Ms Wittmann celebrates Berlin ruling despite MGA hacking findings

Ms Wittmann celebrates Berlin Court Victory, but conveniently forgot the part where Judges found her MGA Hacking Unlawful

Lilith Wittmann has been celebrating what she describes as a victory against the Malta Gaming Authority. Unfortunately, the full Berlin court judgment tells a rather less flattering story. While the judges protected her right to criticise the regulator, they also upheld an injunction based on unlawful access to protected data under Germany's criminal hacking provision. Malta Media has now obtained the complete judgment and some of its findings deserve considerably more attention than Ms Wittmann appears willing to give them.

I have to admit, when I first read Ms Wittmann's LinkedIn announcement, I almost felt sorry for the Malta Gaming Authority. Judging by her celebrations, you would think that the German justice system had just delivered a complete vindication of her investigative methods and given her permission to carry on with whatever she pleased. She was delighted that she could continue describing the MGA as an enabler of organised crime and said she was allowed to use the documents extracted from its systems. The inconvenient part, however, is that the judgment contains considerably more than those two points.

On 9 October 2026, Malta Media received the complete 24-page judgment from Berlin, dated 24 September 2026, issued by Landgericht Berlin II under case number 7 O 254/26 eV. Unlike the single-page document Ms Wittmann showed her followers, we have now examined the operative ruling, the reasoning and the court's assessment of the alleged hacking. And having read the whole thing, I find her presentation of this supposed triumph rather extraordinary. There are certainly parts she won, but there are also findings that should make anyone celebrating this case considerably more cautious.

The court did not simply say hacking might have happened!

Let's start with the part I find particularly interesting, because Ms Wittmann's own explanation deserves some scrutiny. In her LinkedIn post, she suggested that the court had not really wanted to examine whether her activities amounted to hacking and had merely accepted that hacking might have occurred. That is a rather comfortable interpretation when you have just lost the part of a case concerning unauthorised access to protected information. It is also not how I read the judges' reasoning.

On pages 10 and 11, the court expressly addresses Section 202a of the German Criminal Code, the provision dealing with unauthorised access to specially protected data. The judges found that Ms Wittmann had obtained access to information that was not intended for her by overcoming the relevant protections. They concluded that the MGA was entitled to an injunction under German civil law, relying on the infringement of § 202a StGB. That is considerably stronger than casually suggesting somebody might possibly have hacked something.

The judgment also describes how Ms Wittmann used an account created under a false identity and exploited a weakness in the MGA's permission system to grant herself access to other companies' records. It refers to at least 3,027 documents accessed between 4 December 2025 and 16 March 2026, including financial records, regulatory applications and sensitive personal information. The court upheld the injunction preventing repetition of the described unauthorised conduct and materially similar attacks. Those are findings recorded in a German judicial decision, not allegations invented by Malta Media.

There is one distinction I want to make absolutely clear, because the law matters just as much when we are criticising somebody as when we are defending them. This was a civil injunction proceeding, not a criminal trial and Ms Wittmann was not convicted of a criminal offence by this judgment. The court applied the evidential standard applicable to interim proceedings rather than the standard required for a criminal conviction. Nevertheless, it found sufficient grounds to uphold an injunction based on conduct falling within § 202a StGB and pretending that finding is merely a footnote to an otherwise glorious victory is not particularly convincing.

Yes, Ms Wittmann can criticise the MGA. No, the judges did not declare the MGA a criminal organisation.

The second interesting part concerns Ms Wittmann's enthusiastic announcement that she can describe the MGA using the expression “organized crime enablement scheme”. On that issue, she did win and I have no difficulty acknowledging it. The court treated her statements, in their specific context, as protected expressions of opinion rather than assertions of established criminal facts. That is important under German law and it is one I would expect a journalist involved in such litigation to understand.

The judges did not establish that the Malta Gaming Authority is a criminal organisation or that it committed crimes connected to organised criminal networks. They recognised that the expression reflected Ms Wittmann's evaluation of regulatory structures and their alleged consequences. Interestingly, the court referred to earlier reporting by Der Spiegel and the Organized Crime and Corruption Reporting Project, alongside a Wikipedia entry, as sufficient factual background for her opinion. That is a legal assessment of freedom of expression, not judicial confirmation of the underlying criminal allegations.

I have criticised the MGA myself, and Malta Media has examined serious questions surrounding gambling regulation and German licensing. We have also examined disputed German gambling-tax figures, including allegations originally raised through Ms Wittmann's investigations. I have no interest in protecting a regulator from legitimate criticism merely because it operates in Malta. But there is a very substantial difference between a court allowing a journalist to express an opinion and that same court establishing that the opinion is factually correct.

The biggest misunderstanding concerns the hacked documents!

This is where I believe Ms Wittmann's interpretation becomes particularly questionable. She tells her followers that she may use the documents extracted from the MGA for her reporting, which understandably sounds as though a court has examined those documents and expressly authorised their continued use. However, pages 15 to 17 explain something considerably more specific. The MGA's application did not properly seek an injunction against onward disclosure of the extracted documents.

The judges explained that the relevant application concerned giving third parties access to the MGA portal, not passing documents already downloaded from that portal to journalists or other recipients. Ms Wittmann had not given other people access to her account, so that part of the claim failed. The court also explained that it could not simply rewrite the regulator's application to cover something different. When the MGA subsequently attempted to address onward disclosure, the judges considered the attempted extension too late for the urgent proceedings.

That is an extremely important procedural distinction, particularly when someone presents the result as permission to use everything they obtained. The court did not issue a blanket ruling that all extracted documents could lawfully be retained, distributed or published without restriction. It rejected the specific relief requested, partly because of how the claim had been formulated and when the regulator tried to expand it. In fact, the judgment expressly discusses the potential criminal-law relevance of passing on documents obtained through unauthorised access, without determining every possible consequence of such disclosure.

I find that difficult to ignore given what Malta Media has already documented about the Casino Secrets investigations. The concern is not whether journalists may examine confidential documents to expose wrongdoing. The question is where the legitimate public interest ends and the privacy rights of individuals begin, especially when regulatory material contains passports, residential addresses, dates of birth and financial information. Nothing in this Berlin judgment gives Ms Wittmann an unrestricted entitlement to publish such material simply because she happens to describe the exercise as journalism.

A supposed SLAPP victory that still leaves Ms Wittmann paying significant costs

Ms Wittmann also describes the proceedings as a SLAPP, a strategic lawsuit intended to discourage public participation. I understand why a journalist facing expensive litigation might use that description, particularly when the opposing party is a powerful public regulator. The court did reject the MGA's attempts to restrict her statements, which is a significant result for freedom of expression. However, the judgment does not establish that the proceedings constituted an abusive SLAPP.

There is also the matter of costs, which provides another interesting perspective on how complete this victory really was. Under the court's cost allocation, Ms Wittmann must bear half of the court costs and three-fifths of the MGA's recoverable extrajudicial legal costs, while the claimants bear the remaining allocated costs. That is hardly the outcome one would associate with a party winning every substantial issue. She won on expression and avoided a document-sharing restriction under the application as drafted, but the injunction concerning her unauthorised access remained in force.

I am not suggesting the MGA handled every part of this litigation successfully. Clearly, its attempt to restrain the statements failed and its lawyers did not obtain the broader restriction on document dissemination they apparently wanted. The decision also raises legitimate questions about how civil remedies should be framed when confidential regulatory information has already been extracted and passed to third parties. But describing the proceedings as a complete vindication of Ms Wittmann's methods would be every bit as misleading as pretending the MGA won everything.

What about the people whose private information was extracted?

This brings me back to the issue I consider far more important than the legal celebrations taking place on LinkedIn. The documents in question concern companies and individuals who supplied information to a gambling regulator, often because the licensing process legally required them to do so.

Some may be wealthy owners or senior executives whose business activities deserve considerable scrutiny. Others may simply be employees, consultants or compliance professionals whose private records have absolutely nothing to do with the alleged misconduct being investigated.

In our earlier article into Casino Secrets and the Curaçao Gaming Authority, we documented concerns about publicly accessible passport identifiers, private addresses and other sensitive information. That Curaçao incident is legally separate from the MGA litigation and the Berlin judgment does not decide the lawfulness of the Curaçao archive. Nevertheless, the underlying question is remarkably similar.

When does possessing information for investigative purposes become an excuse for making private information available to people who have no legitimate reason to see it?

There is a point I find especially remarkable in Ms Wittmann's LinkedIn announcement. She complains that a German bailiff allegedly passed her own address to Malta without authorisation and she clearly considers this an unacceptable invasion of her privacy. I would have no difficulty supporting her right to privacy if that disclosure was unlawful.

But I struggle to reconcile that complaint with the publication of other people's private addresses through the broader Casino Secrets project, where Malta Media has documented precisely that sort of exposure.

