With the advancement of technology and the increasing digitalization of social, economic, and political relations, cybercrimes have become a central concern for legal authorities worldwide. In Brazil, the challenge of adapting criminal law to this new scenario is becoming increasingly urgent, since the internet has been used to commit crimes such as fraud, theft of personal data, dissemination of fake news, cyberbullying, money laundering, and even attacks against critical infrastructure.
In this article, we will explore how Brazilian criminal law is adapting to this new digital reality, addressing everything from the creation of new laws to the reformulation of existing provisions, as well as the challenges that still need to be overcome in the fight against digital crimes.
1. The Emergence of Cybercrimes and the Legal Challenge
The internet has opened up new possibilities for social and commercial interaction, but it has also facilitated the practice of digital crimes, ranging from unauthorized access to systems and theft of personal information to more complex attacks such as ransomware and intrusions into government databases. Traditional criminal law often failed to foresee the nuances of these new offenses, which has meant that the legal system has needed to evolve to meet these challenges.
Anonymity and the consequent difficulty in identifying criminals, inherent characteristics of cybercrimes, since crimes committed digitally tend to offer a layer of security to their perpetrators, hinder the application of traditional criminal law norms, as illicit behavior can occur in different jurisdictions simultaneously and extremely quickly. This requires not only modern legislation, but also greater and easier international cooperation between States.
2. Evolution of Criminal Law in Brazil
The evolution and adaptation of Brazilian criminal law has already begun, albeit slowly, driven mainly by some high-profile cases that highlight certain gaps in the legislation and by the increase in crimes committed through electronic means.
Below are some examples of rules introduced into the national legal system in recent decades with the aim of offering greater protection against these illegal practices and increasing the likelihood of holding criminals accountable.
2.1. Law No. 12.737/2012 – The Carolina Dieckmann Law
A significant milestone in the evolution of criminal law in Brazil is Law No. 12.737/2012, better known as the Carolina Dieckmann Law. This law was created after the actress had her personal photos stolen from her personal computer, which had been hacked, and published on the internet without her authorization, following threats against her. The law amended the Penal Code by including Article 154-A and other provisions to criminalize the invasion of computer devices.
The Carolina Dieckmann Law defines as a crime the invasion of computers, tablets, cell phones, and other computer devices with the objective of obtaining, altering, or destroying data without the express authorization of the owner. Penalties for this crime range from 3 months to 1 year of imprisonment, in addition to a fine, and can reach 2 years if the invasion results in obtaining private content, such as trade secrets or confidential information.
This was a crucial and significant step in adapting Brazilian legislation to the new digital reality, and since then, the country has implemented and developed new legal mechanisms to deal with the various forms of cybercrime.
2.2. Brazilian Internet Bill of Rights (Law No. 12.965/2014)
Another important advancement in Brazilian regulations was the Marco Civil da Internet (Brazilian Internet Bill of Rights), created by Law No. 12.965/2014, which became the main regulatory framework for the internet in Brazil. Although this law has a focus more directed towards the rights and duties of users and service providers on the internet, it also contributes to and serves as a benchmark for protection against digital crimes.
The Brazilian Civil Rights Framework for the Internet establishes principles such as net neutrality, privacy protection, and the responsibility of service providers. For example, a relevant aspect for the prevention of cybercrimes is the provision that internet providers can be held liable for offensive content if, after judicial notification, they fail to remove the illicit material.
2.3. General Data Protection Law (LGPD) – Law No. 13.709/2018
The General Data Protection Law (LGPD), enacted in 2018, was a direct response to the increase in crimes or "immoral" conduct involving the improper handling of personal data.
Although not a typical criminal law provision, the LGPD (Brazilian General Data Protection Law) establishes clear guidelines on how companies and institutions should collect, store, and process personal data, as well as creating accountability mechanisms in cases of data leaks or misuse. The law seeks to protect citizens' rights to privacy and control over their data. Violation of these rules can result in administrative and financial penalties for companies, in addition to guaranteeing victims the right to compensation.
3. New Crimes and the Brazilian Penal Code
With the increasing sophistication of digital crimes and the way internet users utilize the internet, as demonstrated, the Brazilian Penal Code has needed to undergo significant updates to include criminal offenses related to this new reality.
In addition to the inclusion of Article 154-A by the Carolina Dieckmann Law, already mentioned, which criminalizes the invasion of computer devices, another relevant inclusion by this law was Article 266, which deals with the crime of interruption or disruption of telegraphic, radiotelegraphic, or telephone services, adapted to also encompass the interruption of internet services. This includes DDoS (Distributed Denial of Service) attacks, which overload servers and websites with an excessive flow of data, causing instability or service outages.
Furthermore, a recent addition in 2021 was to Article 171 of the Penal Code, which deals with the crime of fraud, and its application was expanded to include electronic fraud, which is increasingly common, especially in scams carried out through social networks, fraudulent emails, card cloning, creation of fake websites, among others. The penalty for these offenses is 4 to 8 years, plus the possible application of a fine.
4. Challenges in Applying Criminal Law to Cybercrimes
Despite the progress made in Brazilian criminal law in recent years, many challenges remain when it comes to cybercrime, and the regulations still need updating.
One of the biggest problems faced is the fact that many cybercrimes are committed outside national borders, or even in several countries at the same time, which creates difficulties in identifying those responsible and even in applying Brazilian law. International cooperation between states is often complicated by legal differences between countries, making the fight against these crimes a global challenge, to the point that the United Nations (UN) has promoted measures to facilitate the fight against this type of crime.
