using AI to introduce into the network, in a massive manner, realistic images capable of imprinting themselves in users’ memory and becoming viral, may give rise to the so-called “Mandela effect”: a false collective memory in which different people remember the same incorrect details concerning events, images, or statements. An example of this effect, in relation to artificial intelligence, is the fake photo of Pope Francis wearing an enormous white Balenciaga coat, which became viral and entered the (false) collective imagination [57]. An effect that stems from the empirical and neuropsychological observation that memory (including autobiographical memory, made up of semantic and episodic recollections) retains traces of what was perceived and of emotional experience and progressively forgets the origin and source: the psychological truth prevailing over objective truth. A dynamic dramatically amplified by artificial intelligence and by the compulsive bulimia for digital content fueled by algorithms.
Faced with such risks, the European legislator has begun to introduce specific legal obligations aimed at ensuring greater transparency of artificially generated content. The European Artificial Intelligence Regulation (AI Act) provides, for example, that AI systems capable of generating synthetic content must adopt suitable measures to make such content clearly identifiable as artificial. In particular, providers of generative AI systems are required to inform users when they interact with content produced or manipulated by means of artificial intelligence [22].
These regulatory interventions reflect growing awareness: in the era of generative artificial intelligence, protecting the information ecosystem requires not only instruments to combat traditional disinformation, but also mechanisms capable of guaranteeing the traceability and recognizability of synthetic content. The challenge for contemporary law therefore lies in developing forms of regulation that make it possible to enhance the innovative potential of artificial intelligence without compromising the reliability of the information environment.
In the contemporary scientific and institutional debate, the phenomenon of fake news is increasingly analyzed through a conceptual distinction between misinformation, disinformation, and propaganda. Categories which, although sharing the element of untruthfulness or manipulation of information, differ in structure, purpose, and degree of intentionality.
Misinformation consists in the dissemination of false or inaccurate information circulating in the public space without a specific manipulative intent. In such cases, the falsity of the content often derives from interpretative errors, misunderstandings, or the unconscious reproduction of unverified news. The subjective element that characterizes misinformation is therefore the absence of intent: those who disseminate the content do not act with the aim of deliberately altering the informational process, but nonetheless contribute to the circulation of inaccurate or misleading content within the digital ecosystem [23].
Different is the case of disinformation, which arises when false information is disseminated knowingly and deliberately, with the objective of influencing perceptions, opinions, or collective behaviors. The qualifying element of disinformation may be identified in the intentional will to alter the perception of reality through manipulation of the information flow. In this sense, disinformation represents not merely a pathological deviation of the communicative process, but a true strategy of influence, capable of affecting the functioning of markets, public debate, and, in the most extreme cases, democratic processes [24].
Alongside these phenomena lies digital propaganda, which may be defined as the systematic and organized use of disinformation for political, ideological, or strategic purposes. Unlike episodic forms of informational manipulation, propaganda is characterized by the presence of organized structures, coordinated campaigns, and techniques of artificial amplification of content, often carried out through networks of automated accounts, coordinated influencers, or micro-targeting strategies. In the context of digital platforms, such dynamics take on particular relevance because the algorithmic architecture of recommendation systems tends to privilege content with a high capacity to generate engagement, that is, intense emotional interactions, polarization, and conflict [25].
A field in which such dynamics emerge with particular clarity is that of armed conflicts and hybrid wars, where fake news do not consist merely in the episodic dissemination of false content, but are inserted into broader strategies of influence and narrative manipulation. One may think, for example, of the already mentioned pro-Russian campaigns linked to operation “Doppelgänger,” based on the graphic cloning of European journalistic outlets and on the dissemination of content constructed to alter the perception of the conflict in Ukraine and to steer public debate in Union countries. Or one may look, in the context of the war between Israel and Hamas, at the circulation, especially in the days immediately following 7 October 2023, of stock images and videos taken from other theaters of war or from previous events, relaunched as though they documented in real time bombardments, attacks, or atrocities of the ongoing conflict, with the effect of maximizing the emotional impact of the news and steering public reaction in a polarized direction. Likewise, the delegitimization campaigns directed against humanitarian actors, as in the case of UNRWA, which denounced the systematic dissemination of false and manipulated information used as an instrument of war to discredit its work and indirectly hinder its humanitarian action [26].
An equally delicate field concerns disinformation campaigns directed against judges, magistrates, and judicial institutions. In various European contexts, the strategic dissemination of false or manipulated narratives has been used as an instrument of delegitimization of the judiciary, with the objective of undermining public trust in the impartiality of judicial bodies and, more generally, in the rule of law [27]. These phenomena are particularly relevant because they act on one of the essential presuppositions of constitutional democracies: citizens’ confidence in the independence and neutrality of those called upon to apply the law. In this perspective, media and digital smear campaigns may constitute an indirect pressure mechanism on the judiciary, capable of producing systemic effects not unlike those arising from more traditional forms of intimidation [28]. On a comparative level, the phenomenon has taken on particularly evident forms both in Eastern Europe — where there has been no shortage of organized smear campaigns against judges perceived as hostile to political power — and in the United States, where Chief Justice Roberts has expressly included disinformation and intimidation among the main contemporary threats to judicial independence [29]. As regards the judicial police, the qualitative leap brought about by deepfakes now makes it possible to fabricate synthetic audio and video suitable not only for fraud or impersonation, but also for discrediting investigators, casting doubt on the genuineness of investigative activities, or contaminating the informational context in which digital evidence is perceived and assessed, so much so that Europol considers the capacity to prevent and detect such content a strategic priority for law enforcement agencies [30].
Moreover, the algorithms that regulate the visibility of content on the main social platforms operate on the basis of attention-optimization and user-retention logics. As mentioned above, this economic model, founded on the so-called “attention economy” [31], tends inevitably to favor the dissemination of sensationalistic, emotionally polarizing, or controversial content, which is statistically more capable of generating shares, comments, and reactions [32].
A further manifestation of these dynamics can be observed when disinformation is grafted onto electoral competitions already exposed to criminal, clientelistic, or corrupt conditioning: in these contexts, fake news cease to be mere false content and become an instrument through which territorial control, opaque intermediation, and exchange of utilities are transferred onto the symbolic and reputational plane, altering the perception of candidates, delegitimizing opponents, and progressively restricting the space for public debate [33]. In this perspective, delegitimizing campaigns and support campaigns no longer appear as distinct phenomena, but as two sides of the same strategy of influence: the former aim to isolate candidates, administrators, journalists, or guarantee institutions through unfounded accusations, insinuations, or narratives of fraud; the latter construct around certain candidates an artificial consensus, simulating social rootedness, reliability, and the inevitability of the electoral outcome [34]. In the Italian context, the phenomenon emerges above all as a structural vulnerability of the local information environment: AGCOM has described disinformation as a measurable phenomenon of the national information system. In 2024 the Ministry of the Interior recorded 630 acts of intimidation against local administrators, an increase of 13.9 percent compared with the previous year, and the literature on the relationship between the mafia and electoral competition has shown, on the one hand, the electoral support assured in some contexts by mafia organizations and, on the other, the increase in violence against political figures close to the vote [35].
Outside the national context, Operation “Teatro Invisível” in Brazil concerned a criminal organization dedicated to disseminating false news about mayoral candidates in more than ten municipalities in the State of Rio de Janeiro, while the subsequent “Teatro Invisível II” linked that disinformation circuit to hypotheses of money laundering, procurement fraud, and destruction of digital evidence; in Moldova, several investigations brought to light large illicit Russian financing aimed at electoral manipulation, also through the strategic use and organized dissemination of fake news on Facebook, TikTok, and Telegram.
The overall result of this dynamic is a crisis of epistemic authority in the contemporary information ecosystem. This results in a growing difficulty for citizens and consumers in distinguishing reliable information from manipulated content, with relevant effects not only on the cultural and social level, but also on the legal and economic one [36].
A particularly significant phenomenon of disinformation in the digital economy is represented by false online reviews, which constitute a specific form of informational manipulation capable of directly affecting the mechanisms by which the market functions.
In the context of digital platforms, user reviews have assumed an increasingly relevant function in the construction of the commercial reputation of businesses, products, and services. They now represent one of the main tools through which consumers orient their economic choices, performing an informative function which, in fact, integrates or replaces traditional forms of advertising and commercial communication. According to numerous studies, a very high share of consumers systematically consults online reviews before making purchases or choosing services, attributing to such content a high degree of reliability [37].
It is precisely the economic centrality of digital reputation that has favored the spread of manipulative practices aimed at artificially altering public perception of products and services. Among the most widespread techniques are the publication of artificial positive reviews, aimed at improving a company’s reputation, and the dissemination of coordinated negative reviews, directed at damaging competitors. These phenomena fall within “astroturfing” strategies, that is, the artificial creation of apparent consensus through content presented as spontaneous but in reality orchestrated by interested parties [38].
Alongside astroturfing, the practice of so-called “review bombing” has also spread, consisting in the massive publication of coordinated negative reviews, often motivated not by actual consumer experiences but by organized campaigns with reputational, ideological, or commercial purposes. Such dynamics may significantly affect the visibility of products on digital platforms and, consequently, consumer choices [39].
The problem of false reviews assumes relevance not only on an ethical or informational level, but also on a legal and economic one, since it affects various interests protected by the legal system. First of all, manipulation of reviews alters the proper functioning of the digital market, producing distortive effects on competition among economic operators. Secondly, it compromises consumers’ right to receive truthful and transparent information, an essential element for the exercise of informed purchasing choices.
Precisely for these reasons, European law has progressively recognized the legal relevance of online reviews within the discipline of unfair commercial practices. Directive (EU) 2019/2161 — known as the Omnibus Directive — introduced specific transparency obligations for digital platforms, requiring traders who publish reviews to indicate whether and how it has been verified that such reviews come from consumers who have actually purchased or used the reviewed product or service [40].
In parallel, the Digital Services Act has imposed stricter obligations on online platforms regarding algorithmic transparency, management of illegal content, and responsibility in content moderation. Although the regulation does not specifically govern false reviews, it introduces legal instruments intended also to affect such phenomena indirectly, in particular through obligations of systemic risk management and greater accountability of digital platforms [41].
In the Italian legal system, any legal intervention regarding disinformation must necessarily confront the fundamental principle laid down in Article 21 of the Constitution, which recognizes everyone’s right to freely express their thoughts through speech, writing, and every other means of dissemination.
However, this freedom is not absolute in character, but encounters limits deriving from the need to protect other constitutional values of equal relevance, including the dignity of the person, individual reputation, and public order.
The exercise of freedom of information must nevertheless respect certain fundamental criteria, including the truthfulness of the facts reported, the relevance of the information, and expressive restraint. The balancing between freedom of expression and protection of reputation therefore represents one of the central junctions of information law.
In Italy, the legislation aimed at governing the fight against disinformation phenomena in the broad sense is not organic and unified. Protection is articulated rather through a plurality of legal instruments belonging to different sectors of the legal system, which operate on complementary levels.
On the one hand, the protections of the Consumer Code (Legislative Decree no. 206/2005) are certainly relevant, as regards misleading commercial practices under Articles 20 and following [42] , as is the legislation on unfair competition provided for by Article 2598 of the Civil Code, or civil liability for reputational damage. On the other hand, our legal system also provides for various hypotheses of potential criminal relevance of disinformation conduct.
One of the most frequent hypotheses is aggravated defamation by means of publicity, provided for by Article 595, paragraph 3, of the Criminal Code. This offense occurs when defamatory content is disseminated through means suitable for reaching an indeterminate number of persons, a category in which case law has also included digital platforms and social networks [43].
Where false news is capable of disturbing public order or generating alarm in the community, the offense of causing alarm to the authorities, provided for by Article 658 of the Criminal Code, may also arise. This provision has sometimes been invoked in relation to the dissemination of false information concerning health emergencies, catastrophic events, or situations of danger to public safety.
Disinformation may also assume criminal relevance in the economic-financial field. Article 185 of the Consolidated Law on Finance (TUF), in fact, punishes conduct of market manipulation, which may include the dissemination of false or misleading news capable of influencing the price of financial instruments.
In cases where disinformation campaigns are carried out through specific computer techniques, the offenses of fraud (Article 640 of the Criminal Code), impersonation (Article 494 of the Criminal Code), frequently associated with the creation of false profiles on social networks, as well as the offenses of unauthorized access to computer systems (Article 615-ter of the Criminal Code) and unlawful interference in digital communications (Articles 617-quater and 617-sexies of the Criminal Code) may be integrated. The offense of fraud, moreover, could also be hypothesized in relation to false online reviews, when such conduct is instrumental in obtaining an unjust profit.
