Cybercrime Legislation & Case Law

First autonomous codification of computer integrity and telematics inviolability in the Brazilian Criminal Code (Art. 154-A). Established the offense of hacking via breach of security mechanisms to obtain, alter, or destroy data, or install malicious software (analogous in scope to the US CFAA § 1030 and UK Computer Misuse Act).

Established the structural legal architecture for the internet in Brazil, bifurcating connection logs (ISPs, 1-year mandatory retention) and application access logs (platforms, 6-month mandatory retention). Strictly mandates prior judicial warrants for communications disclosure (comparable in scope to EU E-Privacy & US Stored Communications Act).

Standardized data governance, transparency, and processing principles modeled after the EU GDPR. Statutorily exempts criminal investigation and national security from standard commercial consent regimes (Art. 4, III) while mandating strict proportionality and institutional safeguards.

Inserted Arts. 158-A to 158-F into the CPP, establishing a mandatory, chronological traceability framework for digital and physical evidence across 10 statutory stages: recognition, isolation, fixing, collection, packaging, transport, receipt, processing, storage, and disposal (aligning with ISO/IEC 27037:2012 standards).

Settled that ISPs operating under Carrier-Grade NAT (Large Scale NAT) architectures are legally obligated under the Marco Civil to log and disclose the source port (RFC 6888) alongside the public IPv4 address and UTC timestamp to identify individual subscribers.

Binding ruling by the 1st Section of the STJ holding that multinational internet services operating in Brazil through local subsidiaries are subject to Brazilian sovereignty, regardless of where remote data centers are located.

Quadrupled penalties for Art. 154-A (enabling pre-trial detention and wiretaps) and created aggravated electronic fraud (Art. 171 § 4) and electronic larceny (Art. 155 § 4-B) with 4-to-8 year prison sentences. Shifted territorial venue to the victim's domicile (CPP Art. 70 § 4).

The 3rd Section of the STJ established the validity of judicial orders compelling search engines and application providers to produce connection logs of users executing specific keyword queries within delimited timeframes, provided strict necessity and proportionality tests are satisfied.

Promulgated the Budapest Convention into Brazilian domestic law, harmonizing substantive cyber offenses, procedural powers (production orders, expedited preservation, live interception), and direct mutual legal assistance channels.

Settled superior court jurisprudence mandating that physical device seizure during search warrants or in flagrante arrests does NOT authorize forensic extraction of messaging apps (WhatsApp, Signal, Telegram) without explicit, specific judicial data disclosure authorization.

Introduced systematic virtual intimidation (cyberbullying) into Art. 146-A of the Criminal Code (2-to-4 year prison terms) and amended the Heinous Crimes Act (Law 8.072/90) to classify child sexual abuse material possession and transmission as heinous offenses with no bail or amnesty.

Landmark Supreme Court ruling originating in the Marielle Franco assassination investigation validating judicial geofence orders compelling Google to identify accounts present within specific geographic polygons and timeframes, subject to strict subsidiarity and third-party privacy protections.

The first universal cybercrime treaty approved by the UN General Assembly (with Brazil as negotiation committee vice-chair). Extends international legal cooperation beyond Western states, establishing real-time data preservation, cryptoasset tracing, and e-evidence admissibility standards across 190+ member states.

Mandatory upgrade of the Special Return Mechanism (MED) by the Central Bank of Brazil. Enables automated interbank tracing and simultaneous multi-tier asset freezing across mule accounts, extending victim dispute windows to 80 days.

Regulatory decrees implementing Marco Civil diligence standards. Mandates that platforms remove non-consensual AI-generated synthetic intimate imagery (DeepNudes) within 2 hours of formal notification, under strict administrative fines enforced by the ANPD.

Overhauled special investigative techniques in cyberspace. Codified virtual police patrolling across open forums and darknet networks to prevent crimes against vulnerable persons, regulated undercover cyber infiltration using synthetic online identities, and authorized emergency metadata production in imminent life-threat scenarios.