Cybercrime in Brazil: The Carolina Dieckmann Law and the Marco Civil da Internet

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Cybercrime in Brazil is regulated mainly by Law 12.737/2012, known as the Carolina Dieckmann Law, and by the Marco Civil da Internet (Brazil’s Internet Bill of Rights, Law 12.965/2014). Together, they define criminal offenses and set rules for preserving data.

Advances in technology have brought new forms of crime, calling for specific legislative responses. Today, attacks on devices, data leaks, and online fraud each have their own classification in Brazil’s legal system.

The Carolina Dieckmann Law

Law 12.737/2012 created the crime of unlawful intrusion into a computer device, set out in Article 154-A of the Criminal Code. It punishes anyone who breaks into another person’s device, whether or not it is connected to a network, in order to obtain, alter, or destroy data without authorization. The penalty is detention from three months to one year and a fine, increased when the data obtained is disclosed.

The law took its popular name from the case of the actress whose intimate photos were leaked after her computer was hacked. The episode sped up a bill that had been waiting in Congress for years.

The Marco Civil da Internet

The Marco Civil sets out principles and rights for users, along with obligations for internet providers. It requires providers to keep connection records for one year and application records for six months, which plays a central role in investigating digital crimes.

The law also establishes net neutrality, privacy, and data protection, and it sets rules on civil liability for third-party content, which directly affects cases involving social media.

The Marco Civil sets out principles and rights for users, along with obligations for internet providers.

Other Digital Crimes

Beyond these specific provisions, traditional crimes have moved into the online environment. Fraud, threats, insult, calumny, defamation, and child pornography are frequently committed over the internet and are punished under the same offenses in the Criminal Code, with aggravating circumstances when digital means are used to widen the reach of the offense.

The General Data Protection Law

The LGPD (Brazil’s General Data Protection Law, Law 13.709/2018) rounds out the system by imposing obligations on anyone who processes personal data and by providing for severe administrative sanctions. Although it does not create criminal offenses, it adds another layer of responsibility for companies and institutions.

Law 14.155/2021 and Harsher Penalties

Law 14.155/2021 was enacted in response to the growth of digital scams in Brazil. It amended Article 154-A of the Criminal Code, raising the minimum penalty for unlawful intrusion into a computer device to one year and the maximum to four years of imprisonment, plus a fine. The new wording also expanded the aggravated forms of the offense, reaching conduct against authorities and operations against the information systems of public agencies.

The same law created an aggravated form of fraud committed by electronic means, set out in Article 171, paragraph 2-A, with a penalty of four to eight years, recognizing the particular seriousness of online banking fraud. These changes reflect a criminal policy of greater severity to keep pace with increasingly sophisticated scams.

Jurisdiction and Digital Evidence

Determining jurisdiction in cybercrime cases is often debated. As a rule, the place where the crime was completed applies, meaning the place where the result occurred. In bank fraud cases, the STJ (Brazil’s Superior Court of Justice) has held that the court where the branch holding the victim’s account is located has jurisdiction, which directly affects where the case is filed.

Digital evidence, in turn, requires a rigorous chain of custody. Access logs, metadata, forensic images, and technical expert analysis must be collected in a way that preserves their integrity, or the evidence may be tainted. Joint work by the defense, the Public Prosecutor’s Office, and official experts is essential to validate or challenge the material facts of the crime in court.

Social Engineering Scams and Phishing

Among the most common practices in cybercrime is phishing, in which the offender poses as a legitimate institution to trick the victim into handing over banking credentials, passwords, or personal data. This conduct falls under fraud aggravated by electronic means, with significantly harsher penalties since Law 14.155/2021 was enacted.

Social engineering, for its part, does not depend on advanced technical knowledge: the criminal exploits human weaknesses, such as trust and a sense of urgency, to gain access to systems or information. Fake calls from bank call centers, messages from supposed relatives in trouble, and emails with malicious links are the most common methods recorded by specialized police stations.

A victim who has suffered a financial loss from phishing can file a police report at a cybercrime police station and take action against the bank for a security failure, depending on the circumstances of the case. Holding the offender criminally liable while also holding the financial institution civilly liable is, in many cases, legally viable.

Revenge Porn and Digital Crimes Against Honor

The unauthorized disclosure of intimate images, popularly known as revenge porn, is defined as a crime in Article 218-C of the Criminal Code, with a penalty of one to five years of imprisonment. The crime is complete with the mere disclosure, regardless of whether the victim originally consented to the material being obtained.

Crimes against honor committed on the internet, such as insult, calumny, and defamation, follow the offenses in the Criminal Code, but they take on specific features when committed on social media or messaging apps. The potential reach of a post, which can hit thousands of people within seconds, is taken into account by the courts when calculating the sentence and setting civil compensation.

The right to be forgotten, although not established in any specific statute, is recognized in court decisions as a basis for removing unlawful content from digital platforms. The victim can request the immediate removal of the material through urgent injunctive relief, and combine that request with a claim for moral damages.

Police Investigation and International Cooperation

Investigating cybercrime involves technical steps that differ from conventional investigations. The police authority can request that providers preserve records and later obtain the lifting of confidentiality with a court order. The retention period set by the Marco Civil is decisive: once it expires without a formal request, the provider may delete the data.

When the server or the offender is located abroad, Brazil relies on international legal cooperation treaties and on letters rogatory to obtain evidence and, where applicable, to request extradition. Countries that have no bilateral agreement with Brazil are a real obstacle to criminal prosecution, which underscores the importance of opening an investigation quickly and requesting data in time.

Police stations specialized in cybercrime, found in most Brazilian states, have technical teams trained in digital forensic analysis. Filing a police report is the mandatory first step for an investigation to be opened and for relevant data to be preserved before providers’ systems automatically delete it.

Frequently Asked Questions

Is hacking someone’s WhatsApp a crime?

Yes. It constitutes unlawful intrusion into a computer device under Article 154-A. The penalty can be increased when confidential content, such as private conversations, is obtained, or when the information accessed is disclosed. Depending on the facts, it may be charged together with other crimes, such as fraud.

Is sharing a leaked conversation also a crime?

It can be. If you knew the content came from an unlawful source and helped spread it, you may be held liable under the aggravated form of the intrusion offense, for insult or defamation, and even for violation of privacy, depending on the specific case. The analysis depends on the content and the context.

Do providers hand over the criminal’s data?

Only with a court order. The Marco Civil requires a judge’s authorization for providers to release records and content. However, the police authority can ask administratively for the data to be preserved, to prevent its loss before the court rules.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.