Charged with Cybercrime in Greece: The Criminal Process Step by Step

An IP address does NOT equal the perpetrator.

As a rule, an IP address identifies a connection — that is, a router — not a person. Between the connection and the keyboard sit dynamic address allocation, network address translation (NAT/CGNAT, where hundreds of subscribers share the same public IP), shared or open Wi-Fi, the use of a VPN or proxies, and malware that uses a third party’s device without their knowledge.

The reasoning that “IP equals perpetrator” has serious gaps. Technically dismantling this chain is often the single most decisive point of the defence.

The seizure and examination of digital devices is subject to strict procedural conditions and to the principle of proportionality, and certain actions require a court order or a prosecutor’s directive. We scrutinise the lawfulness of the seizure, how far the search into the data extends and whether the safeguards were observed; a single procedural irregularity can ground a nullity or cast doubt on the evidence.

To keep the original from being altered, correct practice requires making a forensic image (bitstream image) using a Write Blocker and computing a mathematical digest (hash, MD5/SHA) that certifies its integrity. In parallel, the chain of custody is maintained — the documented record of every handling of the exhibit. Gaps or discontinuities in the chain, a hash mismatch, or examination of the original without a write blocker cast doubt on authenticity and reliability.

• Why they are weak evidence: they are easily altered or fabricated.
• What is missing: the valuable metadata — timestamp, origin, integrity.
• Out of context: they are lifted from the real flow of the conversation.

To carry evidential weight they must be cross-checked against the primary data held by the provider or the platform. Technical analysis often detects points of editing or digital manipulation.

Providers retain traffic and location data for a certain period, and these can be requested by the authorities. The case law of the Court of Justice of the European Union (CJEU) has restricted the general and indiscriminate retention of, and access to, such data — which opens up room to challenge its lawfulness in every case.

Yes — under conditions and by court order, for serious offences (Article 254 CCP, Law 5002/2022). The order can cover the content of communications, as well as traffic and location data. We always check whether the legal conditions were met and the proper procedure followed.

The Cybercrime Division (Greece’s cyber-crime police unit) acts as a preliminary-examination authority: it collects and examines the digital material, runs its own forensic laboratories and draws up reports that go into the case file; reports can also be filed through the cyberalert.gr platform. A “friendly” phone call asking for clarifications is part of the investigation — anything you say can weigh decisively on the case. Speak to a lawyer before you give any explanation.

Do not hand over any password and do not unlock any device before you speak with us.

The right to silence and the principle against self-incrimination apply; in principle you are not obliged to hand over passwords or unlock your device. Your first moves can weigh decisively on the case — most people incriminate themselves out of fear at the preliminary-examination stage.

These are special investigative measures (Article 254 CCP) permitted in serious cases, such as the online distribution of illegal material. They include covert investigations, undercover infiltration and recording by technical means, always within the safeguards and limits of the law. We check whether those limits were respected (authorisation, proportionality, and the prohibition on entrapment — inciting someone to commit an act).

For misdemeanours, the case is usually brought by direct summons. For felonies, a main judicial investigation comes first and committal is decided by an order of the Judicial Council. The in-the-act (flagrante delicto) procedure is rare in electronic offences, given the nature of the evidence.

Pre-trial detention is an exceptional measure (Article 282 CCP): it requires a felony prosecution, strong indications of guilt and a risk of flight or of committing further offences. For misdemeanours, detention is not on the table, and even for felonies restrictive conditions are usually preferred — and that is where we fight.

Not necessarily. Depending on the length of the sentence, the court may grant suspension of its execution or conversion into community service, while lodging an appeal often has suspensive effect. The outcome depends on the features of the act and the mitigating circumstances that are recognised.

As a rule, misdemeanours become time-barred after five years and felonies after fifteen. The exact time the act was committed is critical, and limitation is examined by the court of its own motion.

The penalty escalates with the seriousness of the offence. Most offences are committed at misdemeanour level and are punishable by imprisonment. In their aggravated forms — e.g. computer fraud causing particularly high loss (over €120,000) or being committed on a professional basis — they are upgraded to a felony and punishable by incarceration. Often several offences coincide, so a single aggregate sentence is imposed.

It is a broad category of acts committed by electronic means or directed against information systems and data. They are regulated in scattered provisions of the Greek Criminal Code — for example, illegal access, copying and interference with data (Articles 370Β-370Ε GCC) and computer fraud (Article 386Α GCC) — as well as in more specific statutes.

Misdemeanours are tried by the Single-member or Three-member Misdemeanours Court and, on appeal, by the corresponding Courts of Appeal. Felonies are tried, as a rule, by the Three-member Court of Appeal for Felonies. A public prosecutor takes part at every stage.

Greek courts generally have jurisdiction when the place where the act was committed, or its effect, is located in Greece. Evidence from abroad is gathered through a European Investigation Order and mutual legal assistance, with the support of agencies such as Europol and Eurojust.

A first-instance conviction can be challenged by appeal, which leads to a fresh examination of the merits. The final word rests with the Supreme Court (Areios Pagos) through cassation, which, however, reviews only errors of law and not the facts.