Specialist Cybercrime Attorneys in Spain

These proceedings rarely start with an arrest: they start with a request to the network operator, a device image or a complaint from the injured company, and the suspect finds out weeks later when the court summons arrives. The applicable offence depends on the conduct. Unauthorised access to an information system by breaching its security measures carries 6 months to 2 years' imprisonment (Art. 197 bis 1 CP). Seriously deleting or altering another party's data, programs or electronic documents carries 6 months to 3 years, rising to 2 to 5 years plus a fine where the circumstances of Art. 264.2 CP apply. And obtaining a non-consented transfer of assets through computer manipulation is punished as fraud, with 6 months to 3 years (Art. 249.1.a CP).

• Do not touch the devices or delete anything. Deletion shows up in the forensic image and is read as concealment. It also destroys the metadata that usually proves the access was authorised or that several people used the machine.
• Ask for the digital chain of custody from day one. Hashes of the copies, the imaging record, who seized the device and when. A broken chain is the most effective challenge in these cases, and it can only be raised if the paperwork is requested in time.
• Do not reply in writing to the injured company. Self-drafted explanatory emails are later produced as an admission and, in computer offences, they usually supply precisely the technical detail the prosecution was missing.
• Gather the evidence of your authorisation to access. The contract, the acceptable-use policy, credentials assigned to you, internal tickets or the email asking you to act. Authorisation, even informal, rules out Art. 197 bis CP.

Cybercrime covers the set of offences committed through information and communication technologies, regulated dispersedly in the Spanish Criminal Code: discovery and disclosure of secrets (Arts. 197-201 CP), illicit access to computer systems (Art. 197 bis), computer damage and system obstruction (Arts. 264-264 ter), computer fraud (Art. 249.1.a CP), banking fraud and phishing, digital identity theft (Art. 401 CP), threats and harassment by digital means (Arts. 169-172 ter), child pornography (Art. 189 CP) and grooming (Art. 183). Supreme Court doctrine has consolidated criteria on electronic evidence, digital chain of custody, validity of forensic dumps and constitutional limitations on technological interventions. The protected legal interest is plural: privacy, secrecy of communications, integrity of computer systems, patrimony and collective security.

The commission modalities have proliferated at the pace of technology. Hacking covers unauthorized access to systems by breaching security measures, creation or distribution of exploits and introduction of backdoors. Phishing and its variants (spear-phishing, smishing, vishing, spoofing, CEO fraud) constitute technical fraud combined with social engineering, where "banking mules" are frequently accused as necessary cooperators. Ransomware and DDoS attacks are computer damage crimes that can affect critical infrastructure. Cryptocurrency fraud (rug pulls, fraudulent ICOs, crypto Ponzi schemes, mixing) requires specialized blockchain traceability. Paradigmatic current cases are SIM swapping, voice-cloning deepfakes, AI-driven digital cloning, labour intrusions (corporate espionage Art. 278 CP) and attacks on financial, health and energy sector infrastructure.

The statutory penalties are severe and modulated by type and aggravators. Illicit access to systems (Art. 197 bis CP) carries 6 months to 2 years' prison, and the penalty one degree higher if committed within a criminal organisation or group (Art. 197 quater CP). Disclosure of secrets (Art. 197 CP) carries 1 to 4 years' prison and a fine in its basic form; 2 to 5 years if the data or images are disseminated (Art. 197.3), the upper half of the range if sensitive data or a minor victim are involved (Art. 197.5), and 4 to 7 years where there is a profit motive and sensitive data are affected (Art. 197.6). Computer damage (Art. 264 CP) carries 6 months to 3 years' prison; aggravated (Art. 264.2), 2 to 5 years plus a fine, including where critical infrastructure is affected; obstructing or interrupting a system (Art. 264 bis) carries 6 months to 3 years, and 3 to 8 years with the same circumstances. Computer fraud (Art. 249 CP) carries 6 months to 3 years' prison, and 1 to 6 years where an aggravating circumstance of Art. 250 applies. Identity theft (Art. 401 CP), 6 months to 3 years' prison. Grooming carries 1 to 3 years' prison or a fine (Art. 183.1 CP), and child pornography 1 to 5 years, rising to 9 in the aggravated cases (Art. 189 CP). Additionally, courts may impose special disqualification from the profession or trade directly linked to the offence (Art. 56 CP), forfeiture of equipment and servers and civil compensation for patrimonial and reputational damage.

The technical defence rests on four consolidated axes. First, IP attribution challenge: case-law recalls that an IP address identifies a connection, not necessarily the user behind the keyboard; shared WiFi networks, dynamic IPs, VPN/Tor use and device malware sow reasonable doubt. Second, digital chain of custody: forensic dump must be performed with hash function (SHA-256, MD5) certifying integrity under ISO 27037 standard; any breach undermines the reliability of the evidence and allows it to be challenged (exclusion under Art. 11.1 LOPJ is reserved for evidence obtained in breach of fundamental rights). Third, absence of intent: in the "banking mule" deception must be proven (false job offer, fraudulent loan) that excludes criminal will; in cases of involuntary file download (cache, Telegram groups, unopened ZIP) knowledge must be excluded. Fourth, nullity of technological interventions: police use of trojans (Art. 588 septies LECrim), IMSI-catcher interventions, remote searches and requests to Facebook, Google or Microsoft require reasoned and proportionate judicial authorization; excesses open the door to evidence inadmissibility.

In current forensic practice we observe exponential growth of cybercrime. The Budapest Convention (Council of Europe Cybercrime Convention 2001 and its Second Additional Protocol 2022), the NIS2 Directive on cybersecurity, the EU AI Act (Regulation 2024/1689), the MiCA Regulation on crypto-assets, Organic Law 1/2025 on Justice Service Efficiency and Supreme Court case-law on electronic evidence configure a rapidly evolving regulatory framework. The UDEF, the Technology Investigation Brigade (BIT) and the Civil Guard's telematic crime teams have advanced forensic capabilities. At Alonso Sala, with more than 15 years of experience, we approach each case coordinating computer forensic experts, blockchain and crypto traceability experts, chain-of-custody specialists and, where necessary, AI and deepfake experts. We connect with disclosure-of-secrets crimes and data-protection compliance when GDPR/LOPDGDD violation concurs.