Another challenge is the anonymity (or at least the feeling of anonymity) that the internet offers to criminals. Often, those responsible for illegal online activities are hidden through virtual private networks (VPNs), TOR browsers, and other methods that make tracking difficult. This requires authorities to develop new technological tools and digital investigation techniques to identify and punish criminals.
Although Brazil has adopted several important measures, such as the Carolina Dieckmann Law and the Marco Civil da Internet (Brazilian Internet Bill of Rights), the constant evolution of technology demands a constant updating of criminal legislation. New types of crimes, such as cyberattacks on critical infrastructure, crimes against honor, and the use of cryptocurrencies for money laundering, require more specific and modern regulations, as well as the creation of a more efficient oversight system.
5. Conclusion and Future Perspectives
Cybercrimes are a growing and complex reality that constantly challenges Brazilian and international criminal law. From the enactment of the Carolina Dieckmann Law to the creation of legal frameworks such as the LGPD (Brazilian General Data Protection Law) and the Marco Civil da Internet (Brazilian Internet Bill of Rights), Brazil has demonstrated continuous efforts to confront these new forms of crime.
Nevertheless, the challenges are many. International cooperation, the development of new digital investigation tools, and the constant updating of laws will be crucial to ensuring that criminal legislation remains effective in the face of the rapidly transforming digital landscape.
Brazilian criminal law is constantly adapting to meet new digital challenges, but rapid technological changes indicate that further updates and adjustments will be necessary in the coming years. The need for new laws addressing cybersecurity in critical infrastructures, such as power grids and financial systems, is evident, given the increase in cyberattacks on these sectors.
Furthermore, the trend is for legislation to become increasingly focused on protecting personal data, as the use of artificial intelligence and big data advances and data proves to be an important resource with financial value. The integration between criminal law and technological regulation will be increasingly important to prevent and adequately punish digital crimes, promoting a safer internet for all.
References
ARAÚJO, Janaína. Ten years of the Carolina Dieckmann Law: the first to punish cybercrimes. Rádio Senado , March 29, 2023. Available at: https://www12.senado.leg.br/radio/1/noticia/2023/03/29/dez-anos-de-vigencia-da-lei-carolina-dieckmann-a-primeira-a-punir-crimes-ciberneticos . Accessed on: October 20, 2024.
BARBAGALO, Fernando Brandini. The new crime of electronic fraud and the principle of legality. Court of Justice of the Federal District and Territories , 2022. Available at: https://www.tjdft.jus.br/institucional/imprensa/campanhas-e-produtos/artigos-discursos-e-entrevistas/artigos/2022/o-novo-crime-de-fraude-eletronica-eo-principio-da-legalidade . Accessed on: October 21, 2024.
BRAZIL. Decree-Law No. 2.848, of December 7, 1940. Penal Code. Official Gazette of the Union , Brasília, DF, December 31, 1940. Available at: https://www.planalto.gov.br/ccivil_03/decreto-lei/del2848compilado.htm . Accessed on: October 13, 2024.
BRAZIL. Law No. 12.737, of November 30, 2012. Provides for the criminalization of computer crimes. Official Gazette of the Union , Brasília, DF, Dec. 3, 2012. Available at: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2012/lei/l12737.htm . Accessed on: Oct. 13, 2024.
BRAZIL. Law No. 12.965, of April 23, 2014. Establishes principles, guarantees, rights and duties for the use of the Internet in Brazil (Marco Civil da Internet). Official Gazette of the Union , Brasília, DF, April 24, 2014. Available at: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm . Accessed on: October 13, 2024.
BRAZIL. Law No. 13.709, of August 14, 2018. Provides for the protection of personal data (General Data Protection Law – LGPD). Official Gazette of the Union , Brasília, DF, August 15, 2018. Available at: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm . Accessed on: October 13, 2024.
CAMPELO, Marcelo. Cybercrimes – Interruption or disruption of computer services – Art. 266 – Penal Code. Migalhas , Apr. 10, 2023. Available at: https://www.migalhas.com.br/depeso/384516/crimes-ciberneticos–interrupcao-de-servicos-informaticos . Accessed on: Oct. 21, 2024.
Cybercrimes. United Nations Office on Drugs and Crime – UNODC . Available at: https://www.unodc.org/lpo-brazil/pt/covid19/cibercriminalidade-e-desinformacao.html . Accessed on: October 21, 2024.
What is the LGPD? Federal Public Prosecutor's Office – MPF . Available at: https://www.mpf.mp.br/servicos/lgpd/o-que-ea-lgpd . Accessed on: October 21, 2024.
RAMOS, Rahellen. What is the Brazilian Internet Bill of Rights? Politize , August 06, 2021. Available at: https://www.politize.com.br/marco-civil-da-internet/#:~:text=Entre%20idas%20e%20vindas%2C%20mesmo,de%20busca%20pelos%20resultados%20indexados . Accessed on: October 20, 2024.
SABINO, Marco Antonio da Costa. FIA Business School , November 05, 2020. Available at: https://fia.com.br/blog/anonimato-na-internet/#:~:text=Anonimato%20na%20internet%20%C3%A9%20uma,poderiam%20revelar%20quem%20ele%20%C3%A9.. . Accessed on: October 21, 2021.
