Publications

13 July 2026

Cybercrime - A New Paradigm for Criminal Law

The digital transformation of society constitutes one of the most profound changes of recent decades, inevitably reflecting upon the criminal phenomenon. 

The widespread use of information and communication technologies and the growing interconnectivity of computer systems have led to the emergence of new forms of criminality and the adaptation of traditionally known illicit behaviors to the digital environment. Cyberspace has thus come to be seen not only as an instrument for criminal activity but also as the very object of criminal law protection. This reality has forced Criminal Law and Criminal Procedure Law to adapt classic institutes to a context marked by the dematerialization of conduct, the absence of physical borders, and the high volatility of digital information.

In fact, crime is no longer necessarily associated with a geographically defined space; it can be executed remotely, using infrastructures distributed across different States and producing simultaneous effects in multiple jurisdictions. Furthermore, not only the execution of crimes but also many of the preparatory activities have moved to the digital environment, benefiting from the relative anonymity provided by electronic communication networks and the ease of concealing the identity of the perpetrators.

One of the first difficulties raised by this reality relates to the application of the principle of territoriality in criminal law. The transnational nature of cybercrime challenges classic criteria for determining jurisdictional competence and highlights the need for effective international judicial cooperation mechanisms. The alignment of legal systems has, therefore, become an essential condition to ensure an effective criminal justice response to computer-related crime.

Technological evolution has also raised the question of whether the legal definitions provided in the Criminal Code would be sufficient to cover conduct carried out in cyberspace, or if, conversely, the establishment of new types of crime would be required. This doubt is particularly evident when comparing, for instance, the crime of property damage provided for in the Criminal Code with the crime of computer damage. Although both types of crime share affinities regarding the protection of certain interests, treating them as legally equivalent proves unsustainable. The destruction, suppression, deterioration, alteration, or rendering unusable of computer data does not necessarily correspond to the physical destruction of a tangible object, just as unlawful access to a computer system cannot simply be equated to trespassing or the violation of private property.

The specificity of the material object of the action, the protected legal assets, and the methods of injury justified making these behaviors distinct legal types of crime in their own right. This solution is further grounded in the principle of criminal legality, enshrined in Article 29 of the Constitution of the Portuguese Republic and implemented in Article 1 of the Criminal Code. The prohibition of the analogical application of substantive law prevents behaviors inherent to computer crime from being subsumed, through interpretation, into legal definitions conceived for distinct material realities. The creation of specific legal definitions is, therefore, not a mere policy option; rather, it corresponds to a requirement stemming from the principle of specificity (nullum crimen sine lege) and the need to guarantee certainty, determinability, and predictability in criminal intervention.

It was within this context that the Portuguese legislator approved Law No. 109/2009 of September 15 (Cybercrime Law), a statute that established various distinct types of computer-related crimes and set forth a specific procedural regime for obtaining, preserving, and collecting electronic evidence. The approval of this regime represented a decisive moment in adapting the Portuguese legal system to the requirements arising from the Council of Europe Convention on Cybercrime, signed in Budapest in 2001, while simultaneously strengthening international cooperation mechanisms in criminal matters.

Technological evolution has also brought about far-reaching changes in Criminal Procedure Law. Digital evidence possesses characteristics that profoundly distinguish it from traditional evidence. Its immaterial nature, the ease of alteration, deletion, or dissemination, and the high volume of information stored in computer systems pose specific challenges to criminal investigation. In this domain, expedited preservation mechanisms for computer data assume particular relevance. Frequently, data preservation must precede its analysis, otherwise relevant information could be deleted or modified before evidentiary proceedings take place. This need is particularly evident when certain service providers are legally required to delete data after a specified retention period has elapsed.

On the other hand, the admissibility of digital evidence depends on demonstrating its authenticity and integrity. The ease with which electronic data can be manipulated requires the use of technical procedures that ensure the preservation of the digital chain of custody, making it possible to prove that the evidence presented in court faithfully corresponds to the data existing at the time of its collection. Ensuring the reliability of evidence thus becomes of paramount importance to guarantee respect for defense rights and the principle of a fair trial.

The path taken over the last two decades demonstrates that cybercrime did not merely represent the emergence of new ways to commit crimes. Above all, it represented a test of the Law's capacity to adapt. The legislator was called upon to create new legal definitions, and the courts to reinterpreting traditional institutes.

Technological evolution will inevitably continue to pose new challenges, but one conclusion seems clear: 21st-century Criminal Law can no longer be understood without considering the digital dimension of crime and the legal problems arising from it.