Back Brazil

Status regarding Budapest Convention

Status regarding Budapest Convention

Status : Party See legal profile

Cybercrime policies/strategies

Decreto Nº 9.637 (Dec 2018) launched Brazil’s National Policy on Information Security (Política Nacional de Segurança da Informação –PNSI), which introduces principles for national information security (including data protection, respect for human and fundamental rights; security of confidential information and critical infrastructures; and international cooperation). One of its key objectives is to continuously improve the legal and regulatory framework on information security. PNSI also introduced the roles of the Institutional Security Office of the Presidency of the Republic and its advisory body (the Information Security Management Committee), including the mandate of drafting the National Information Security Strategy.

PNSI established also the National System for Digital Transformation (SinDigital), which includes the Brazilian Strategy for Digital Transformation/ Estratégia Brasileira para a Transformação Digital (E-Digital, 2018) as a federal government initiative, coordinated by the Ministry of Science, Technology and Innovation/ Ministério da Ciência, Tecnologia e Inovações (MCTI). An Inter-Ministerial Working Group developed the said public policy which includes an axis focused on Building Trust and Confidence in the Digital Environment/ Defesa e Segurança no Ambiente Digital, referring also to “the need for a broad review and integration of legislation aimed at combatting cybercrime”.

In February 2020, the National Cyber Security Strategy – E-Ciber (Estratégia Nacional de Segurança Cibernética, Decreto Nº 10.222) was adopted. E-Ciber recognizes the importance of addressing cybercrimes in this context, from having an adequate cybercrime legal framework, to providing and ensuring for their reporting and investigation, to the training of professionals and improving citizens’ awareness and reporting of such crimes. Among its strategic objectives, it proposes the establishment of a centralized governance model for the country, through the creation of a national cybersecurity system. Some of its roles would be to:

  • promote joint analysis of the challenges faced in combating cybercrime;
  • improve the national cybercrime investigation infrastructure;
  • create a national cybersecurity council;
  • receive complaints, investigate incidents and promote awareness and education in society on the subject.

Other relevant strategic objectives focus on the improvement, review, and update of existing regulations and the legal framework on cybersecurity, addressing new issues and developing new instruments, as well as the expansion of Brazil’s international cooperation in the field. Examples of recommended actions:

  • identify and address issues missing from current legislation;
  • make efforts to include in the Penal Code, Decree-Law No. 2.848 (Dec 1940), new classifications for cybercrimes;
  • prepare regulations on emerging technologies;
  • expand the use of international mechanisms to combat cybercrime (e.g. pursue mutual legal assistance treaties).

E-Ciber notes that Brazil also needs to strengthen and improve its government bodies which deal with threats and the fight against cybercrimes. Among the actions recommended in this sense are: (1) the Government Cyber ​​Incidents Treatment and Response Center (CTIR Gov) – as the central government agency that coordinates and carries out actions aimed at the management of computer incidents, should be granted action at the national level; and (2) improve the national structure for investigating cybercrimes.

The Parliamentary Inquiry Commission on Cybercrime/ CPI de Crimes Cibernéticos (2015-2016), produced a report assessing the country’s legislation in 2016, in which it recommended a number of draft bills and other policy recommendations.

By Legislative Decree no. 37 of 2021, the Congress of Brazil approved the accession to the Budapest Convention.

Cybercrime legislation

Over the years, cybercrime has preoccupied the legislator significantly, with both houses of Congress proposing several amending draft laws to the Penal Code and Criminal Procedure Code in this respect. The following legislation incorporates or is dedicated to specific aspects regarding cybercrimes and electronic evidence:

Penal Code/ Código Penal – Decreto-Lei Nº 2.848 (Dec 1940);

Law/ Lei Nº 12.737 (Nov 2012), amending the Penal Code with some substantive provisions on cybercrimes;

Law/Lei Nº 14.155 (May 2021), amending the Penal Code and Criminal Procedure Code (with impact on cybercrime offences and competence);

Law/ Lei Nº 8.069 (Jul 1990) – statute of children and adolescents;

Criminal Procedure Code/ Código de Processo Penal – Decreto-Lei Nº 3.689 (Oct 1941).