However, none of these offenses is capable of guaranteeing unified protection (at least ex post) with respect to the broader and more multifaceted phenomenon described so far. The failure to introduce a specific sanctioning discipline is perhaps the symptom of a limited perception of the actual harmful scope of this set of conducts, which from time to time are analyzed and narrated individually in the news and in public debate.
In recent years, moreover, a process of rethinking the discipline relating to online reviews has begun. In particular, some legislative proposals — including the bill on small and medium-sized enterprises, definitively approved by the Senate on 4 March 2026 and awaiting publication [44] – have provided for the introduction of specific obligations of transparency and traceability of digital reviews, as well as the recognition of protective instruments such as the right of reply and the authentication of reviews published on platforms.
The growing institutional attention to the phenomenon of disinformation reflects an awareness that is by now widespread at the European and international level. In 2024 the Vice-President of the European Commission Věra Jourová defined the systemic spread of fake news as “a real danger to democracy,” underlining how informational manipulation represents one of the main challenges for protecting informational pluralism and for the proper functioning of contemporary democratic systems [45].
In recent years the European Union has adopted a series of regulatory instruments which, although pursuing different purposes, contribute to outlining an increasingly articulated normative system for governing digital platforms.
One of the pillars of this architecture is the Digital Services Act (DSA), Regulation (EU) 2022/2065, fully in force since 2024. The DSA introduces a set of progressive obligations for providers of digital services, with particular attention to Very Large Online Platforms (VLOPs) and large search engines. Among the most innovative elements of the regulation are obligations of transparency of recommendation algorithms, systems for reporting and removing illegal content, as well as the provision for periodic assessments of systemic risks connected to the functioning of platforms. Among such risks, the regulation expressly includes the dissemination of disinformation and the manipulation of democratic processes [46].
Alongside the DSA stands the Digital Markets Act (DMA), Regulation (EU) 2022/1925, which addresses the problem of concentration of economic power in the digital platforms sector. The DMA introduces specific obligations for so-called gatekeepers, namely the large platforms that control digital infrastructures essential for access to online markets. Although the regulation is primarily oriented toward protecting competition, it also affects indirectly the circulation of information in the digital environment, by imposing limits on self-preferencing practices and strengthening interoperability among digital services [47].
In parallel, the European Union has strengthened consumer protection in the context of digital commerce through Directive (EU) 2019/2161, known as the Omnibus Directive. This act, in amending the discipline of unfair commercial practices and consumer rights, introduces specific transparency obligations relating to online reviews. In particular, traders who publish reviews must indicate whether and how it has been verified that such reviews come from consumers who have actually used or purchased the reviewed product or service. The dissemination of false or manipulated reviews may therefore constitute a misleading commercial practice, with consequent legal responsibilities [48].
More recently, the European regulatory framework has been further broadened by the adoption of the Artificial Intelligence Regulation (AI Act), approved in 2024. Although not specifically dedicated to the phenomenon of disinformation, the AI Act introduces important transparency obligations for artificial intelligence systems capable of generating synthetic content, including images, audio, and realistic videos commonly defined as deepfakes. The regulation provides, in fact, that such content must be clearly identifiable as artificially generated, in order to prevent it from being used to manipulate public opinion or disseminate misleading information [49].
Taken together, these normative instruments outline a significant transformation of European law regarding digital platforms. Whereas in the initial phase of Internet development regulation had concentrated mainly on intermediary liability and on the freedom of circulation of information, the new European regulatory framework appears increasingly oriented toward protecting the integrity of the digital information ecosystem.
From this perspective, the regulation of platforms no longer concerns only the removal of illegal content, but extends to the management of systemic risks connected to the functioning of digital infrastructures, including disinformation, algorithmic manipulation, and distortions of the digital market. The European Union therefore appears to pursue a regulatory model that aims to balance technological innovation with the protection of the fundamental values of the European legal order, including freedom of expression, consumer protection, fair competition, and the proper functioning of democratic processes.
Despite the presence of civil, administrative, and criminal regulatory instruments suitable for repressing some forms of informational manipulation, the effectiveness of judicial action often stops in the face of structural obstacles of an evidentiary and practical nature.
One of the main critical factors, in fact, is represented by the anonymity or pseudonymization of users online. Digital platforms in fact allow the creation of accounts through non-verifiable or easily falsifiable identities, making it more difficult to identify with certainty the subjects responsible for the dissemination of unlawful content. The use of fictitious digital identities, coordinated profiles, or temporary accounts often allows the authors of disinformation campaigns to operate without leaving traces easily attributable to their real identity [50].
A further element of complexity is represented by the growing use of bots and automated systems for disseminating content. In such cases, reconstructing individual responsibilities becomes particularly complex, since the dissemination of content occurs through distributed technological infrastructures and at times is difficult to trace back to specific legal subjects [51].
To the technical difficulties are added, moreover, problems of a territorial and jurisdictional nature. Digital platforms operate on a global scale and content may be generated, hosted, and disseminated through servers located in different States. This transnational dimension makes it more complex to identify the competent jurisdiction and to apply effectively the instruments of international judicial cooperation, especially in cases where the subjects involved operate from countries with different regulations or with limited mechanisms of judicial collaboration [52].
The analysis of the legal, technological, and economic profiles of disinformation highlights how the fight against such phenomena cannot be entrusted exclusively to traditional repressive instruments. The systemic nature of the digital information ecosystem, characterized by algorithmic intermediation, the globality of platforms, and the speed of dissemination of content, requires a structural and multi-level approach, capable of integrating normative, technological, and cultural instruments.
From this perspective, strengthening policies to combat disinformation must necessarily move along several complementary directions.
A first field of intervention concerns the strengthening of transparency obligations for digital platforms. The growing centrality of algorithms in the selection and distribution of content makes it in fact necessary to develop more advanced mechanisms of transparency and responsibility with respect to the criteria that determine the visibility of information online. In this direction move the initiatives of European regulations introducing obligations of algorithmic accountability, requiring large digital platforms to assess and mitigate the systemic risks connected to the dissemination of disinformation content [53].
A second profile concerns the greater reliability of online reviews, which today represent one of the most influential tools in the formation of consumption decisions. The introduction of Step-up Authentication systems or other advanced mechanisms for verifying users’ identities could help reduce the spread of false or manipulated reviews, and this would make it possible to strengthen the link between digital identity and published content, increasing the traceability of online interactions.
Alongside such instruments, systems of certification of informational sources may also be accompanied, capable of providing users with reliable indicators on the origin and reliability of content. A further strategic element consists in promoting independent information verification systems (fact-checking), which may operate in a transparent and verifiable way also with respect to online reviews and user-generated content. Such mechanisms, if adequately structured and independent, may contribute to strengthening the quality of public debate and to reducing the spread of false or misleading information [54].
In parallel, strengthening policies of digital education and media literacy of individual citizens assumes a fundamental role. The ability to recognize manipulated content, verify sources, and understand the functioning of algorithms represents, in fact, one of the most effective tools for preventing disinformation. Numerous international institutions have highlighted how promoting digital culture constitutes an essential element for the resilience of democratic societies against informational manipulation campaigns [55].
Finally, a central role in reform perspectives is represented by the growing attention to the principles of algorithmic accountability. The algorithms that regulate the distribution of content on digital platforms significantly influence the visibility of information and the formation of public opinion. The possibility of subjecting such systems to forms of independent audit and regulatory verification represents one of the most promising tools for ensuring greater transparency and responsibility in the digital information ecosystem [56].
More than the spread of falsehood in itself, what today causes concern is the inadequacy of the legal system (Italian and European) to govern it in an organic way. There is still no unified discipline capable of preventing informational manipulation ex ante and, at the same time, countering its effects ex post with instruments effective and coherent with the nature of the phenomenon. The current system remains fragmented, episodic, entrusted to scattered rules and to remedies that are often tardy with respect to the speed with which deceptive content spreads, becomes established, and produces damage. Thus, while technology industrializes deception, the law too often continues to chase after it without fully understanding it. It is precisely in this asymmetry that the weakness of the public response is measured: there is not only a lack of an adequate sanction, there is a lack of an overall normative vision. As long as this gap persists, fake news and manipulations will continue to prosper in the cracks of a system that, rather than preventing the phenomenon, suffers its evolution.
Prof. Avv. Roberto De Vita
Avv. Giada Caprini
Avv. Marco Della Bruna
[1] Reuters Institute, Digital News Report 2025, <https://www.digitalnewsreport.org>
[2] UNESCO – Ipsos, Survey on the Impact of Online Disinformation and hate speech, 2023, <https://www.unesco.org/sites/default/files/medias/fichiers/2023/11/unesco_ipsos_survey.pdf>
[3] European Commission, Tackling Online Disinformation: A European Approach, <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52018DC0236>
[4] https://europa.eu/eurobarometer/surveys/detail/3592
[5] <https://drive.google.com/file/d/1KwGqR4cB8Yg03YPbfSTXBIe-U_EaJ2s6/view> e
[6] Ital Communications – Censis, Disinformazione e fake news in Italia, 2023, <https://italcommunications.it/wp-content/uploads/2025/01/Rapporto-ItalCommunications-Censis-2023.pdf>;
[7] Infodata – Il Sole 24 Ore, <https://www.infodata.ilsole24ore.com/2025/12/11/per-tre-persone-su-dieci-la-disinformazione-non-e-un-grosso-problema-ed-e-questo-il-problema/?refresh_ce=1>
[8] European Parliament Research Service, Artificial Intelligence and Disinformation, <https://www.europarl.europa.eu>
[9] Agência Brasil, analisi sull’aumento di contenuti generati da IA nel 2026, <https://agenciabrasil.ebc.com.br>
[10] NewsGuard, AI-Generated News Sites Report, <https://www.newsguardtech.com>
[11] Luca M., Zervas G., Fake It Till You Make It: Reputation, Competition, and Yelp Review Fraud, Harvard Business School.
[12] OECD, Online Consumer Reviews: The Case of Fake Reviews and Consumer Protection, <https://www.oecd.org>
[13] Duivenvoorde, Generative AI and the future of marketing: A consumer protection perspective, Computer Law & Security Review 57, luglio 2025, <https://www.sciencedirect.com/science/article/pii/S2212473X25000148>
[14] EUvsDisinfo – Doppelgänger Campaign Analysis, <https://euvsdisinfo.eu/tag/doppelganger/?numberposts=20>
[15] ISPI, Disinformazione e minacce ibride alle democrazie, <https://www.ispionline.it>
[16] Investigative reports on disinformation campaigns in Moldova (2024–2025).
[17] IDMO – Microsoft Threat Analysis Center, Generative AI and Information Manipulation.
[18] S. Vosoughi, D. Roy, S. Aral, The Spread of True and False News Online, Science, 2018,
[19] European Parliamentary Research Service, Information manipulation in the age of generative artificial intelligence (2025), <https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/779259/EPRS_BRI(2025)779259_EN.pdf>
[20] Chesney, D. Citron,Deepfakes and the New Disinformation War, Foreign Affairs (2019), <https://www.foreignaffairs.com/articles/world/2018-12-11/deepfakes-and-new-disinformation-war>
[21] European Parliamentary Research Service, Tackling deepfakes in European policy (2021), <https://www.europarl.europa.eu/thinktank/en/document/EPRS_STU(2021)690039>
[22] Parlamento europeo, Artificial Intelligence Act – normativa europea sull’intelligenza artificiale, <https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence>
[23] UNESCO, Journalism, Fake News and Disinformation. Handbook for Journalism Education and Training (2018),
<https://unesdoc.unesco.org/ark:/48223/pf0000265552>
[24] European Commission, Tackling Online Disinformation: A European Approach (2018), <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52018DC0236>
[25] European Commission, Code of Practice on Disinformation (2022), <https://digital-strategy.ec.europa.eu/en/policies/code-practice-disinformation>
[26] Cfr. EEAS, “Doppelganger strikes back: FIMI activities in the context of the EE24”, 2024, <https://euvsdisinfo.eu/uploads/2024/06/EEAS-TechnicalReport-DoppelgangerEE24_June2024.pdf>; EDMO, “Disinformation about Israel/Hamas conflict flooded the EU in October”, 2023, <https://edmo.eu/wp-content/uploads/2023/09/EDMO-29-Horizontal-FCB-updated.pdf>; European Commission, “Commission opens formal proceedings against X under the Digital Services Act”, 18 dicembre 2023, <https://digital-strategy.ec.europa.eu/en/news/commission-opens-formal-proceedings-against-x-under-digital-services-act>; UNRWA, “The spread of misinformation & disinformation continues to be used as a weapon of war in Gaza”, 2024, https://www.unrwa.org/newsroom/official-statements/spread-misinformation-disinformation-continues-be-used-weapon-war-gaza>.
