Criminal Lawyers in Hacking & Intrusion Defense

The offence of unlawful access to computer systems, regulated in Art. 197 bis of the Spanish Criminal Code (introduced by Organic Law 1/2015 in compliance with the Budapest Convention and Directive 2013/40/EU on attacks against information systems), protects the security and confidentiality of computer systems and data. It is the so-called "computer trespassing" and sanctions both access and mere unauthorised permanence in a system, regardless of whether damage is caused, data are extracted or any benefit is obtained. Consolidated Supreme Court case-law has precisified the contours of the type: it requires breach of security measures, unauthorised access and intent in the conduct. As criminal lawyers specialising in computer offences, we articulate the defence with specialised forensic computer expertise.

The typical modalities are varied and constantly sophisticated. Access by credential breach through brute force, dictionary, prior phishing, social engineering, or use of keys leaked in data breaches. Access by vulnerability exploitation (zero days, SQL injection, cross-site scripting, buffer overflow, vulnerabilities in outdated components). Improper use of legitimate credentials after termination of employment or partnership (ex-employees accessing with their non-revoked keys, separated partners maintaining access). The unlawful permanence in systems initially accessed legitimately when authorisation has been lost (Art. 197 bis.2 CP). The unauthorised pentesting and so-called "white hat hacking" which, despite its research or educational purpose, integrates the criminal type without prior contractual authorisation. And access to third-party protected WiFi networks through key cracking.

The penalties under Art. 197 bis CP are graduated. The basic type (access by breaching security measures) carries prison from 6 months to 2 years. The unlawful permanence in the system after losing authorisation is sanctioned with the same penalty (Art. 197 bis.2 CP). When access results in discovery of secrets, the type combines with Art. 197.1 CP, raising penalties to 1-4 years' prison; if the data are disclosed or transferred, penalties rise to 2-5 years (Art. 197.3 CP). In aggravated cases (vulnerable victims, especially protected secrets, profit purposes), penalties may reach 5 years' prison. For companies, criminal liability of the legal entity is foreseen (Art. 31 bis CP). It also frequently concurs with computer damage (Art. 264 CP), computer fraud (Art. 248 CP), revelation of trade secrets (Arts. 278-280 CP) or money laundering.

The technical defence articulates several complementary lines. First, the absence of security measures: if the system was exposed without password, with default credentials (admin/admin) or without basic encryption, the typical element of "breach of security measures" is missing, excluding the type under Art. 197 bis CP. Second, the express or tacit authorisation: pentesting contracts, bug-bounty programmes, legitimately retained credentials, or lax usage policies may constitute sufficient authorisation. Third, the absence of intent: accidental access (link click, unintentional redirection), or reasonable belief of authority exclude intent. Fourth, the expert challenge of forensic attribution: logs, IPs and temporal correlations presented by the prosecution are frequently vulnerable to specialised technical counter-expertise demonstrating alternative explanations (Tor/VPN use, IP spoofing, shared devices). Fifth, the voluntary cooperation with the owner and absence of harm in ethical-hacking cases, as highly qualified mitigating factors.

In current forensic practice we observe exponential growth in hacking and computer-intrusion proceedings, especially linked to labour conflicts with ex-employees, ransomware attacks on companies, personal account hacking in couple-relationship contexts, attacks on critical infrastructures and industrial cyber-espionage operations. Directive NIS2 (EU 2022/2555) on cybersecurity, Regulation DORA EU 2022/2554 on digital operational resilience, Organic Law 1/2025 on Justice Service Efficiency and recent case-law from the Supreme Court and the National High Court on organised cybercrime have hardened the institutional framework. At Alonso Sala, we tackle each file with certified forensic computer experts (CISSP, CEH, OSCP), articulate technical counter-expertise to challenge attribution and build technically solid and procedurally aggressive defences.