§ 303b StGB
Section 303b German Criminal Code — Computer Sabotage
§ 303b StGB — Computersabotage
Section 303b of the German Criminal Code criminalises the significant disruption of a data processing that is of essential importance to another. It covers, among other things, data tampering, the input or transmission of data with intent to cause harm (such as Denial of Service (DoS)/Distributed Denial of Service (DDoS) attacks) and the damaging of equipment. For attacks on companies and authorities the penalty range rises considerably.
History & facts. Section 303b builds on Section 303a and criminalises the significant disruption of essential data processing; one offending act is, among others, the input or transmission of data with intent to cause disadvantage, which covers Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks in particular. The basic offence extends up to three years' imprisonment or a fine; if the act concerns a data processing of essential importance to a third-party operation, company or authority, the range rises to up to five years, and further in especially serious cases.
Outlook & recommendation. Section 303b is the relevant offence for attacks that paralyse operations — from ransomware to Distributed Denial of Service (DDoS) — and especially relevant where critical infrastructure is affected. For operators this means: a successful attack is not only a technical but a criminally tangible event whose clarification lives on clean forensic documentation. Criminal law and regulatory duties (such as Network and Information Security Directive 2 (NIS2) notifications) run in parallel here. This is not legal advice.