[27] Cfr. OHCHR, “A/75/172: Disciplinary measures against judges and the use of “disguised” sanctions” (2020), <https://www.ohchr.org/en/documents/thematic-reports/a75172-disciplinary-measures-against-judges-and-use-disguised-sanctions>; v. anche ENCJ, “Statement by the Executive Board of the ENCJ On Pressure and Intimidation of Judges through Media”, 17 dicembre 2025, <https://obt-jud.hu/en/statement-executive-board-encj-pressure-and-intimidation-judges-through-media>
[28] Corte EDU, Grande Camera, “Morice v. France”, 23 aprile 2015, <https://hudoc.echr.coe.int/eng?i=001-154265>
[29] OKO.press, “Smear campaign coordinated by the Ministry of Justice, aimed to discredit Polish judges, discovered” (2019), <https://oko.press/why-did-the-polish-deputy-minister-of-justice-resign-everything-you-need-to-know-about-the-piebiak-scandal> e Supreme Court of the United States, “2024 Year-End Report on the Federal Judiciary”, <https://www.supremecourt.gov/publicinfo/year-end/2024year-endreport.pdf>
[30] Europol, “Facing reality? Law enforcement and the challenge of deepfakes”, <https://www.europol.europa.eu/publications-events/publications/facing-reality-law-enforcement-and-challenge-of-deepfakes>; v. anche Europol, “Europol report finds deepfake technology could become staple tool for organised crime”, 28 aprile 2022, <https://www.europol.europa.eu/media-press/newsroom/news/europol-report-finds-deepfake-technology-could-become-staple-tool-for-organised-crime>
[31] L’economia dell’attenzione e il paradosso che sta uccidendo i giornali, <https://www.feltrinellieducation.it/magazine/l-economia-dell-attenzione-e-il-paradosso-che-sta-uccidendo-i-giornali>
[32] Shoshana Zuboff, The Age of Surveillance Capitalism, PublicAffairs, 2019; v. anche Reuters Institute, Digital News Report 2024, <https://www.digitalnewsreport.org>
[33] Council of Europe, “Information Disorder: Toward an interdisciplinary framework for research and policy making”, <https://edoc.coe.int/en/media/7495-information-disorder-toward-an-interdisciplinary-framework-for-research-and-policy-making.html> ); International IDEA – Clingendael Institute, “Protecting Politics: Deterring the Influence of Organized Crime on Elections”, <https://www.idea.int/publications/catalogue/protecting-politics-deterring-influence-organized-crime-elections>
[34] Council of Europe, “Information Disorder”, cit.; International IDEA – Clingendael Institute, “Protecting Politics”, cit., che descrive le modalità attraverso cui la criminalità organizzata interferisce nei processi elettorali.
[35] AGCOM, “News vs. Fake nel sistema dell’informazione”, <https://www.agcom.it/pubblicazioni/rapporti/news-vs-fake-nel-sistema-dellinformazione-interim-report-indagine>; Ministero dell’interno, “Atti intimidatori nei confronti degli amministratori locali”, <https://www.interno.gov.it/it/stampa-e-comunicazione/dati-e-statistiche/atti-intimidatori-nei-confronti-amministratori-locali> e “Report anno 2024”, <https://www.interno.gov.it/sites/default/files/2025-04/report_atti_intimidatori_amm_locali_anno_2024.pdf>; G. De Feo, G. De Luca, “Mafia in the Ballot Box”, in American Economic Journal: Economic Policy, https://www.aeaweb.org/articles?id=10.1257%2Fpol.20150551; A. Alesina, S. Piccolo, P. Pinotti, “Organized Crime, Violence, and Politics”, in The Review of Economic Studies, <https://academic.oup.com/restud/article/86/2/457/5060718>
[36] C. Wardle, H. Derakhshan, Information Disorder: Toward an interdisciplinary framework for research and policy making, Council of Europe (2017), <https://edoc.coe.int/en/media/7495-information-disorder-toward-an-interdisciplinary-framework-for-research-and-policy-making.html>
[37] OECD, Online Consumer Reviews: The Case of Fake Reviews and Consumer Protection (2019),
<https://www.oecd.org/competition/consumer-policy/fake-reviews.htm>
[38] European Commission, Behavioural Study on Misleading Online Reviews (2020),
<https://op.europa.eu/en/publication-detail/-/publication/9f9b6d2a-0f0e-11ea-8c1f-01aa75ed71a1>
[39] M. Luca, G. Zervas, Fake It Till You Make It: Reputation, Competition, and Yelp Review Fraud, Harvard Business School Working Paper (2016), <https://www.hbs.edu/faculty/Pages/item.aspx?num=51974>
[40] Direttiva (UE) 2019/2161 del Parlamento europeo e del Consiglio (Omnibus Directive), <https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX:32019L2161>
[41] Regolamento (UE) 2022/2065 – Digital Services Act, <https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX:32022R2065>
[42] On which the Italian Competition and Market Authority (AGCM) has jurisdiction. In parallel, independent authorities play an increasingly relevant role in combating online disinformation practices. In particular, the Communications Regulatory Authority (AGCOM) exercises supervisory functions in matters of informational pluralism and regulation of digital platforms, also intervening with guidelines and monitoring tools relating to the dissemination of disinformation content in the digital space.
[43] Cass. Pen., Sez. V, 8 giugno 2015, n. 24431.
[44] Senate Act no. 1484-B definitively approved on 4 March 2026 and awaiting publication, <https://www.senato.it/service/PDF/PDFServer/BGT/01496644.pdf> <https://www.senato.it/export/ddl/full/59139>
[45] European Commission – statements by Vice-President Věra Jourová on disinformation,<https://digital-strategy.ec.europa.eu/it/news/vice-president-jourova-mission-canada-discuss-issues-related-disinformation-and-foreign>
[46] Regulation (EU) 2022/2065 of the European Parliament and of the Council – Digital Services Act, <https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX:32022R2065>
[47] Regulation (EU) 2022/1925 of the European Parliament and of the Council – Digital Markets Act, <https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX:32022R1925>
[48] Directive (EU) 2019/2161 of the European Parliament and of the Council – Omnibus Directive, <https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX:32019L2161>
[49] European Parliament – Artificial Intelligence Act (AI Act), <https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence>
[50] Council of Europe, Information Disorder: Toward an Interdisciplinary Framework for Research and Policy Making (Wardle, Derakhshan, 2017), <https://rm.coe.int/information-disorder-report/1680762772>
[51] Ferrara E. e al., The Rise of Social Bots, Communications of the ACM, 2016, <https://cacm.acm.org/research/the-rise-of-social-bots/>
[52] Council of Europe, Budapest Convention on Cybercrime, <https://www.coe.int/en/web/cybercrime/the-budapest-convention>
[53] Regulation (EU) 2022/2065 – Digital Services Act, <https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX:32022R2065>
[54] European Commission, Code of Practice on Disinformation (2022), <https://digital-strategy.ec.europa.eu/en/policies/code-practice-disinformation>
[55] UNESCO, Media and Information Literacy: Policy and Strategy Guidelines, <https://www.unesco.org/en/media-information-literacy>
[56] European Parliamentary Research Service, A governance framework for algorithmic accountability and transparency, <https://www.europarl.europa.eu/thinktank/en/document/EPRS_STU(2019)624262>
[57] S. Wells, The Mandela effect tricks our brains with false memories. Is AI making it worse?, National Geographic, 04.08.2025, <https://www.nationalgeographic.it/tutto-cio-che-sappiamo-sull-effetto-mandela-dai-falsi-ricordi-all-impatto-dell-intelligenza-artificiale>
“Crimes against the Public Administration, anti-corruption legislation and control systems in the EU and Italy“: the lectures of Prof. Avv. Roberto De Vita ‘s class for the 39th Qualification Course “Economic Financial Investigator” at the Guardia di Finanza School of Economic and Financial Police begin today.
abuse of office
trafficking in unlawful influence
Our new book “Encrypted evidence in the criminal trial” is now available on Amazon in Kindle format.

A monographic in-depth analysis of the most complex issue facing digital evidence and criminal proceedings.
Cryptography has become a structured and indispensable component of the digital dimension of society and individual relationships—no longer a tool reserved for a few, but a fundamental element for all.
In Italy, criminal investigations and trials, which are well-structured around testimonial evidence, fail when faced with encrypted evidence, unable to resolve the dilemma between the right to remain silent and the obligation to surrender encryption keys.
In the United States, as well as in the United Kingdom, France, and Belgium, laws and precedents reflect the critical conflict between the privilege against self-incrimination and the impenetrability of cryptographic systems. With numerous references to case law (Italian, supranational, and foreign), legal doctrine, and legislative texts, this work explores the complexities through both a phenomenological and comparative lens.
Buy the book on Amazon.
Article by Prof. Avv. Roberto De Vita published on no. 2/2025 of the Rassegna dell’Arma dei Carabinieri (Carabinieri’s Review).
L’operazione investigativa franco-olandese che ha portato alla raccolta massiva di dati da parte di autorità europee ha stimolato una varia e corposa produzione giurisprudenziale. Al tempo stesso, si è acceso il dibattito sulla materia dell’acquisizione di comunicazioni cifrate da dispositivi criptati e sulle relative implicazioni sui temi del contraddittorio e del controllo giurisdizionale, che ha stimolato numerose riflessioni critiche sul bilanciamento tra efficacia investigativa e garanzie difensive. Infatti, a partire dai casi EncroChat e Sky-ECC, si sono succedute pronunce sovranazionali e nazionali, dalla sentenza della Corte di Giustizia dell’Unione Europea sul caso EncroChat, che ha definito i criteri di legittimità per l’emissione e l’utilizzo dell’Ordine Europeo di Indagine (OEI), fino alle sentenze “gemelle” delle Sezioni Unite della Cassazione del 2024, che hanno indirizzato la recente giurisprudenza italiana e le attività di Autorità Giudiziaria, Polizia giudiziaria, avvocati e consulenti.
The Franco-Dutch investigative operation that led to the mass collection of data by European authorities has triggered a wide and substantial case law. At the same time, it has sparked a debate on the acquisition of encrypted communications from secure devices and its implications on adversarial proceedings and judicial oversight. This debate has prompted numerous critical reflections on the balance between investigative effectiveness and the protection of defendants’ rights. Starting from the EncroChat and Sky-ECC cases, both supranational and national rulings have followed — from the judgment of the Court of Justice of the European Union on the EncroChat case, which established the legitimacy criteria for the issuance and use of the European Investigation Order (EIO), to the 2024 “twin” rulings of the Italian Supreme Court’s United Sections, which have shaped recent Italian case law and the practices of judicial authorities, law enforcement, lawyers, and technical consultants.
Sommario: 1. The EncroChat case. – 2. The ruling of the European Union Court of Justice. – 3. National cases: from EncroChat to Sky-ECC. – 4. The twin rulings of the United Sections of the Court of Cassation.
The constant technological evolution of encryption systems protecting digital devices has significantly increased, in recent years, the importance of issues related to the methods used to acquire the data stored on them.
In the European context, particular relevance has been given to the judgment delivered on April 30, 2024, by the Court of Justice of the European Union in case C-670/22 – M.N. (EncroChat), following questions referred by a German court (Landgericht Berlin). The case primarily concerned the legitimacy of European Investigation Orders (EIOs) issued by the German Public Prosecutor’s Office to France, requesting data from the EncroChat messaging application collected by French authorities, to be used in criminal proceedings in Germany.
The case[1] stems from a lengthy investigative operation, following which—in 2020—the police forces and judicial authorities of France and the Netherlands (supported by Europol and Eurojust) announced they had dismantled the encrypted communication network in question, which was primarily used by organized criminal groups. During the investigation, millions of messages exchanged via the platform were intercepted and analyzed in real time.
The distinctive feature of these messaging systems lay in the ability to purchase subscriptions (costing thousands of euros) for the use of modified devices provided by vendors, equipped with features designed to reduce traceability. These included the disabling of microphones, GPS, and cameras, automatic deletion of sent messages after just a few seconds, and more. Additionally, users could enable a “dummy mode” that made the phone appear as a standard Android device, as well as a “panic button” to immediately erase the entire contents of the device[2].
