The use of malware as a means of obtaining evidence in brazilian criminal proceedings

the need for specific law and the impossibility of analogous use of other procedural devices

Abstract

This study aims to analyze the possibility of using malware as a covert means of obtaining evidence in Brazilian criminal proceedings, examining its compatibility with the fundamental rights to privacy, intimacy, the inviolability of communications, and the principle of strict legality. To this end, the research adopts the hypothetical-deductive method, grounded in a specialized literature review and in the analysis of the paradigmatic precedent of the Brazilian Superior Court of Justice in RHC 99.735/SC, in which the legality of highly intrusive digital investigative techniques was assessed. The results indicate that the installation of malware in electronic systems—by enabling access to past, present, and future data, as well as permitting domestic monitoring through cameras and microphones—goes beyond the scope of Law No. 9.296/1996 and lacks support in the current procedural criminal framework, thereby preventing the use of analogy or extensive interpretation to legitimize such practices. Moreover, the study shows that the Superior Court of Justice, upon recognizing the hybrid and atypical legal nature of these technological instruments, reaffirmed the principle of procedural legality and the need for enhanced protection of intimacy within the context of “third-generation evidence.” The conclusions reached demonstrate that, although malware constitutes a highly effective investigative tool in light of the increasing sophistication of digital crime, its use in Brazil requires specific legislative regulation capable of establishing exhaustive hypotheses for its application, proportionality requirements, and adequate judicial oversight safeguards, lest the practice compromise the Democratic Rule of Law and the essential guarantees of criminal procedure.