I can explain, a bit, as I recently did a bit of research in this area, particularly Section 202 (Section 202a, Section 202b, and Section 202c) of the German Cr

I can explain, a bit, as I recently did a bit of research in this area, particularly Section 202 (Section 202a, Section 202b, and Section 202c) of the German Criminal Code (Strafgesetzbuch, StGB) which addresses the unauthorized access to data. Disclaimer: I'm not a lawyer (but I do have one). In Germany this is taken very seriously. - 202a deals with secret interception of data which was not intended for the interceptor - 202b makes it illegal to access data within a system without the necessary authorization. I think this also means (I'm sure someone out there can correct me if I'm wrong) that even if the accessor knows the password and has even been given it, but does not have the explicit granted permission nor authority to use it to access the system, it is a crime. I'm pretty sure (as a layman) that this is what this case is about. Perhaps this and a bit of 202a. 'Goodwill, whitehat' etc will not help here. Lucky he had no criminal priors and Germany is not generally a fan of throwing people in prison. - 202c is mostly about stealing data, making it public, or using it for (a) or (b).