Starting from an operation carried out on an EncroChat server located in Roubaix, France, investigators developed a trojan malware that was first injected into the server and then into users’ devices, disguised as an operating system update. Out of 64,134 registered users, 32,477 accounts from 122 different countries were monitored. Among these, 380 were located in France and as many as 4,600 in Germany. Thanks to the chats extracted from EncroChat and those obtained in a similar operation involving Sky-ECC servers in Belgium, over one hundred members of drug trafficking organizations have recently been convicted in Belgium[3].
Through this operation, between April and June 2020, French authorities were able to collect various types of data: device IMEI codes, users’ email addresses, date and time of communications, the location of the antennas used to access the network, as well as the textual and multimedia contents of ongoing conversations. They also managed to access the entire memory of the intercepted devices, including messages sent before the start of the investigation that had not yet been deleted. These actions led to numerous arrests[4], even in countries that had not been directly involved in the investigation but where the use of encrypted phones was particularly widespread among criminal organizations. The interception operation concluded on June 13, 2020, when EncroChat realized its systems had been compromised and sent an alert message to all its users.
The defendant in the case brought before the CJEU was also a user of the platform, which he used to manage drug trafficking operations. He faced fourteen charges related to drug dealing and four for possession of narcotics, including 188 kilograms of marijuana and 3.5 kilograms of cocaine, all within the period between April and May 2020. The proceedings were initiated after the BKA (Bundeskriminalamt)[5] acquired data related to German users, obtained through cooperation with the joint Franco-Dutch investigative team. Only at a later stage did the German authorities issue a European Investigation Order (EIO) to officially use the data provided by the Gendarmerie as part of their investigation.
Since this method of data acquisition was considered to conflict with the safeguards provided by German and European law, the Regional Court of Berlin deemed it appropriate to refer the matter to the Court of Justice of the European Union to assess its legality and admissibility.
In its judgment, the CJEU based its reasoning on the provisions of Directive 2014/41/EU[6] concerning the European Investigation Order (EIO) in criminal matters.
First, the Court focused on the authority competent to issue an EIO aimed at obtaining the transmission of evidence already in the possession of the competent national authorities. It clarified that this authority does not necessarily have to be a judge, provided that this is in accordance with the legal provisions of the issuing Member State. In Germany, for instance, an order for the transmission of already collected data may be issued by a public prosecutor—unlike an order for data interception, which must be issued by a judge. In the case at hand, therefore, a public prosecutor could validly issue an EIO requesting the transmission of EncroChat data already gathered by the executing State (in this instance, the French authorities).
Secondly, the public prosecutor may issue an EIO for the transmission of evidence already held by the authorities of the executing State, even if such evidence was obtained through the interception of encrypted telecommunications by the authorities of the issuing State, as long as the investigative order complies with all conditions that may be required under the law of the issuing State for the transmission of such evidence in a purely domestic case.
Where such a measure is not permitted in a comparable domestic case, the notification allows the competent authority of the notified State to indicate that the interception cannot be carried out or must be terminated, or, where applicable, that the material already intercepted cannot be used or may only be used under certain conditions. This not only ensures respect for the sovereignty of the notified State, but also safeguards the rights of individuals involved in the interception.
Finally, the Court stated that the obligation to exclude information and evidence obtained in breach of EU law requirements arises only if a court concludes that the EIO was issued unlawfully. In any case, the rules concerning the admissibility of evidence and the assessment of information in criminal proceedings fall within national law. However, the rights of the defence and the right to a fair trial must be guaranteed: if a defendant is unable to examine or challenge important information or evidence obtained through the EIO, and such evidence is likely to have a decisive influence on the facts and on the judge’s decision, it must be excluded from criminal proceedings by national courts.
In Italy, the Court of Cassation reviewed a decision by the Rome Tribunal, which had rejected a defendant’s request to disclose the methods used by the police to acquire and decrypt data from Sky-ECC[7], a platform based on encrypted phones similar to EncroChat[8].
The Tribunal had argued that, since the material had been obtained by Europol and foreign judicial authorities on the basis of a European Investigation Order (EIO), the information could be used without further verification, relying on the presumption that the interception had been carried out lawfully.
The Court of Cassation, however, ruled that encrypted messages obtained by Europol and foreign authorities could not be used unless prosecutors explained how such evidence had been acquired.
According to the Court, the principle of adversarial proceedings implies a dialectical process that concerns not only the content of the acquired material, but also the methods by which it was obtained. Therefore, the defendant should be able to challenge not only the substance of the evidence, but also the process of its acquisition, in order to ensure the full right to defense and to assess the relevance, reliability, and probative value of the evidence[9].
However, following that ruling, in 2023 the same Italian Court of Cassation issued other judgments concerning encrypted communication platforms such as Sky-ECC and EncroChat, departing from the aforementioned principles. Instead, it confirmed the validity and admissibility of data acquired in criminal proceedings through European Investigation Orders (EIOs), adopting a stance aimed at preserving investigative results rather than upholding guarantees related to adversarial scrutiny of evidence acquisition methods[10].
In particular, the twin rulings of 2024 (nos. 23755 and 23756) established a series of legal principles regarding European Investigation Orders (EIOs) and the cross-border transmission of evidence within the Union—principles that may serve as an important interpretive benchmark, at least within Italy[11].
Regarding the legal classification, the Court clarified that such operations cannot be considered as a “seizure of documents and computer data stored abroad” (Article 234-bis of the Italian Code of Criminal Procedure). This provision was deemed incompatible with the legal framework governing the EIO, as it does not entail any form of cooperation with judicial authorities of other States. Furthermore, Recital 35 of the Directive explicitly states that the EIO takes precedence over any other international instrument applicable in the same field.
As a result, when relying on the EIO, the guarantees provided for the collection of evidence through this instrument must be respected. Chief among these is the principle of equivalence, which requires that the investigative act requested through an EIO must be admissible under the same conditions as would apply in a comparable domestic case. Another key element is the principle of proportionality, which demands that any restrictions on fundamental rights be limited strictly to what is necessary, without undermining their essential content.
The central issue concerns the application of these principles to evidence already independently collected by foreign authorities, which was gathered in accordance with the laws of the country of origin, rather than following the procedural rules of the domestic legal system.
Since neither the Directive nor Legislative Decree No. 108 of 21 June 2017[12] (which implemented the EIO by transposing the Directive) provides specific guidance on this matter, the relevant legal reference becomes Article 78 of the implementing provisions of the Italian Code of Criminal Procedure. This article governs the acquisition of documentation relating to acts carried out by a foreign judicial authority within a criminal proceeding, according to Article 238 of the Code of Criminal Procedure (which regulates the transfer of evidence from one proceeding to another within the same legal system). Although originally conceived at a time when the only international cooperation tool for evidence gathering was the letter rogatory, this provision is considered applicable to the EIO as well.
From this rule, the Italian Supreme Court’s United Sections derived a general principle that underpins their entire reasoning: in cases involving evidence already collected abroad prior to the issuance of the EIO, equivalence with domestic proceedings must not be assessed based on how the evidence was formed, but rather in terms of how it circulates between different proceedings.
It follows that, according to the Court of Cassation, the only evidentiary rules relevant to the acquisition in Italy of evidence gathered abroad are those provided under Article 238 of the Italian Code of Criminal Procedure (c.p.p.), as referenced by Article 78 of its implementing provisions. Additionally, if the evidence was obtained through wiretapping or interceptions, Article 270 c.p.p., which governs the use of intercepted communications in other proceedings, also applies[13].
The United Sections of the Court further ruled out the need for prior judicial authorization from the issuing State when an EIO is used to acquire encrypted communications that have already been autonomously collected abroad.
If, at the national level, the transfer of evidence between proceedings does not require prior judicial authorization, then the same principle applies to the EIO. In fact, neither Article 238 nor Article 270 c.p.p. imposes such a requirement.
By virtue of the principle of equivalence, the Court of Cassation thus held that an EIO of this kind may be issued directly by the public prosecutor, even when the evidence has been collected abroad through interceptions or the acquisition of call data records.
This conclusion is also supported by the judgment of the Court of Justice in the EncroChat case[14], which confirmed that the public prosecutor is among the authorities authorized to issue an EIO, provided they are competent, in a comparable domestic case, to order an investigative measure aimed at obtaining evidence already held by national authorities.
According to the Court, even though prior judicial authorization is not required for issuing an EIO to acquire encrypted communications already collected abroad, this does not mean that all forms of judicial oversight in the issuing State can be excluded. In fact, the EIO system necessarily entails judicial control to ensure compliance with fundamental rights and the principle of proportionality. It is also essential to guarantee that the investigative acts requested can be challenged through mechanisms equivalent to those available in domestic cases[15].
As a result, the issuing State must still provide for judicial oversight, even if it occurs at a later stage. The Court of Cassation considers that such review falls to the national judge who is called upon to use the evidence gathered abroad via an EIO—such as the trial judge or the judge deciding on a precautionary measure—who has the authority to assess whether the conditions for admitting and using that evidence are met. Moreover, this ex post review would be sufficient to safeguard the right to challenge provided under Article 14 of the Directive.
The position taken by the United Sections in these recent rulings has not been without criticism. As noted in academic commentary, the real issue is not the existence of judicial oversight per se, but rather its limitations—since the rules governing the admissibility of evidence obtained via EIOs in domestic proceedings remain unclear.
Indeed, despite the existence of a common legal framework for EIOs, Member States have thus far been unable to agree on harmonized rules regarding the admissibility of evidence, which continues to pose a significant barrier to effective European judicial cooperation[16].
Moreover, this implies that, if the principle of equivalence in terms of evidentiary forms and guarantees were to be applied strictly, most of the evidence would end up being inadmissible in domestic proceedings—particularly in cases like these, where the evidence was gathered well before, and independently of, the issuance of an EIO[17].
However, several commentators have pointed out that the actions carried out by the French judicial police would never have been admissible in an Italian trial if conducted under the rules of Italian domestic law. In effect, the operation amounted to mass surveillance without specific targets, resulting in a dragnet impact on all users involved[18]. Moreover, the model of deferred judicial oversight is unconvincing to some, appearing more like a mere opportunity to “have a say,” lacking any real effectiveness, and bearing little resemblance to the adversarial and immediate formation of evidence typically expected in a fair trial[19].
Following the twin rulings of the United Sections, the Court of Cassation confirmed the aforementioned approach and went even further, also allowing the use of IMSI Catcher technology in criminal investigations. This tool enables monitoring of mobile devices within a specific area by identifying the unique IMSI (International Mobile Subscriber Identity) code of SIM cards. It does not intercept the content of communications, but rather identifies the devices operating within the area—making it a useful and preparatory step for subsequent interceptions.
Although this activity closely resembles the acquisition of phone records in terms of the information obtained, the Court held that it should instead be classified as a proactive act of the judicial police and not as an evidentiary tool. It ruled that it does not constitute a means of obtaining evidence, but merely the “operational basis for the interception of conversations”[20].
The European Court of Human Rights (ECtHR), however, takes a different view. It found a violation of Article 8 of the ECHR in cases where information capable of identifying an individual user (in the specific case, data linked to an IP address) was obtained without proper safeguards. In particular, the Court emphasized the lack of protection against arbitrary interference, abuse, or the absence of independent oversight of police operations[21].
The impact of the recent rulings by the Court of Cassation is beginning to emerge in the operational practices of judicial authorities. Notably, newly published guidelines from the Public Prosecutor’s Office of Rome address the seizure of mobile phones and other digital devices[22]. These guidelines, taking into account the substantial case law on the matter, include the position that “the seizure of IT devices and their subsequent analysis may be ordered by the public prosecutor without prior judicial authorization.”
The stance taken by the Rome Prosecutor’s Office enters a highly debated area, especially in light of the controversial legislative process[23] currently underway to establish a more systematic legal framework for the seizure of digital devices (Bill No. C. 1822[24]). Contrary to much of the case law (including international precedents) and the approach adopted in the abovementioned guidelines, the intention of the legislature appears to be to require a judicial order issued by the preliminary investigations judge upon request of the public prosecutor.
In this context, a comprehensive legislative intervention is highly desirable—one that brings clarity to a regulatory field which, both in Italy and abroad, has seen significant divergence in legal doctrine and case law. So far, this has not produced a fully coherent approach that adequately respects the principles of adversarial proceedings and the right of the accused to a proper defense.
[1] Cfr. Roberto De Vita, Marco Della Bruna, EncroChat: il rinvio pregiudiziale alla Corte di Giustizia dell’Unione Europea, in DEVITALAW, 8 aprile 2023, https://www.devita.law/encrochat-rinvio/.
