Article 197 bis Spanish Criminal Code: Unlawful access to information systems and interception of data

Article 197 bis punishes access to the whole or part of an information system by circumventing the security measures established to prevent it, and the interception, by technical means, of non public transmissions of computer data, including the electromagnetic emissions of the system.

Also cited as: article 197 bis Spanish Criminal Code · art. 197 bis CP · Spanish Penal Code article 197 bis · artículo 197 bis del Código Penal.

Wording of Article 197 bis of the Spanish Criminal Code

Elements of the offence

1. In paragraph 1, access to the whole or a part of an information system, the facilitation of that access to another, or remaining within the system against the will of the person entitled to exclude the intruder.
2. The circumvention of the security measures established to prevent that access. Where no such measure exists, the objective element is not satisfied.
3. The absence of due authorisation, assessed by reference to the access actually granted and not to the purpose pursued.
4. In paragraph 2, the use of technical devices or instruments to intercept non public transmissions of computer data, including the electromagnetic emissions of the system.

Defence strategy

Existence and circumvention of security measures. Paragraph 1 requires that security measures established to prevent access be circumvented. Access to a system without a password, with credentials voluntarily handed over or through a publicly exposed interface does not satisfy that element.

Scope of the authorisation held. An employee or a service provider holding credentials of their own does not commit the offence by using them, even where that use exceeds internal policy. The dividing line is the authorisation granted and not the purpose for which it was used, and the internal documentation on access profiles is decisive.

Attribution of the access. The correlation between an internet protocol address, a session and a natural person requires technical evidence. Shared credentials, the absence of two factor authentication and the lack of a forensic examination of the terminal are habitual grounds of challenge.

Concurrence with Articles 197 and 264. Unlawful access is frequently charged together with the disclosure of secrets and with computer damage. Delimiting each provision avoids a double assessment of the same intrusion and habitually reduces the resulting penalty.

• Article 197 CP: disclosure of secrets and privacy
• Article 264 CP: computer damage
• Cybercrime defence in Spain
• Cyberattack incident response

This entry is provided for information only and does not constitute legal advice. The application of any provision depends on the circumstances of the individual case and requires examination of the case file by a qualified lawyer.