A Berlin court has partly rejected the Malta Gaming Authority’s attempt to restrict IT security researcher Lilith Wittmann’s disclosures and public criticism, according to netzpolitik.org.

On 24 September 2026, the court maintained a prohibition on renewed unauthorised access to the MGA’s portal. However, it allowed Wittmann to share the documents with journalists and investigators and upheld her disputed statements as permissible opinions.

Wittmann obtained financial records during research into allegedly illegal gambling involving Lottoland. She estimates that its German activities cost the state approximately €400 million in tax revenue between 2019 and 2023. These allegations have not resulted in a judgment; whether the MGA knew about the alleged practices remains unclear.

Wittmann faces estimated legal costs of €15,000–€20,000. The MGA also hired investigators, saying it needed her address to serve legal documents. Wittmann described their enquiries, including contacts with former employers, as intimidating.

She and her lawyers characterise the proceedings as an attempt to silence public-interest reporting. The MGA rejects that allegation, saying it sought to protect information from unauthorised access.

The ruling distinguishes between obtaining documents unlawfully and subsequently sharing them for reporting. 

What follows is an article about this story, published in German by netzpolitik.org yesterday. The article has been translated into English using AI.

Malta versus Lilith Wittmann: Court Ruling Strengthens Freedom of Expression and Press Freedom

IT security expert Lilith Wittmann passed data from Malta’s gambling regulator to media outlets and investigating authorities, suggesting that the regulator had allegedly facilitated illegal gambling. The authority subsequently took legal action against her. A court ruling has now strengthened freedom of expression and freedom of the press.

By Esther Menhard
Published by netzpolitik.org on 28 September 2026 at 13:26
English translation

Photo: Lilith Wittmann after the public hearing at Berlin Regional Court II. Image and editing: netzpolitik.org, CC BY-SA 4.0.

How much tax revenue does the German state lose through illegal gambling? This is one of the questions IT security expert Lilith Wittmann has been investigating. Her research drew her attention to Malta’s gambling regulator, the Malta Gaming Authority (MGA). She obtained documents and passed them to media outlets and investigating authorities. The MGA then applied to Berlin Regional Court II for an interim injunction against her.

The application essentially contained two demands. First, Wittmann was to be prohibited from creating another account under a false identity on the MGA’s web portal and from obtaining further access to documents stored there. These included annual accounts, financial reports and tax records. The MGA also sought to prevent her from passing these documents to third parties, such as journalists.

Second, the MGA sought to prohibit Wittmann from publicly stating that it supported “networks of organised crime” and had “created structures that enable organised crime” — expressed in her original wording as “organized crime enablement schemes you created”. Wittmann had posted these statements on LinkedIn in March.

The court delivered its ruling on 24 September. It upheld part of the interim injunction: Wittmann must not “hack” the MGA’s web portal again. However, it overturned other parts: she may pass the documents to the press and investigating authorities, and she may make the statements about the MGA that she had published on LinkedIn.

Malta as a Business Base

Wittmann researches illegal gambling. She has published parts of her investigation on her blog and in collaboration with the television programme RTL Extra. In a report broadcast in July, she discussed her investigation into the Lottoland group. Through the websites lottoland.com and lottohelden.de, the group offers what are known as secondary lotteries in Germany.

Players place bets on the outcome of lottery draws rather than entering the lotteries themselves. Secondary lotteries are prohibited in Germany.

It is not immediately apparent to players that they are participating in illegal gambling. The websites initially appear reputable, partly because they resemble those of the state lottery. Only the small print tells users that they are placing bets rather than participating in a lottery.

The legal notices on both websites name “Deutsche Lotto- & Toto-Agentur” and give Malta as the company’s location. The MGA’s logo also appears at the bottom of the website. The authority issued Lottoland’s gambling licence.

What Do the Documents Contain?

Wittmann estimates that the Lottoland group’s business practices deprived the German state of approximately €400 million in tax revenue between 2019 and 2023. Her estimate draws on internal documents, including the annual accounts of Malta-based European Lotto and Betting Limited, which runs Lottoland’s German operations.

Wittmann extracted these documents from the Maltese gambling regulator’s portal. They contain figures for the revenue Lottoland generated in Germany.

German investigating authorities apparently already had Lottoland in their sights. However, according to Thomas Dünchheim, a lawyer and gambling law expert interviewed in the RTL report, they had previously lacked evidence of the revenue generated in Germany that would allow them to take action against the companies on tax grounds. This information was important for determining how much tax Lottoland should have paid.

It remains unclear whether the MGA knew about the Lottoland group’s alleged practices. In response to our enquiry, the authority stated only that “tax liabilities arising in Germany fall within the remit of the competent German authorities”. No judgment has yet been delivered on this matter.