[2] Gareth Corfield, Euro police forces infiltrated encrypted phone biz – and now ‘criminal’ EncroChat users are being rounded up, in The Register, 2 luglio 2020, https://www.theregister.com/2020/07/02/encrochat_op_venetic_encrypted_phone_arrests.
[3] Tribunal de première instance francophone de Bruxelles, 46e chambre correctionnelle, n. 2024/6283, 29 ottobre 2024.
[4] Nei soli Paesi Bassi, centinaia di investigatori hanno utilizzato i dati estratti dalle chat per arrestare oltre 100 persone, smantellare 19 laboratori di droghe sintetiche, e sequestrare ingenti quantità di cocaina, crystal meth, armi, veicoli e milioni di euro in contanti.
[5] BKA, https://www.bka.de/DE/Home/home_node.html.
[6] In particolare, sui considerando 2, da 5 a 8, 19 e 30 e artt. 1, 2, 4, 6, 14, 30, 31, 33.
[7] Cfr. sulla vicenda complessiva, Marcello Daniele, OEI e messaggi digitali già acquisiti all’estero, Riflessioni a partire dal caso Sky ECC, Testo della relazione, ampliata e corredata di note, svolta nell’ambito del corso La cooperazione giudiziaria in materia penale nel quadro dei processi europei di digitalizzazione della giustizia (Napoli, 9-11 dicembre 2024), organizzato dalla Scuola Superiore della Magistratura, in Sistema Penale, 27 marzo 2025,
https://sistemapenale.it/it/articolo/daniele-oei-e-messaggi-digitali-gia-acquisiti-allestero.
[8] Per approfondire, si veda Antonio Laudisa, Marco Della Bruna, Sky-ECC: il diritto di difesa e il contraddittorio sulle modalità di acquisizione di chat criptate. Nota a Cassazione penale n. 32915 del 07.09.2022 , in DEVITALAW, 8 ottobre 2022, https://www.devita.law/sky-ecc/.
[9] Cass. Pen., Sez. IV, 15 luglio – 7 settembre 2022, n. 32915.
[10] Cfr. ad esempio, Cass. Pen., Sez. VI, 26 ottobre – 21 novembre 2023, n. 46833, in ordine alla utilizzabilità di documentazione di atti compiuti autonomamente da autorità giudiziarie straniere in diversi procedimenti penali.
[11] Cass. Pen., SS.UU., 29 febbraio – 14 giugno 2024, n. 23755 e Cass. Pen., SS. UU., 29 febbraio – 14 giugno 2024, n. 23756. In senso conforme, cfr. Cass. Pen., Sez. III, 26 settembre – 3 dicembre 2024, n. 44046; Cass. Pen., Sez. IV, 21 maggio – 22 agosto 2024, n. 32961; Cass. Pen., Sez. IV, 10 aprile – 3 luglio 2024, n. 25912; Cass. Pen., Sez. III, 22 gennaio – 3 marzo 2025, n. 8865 che, sulla base dei principi espressi dalle Sezioni Unite, ha ribadito, tra gli altri, il “principio della presunzione di legittimità delle misure mediante la quali lo Stato di esecuzione ha raccolto le prove e di conformità ai diritti fondamentali dell’attività svolta dall’autorità giudiziaria estera nell’ambito di rapporti di collaborazione ai fini dell’acquisizione di prove, e dell’onere per la difesa di allegare e provare il fatto dal quale dipende la violazione denunciata“.
[12] D.Lgs. 21 giugno 2017, n. 108, Norme di attuazione della Direttiva 2014/41/UE del Parlamento europeo e del Consiglio, del 3 aprile 2014, relativa all’ordine europeo di indagine penale.
[13] Cass. Pen., SS.UU., 28 novembre 2019 – 2 gennaio 2020, n. 51; Cass. Pen., Sez. VI, 20 gennaio – 11 giugno 2021, n. 23148; Cass. Pen., Sez. IV, 25 giugno – 8 luglio 2020, n. 20127.
[14] CGUE, C-670/22, cit.
[15] La Corte di Giustizia, nella sentenza Gavanozov II (causa C-852/19, 11 novembre 2021) ha stabilito che deve esistere un mezzo di impugnazione anche quando non è previsto per un caso analogo nel diritto interno, in applicazione del diritto a un ricorso effettivo sancito dall’art. 47 della Carta di Nizza.
[16] Marcello Daniele, Le sentenze “gemelle” delle Sezioni Unite sui criptofonini, in Sistema Penale, 17 luglio 2024, https://www.sistemapenale.it/it/scheda/daniele-le-sentenze-gemelle-delle-sezioni-unite-sui-criptofonini#_ftn9.
[17] Marcello Daniele, OEI e messaggi digitali già acquisiti all’estero, Riflessioni a partire dal caso Sky ECC, cit.
[18] Gian Domenico Caiazza, Il Grande Fratello, l’incubo delle intercettazioni di massa è già realtà: siamo già tutti dentro Minority Report, in Il Riformista, 7 dicembre 2025, https://www.ilriformista.it/il-grande-fratello-lincubo-delle-intercettazioni-di-massa-e-gia-realta-siamo-gia-tutti-dentro-minority-report-448364/.
[19] Luca Marafioti, Sezioni Unite e tirannie tecnologiche: diritto di difesa, contraddittorio e “criptofonini”, in Diritto di Difesa, 18 settembre 2024, https://dirittodidifesa.eu/sezioni-unite-e-tirannie-tecnologiche-diritto-di-difesa-contraddittorio-e-criptofonini-di-luca-marafioti/.
[20] Cass. Pen. 44047/2024 cit.
[21] CEDU, Benedik c. Slovenia, ricorso n. 62357/14, 24 aprile 2018.
[22] Procura della Repubblica presso il Tribunale Ordinario di Roma, n. 1637/2025 Prot. Gab. CIRC. N. 10, 9 giugno 2025, https://www.sistemapenale.it/pdf_contenuti/1749504886_circ-n-10-del-9-giugno-2025-linee-guida-in-materia-di-sequestri-di-telefoni-e-altri-strumenti-informatici.pdf.
[23] A proposito del d.d.l. in materia di sequestro di dispositivi, sistemi informatici o telematici o memorie digitali: le osservazioni del Procuratore nazionale antimafia e del Presidente dell’ANM, Sistema Penale, 25 maggio 2025, https://www.sistemapenale.it/it/documenti/a-proposito-del-ddl-in-materia-di-sequestro-di-dispositivi-sistemi-informatici-o-telematici-o-memorie-digitali-le-osservazioni-del-procuratore-nazionale-antimafia-e-del-presidente-dellanm
[24] Approvata dal Senato il 10 aprile 2024 e trasmessa alla Camera dei Deputati, assegnata alla II Commissione Giustizia, in corso di esame in Commissione https://www.senato.it/leg/19/BGT/Schede/Ddliter/58159.htm. Per approfondire, Roberto De Vita, Valentina Guerrisi, Antonio Laudisa, Marco Della Bruna, La prova digitale nel processo penale, DEVITALAW, Roma, 2 maggio 2025.
Today we will be at the Women’s Anti-Aggression Seminar organized by APCUP Italy at Augustea Sport City.
The initiative was created to promote awareness, prevention and self-defense, offering concrete tools to counter all forms of violence.
During the seminar, we will address the legal profiles of victim protection, within a multidisciplinary discussion involving experts in self-defense, communication and gender-based violence.

Prof. Avv. Roberto De Vita will give a lectio magistralis today at the Police High School for First Executives of the State Police on the topic of “Digital Evidence in the Criminal Trial.”
In his talk he will address, with a systemic approach and operational projection, the key issues related to digital evidence, from the implications of cryptography to the future of investigations in criminal proceedings.

Report – Episode of 11/16/2025
Report by Daniele Autieri
This is the story of Federica Federici and her battle to find her daughter, kidnapped four years ago by her husband and father of the child. A personal drama that leads to the geopolitical balances in the region, pulling a thread from Almasri to the highest levels of the Italian government.
Read the original article on Il Fatto Quotidiano
by Marco Grasso
According to the Italian government’s official version, there were reasons of national interest behind the return to al-masri‘s Libya . Last January. photos of the general getting off an Italianstate plane have gone around the world . Thereis a lesser-known story, however, that shows how Italy, despite the condescension shown toward an official wanted by the InternationalCriminal Court for crimes against humanity, struggle to defend their citizens in Libya. It is about the kidnapping of an Italian girl : little Hager ,who isnow 7 years old, taken almost four years ago to her mother, Federica Federici,a 34-year-old Roman office worker , from the former Libyan husband, Mohamed B., a member of a family protected by a powerfullocal clan , the one headed by Muammar al-Dhawi. A painful family affair ,which at one point, according to one version provided and confirmed to the family by qualified institutionalfigures , would cross Iaffaire Almasri. And also because of this intersection true, alleged or boasted, the dossier has become very thorny and has been circulating on desksfor months of most highest representatives of the government.
THE COUPLE had met in Malta and marriedin Italy, where Hagerwas born in 2018 .She converts, however,the man struggles to integrate and shows signs of growing religious intransigence. On March 9 , 2022, using his father’s illness as an excuse, he kidnaps his daughter. A lawsuit is triggered.
Willing to do anything, Federica moved to Tripoli, with the help of a contract provided by the Italian embassy. Prosecutions go on; today a European and an international arrest warrant hangs over Mohamed B., issued following a request for precautionary measures issued by the Prosecutor’s Office Di Roma. And even a Libyan court, the Islamic court of Bab Ben Gashir, ruled on the case in the fall of 2024, ordering in a historic ruling, the return and exclusive custody of the little girl to her Italian mother, dropping the charge of apostasy.
Meanwhile, however, nothing moves. Mohamed B.-protected by a diplomatic passport and brother of a Libyan Foreign Ministry delegate to Palestinian Relations-is apparently and inexplicably nowhere to be found. Until, last January, the return of the General accused torturer seemed to open a glimmer of hope: “The Almasri case was shown to me by the Agency as a great opportunity for exchange. Since then I have been waiting impatiently for someone to come knocking on my door to return what was taken from me. But no one has ever come knocking.” These words are written in her own handwriting by the child’s mother, Federica Federici, in a letter delivered in late July to Giorgia Meloni, after several meetings took place in the presence of top government officials and the premier’s sister Arianna. The agency to which the woman refers is Axis, the foreign intelligence service headed by General Giovanni Caravelli. Confirming the woman’s claim – namely, an alleged connection between the Almasri case and that of the little Hager girl – are two meetings that took place in early summer at the highest institutional levels; summits in which the woman attended together with her attorney, lawyer Roberto De Vita, in the presence of Foreign Minister Antonio Tajani and Undersecretary to the Presidency of the Council Alfredo Mantovano: “In the Farnesina we learn from advisor Alessio Nardi and Protection Unit head Marco Petacco that my dossier is in the hands of General Caravelli. We suggest a meeting, which to date has not yet taken place. At Palazzo Chigi, adviser Alessandro Monteduro reports to us that my ex-husband would be traced between Libya and the Emirates, and my daughter may be in Oman.” In fact, the Oman one is a false flag denied already a year and a half earlier. The child, for other sources, would be in the Warshafana air. The question is why-in a certainly complex scenario such as Libya, where Italian companies nevertheless continue to operate-Italy has not yet done anything to have her returned.
Court of Treviso, Criminal Sec., Feb. 26, 2025, no. 376
In recent years, stalking has emerged with increasing evidence as a large-scale social phenomenon in Italy, not limited to isolated cases, but widespread and expanding both in public perception and in official statistical data.
In fact, the number of calls to the public utility number 1522[1] (anti-violence and stalking number), requesting help from victims of stalking, has seen a sharp increase: from 897 in 2019[2] to 2115 in 2024[3] and, according to data reported by the State Police in the latest report in March 2025[4], stalking crimes committed in 2024 were 20.289, compared to 19,538 in 2023 and 18671 in 2022, confirming a continuously increasing trend, with victims always predominantly female (consistently around 75%).
As early as 2014, ISTAT, in its latest completed survey[5], estimated that 3,466,000 women, or 16.1 percent of women between the ages of 16 and 70, had experienced persecutory acts by someone in their lifetime, and that among women in the same age group who had an ex-partner, 21.5 percent (or 2,151,000,000) had experienced persecutory behavior by an ex-partner in their lifetime[6].
During the year alone considered in the survey, there were 147,000 victims from ex-partners, while those who had reported stalking from other people 478,000.[7]
These data confirm that stalking – for a long time – has not been a marginal incident, but a structural reality with high numbers and an increasing trend, involving mostly women and finding the ex-partner as the main perpetrator.