Law/ Lei Nº 9.296 (Jul 1996) – on interception of communications;

Law/ Lei Nº 9.610 (Feb 1998) – Brazilian Copyright Law;

Law/ Lei Nº 9.609 (Feb 1998) – on intellectual property of computer programmes (Brazilian Software Law);

Brazilian Internet Law/ Marco civil da Internet – Lei Nº 12.965 (Apr 2014) – rights and obligations of internet use;

Lei Nº 12.965 (2014), known as the Brazilian Internet Law aims to consolidate the rights, duties and principles for the use and development of the Internet in Brazil. It also provides for the ISPs to retain connection data.

Currently, the Congress of Brazil is debating a draft law amending the Criminal Procedure Code, defining the rules for obtaining and admissibility of digital evidence in criminal proceedings.

Cybercrime legislation

State of cybercrime legislation

Legislative process

The legislative process is initiated with the proposal of an ordinary or supplemental law (a bill of law) by:

  • any member or committee of the Chamber of Deputies, Federal Senate, or National Congress;
  • the President of the Republic;
  • the Federal Supreme Court and Higher Federal Courts;
  • the Attorney General of the Republic;
  • any ordinary citizen in the manner and cases provided for in the Constitution of 5 October 1988.

A bill approved by one Chamber must be reviewed by the other in a single round of discussion and voting. If the reviewing Chamber approves the bill, it must be sent for enactment or promulgation, or if it is rejected, it must be archived. If a bill is amended, it must return to the Chamber that initiated it.

After being approved by the reviewing house, a bill is then sent to the President for final approval or veto. If approved by the President, it becomes law forty-five days after its publication in the Official Gazette (Diário Oficial), or within the period of time established in the bill.

The President can veto a bill of law in whole or in part if he/she considers it unconstitutional or contrary to the public interest. The veto must occur within fifteen working days, counted from the date of receipt, and the President must inform the President of the Senate of the reasons for his/her veto within forty-eight hours. After a period of fifteen days has elapsed, silence on the part of the President of the Republic operates as an approval.

A presidential veto is examined in a joint session, within thirty days counted from the date of receipt, and may be rejected only by the absolute majority of the Deputies and Senators through secret voting. If the veto is not upheld, the bill is sent to the President for promulgation. (US Library of Congress, 2020)

Cybercrime legislation

Over the years, cybercrime has preoccupied the legislator significantly, with both houses of Congress proposing several amending draft laws to the Penal Code and Criminal Procedure Code in this respect. The following legislation incorporates or is dedicated to specific aspects regarding cybercrimes and electronic evidence:

Lei Nº 12.965 (2014), known as the Brazilian Internet Law aims to consolidate the rights, duties and principles for the use and development of the Internet in Brazil. It also provides for the ISPs to retain connection data.

Currently, the Congress of Brazil is debating a draft law amending the Criminal Procedure Code, defining the rules for obtaining and admissibility of digital evidence in criminal proceedings.

Substantive law

The Penal Code of 1940 was amended in 2012 and further in 2021 and as effect, new cybercrime offences were included or amended and/or heavier sanctions were included for several cybercrime offences.

As such, in 2012, Law 12.737 introduced into the Penal Code the crimes of illegal access, illicit dissemination of devices and denial of service (Articles 154-A, 154-B, and 266). It also criminalized the counterfeit of credit cards.

Illegal interception is provided for in article 10 of the Law 9.296/96.

The Statute of the Child and Adolescent (Estatuto da Criança e Adolescente), Law 8.069/1990, in articles 240, 241-A, 241-B, 241-C and 241-E, provides for punishment of factuality related to digital child pornography., while the law Nº 13.185 of 2015 focuses on online bullying.

Procedural law

The Brazilian legal framework does not provide specific provisions on digital evidence. There are also no specific international judicial cooperation rules in the area of cybercrime. Some procedural powers still exist in other laws:

  • Article 10,§3º Law 12.965 (2014) allows police authorities and the Public Attorney's Office to request directly to service providers to grant access to users' subscriber data (not included IP addresses which depend on a court order).
  • Article 10 of Law 12.965/2014 provides that a court order is required for providers to make available connection records, as well as stored content of private communications.
  • The provisions of the Criminal Procedure Code on traditional search and seizure (art. 240 of the Criminal Procedure Code) are use also for search and seizure of stored computer data.
  • Interception of communications is regulated by Law 9.296/1996, allowing the interception on both telephone and information technology systems in the scope of criminal investigations. Setting up an interception is conditioned by a court order and the request must be justified by a reasonable suspicion of the crime and by the impossibility of obtaining evidence by other means.
  • The new article 10-A of Law 12.850 (2013) included and regulated the possibility of virtual infiltration by police agents.
  • Article 38 of ANATEL Resolution 596/2012 allows the agency to directly request access to account information and call records of users from service providers.

