1. Meaning: Autonomous Vehicle Cybercrime in Germany

Autonomous vehicle cybercrime refers to unlawful acts targeting:

• Self-driving systems (SAE Level 3–5)
• Vehicle-to-Everything (V2X) communication networks
• On-board systems (ECUs, CAN bus)
• Cloud-based driving platforms (fleet AI systems)
• Sensor fusion modules (LiDAR, radar, GPS spoofing systems)

Common attack types:

• Remote takeover of steering/braking systems
• GPS spoofing / route manipulation
• Malware injection into vehicle ECUs
• Ransomware targeting fleet management systems
• Exploitation of OTA (over-the-air) updates
• Vehicle sensor interference (LiDAR/camera spoofing)

2. German Legal Framework Applicable

Autonomous vehicle cybercrime is prosecuted under multiple layers:

2.1 Core Cybercrime Provisions (StGB)

🔐 § 202a StGB – Data Espionage

Unauthorized access to protected vehicle systems (e.g., telematics, ADAS control units)

🔐 § 202b StGB – Interception of Data

Capturing V2X communication (vehicle-to-vehicle or vehicle-to-infrastructure signals)

🔐 § 202c StGB – Preparation of Hacking Tools

Developing or distributing tools used to exploit vehicle software

💻 § 303a StGB – Data Tampering

Altering vehicle software, navigation data, or control parameters

💥 § 303b StGB – Computer Sabotage

Disabling autonomous driving functions or ECUs

💰 § 263a StGB – Computer Fraud

Manipulating toll systems, ride-sharing billing, or autonomous taxi pricing

2.2 Road Traffic + Product Liability Law

🚗 StVG (Road Traffic Act)

• Introduces liability rules for automated driving systems
• Manufacturer responsibility increases in autonomous mode

⚖ Product Safety Law (ProdSG + EU GPSR principles)

• Vehicle software is treated as safety-critical product

2.3 EU Law Overlay

• GDPR applies to driver biometric + behavioral data
• EU Cybersecurity Act applies to connected vehicle infrastructure
• NIS2 Directive affects critical transport infrastructure security

3. Why Autonomous Vehicles Are High-Risk Cyber Targets

Autonomous vehicles are uniquely vulnerable because they are:

• Fully network-connected (5G, LTE, V2X)
• Software-defined machines (continuous OTA updates)
• Sensor-dependent (GPS, cameras, radar fusion)
• Safety-critical systems (cyberattack = physical harm risk)

Thus, German law treats them as “cyber-physical systems”, meaning:

digital intrusion → physical danger → aggravated criminal liability

4. Case Laws Relevant to Autonomous Vehicle Cybercrime (Germany + EU)

Although Germany has limited AV-specific cybercrime cases, courts apply existing cybercrime + data protection + sabotage jurisprudence directly to autonomous systems.

1. BGH – Ransomware / System Locking via Malware

📌 BGH, 1 StR 78/21 (08.04.2021)

• Installing ransomware that locks systems = § 303b StGB (computer sabotage)
• Even indirect system disruption qualifies

👉 AV relevance:
If autonomous fleet vehicles are locked or disabled remotely → computer sabotage applies

2. BGH – Malware-Based System Interference (Trojan doctrine)

📌 BGH, 1 StR 412/16 (27.07.2017)

• Trojan bypassing firewall = § 202a StGB + § 303a StGB
• Protects integrity of data systems, not just secrecy

👉 AV relevance:
ECU malware or CAN-bus injection attacks fall directly under this doctrine

3. BGH – System Sabotage Principles (Data Availability Protection)

📌 BGH, 5 StR 164/16 (11.01.2017)

• Any disruption of data processing systems qualifies as computer sabotage
• Law applies regardless of system legality or purpose

👉 AV relevance:
Disabling autonomous driving sensors or ADAS systems = sabotage even if temporary

4. BGH – Smart Digital Fraud and Automated Systems Manipulation

📌 BGH, 6 StR 557/24 (2025 doctrine on digital manipulation)

• Manipulation of automated digital systems can constitute computer fraud
• Focus on unauthorized data manipulation in networked systems

👉 AV relevance:
Tampering with autonomous taxi billing or routing systems = § 263a StGB

5. ECJ – Digital Rights Ireland (Data Protection in Digital Systems)

📌 Joined Cases C-293/12 & C-594/12

• Mass digital data retention violates EU fundamental rights

👉 AV relevance:
Autonomous vehicles collect massive driving + biometric data → strict limits on retention and access

6. ECJ – Tele2 Sverige / Watson (Targeted Data Access Only)

📌 Joined Cases C-203/15 & C-698/15

• Blanket surveillance/data retention is unlawful
• Requires targeted, proportionate access

👉 AV relevance:
Police access to AV telemetry or black-box data must be strictly justified

7. BGH – IT System Security Protection Doctrine

📌 BGH, 1 StR 370/07 line of jurisprudence

• IT systems are constitutionally protected against unauthorized intrusion
• Extends to complex networked systems

👉 AV relevance:
Autonomous driving platforms are protected “IT ecosystems”

8. ECtHR – S. and Marper v UK (2008)

• Indefinite retention of personal digital data violates privacy rights

👉 AV relevance:
Vehicle driving logs, biometric driving behavior data must not be stored indefinitely

5. Legal Classification of Autonomous Vehicle Cybercrime

6. Key Legal Principle in Germany

German courts treat autonomous vehicles as:

“safety-critical cyber-physical systems where digital interference is equivalent to physical endangerment.”

This leads to:

• higher sentencing severity than traditional hacking
• combined criminal charges (data + physical endangerment)
• strict liability exposure for manufacturers in system failures

7. Emerging Legal Challenges (Important)

7.1 AI responsibility gap

Who is liable when:

• AI misbehaves after cyber intrusion?
• attacker manipulates perception models?

7.2 Over-the-air update vulnerabilities

Legal uncertainty whether:

• manufacturer or hacker-caused update failure triggers liability

7.3 Cross-border attacks

Vehicle systems often rely on cloud servers outside Germany → jurisdiction issues

8. Final Conclusion

Autonomous vehicle cybercrime in Germany is treated as a high-severity hybrid offense area, combining:

• cybercrime law (StGB §§ 202a–202c)
• computer sabotage (§ 303b StGB)
• fraud (§ 263a StGB)
• EU privacy and cybersecurity law
• road traffic safety regulation (StVG)

German and EU case law consistently shows that:

digital attacks on autonomous vehicles are legally treated as threats to physical safety, not just IT systems.