The impact on victims’ psychological health and freedom of self-determination makes a broad and effective interpretation of the criminal protection provided by Article 612 bis of the Criminal Code crucial.
And instead, the decision of the Court of Treviso in commentary, excluded the configurability of the crime of persecutory acts even in the face of multiple invasive and intimidating behaviors, going against all the indications, including international ones, now constantly given to Italy regarding the protection of victims of gender violence, confirming the great resistance of the jurisprudence to make that paradigm shift necessary to achieve a system that can guarantee real instruments of protection for victims of violence.
The judgment, in order to acquit the defendant, uses different types of readings that are incompatible with an effective framing of the case:
The court reports–considering them fully proven–the defendant’s very serious conduct toward his former partner, consisting of:
However, he does not believe that they resulted in any appreciable change in the life habits of the offended person, who would continue to frequent the gym, work and family environment, without explicitly reporting that he made changes to avoid possible encounters.
For this reason, the judge acquitted the defendant of the charge under Article 612 bis of the Criminal Code, convicting him of only the crime of bodily injury (Article 582 of the Criminal Code) related to the assault.
The ruling values two logical steps:
The decision would thus seem to hinge on a formalist and restrictive concept of a change in living habits: following the arguments of the trial judge, the crime would be integrated only in the presence of tangible and radical changes (such as changes of domicile, interruption of social activities, change of working hours or places) and not also in the case of invasive conduct that generates latent fear or qualitative limitations in freedom of movement.
The Tribunal’s approach thus raises several concerns.
In fact, the artificial breakdown operated on the totality of conduct and the parceled evaluation of each individual episode risk losing sight of the cumulative persecutory effect: the crime of stalking, on the other hand, is characterized by habitual conduct, which requires a unified and contextual reading.
As for the proof of the event, the judge seems to require an explicit statement from the victim about the change of life that took place; this risks turning the absence of verbalization into “negative evidence,” to the detriment of the assessment, even circumstantial, of anxiety, fear and psychological conditioning resulting from the complex of conduct acted.
The event referred to in Article 612 bis of the Criminal Code, on the other hand, according to the jurisprudence of legitimacy, does not necessarily imply a quantitative material transformation of daily routines, but may consist of qualitative limitations, even implicit and internalized, affecting freedom and self-determination.
And in fact, the Supreme Court over time has made it clear that “on the subject of persecutory acts, for the purposes of identifying the change in lifestyle habits as an integrative element of the crime under Article 612 bis of the Criminal Code, it is necessary to consider the significance and emotional consequences of the coercion on the lifestyle habits to which the victim feels he or she is being forced, and not the purely quantitative assessment of the changes made (Sec. 5, No. 24021 of 04/29/2014, G, Rv. 260580)”[8], that, in addition, the offense exists even if the harassing conduct is interspersed with a long period of time, as long as the unity of the offense and the intimidating effect remain intact[9] and that even the reciprocity of the conduct does not exclude stalking, but only requires a punctual motivation as to the existence of the damaging event in the offended person’s sphere[10].
An elastic and substantive notion of “change” is thus delineated, which takes into account the psychological experience of the victim and does not demand documentary evidence of outward changes.
This approach contrasts with the one adopted by the Treviso court and would allow it to be argued that the persecutory event can be said to be integrated even in the absence of physical displacement or radical organizational changes, when the state of subjection, fear and limitation of freedom of self-determination is proven.
The approach followed by the judge of merit – based on the analytical breakdown of the episodes and the exclusion of relevance of internalized limitations, if not accompanied by tangible external changes – would, thus, stand in contrast to the established orientation of the jurisprudence of legitimacy. The Supreme Court has repeatedly clarified, in fact, that the crime of persecutory acts does not necessarily require a material and visible alteration of the habits of life, since the event may also consist of qualitative, silent and internalized changes, as long as they are capable of affecting the victim’s freedom of self-determination (see Cass. Pen., Sec. V, March 6 – April 16, 2025, no. 15165 and Cass. Pen. Sec. V, Jan. 10 – Feb. 20, 2024).
In the same vein, the Supreme Court has reiterated that the judge’s assessment must concern the unitary whole of conduct and not their atomistic examination (see Cass. Pen., Sec. V, May 2 – August 6, 2024, No. 32081; Cass. Pen., Sec. V, May 8 – 2025, No. 18868; and Cass. Pen., Sec. V, Nov. 22, 2019 – Jan. 27, 2020, No. 3251), recognizing significance to the psychological experience of the offended person.
This pronouncement allows us to measure the distance, still found in the decisions of some judges of merit, between the letter of Article 612 bis of the Criminal Code and its rationale of effective protection of the victims of persecutory conduct, highlighting the risks of an overly restrictive interpretation of the case, which ends up emptying the criminal protection against persecutory conduct of its content.
In fact, the “artifice” of disaggregating the episodes and deeming the change of lifestyle habits unproven in the absence of outward demonstrations can turn into a veritable argumentative loophole, apt to frustrate the ratio legis.
An interpretation of the rule in line with Supreme Court jurisprudence, on the contrary, would require assessing the conduct as a whole and in its impact on the victim’s emotional state and self-determination, recognizing that the alteration of habits also includes silent and internalized qualitative changes that are not visible but equally relevant, and preventing the absence of a formal statement by the victim from becoming negative evidence in favor of the defendant.
In the case at hand, the acquittal of the defendant as to the crime of persecutory acts appears to be an expression of an interpretative orientation that, by favoring the formal and material fact of the “change of life habits,” would end up neglecting the psychological and qualitative component of the injury to the freedom of self-determination, which instead constitutes the core of the incriminating case.
Moreover, the analytical breakdown of individual episodes and the requirement for tangible evidence of a radical outward disruption of daily routines appears to depart from that elaboration of the jurisprudence of legitimacy that has recognized central value in the victim’s subjective experience, valuing the internalized and often silent limitations that are likely to profoundly affect freedom of movement and self-determination.
This interpretative gap risks weakening the preventive and repressive scope of the rule, potentially placing it in conflict with Italy’s international obligations, particularly the Council of Europe Convention on Preventing and Combating Violence against Women and Domestic Violence (Istanbul Convention, Law No. 77/2013[11]).
Art. 49 of the Convention requires states to ensure effective protection of victims against all forms of gender-based violence, including persecutory conduct that impairs personal liberty even in ways that are not immediately visible.
Hence the need for a hermeneutics oriented toward restoring to Article 612 bis of the Criminal Code its substantially protective function, enhancing the unity of the conduct and its overall impact on the life of the offended person, and recognizing that the change in living habits cannot be confined to external changes only (in a rigidly quantitative conception), but also includes those psychological and qualitative changes that harm, often in a subtle and progressive manner, the victim’s freedom of self-determination.
References
[1] 1522, <https://www.1522.eu>
[2] ISTAT, Protection for Women Victims of Violence – Years 2021 and 2022 , <https://www.istat.it/comunicato-stampa/il-sistema-di-protezione-per-le-donne-vittime-di-violenza-anni-2021-e-2022/>
[3] ISTAT, The Public Utility Number 1522 – I Quarter 2025 , <https://www.istat.it/tavole-di-dati/il-numero-di-pubblica-utilita-1522-i-trimestre-2025/>
[4] State Police, <https://www.poliziadistato.it/statics/20/report-8-marzo-giornata-internazionale-della-donna.pdf>
[5] ISTAT, The number of victims and forms of violence, < https://www.istat.it/statistiche-per-temi/focus/violenza-sulle-donne/il-fenomeno/violenza-dentro-e-fuori-la-famiglia/il-numero-delle-vittime-e-le-forme-di-violenza/#:~:text=Lo%20stalking%20è%20stato%20subito,16%2C1%25%20delle%20donne>
[6] ISTAT, Stalking Women, <https://www.istat.it/comunicato-stampa/sicurezza-delle-donne-2006/>
[7] ISTAT, The number of victims and forms of violence, <https://www.istat.it/statistiche-per-temi/focus/violenza-sulle-donne/il-fenomeno/violenza-dentro-e-fuori-la-famiglia/il-numero-delle-vittime-e-le-forme-di-violenza/#:~:text=Lo%20stalking%20è%20stato%20subito,16%2C1%25%20delle%20donne>
[8] Cass. Pen, Sec. V, Jan. 22-March 6, 2018, no. 10111.
[9] See Criminal Cass., Sec. V, Feb. 18-July 7, 2025, No. 24726; Criminal Cass., Sec. V, April 3-May 19, 2025, No. 18774; Criminal Cass., Sec. V, Oct. 10, 2024-Jan. 29, 2025, No. 3808; and Criminal Cass., Sec. V, April 22-Aug. 4, 2021, No. 30525.
[10] Ex multis: Cass. Pen. Sec. V, Nov. 27, 2024 – Mar. 10, 2025, No. 9574 and Cass. Pen, Sec. V, Nov. 12, 2024 – Feb. 4, 2025, no. 4546: “the reciprocity of the harassing behavior does not exclude the configurability of the crime of persecutory acts, incumbent on the judge, however, in siffatta hypothesis, a more accurate burden of motivation regarding the existence of the event of harm, that is, the state of anxiety or fear of the alleged offesa person, his effective fear for his own safety or that of persons close to him or the necessity of the change of living habits.”
[11] <https://www.gazzettaufficiale.it/eli/id/2013/07/01/13G00122/sg>
Today, at the Aula Magna of the University of Naples “Parthenope,” Prof. Avv. Roberto De Vita will speak at the CIRPED 2025 National Conference, dedicated to the theme “2000-2025: Educational Con-fines Between Generations. A Jubilee for Education.”
An important opportunity for academic and professional discussion, between different disciplines and expertise, on the new horizons of education, the evolution of the dynamics that characterize intergenerational relationships, and the challenges posed by technological innovation to educational and social processes, in an era characterized by profound and radical transformations.
The event, sponsored by the Italian Center for Pedagogical Research (CIRPED), brings together scholars, researchers and practitioners to reflect, from an interdisciplinary perspective, on the profound changes that have swept through society in the past twenty-five years and the future transitions that are unceasingly emerging, in the quest to redefine educational scenarios.

Lectures by Prof. Avv. Roberto De Vita for the 40th Institute Course of the Carabinieri Officers School, entitled “Digital Evidence in the Criminal Trial,” begin today.

Israel has committed genocide against Palestinians in the Gaza Strip, the UN Independent International Commission of Inquiry on the Occupied Palestinian Territory, including East Jerusalem, and Israel said in a new report today. The Commission urges Israel and all States to fulfil their legal obligations under international law to end the genocide and punish those responsible for it.
The Commission has been investigating the events on and since 7 October 2023 for the last two years, and concluded that Israeli authorities and Israeli security forces committed four of the five genocidal acts defined by the 1948 Convention on the Prevention and Punishment of the Crime of Genocide, namely killing, causing serious bodily or mental harm, deliberately inflicting conditions of life calculated to bring about the destruction of the Palestinians in whole or in part, and imposing measures intended to prevent births.
Explicit statements by Israeli civilian and military authorities and the pattern of conduct of the Israeli security forces indicate that the genocidal acts were committed with intent to destroy, in whole or in part, Palestinians in the Gaza Strip as a group.
“The Commission finds that Israel is responsible for the commission of genocide in Gaza,” said Navi Pillay, Chair of the Commission. “It is clear that there is an intent to destroy the Palestinians in Gaza through acts that meet the criteria set forth in the Genocide Convention.”
“The responsibility for these atrocity crimes lies with Israeli authorities at the highest echelons who have orchestrated a genocidal campaign for almost two years now with the specific intent to destroy the Palestinian group in Gaza,” Pillay said. “The Commission also finds that Israel has failed to prevent and punish the commission of genocide, through failure to investigate genocidal acts and to prosecute alleged perpetrators.”
The report is based on all the Commission’s prior investigations, as well as factual and legal findings in relation to attacks in Gaza carried out by Israeli forces, and the conduct and statements of Israeli authorities from 7 October 2023 until 31 July 2025. The Commission’s findings are based on a comprehensive examination of the underlying acts of genocide (actus reus) and genocidal intent (dolus specialis).
In establishing the genocidal acts, the Commission examined the Israeli military operations in Gaza, including killing and seriously harming unprecedented numbers of Palestinians; imposing a total siege, including blocking humanitarian aid leading to starvation; systematically destroying the healthcare and education systems in Gaza; committing systematic acts of sexual and gender based violence; directly targeting children; carrying out systematic and widespread attacks on religious and cultural sites; and disregarding the orders of the International Court of Justice.