Safeguards

The Brazilian Federal Constitution (1988) generally protects the right to privacy, including the secrecy of correspondence, telegraphic, telephone and data communications. The amendments of February 2022 brought on the Constitution included the right to the protection of personal data, including in digital media, is ensured under the law, as a constitutional fundamental right.

Law 12.965 (Marco Civil da Internet, 2014) provides safeguards on article 7 which ensures the secrecy of private stored data, which can be disclosed only by a judicial order, and the secrecy of communications flow, which can be disclosed only by a judicial order with the limits specified in the law.

The Interception law also contains safeguards, the period for surveillance may not exceed 15 days, but it can be renewed for equivalent periods under strict court scrutiny and only when it is the sole means to investigate a crime.

Related laws and regulations

Specialised institutions

Specialised institutions

  • The Federal Police has since 2003 a Cybercrime Enforcement Service (Serviço de Repressão a Crimes Cibernéticos – SRCC), under the command of the Directorate for Investigation and Combat of Organized Crime (DICOR).
  • At the level of the Ministry of Justice and Public Security (MJSP), there is a Cyber Operations Laboratory (Laboratório de Operações Cibernéticas) within the Integrated Operations Secretariat.
  • The Federal Prosecution Service has a National Advisory Group (Grupo de Apoio sobre Criminalidade Cibernética - GACC) under the Criminal Chamber of the Prosecutor General’s Office since 2011. São Paulo and Rio de Janeiro have specialized cybercrime units, mainly dedicated to online child pornography and hate speech cases, since 2003 and 2006, respectively.
  • Government Cyber Incident Treatment and Response Center (Centro de Tratamento e Resposta a Incidentes Cibernéticos de Governo): is part of the Information Security Department (DSI) of the Institutional Security Office of the Presidency of the Republic and is the national coordination Computer Security Incident Response Team (CSIRT).
  • The CTIR Gov is a "Computer Security Incident Response Team (CSIRT)", or Group Security Incident Response, responsible organization to receive, analyze and respond to reports and activities related to security incidents on computers.
  • The Internet Steering Committee (Comitê Gestor da Internet) is responsible for establishing strategic guidelines related to the use and development of the Internet in Brazil and also coordinates the activity of the Brazilian CERT.

Cybersecurity governance structure (mostly according to the E-Ciber policy - PT):

national responsibility centers:

international coordination centers:

critical infrastructure CSIRTs:

provider CSIRTs:

corporate CSIRTs: CERT-RS, SEGTIC UFRJ, CSIRT Unicamp;

public institutions CSIRTs:

military CSIRTs:

International cooperation

Competent authorities and channels

The Ministry of Justice and Public Security, through the Department of Asset Recovery and International Legal Cooperation of the National Secretariat of Justice (DRCI/Senajus) acts as the Central Authority for International Legal Cooperation. As provided in Decree No. 9662 of 1 January 2019, the processing of measures relating to extradition and the transfer of convicted persons is the competence of the same Department of Asset Recovery and International Legal Cooperation of the National Secretariat of Justice. With the aim of improving the processing flow of extradition requests, giving this process greater celerity, Ordinance No. 217 of 27 February 2018 was published.

International Cooperation Unit (SCI) at the Federal Prosecution Service (MPF) is attached to the Office of the Prosecutor General and has been assisting the Office of the Prosecutor General since 2005 in matters of international judicial and legal cooperation with foreign authorities and international organizations, and in relations with national bodies involved in international cooperation activities.

Jurisprudence/case law

Sources and links

Print Brazil
Tools on Cybercrime & Electronic Evidence Empowering You!

These profiles do not necessarily reflect official positions of the States covered or of the Council of Europe. 

Contribute

  Are you aware of the latest legislative or policy developments on cybercrime and electronic evidence?

  Share this information with us helping to keep this platform up to date.

Useful links