In Support of Press Freedom

“As the applicant, the MGA wanted to secure the broadest possible prohibition. Initially, it succeeded in obtaining this through a court order,” Jonas Kahl told netzpolitik.org. Following the public hearing, however, little of that prohibition remained. Kahl, a lawyer with the firm Spirit Legal, represented Wittmann in court.

“The court now makes clear in its judgment that all the challenged statements by Lilith Wittmann are permissible expressions of opinion and not false assertions of fact,” Kahl said.

Wittmann also expressed relief. “I am allowed to say that the MGA may, in certain circumstances, enable organised crime, and that is extremely important for reporting,” she told netzpolitik.org.

The MGA also failed to achieve another central objective of its application for an interim injunction. Under the ruling, journalists may use the documents Wittmann extracted from the authority’s system.

The Maltese gambling regulator had argued that hacking also encompassed giving third parties — journalists, for example — access to documents. The court has now clarified that giving third parties access to documents is not the same as giving them access to the system.

Security Expert Left to Bear the Costs

In Kahl’s view, the MGA nevertheless achieved an indirect success in one respect.

“The opposing party’s conduct suggests that its primary concern is not enforcing its rights, but making things as difficult as possible for Lilith Wittmann and generating substantial legal costs,” he said. Those costs are expected to amount to between €15,000 and €20,000.

Alongside lawyers’ fees, there are costs associated with the proceedings before the civil chamber. Because of the particular rules governing civil proceedings, Wittmann must bear most of these costs herself, even though the court ruled partly in her favour.

Further costs would arise if the MGA appealed. Asked whether it intended to do so, the authority declined to comment.

Wittmann believes the authority’s real objective is “to stop me from continuing to investigate and report. That is why I do not expect it to leave me alone.”

MGA Hired a Private Investigation Agency

Before seeking the interim injunction, the MGA commissioned a private investigation agency to monitor Wittmann. The agency’s report forms part of the court file.

When asked about this, the MGA told netzpolitik.org that it had commissioned the agency to establish Wittmann’s “physical address” so that “relevant legal documents” could be served.

The agency also spoke to Wittmann’s former employers.

“When you suddenly see a report running to several pages, showing that someone has spoken to your former employers and visited your old addresses — that is intimidating,” Wittmann said.

Litigation as Intimidation

Wittmann and her lawyers believe the MGA’s action constitutes a SLAPP.

The term describes the use of substantively unfounded lawsuits, for example by companies, to obstruct journalists’ work. The abbreviation stands for “strategic lawsuit against public participation”. To protect journalists against such proceedings, the European Union adopted its Anti-SLAPP Directive in 2024.

The directive provides for defendants to seek an early judicial assessment of potentially intimidatory lawsuits. The claimant must then explain why the proceedings should continue. It also provides protection against high legal costs and seeks to deter SLAPP proceedings through the prospect of sanctions.

However, Wittmann and her lawyers were unable to rely on the directive because it had not yet been transposed into German national law. German courts could therefore not readily apply its provisions.

Speaking to netzpolitik.org, the MGA rejected the SLAPP allegation. It said the purpose of its application for an interim injunction was to protect the information entrusted to it against unauthorised access.

A Matter of Public Interest

According to the court, the way Wittmann obtained information from the authority could be considered a breach of section 202a of the German Criminal Code, commonly referred to as the “hacker provision”. Such a breach occurs when someone overcomes security barriers to gain unauthorised access to an IT system.

To obtain documents from the MGA’s portal, Wittmann assumed another identity. She also happened upon an interface through which she gained access to organisations within the MGA’s system, where she could then download documents. She describes her methods in a blog post. The MGA has since closed the security vulnerability.

Wittmann justifies her actions on the grounds that the documents are of public interest. She invokes the principle known as “Lex Wallraff”, named after investigative journalist Günter Wallraff, who obtained employment at the newspaper Bild under a false identity for an investigation.

According to a ruling by Germany’s Federal Court of Justice, journalists may, in justified individual cases, obtain and disseminate information through prohibited means where the purpose is to expose wrongdoing that harms the public. In such cases, the court held, press freedom outweighs the interests of those affected.

Does It Constitute Hacking?

Berlin Regional Court II considered the “security measures” the MGA had implemented for its website to be “sufficient”. It held that “proper use” of the portal would not have provided access to the organisations and documents.

Wittmann’s lawyers, however, argue that the system was open and failed to meet EU legal requirements for IT security.

“Authorities are legally required to protect their systems,” said Peter Hense, who also represents Wittmann. Since the MGA processes personal data, it is subject to the General Data Protection Regulation, which imposes strict requirements in this area.

A 2024 audit report by the consultancy PricewaterhouseCoopers, submitted by the MGA, supports this assessment. In the view of Wittmann’s lawyers, the heavily redacted report suggests that the MGA had not adequately protected its IT system against outside access.