In establishing genocidal intent, the Commission applied the “only reasonable inference” standard set forth by the International Court of Justice in the case of Bosnia v. Serbia. The Commission analysed statements made by Israeli authorities and concluded that those statements are direct evidence of genocidal intent. The Commission also analysed the pattern of conduct of Israeli authorities and the Israeli security forces in Gaza, including imposing starvation and inhumane conditions of life for Palestinians in Gaza, and found that genocidal intent was the only reasonable inference that could be concluded from the nature of their operations.
“Israel has flagrantly disregarded the orders for provisional measures from the International Court of Justice and warnings from Member States, UN offices, human rights organisations and civil society groups, and continued the strategy of destruction of the Palestinians in Gaza,” said Pillay. “The Commission finds that the Israeli authorities had no intention to change their course of actions. On the contrary, Israeli authorities have persisted and continued with their genocidal campaign in Gaza for almost two years now. Israel must immediately end the genocide in Gaza and comply fully with the orders for provisional measures of the International Court of Justice,” she added.
The acts of Israeli political and military leaders are attributable to the State of Israel. The Commission therefore concluded that the State of Israel bears responsibility for the failure to prevent genocide, the commission of genocide and the failure to punish the perpetrators of genocide against the Palestinians in the Gaza Strip.
The Commission also concluded that Israeli President Isaac Herzog, Prime Minister Benjamin Netanyahu and then Defence Minister Yoav Gallant, have incited the commission of genocide and that Israeli authorities have failed to take action against them to punish this incitement. The Commission has not fully assessed statements by other Israeli political and military leaders and considers that they too should be assessed to determine whether they constitute incitement to commit genocide.
The Commission urges the Government of Israel to comply immediately with its international legal obligations, including to end the genocide in the Gaza Strip and fully implement the provisional measures orders of the International Court of Justice.
Israel must end its policy of starvation, lift the siege and facilitate and ensure the unimpeded access of humanitarian aid at scale and unhindered access of all United Nations staff, including UNRWA and OHCHR international staff, and all recognized international humanitarian agencies delivering and coordinating aid. The Commission calls on Israel to immediately end the activities of the Gaza Humanitarian Foundation.
The Commission recommended that Member States cease the transfer of arms and other equipment that may be used for the commission of genocidal acts to Israel; ensure individuals and corporations in their territories and within their jurisdiction are not involved in aiding and assisting the commission of genocide or incitement to commit genocide; and take action on accountability through investigations and legal proceedings against individuals or corporations that are involved in the genocide directly or indirectly.
“The international community cannot stay silent on the genocidal campaign launched by Israel against the Palestinian people in Gaza. When clear signs and evidence of genocide emerge, the absence of action to stop it amounts to complicity,” said Pillay. “Every day of inaction costs lives and erodes the credibility of the international community. All States are under a legal obligation to use all means that are reasonably available to them to stop the genocide in Gaza,” she added.
The issues of (un)proper nutrition and its impact on health, which are increasingly at the center of contemporary debate, are beginning to raise numerous questions about the possible responsibilities-even criminal ones-that can be found on the part of those who hold a position of guarantor with respect to individual food choices.
In particular, the issue becomes even more sensitive where children and adolescents suffer health damage, even in the long term. Parents and educators, on the one hand, and food companies, on the other, are increasingly held accountable for their respective choices and their consequences, including before the Courts.
With regard to the former, the judicial record, especially in the Anglosphere, is crowded with proceedings in which children and young people are removed from the care of their parents and placed in the care of social services because of the condition of obesity found by the courts. In some cases, as was the case with two little brothers in West Sussex (UK) [4], these were also children with good academic performance and excellent education, well integrated in their social context, whose parents, however, had repeatedly demonstrated an inability to manage their children’s diet, which combined intake of “junk food” and low physical activity: thus leading to unhealthy and worrying Body Mass Index values and to the orders of juvenile courts.
At the same time, public awareness and sensitivity to the nutritional components of commonly consumed foods is growing, and the political debate is intensifying-especially in Europe-about which food products should be taxed, discouraged or, conversely, protected. Within this framework, as mentioned and as will be discussed in more detail below, studies and research are increasing that identify a direct link between obesity (and several other diseases) and the consumption of “ultra-processed” foods.
Obesity is assuming epidemic characters worldwide, with alarming values particularly in the younger generation and trend projections that foresee a marked worsening of the phenomenon.
The World Obesity Federation estimates that by 2030, 50% of adults will have a high Body Mass Index (BMI). In fact, 33% of men and 28% of women will be overweight (BMI greater than 25 kg/m²), 12% and 14%, respectively, will be obese (BMI greater than 30 kg/m²), while 5% and 8% will be severely obese (BMI greater than 35 kg/m²) [5] and will have a high risk of developing other noncommunicable diseases that will require medical interventions. Childhood obesity is also growing steadily around the world: according to the 2025 report of the Lancet commission on adolescent health and wellbeing, 464 million young people will be overweight or affected by obesity by 2030, up from 143 million in 2015 [6].
Shifting the magnifying glass to our country, according to the latest data from the Istituto Superiore di Sanità, in 2023 19% of children were overweight and 9.8 were obese [7]. Regarding regional variability, higher prevalences are confirmed in the South and the Center than in Northern Italy, with marked differences between the top-ranked, autonomous province of Bolzano (overweight 12%, obese 3.3%) and the last, Campania (overweight 24.6%, obese 18.6%).
Recent decades have also seen a significant increase in obesity rates in developing countries. This phenomenon may appear almost paradoxical, because we are talking about realities that have historically struggled with malnutrition and undernourishment, such as Mexico, India, China, or Thailand. This phenomenon is a concrete example of why obesity is currently considered a global epidemic. In fact, it would be a mistake to consider it as a disease of the individual, but, on the contrary, it is the result of numerous environmental and socio-economic factors, which strongly condition eating habits and lifestyles, leading to its spread with epidemic characteristics.
Economic development and income growth, at the same time, are directly proportional to the number of overweight and obese people. The factors that have led to this condition can be traced mainly to rapid urbanization: this has resulted, particularly for children, in sedentary lifestyles, accompanied by excessive use of electronic devices and television [8] and the gradual departure from normally recommended habits: healthy diet, sleep, physical activity. In addition to this have been the increased availability of ultra-processed foods, the rise of fast food and junk food (increasingly cheap and easily accessible) at the expense of fresh and nutritious foods (increasingly expensive)[9].
Widespread obesity in the population directly results in cardiovascular complications, such as hypertension, dyslipidemia, atherosclerosis, myocardial infarction, stroke, and increased likelihood of developing various types of cancers. Excess adiposity results among the main risk factors in developing metabolic diseases, including type 2 diabetes, as weight gain results in insulin resistance (insulin is the hormone that regulates blood sugar).
Again, obese patients often go on to experience respiratory and musculoskeletal diseases, nonalcoholic fatty liver, and, something not to be underestimated, psychological and psychiatric issues.
In addition to its direct health effects, obesity also has significant social and economic consequences: the condition is associated with increased work absenteeism, lower benefits, and high health care costs for treatment and long-term care.
The World Obesity Federation predicts that, if prevention and treatment measures are not improved, the global economic impact of overweight and obesity will reach $4.32 trillion annually by 2035. Equal to nearly 3 percent of global GDP, this impact is comparable to that of COVID-19 in 2020 [10].
These costs are directly related to the health care costs of treating obesity-related diseases, and indirectly, the cost is compounded by the loss of work productivity, disability, and premature mortality of obese individuals [11]. In addition, obesity is an important cause of long-term disability, and people with the condition have to live with discrimination and social prejudice on a daily basis [12].
Added to these are the biases that can also be found within courtrooms, where sometimes the weight of defendants and victims is used as a central argument in the assessment of facts. For both defendants and victims, their bodies may be perceived as beyond their control. According to this view, an overweight predator would be unable to restrain himself from committing crimes, just as a particularly corpulent victim would be unable to control his body to defend himself. Moreover, similarly to crime victims who belong to fragile groups, such as children, the elderly or those with mental illness, overweight victims may also be recipients of feelings of pity in courtrooms. However, in the opposite sense, in cases of abuse and violence, overweight women may not be taken seriously because of the stereotype that victims of these crimes are often imagined as thin people [13].
The onset of obesity in the early years of life has a worrisome impact on health, not only because these individuals will most likely remain obese as adults, but also because children/youth often present with metabolic, cardiovascular, respiratory, orthopedic complications, and nutritional deficits.
In essence, a clinical picture similar to that of an adult is found: according to a study conducted by Dr. Valerio Nobili, head of hepato-metabolic pathology at the Bambino Gesù, about 70 percent of overweight or obese children have nonalcoholic hepatic steatosis, an accumulation of fat in liver cells: these children have twice the risk of prediabetic condition and diabetes than healthy children [14].
Hypertension is also a complication that occurs in childhood: on average, the prevalence of this condition in children is 1-2% in normal weight, 5-6% in overweight, and 20-22% in obese [15].
What is more, the onset of obesity in adolescence, may result in alterations in puberty: in females, sexual maturation is anticipated; in fact, early telarche and menarche are observed [16], while in males it is delayed. Thus, the continuous increase in obesity in our society has resulted in spaced sexual maturation between the two sexes.
Hyperandrogenism (excess of androgens) is common in females, resulting in polycystic ovary syndrome, which is associated with altered menstrual cycle, acne, androgenetic alopecia, and marked insulin resistance [17].
In males, there is a high risk of low sperm motility [18], erectile dysfunction, low libido and reduced testosterone concentration, caused precisely by excess adipose[19]. All this results in reduced testicular volume and possible infertility in adulthood.
Three of the main causes of weight gain in adolescents we find incorrect eating habits in the first place. The study on food consumption in Italy, conducted by the CREA (Food and Nutrition Research Center), shows that Italian adolescents are below the intake levels recommended by the LARN (Reference Intake Levels of Nutrients and Energy for the Italian population), with regard to the consumption of vegetable proteins and foods that provide fiber: such as legumes, whole grains, fruits and vegetables. As for fruit, in particular, the average daily consumption among adolescents (146 g/day) and children (139 g/day) is much lower than in adults (194 g/day). As for vegetables, where the average consumption of the population is 147 g/day, it is only 86 g/day for children. In contrast, the tendency is to overconsume proteins and lipids of animal origin (cheese and meat, particularly red and processed meat) and high-glycemic-index carbohydrates, such as fruit juices, boxed breads, refined flours and industrial snacks[20].
According to ISS’s Health Behaviour in School-aged Children (HBSC) study, breakfast, considered the most important meal of the day, is eaten by only slightly more than half of young people between the ages of 11 and 17. There is also an excessive daily consumption of carbonated and/or sugary drinks (15 percent) and 1 in 4 adolescents consume sweets at least once a day. At the same time, there are low percentages of fruit and vegetable consumption (even below 30% in some age groups) consistent with the above data [21].
At this point, it is important to introduce the topic of the famous “ultra-processed foods,” around which the public debate of recent years has been raging.
In this regard, the most widely used classification is that of the NOVA system [ 22]], which subdivides foods according to the degree and purpose of industrial processing and includes 4 groups: unprocessed or minimally processed foods; foods processed in the kitchen for the purpose of extending shelf life; processed foods; and, indeed, ultra-processed foods.
Specifically, ultra-processed foods are formulations of ingredients, which are derived from a series of industrial processes (hence the term “ultra-processed”).
These processes include several steps: they may begin with the fractionation of whole foods (such as corn, wheat, soybeans, sugarcane, or beets) into substances that include only sugars, oils and fats, proteins, starches, and fibers; or with the shredding or grinding of animal carcasses, usually from intensive livestock farms. Some of these substances are then subjected to hydrolysis, hydrogenation or other chemical modification.
The next steps involve the assembly of these modified substances, with little, if any, whole foods present, using industrial techniques such as extrusion, molding and pre-frying. Dyes, flavorings, emulsifiers, and other additives are then frequently added to make the final product palatable or hyper-flavored. The processes end with sophisticated packaging, usually made of synthetic materials.
Sugar, oils, fats and salt are often major players in the ingredient list of these foods.
Sugar, in particular, is used in different forms, such as fructose, high-fructose corn syrup, fruit juice concentrate, invert sugar, maltodextrin, dextrose, and lactose. At the same time, the oils used are often modified (hydrogenated or interesterified oils).
As for additives, they include flavorings, flavor enhancers, coloring agents, emulsifiers, emulsifying salts, sweeteners, thickeners, and antifoaming, bulking, carbonating, foaming, gelling, and polishing agents. These mask unwanted sensory properties resulting from the ingredients, processes, and packaging used in the production of ultra-processed foods; they also impart sensory characteristics to the final product that are particularly attractive to see, taste, smell, and/or touch[23].