Surely the protection of someone's residential address cannot depend entirely on whether the person publishing it considers themselves to be on the right side of an investigation. Journalists have privacy rights, gambling executives have privacy rights and ordinary employees whose documents are stored in regulatory databases have privacy rights as well. Those rights may sometimes have to be balanced against genuine public-interest reporting, but that requires a proper justification for what is disclosed. It does not mean that everyone who appears in a regulatory file has surrendered their right to keep their private life private.

Ms Wittmann won the right to speak. She did not win a licence to hack.

I have no difficulty accepting that Ms Wittmann achieved two important results in Berlin. She successfully defended her freedom to make the challenged statements about the MGA and the court rejected the attempted restriction concerning third-party access and onward document sharing under the application before it. Those are genuine legal victories and it would be dishonest to suggest otherwise.

Equally, however, the judges upheld an injunction grounded in unauthorised access to protected data and that finding deserves exactly the same public attention.

What I find difficult to accept is the tendency to present judicial decisions as though the favourable passages somehow cancel everything else in the same document. Ms Wittmann is entitled to celebrate her successful defence of freedom of expression, just as Malta Media is entitled to question the methods used to obtain regulatory information. The fact that information may expose real wrongdoing does not automatically make the methods used to acquire it lawful, nor does it remove the obligation to consider the privacy of people who were never accused of anything. These are separate questions, and this judgment makes that separation rather clear.

Having read all 24 pages, I would describe the decision as a mixed result with a particularly serious finding concerning Ms Wittmann's unauthorised access to the MGA's protected information. It is certainly not the complete judicial blessing that a casual reader might take away from her LinkedIn celebrations. The German court protected her right to express controversial opinions, but it also accepted, to the standard required in these civil proceedings, that her conduct satisfied the relevant hacking-related legal requirements. And until the distinction between investigating wrongdoing and unlawfully obtaining protected information is taken seriously, I suspect we will continue seeing celebrations that sound rather different from the judgments on which they are based.

FAQs

What did the Berlin court decide in the case involving Ms Wittmann and the Malta Gaming Authority?
The Berlin court delivered a mixed ruling on 24 September 2026. It protected Ms Wittmann's right to express critical opinions about the Malta Gaming Authority while upholding an injunction concerning unauthorised access to protected regulatory information.

Did the Berlin court find that Ms Wittmann had unlawfully accessed MGA systems?
Yes. In the civil injunction proceedings, the court found sufficient grounds to conclude that Ms Wittmann had accessed protected information without authorisation, engaging Section 202a of the German Criminal Code. However, this was not a criminal conviction.

Was Ms Wittmann convicted of hacking under German criminal law?
No. The proceedings concerned a civil injunction rather than a criminal prosecution. The judges relied on conduct falling within Section 202a of the German Criminal Code, but the ruling did not establish criminal guilt.

How many MGA documents did the Berlin court examine in connection with Ms Wittmann's activities?
The judgment referred to at least 3,027 document retrievals between 4 December 2025 and 16 March 2026. The material included financial records, regulatory applications and sensitive personal information.

Did Ms Wittmann win the right to criticise the Malta Gaming Authority?
Yes. The court protected her right to express critical opinions about the MGA, including the description “organized crime enablement scheme”. The judges treated the disputed expression as an opinion rather than an established statement of criminal fact.

Did the Berlin court declare the Malta Gaming Authority a criminal organisation?
No. The court did not determine that the MGA was a criminal organisation or had committed crimes. It concluded that Ms Wittmann's disputed statements were protected expressions of opinion in their particular context.

Did the Berlin ruling allow Ms Wittmann to publish all documents obtained from the MGA?
No blanket authorisation was granted. The court rejected the requested restrictions concerning document sharing partly because of how the MGA formulated its application. The ruling did not establish an unrestricted legal right to retain, distribute or publish all extracted information.

What legal costs was Ms Wittmann ordered to pay following the Berlin judgment?
Under the judgment's cost allocation, Ms Wittmann was required to bear half of the court costs and three-fifths of the MGA's recoverable extrajudicial legal costs. The claimants were responsible for the remaining allocated costs.

Was the MGA's legal action against Ms Wittmann officially classified as a SLAPP?
No. Although Ms Wittmann characterised the proceedings as a strategic lawsuit against public participation, the judgment did not establish that the case constituted an abusive SLAPP. The court nevertheless rejected restrictions on her protected expressions of opinion.

What privacy concerns arise from the MGA documents obtained by Ms Wittmann?
The documents reportedly included sensitive personal information belonging to individuals connected with gambling companies and regulatory applications. The case raises questions about how investigative journalism should balance public-interest reporting against individuals' privacy rights, particularly when information includes residential addresses, identity documents and financial records.