Hacking: The Offence of Illegal System Access (Art. 197 bis CP)

The term hacking covers very different conduct, from technical curiosity to a targeted attack on a company. In criminal law, the core provision is article 197 bis of the Spanish Criminal Code (CP), which punishes illegal access to computer systems, complemented by the supply of tools (art. 197 ter) and by computer damage or sabotage (arts. 264 to 264 ter). As criminal lawyers specialising in computer offences, we explain which conduct is an offence, how it differs from neighbouring figures and how a defence is built.

What Art. 197 bis CP Punishes

The provision contains two forms. The first is illegal access: anyone who, breaching the security measures put in place to prevent it, and without being duly authorised, accesses, or facilitates another person's access to, all or part of an information system, or remains in it against the will of the person with the legitimate right to exclude them. The penalty is imprisonment of six months to two years.

The second form is the interception of communications: anyone who, by technical devices or instruments and without authorisation, intercepts non-public transmissions of computer data taking place from, to or within an information system, including its electromagnetic emissions. The penalty is imprisonment of three months to two years or a fine of three to twelve months. The protected legal interest is the security of information systems in its threefold dimension: confidentiality, integrity and availability.

The Elements of Illegal Access

For the access to be an offence, three requirements must concur, and they define the punishable conduct with precision:

• Breach of security measures: the system had to be protected (passwords, authentication, encryption, firewalls) and the perpetrator gets around that barrier. Accessing an open, unprotected resource does not, on its own, satisfy this requirement.
• Lack of authorisation: the access takes place without the consent of the person entitled to control the system. This is the heart of the offence and, at the same time, the main ground of defence.
• Intent: the perpetrator knows and intends to access without being authorised. Negligent conduct is not punished.

The offence is committed upon effective access to, or remaining in, the system, regardless of whether any information is extracted or any harm is caused. That is why hacking can be an offence even if "nothing was taken".

Supplying Programs and Passwords (Art. 197 ter CP)

The Code extends protection to preparatory acts. Art. 197 ter CP punishes anyone who, without being duly authorised, produces, acquires for use, imports or supplies to third parties, with the intent to facilitate the commission of the offences under art. 197 or art. 197 bis: (a) a computer program designed or adapted principally to commit those offences; or (b) a password, access code or similar data allowing entry into the system. The penalty is imprisonment of six months to two years or a fine of three to eighteen months.

The key to the defence is purpose: many security tools (vulnerability scanners, auditing suites) have a perfectly legitimate dual use. The offence requires the program to be designed principally to commit crime and that the intent to facilitate the offence be present.

Computer Damage and Sabotage (Arts. 264 to 264 ter CP)

Where the attack does not stop at entering but destroys, alters or paralyses, the computer-damage offences come into play:

• Art. 264 CP — damage to data: deleting, damaging, deteriorating, altering, suppressing or rendering inaccessible another person's data, programs or electronic documents, without authorisation and seriously, with a serious result. Penalty of imprisonment of six months to three years; in the aggravated cases (criminal organisation, damage of special gravity, essential public services, critical infrastructure), imprisonment of two to five years and a fine.
• Art. 264 bis CP — system sabotage: seriously obstructing or interrupting the functioning of another person's computer system. Penalty of imprisonment of six months to three years, in its upper half where the activity of a company or public administration is significantly impaired; aggravated up to imprisonment of three to eight years and a fine.
• Art. 264 ter CP — sabotage tools: producing or supplying programs or passwords designed to commit the above damage. Penalty of imprisonment of six months to two years or a fine of three to eighteen months.

Distinction from Disclosure of Secrets and Computer Fraud

Hacking is often confused with other figures from which it should be kept apart:

• Disclosure and revelation of secrets (art. 197 CP): this protects privacy, not the system. It punishes seizing personal data or communications, or disclosing them, with imprisonment of one to four years and a fine, aggravated if there is disclosure. While art. 197 bis punishes the intrusion as such, art. 197 punishes the attack on personal data. A single episode often begins as illegal access and ends up affecting privacy, which gives rise to a concurrence to be resolved case by case.
• Computer fraud (art. 249 CP): this requires intent to profit and an unconsented transfer of assets obtained through computer manipulation (for example, diverting a transfer after compromising online banking). Where illegal access is the means of achieving that transfer of assets, the correct classification and the concurrence relationship are central technical issues.

Legitimate Penetration Testing and Authorisation

Ethical hacking or penetration testing —testing a system's security to find flaws— is only lawful with the holder's authorisation. The defence of a security professional turns on evidencing:

• The existence of a written contract or engagement defining the scope, the authorised systems and the timeframe.
• That the work did not exceed the agreed scope (no access to systems or data outside the engagement).
• Reliance on responsible disclosure or bug bounty programmes, where they exist, as the framework for the activity.

Without evidenceable authorisation, the researcher's good intentions do not exclude the offence: the offence is built on the lack of consent, not on the ultimate purpose.

Lines of Defence

1. Existence of authorisation: the holder's consent or an audit contract that rules out the unauthorised nature of the access.
2. No breach of security measures: the resource was open or there was no technical barrier to get around.
3. Disputing authorship: an IP address or a device does not on its own identify the perpetrator; shared networks, compromised equipment, dynamic IPs and spoofing call for rigorous proof.
4. Challenging the digital evidence: the integrity and chain of custody of logs, images and exhibits; the lawfulness of how they were obtained and, where relevant, of any international cooperation.
5. Classification and concurrence: arguing the fit between arts. 197 bis, 197, 264 and 249 avoids disproportionate penalties from an incorrect classification.
6. Mitigating factors: reparation of the harm, confession or cooperation where appropriate.

In this area, the settled case law of the Supreme Court stresses the requirement of breaching the security measures and of unauthorised access as the pillars of the offence, as well as rigour in assessing the electronic evidence, which leaves a technical margin for defence that should be worked on from the outset.