The processes and ingredients used in the production of ultra-processed foods are specifically designed to create highly profitable products: low-cost ingredients with long shelf lives, whether on supermarket shelves or in the home pantry. As a result, they tend to easily replace all other NOVA food groups.
Ultra-processed products, then, are not only the averse packaged snacks or carbonated drinks that we “indulge in once in a while,” but also a number of everyday consumer products that the average consumer would probably never include in this category. A particularly effective example of these products is yogurt.
As a result of highly effective marketing campaigns, contemporary fashion is geared toward “High Protein” products; thus, in this case, yogurts with added protein to make the product, already a protein source in itself, even more protein-packed.
Below are two photos corresponding to the labels and ingredient list of two types of yogurts: one defined as “protein” (photo 1 ) and one “normal” (photo 2).

From reading the values, it is clear that, per 100gr of product, the one labeled as “high protein” has even less protein (9.4 g) than the “normal” one (10.3 g), with an ingredient list worthy of ultra-processed food classification.
By comparing nutrition tables and ingredients from labels, as you just did for yogurt, you can see that many of the products that populate daily cupboards are highly processed.
As analyzed above, obesity is a chronic multifactorial disease, and among the many reasons for its development, in recent years ultra-processed foods have emerged as a major determinant. Indeed, in a small volume of these products, hundreds of kcal are contained, yet they are not of good quality and do not provide useful nutrients to our bodies. On the contrary, the low fiber content and the prevalence of sugars, additives, and saturated fats make these foods precursors to several types of cancers, chief among them colorectal cancer[
[24]. Diets high in UPFs (ultra-processed foods), then, are related to an increased risk of diseases related to immune system dysregulation, such as inflammatory bowel disease (with alteration of the gut microbiota) and autoimmune diseases, such as multiple sclerosis and celiac disease[25]. Finally, some UPFs of animal origin and artificially sweetened beverages are particularly linked to an increased risk of developing type 2 diabetes[26].
In any case, it does not seem correct to “demonize” this food group and a priori oppose its consumption, which-if occasional-can be part of a healthy and balanced lifestyle without posing health risks.
What becomes more relevant is the overall diet of the individual, rather than the individual food, food group or single nutrient. The key word in this regard is awareness. Several factors contribute to the development of the latter. First, the marketing choices of large food companies assume an important role in the choices of consumers, who often tend to rely too easily on labels that extol seemingly beneficial features of products: no added sugar, high protein content, no palm oil, etc. The advancement of research and the consolidation of a widespread scientific basis for identifying harmful foods and production processes could force manufacturers to confront the growing risk of liability for injuries, including serious and permanent ones, caused by habitual consumption of products sold as harmless. Conversely, obligations to affix labels warning the purchaser of potential side effects could become more widespread: what is happening, for example, with alcohol products, tobacco derivatives or-increasingly-with unsaturated fats [27].
On the other hand, as far as children are concerned, the role – and responsibility – of parents is central, who will be asked to respond to a standard of care and dietary attention to which they are not yet accustomed – as shown also by Italian data on the nutrition of the youngest. In this regard, it will be essential first and foremost to raise awareness among adults so that they choose to adopt and teach children a healthy eating style from the earliest months of life. In this way, it will be possible to prevent the consolidation of wrong and potentially harmful eating habits in later years.
As noted in one of the court orders above[28], being present and loving parents, in the context of a happy family, is no longer sufficient to meet the health needs of children, especially where the severity of problems resulting from overweight or obesity are not fully understood.
Dr. Maddalena Cotardo, Biologist Nutritionist
Antonio Laudisa, Criminal Attorney
[1] https://www.judiciary.uk/wp-content/uploads/2023/03/R-v-Lloyd-Jones-Titford-sentencing-010323.pdf
[2] https://www.forthepeople.com/sites/default/files/2024-12/Filed%20UPF%20Complaint.pdf
[3] González-Gil, Esther M. et al, Associations between degree of food processing and all-cause and cause-specific mortality: a multicenter prospective cohort analysis in 9 European countries
[4] https://www.bailii.org/ew/cases/EWFC/OJ/2020/B62.html
[5] World Obesity Atlas 2025, World Obesity, March 2025, https://s3-eu-west-1.amazonaws.com/wof-files/World_Obesity_Atlas_2025_rev1.pdf
[6] Amouzou, A., Barros, A.J.D., Requejo, J., Faye, C., Akseer, N., Bendavid, E., Blumenberg, C., Borghi, J. , El Baz, S., Federspiel, F., Ferreira, L.Z., Hazel, E., Heft-Neal, S., Hellwig, F., Liu, L., Maïga, A., Munos, M., Pitt, C., Shawar, Y.R., Shiffman, J., et al. (2025). The 2025 report of the Lancet Countdown to 2030 for women’s, children’s, and adolescents’ health: tracking progress on health and nutrition. The Lancet 405 (10488) 1505-1554. 10.1016/S0140-6736(25)00151-5.
[7] https://www.epicentro.iss.it/okkioallasalute/pdf2024/INFOGRAFICA%20OKKIO%202023_2%20maggio%20DEFINITIVA.pdf
[8] Florida Atlantic University. “Alarming surge: Global crisis of childhood overweight and obesity.” ScienceDaily. ScienceDaily, September 26, 2024. www.sciencedaily.com/releases/2024/09/240926131942.htm.
[9] Monteiro, C.A., Moubarac, J.-.-C., Cannon, G., Ng, S.W. and Popkin, B. (2013), Ultra-processed products: global dominance. Obes Rev, 14: 21-28 . https://doi.org/10.1111/obr.12107.
[10] World Obesity, Economic impact of overweight and obesity to surpass $4 trillion by 2035, March 2, 2023, https://www.worldobesity.org/news/economic-impact-of-overweight-and-obesity-to-surpass-4-trillion-by-2035
[11] Bramming M, Jørgensen MB, Christensen AI, Lau CJ, Egan KK, Tolstrup JS. BMI and Labor Market Participation: A Cohort Study of Transitions Between Work, Unemployment, and Sickness Absence. Obesity (Silver Spring). 2019 Oct;27(10):1703-1710. doi: 10.1002/oby.22578. PMID: 31544342.
[12] Nutter S, Russell-Mayhew S, Alberga AS, Arthur N, Kassan A, Lund DE, Sesma-Vazquez M, Williams E. Positioning of Weight Bias: Moving toward Social Justice. J Obes. 2016;2016:3753650. doi: 10.1155/2016/3753650. Epub 2016 Sep 22. PMID: 27747099; PMCID: PMC5055973.
[13] Elizabeth Beety, Valena (2013) “Criminality and Corpulence: Weight Bias in the Courtroom,” Seattle Journal for Social Justice: Vol. 11: Iss. 2, Article 4, https://digitalcommons.law.seattleu.edu/sjsj/vol11/iss2/4; Tracy Royce, The Shape of Abuse: Fat Oppression as a Form of Violence Against Women, in THE FAT STUDIES READER 151, 153 (Esther Rothblum & Sondra Solovay eds., 2009), https://dokumen.pub/the-fat-studies-reader-9780814777435.html.
[14] Children and diabetes: double the risk if the liver is fatty – Bambino Gesù Children’s Hospital, https://www.ospedalebambinogesu.it/bambini-e-diabete-rischio-doppio-se-il-fegato-e-grasso-90316/
[15] Simonetta Genovesi, Laura Antolini, Marco Giussani, et al. Hypertension, Prehypertension, and Transient Elevated Blood Pressure in Children: Association With Weight Excess and Waist Circumference, American Journal of Hypertension, Volume 23, Issue 7, July 2010, Pages 756-761, https://doi.org/10.1038/ajh.2010.50.
[16] Itriyeva K. The effects of obesity on the menstrual cycle. Curr Probl Pediatr Adolesc Health Care. 2022 Aug;52(8):101241. doi: 10.1016/j.cppeds.2022.101241. Epub 2022 Jul 21. PMID: 35871162; PMCID: PMC9449629.
[17] Ibid.
[18] Leisegang K, Sengupta P, Agarwal A, Henkel R. Obesity and male infertility: Mechanisms and management. Andrology. 2021 Feb;53(1):e13617. doi: 10.1111/and.13617. Epub 2020 May 12. PMID: 32399992.
[19] vKhodamoradi, Kajala; Parmar, Madhumitaa; Khosravizadeh, Zahrab; Kuchakulla, Manisha; Manoharan, Meenakkshyc; Arora, Himanshua,d. The role of leptin and obesity on male infertility. Current Opinion in Urology 30(3):p 334-339, May 2020. | DOI: 10.1097/MOU.0000000000000762.
[20] https://www.crea.gov.it/web/alimenti-e-nutrizione/-/iv-scai-studio-sui-consumi-alimentari-in-italia
[21] https://www.epicentro.iss.it/hbsc/pdf/temi2022/abitudini-alimentari-2022.pdf
[22] FAO, Ultra-processed foods, diet quality, and health using the NOVA classification system, https://www.fao.org/fsnforum/resources/trainings-tools-and-databases/ultra-processed-foods-diet-quality-and-health-using-nova
[23] Monteiro CA, Cannon G, Levy RB, Moubarac JC, Louzada ML, Rauber F, Khandpur N, Cediel G, Neri D, Martinez-Steele E, Baraldi LG, Jaime PC. Ultra-processed foods: what they are and how to identify them. Public Health Nutr. 2019 Apr;22(5):936-941. doi: 10.1017/S1368980018003762. Epub 2019 Feb 12. PMID: 30744710; PMCID: PMC10260459.
[24]
Association of ultra-processed food consumption with colorectal cancer risk among men and women: results from three prospective US cohort studies, British Medical Journal, 2022
[25] Maki, K.A., Sack, M.N. & Hall, K.D. Ultra-processed foods: increasing the risk of inflammation and immune dysregulation? Nat Rev Immunol 24, 453-454 (2024). https://doi.org/10.1038/s41577-024-01049-x.
[26] Food consumption by degree of food processing and risk of type 2 diabetes mellitus: a prospective cohort analysis of the European Prospective Investigation into Cancer and Nutrition (EPIC), Dicken, Samuel J. et al, The Lancet Regional Health – Europe, Volume 46, 101043.
[27] https://www.who.int/news/item/07-12-2021-countries-with-regulations-protecting-people-from-industrially-produced-trans-fat-tripled-over-the-past-year
[28] https://www.bailii.org/ew/cases/EWFC/OJ/2020/B62.html
Our new book “Digital Evidence in the Criminal Trial” is available on Amazon, in Kindle and paperback formats.
A text designed for lawyers, magistrates, law enforcement, consultants, compliance specialists, students, and anyone who wants to better understand the role, dimensions, and significance of digital evidence in the criminal justice process.
The issue of digital evidence and its universal pervasiveness constitutes the current greatest complexity for the criminal trial and pre-trial investigation, which challenges the relationship between trial and adversarial in the formation of evidence.
Digital evidence represents the result whose “acceptability” is not related to the end, but resides solely in the method, that of digital forensics. A digital evidence process flawed in method can only lead to an abnormal result in merit: cognitive abnormality before even legal abnormality.
In this treatise, with systemic vision and practical detail, we go step by step through the digital dimension of the means of searching for evidence, the apparent repeatability of technical investigations, the indispensability of the capturer and its unresolved pitfalls, unavoidable cryptography and the progressive, mimetic and karstic use of artificial intelligence in prevention and justice; and then looking at the operational complexities of the dematerialization of jurisdiction in the face of transnational and deterritorialized digital evidence, from the European order of inquiry to the order of production and preservation of digital evidence.
With more than 1,000 citations among judgments (Italian, supranational and foreign), doctrine and normative references, with a comparative lens, a punctual reflection is walked through, also in the light of the Constitutional Court’s judgment No. 170 of 2023, the “twin” judgments of the United Sections, Nos. 23755 and 23756 of Feb. 29, 2024, and the EU Court of Justice’s ruling of Oct. 4, 2024 (Case C-548/21), up to an initial analysis of the bill on artificial intelligence C. 2316 and the bill on digital forensics C. 1822 (Zanettin-Bongiorno), both under consideration in the House committee since April 2025.
Preface by Giovanni Russo, magistrate, former Deputy National Anti-Mafia and Anti-Terrorism Prosecutor, and afterword by Stefano Elli, journalist for Il Sole 24 Ore.
Eurispes Cybersecurity Observatory – Short Report – Part 1 On the eve of the…