BrazilPenal Code Art. 154-A, Invasion of a Computing Device
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not invade a computing device, connected to a network or not, to obtain, alter, or destroy data or information without the device user's authorization, or to install a vulnerability to obtain an unlawful advantage.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate this article.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Reclusão of 1 to 4 years and a fine for invading a device (caput); reclusão of 2 to 5 years and a fine where the invasion yields private communications, trade or industrial secrets, confidential information, or unauthorized remote control (§ 3º); the penalty for either tier increases by 1/3 to 2/3 for resulting economic loss (§ 2º), by 1/3 to 2/3 for disclosure, sale, or transmission of the obtained material to a third party (§ 4º), and by 1/3 to 1/2 where the victim is the President, a governor, a mayor, or specified other officials (§ 5º).
What it makes you log
Logging duty
Article 154-A punishes invading another's computing device to obtain, alter or destroy data without the user's express or tacit authorization, or to install vulnerabilities for unlawful advantage. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Article 154-A punishes invading another person's computing device, whether or not connected to a network, to obtain, alter, or destroy data or information without the device user's express or tacit authorization, or to install a vulnerability to obtain an unlawful advantage, with reclusão of 1 to 4 years and a fine under the wording Lei nº 14.155/2021 gave the offense, up from the original Lei nº 12.737/2012 penalty of detention of 3 months to 1 year and a fine.
Section 2 raises the penalty by one third to two thirds if the invasion causes economic loss.
Section 3 sets a separate penalty of reclusão of 2 to 5 years and a fine where the invasion obtains the content of private electronic communications, trade or industrial secrets, confidential information as defined by law, or unauthorized remote control of the invaded device, and section 4 raises that penalty by one third to two thirds where the obtained material is disclosed, marketed, or transmitted to a third party.
Because the offense's trigger is invading a device, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .