Attribution of authorship
IP, IMEI and account identify a device or an access, not a person. Shared networks, intrusions and mule accounts are scenarios the defense investigates.
Criminal · offenses committed online
Cybercrime: how the investigation reaches you and what the defense checks
IP addresses, connection logs, bank accounts and messages form the basis of these investigations. Every link in that technical chain can be verified, and that is where the defense works.
Straight answer: which conduct is treated as cybercrime
Brazilian law has no single 'cybercrime'. There are specific offenses, such as intrusion into a computer device (article 154-A of the Penal Code), electronic fraud (article 171, paragraph 2-A), theft through electronic fraud (article 155, paragraph 4-B) and non-consensual sharing of intimate images (article 218-C), as well as ordinary offenses committed online, such as threats, extortion, defamation and fraud. The investigation uses connection and application data provided by providers under the Brazilian Internet Act (Marco Civil).
This page is for persons investigated or accused of online conduct, account holders whose accounts were used by third parties, scam victims treated as suspects, and technology professionals. Practice throughout the State of São Paulo, Brazil, including inland and coastal districts, with in-person meetings in São Paulo (Paulista and Tatuapé offices) or by video call.
What the defense examines in a digital accusation
Lawfulness of data collection
Connection logs and content of communications require a specific court order. Data obtained directly from platforms without an order or beyond its scope can be challenged.
Digital chain of custody
Extraction from phones and computers needs hashes, identified tools and an expert report. Without them, the integrity of the material cannot be verified.
Context of messages
Isolated screenshots omit what came before and after. The defense requests the full conversations and expert examination of authenticity.
Mule accounts and good faith
Whoever lent an account or received funds without knowing about the scam may be investigated. Proof of good faith and spontaneous return are relevant.
Jurisdiction
Online offenses may involve state or federal courts and different districts. Defining the right court avoids nullities and delays.
What to avoid when the investigation begins
Deleting or wiping
Destroying data after learning of the investigation is a separate offense and eliminates evidence that could favor the defense.
Answering informal contacts
Messages from alleged victims, officers or platforms must be preserved, not answered without guidance.
Handing over devices spontaneously
Delivery may be appropriate in some cases, but it must happen with a defined scope and a record, never improvised.
How the technical defense is built
1. Technical mapping
Identifying the data used by the investigation, the court orders behind it and the devices involved.
2. Expert examination and counter-evidence
Independent expert analysis of authorship, integrity and context of the digital material.
3. Procedural defense
Challenging unlawful evidence, responding to the charge and, when applicable, a non-prosecution agreement.
Keep the devices as they are. If you need to keep using them, make a full backup first and record the date. The defense's expert examination depends on the original state of the data.
Frequently asked questions about cybercrime
My bank account received money from a scam. Will I be arrested?
Receiving funds is not a crime by itself. The investigation checks whether there was conscious participation. Returning the money and presenting a documented explanation is usually decisive.
Is evidence obtained from screenshots valid?
It may be admitted, but its weight depends on corroboration. Without the full conversation and an expert examination, the defense can question authenticity and context.
Can the police access my seized phone?
Only with a court order authorizing examination of the contents. Access without that order, or beyond the authorized scope, produces unlawful evidence.
Official references and related pages
Reference legislation for online conduct in Brazil. The exact classification depends on the fact described in the investigation.
Summoned or had devices seized in a digital investigation?
Send what you already know through the secure channel, without deleting anything. The screening identifies the data used against you and what must be preserved.