GENERAL FRAMEWORK

The right to privacy and having one’s personal data protected from interference is a cornerstone of the European legal order3F 4 . Limitations to these rights exist, particularly in order to allow Law Enforcement Agencies and other state actors, including intelligence services to collect information and evidence in criminal investigations and cases where there is a threat to national security through special investigative techniques. Historically, the limits to the right to privacy were undertaken using coercive measures which were limited in scope and in their invasiveness (through house searches, wiretapping etc). The increased reliance on connected devices, in particular mobile telephones and computers, increases the amount of information which can be collected. Hacking a device allows for access to all data held on a device, as well as all information flows in and out of the device; this is likely to constitute the collection of a much greater amount of data, as well as the collection of much more sensitive data. Special investigative techniques include the hacking of devices and gaining access to them through hacking and the use of spyware. Law enforcement representatives, state that the use of hacking techniques as an investigative tool brings significant improvements in investigative effectiveness.4F 5 Although the use of hacking techniques will bring improvements in investigative effectiveness, the significant amount and sensitivity of data that can be accessed through these means acts as a stimulus for another key debate: ensuring the protection of the fundamental right to privacy. In criminal investigation cases, the police or the public prosecutor are generally in charge of requesting the use of special investigation techniques. A judge or a court are responsible for authorising and monitoring the procedure. Table 1 below summarises the procedure of the use of special investigative techniques in the countries covered by this study. Table 1: Authorisation of special investigative techniques in criminal law

EL ES HU PL DE FR IT NL

Who can request Investigative authority PP PP Investigative authority

Who authorises? Prosecutor or judicial council

* PP: Public Prosecutor Judge Judge Judge (local district court)

PP or Federal Criminal Police Office

Judge (court)

PP or investigative judge PP PP

Judge Judge Investigative judge

Intelligence services are governed by different procedures, reflecting the framework in which they operate, which may require speed and more secrecy. As such, the request and authorisations procedure are different. Due to the secrecy of some of the intelligence services actions, the rules governing their operations can often be secret. Oversight mechanisms, both in the time leading to the use of special investigative techniques (ex-ante) or after they have been completed (ex-post)

4 As reflected in the European Convention on Human Rights and the Charter of Fundamental Rights of the EU. See Chapter 6 for a review of the legal framework. 5 IACP Summit Report. 2015. Data, Privacy and Public Safety: A Law Enforcement Perspective on the Challenges of Gathering

Electronic Evidence.

mechanisms are therefore necessary. These oversight mechanisms help ensure intelligence agencies operate within the law, while being able to do so with an adequate amount of secrecy. These mechanisms include internal control procedures, parliamentary oversight, judicial review and redress in cases where the law has been broken.

This study examines the existing framework in eight Member States, in order to assess whether there are similarities, and practices that can be identified. The emergence of the Pegasus scandal has provided a real-life test of the effectiveness and efficiency of these mechanisms. The box below provides the definition of key terminology Box 1: Terms and definitions used in this report

Hacking - a situation in which someone abuses their authority to illegally access an information network while using a computer or another information processing device

Intelligence service - a government department involved in the gathering of military or political information, especially in the interests of national security.

Law Enforcement Authorities – a government agency responsible for the enforcement of the laws (police, gendarmerie or equivalent)

Special investigative measures or techniques are a way for gathering information systematically in such a way as not to allow the target person to know of them5F 6

Spyware - software that is installed on a user's computer without their knowledge. Such software transmits information on the user and his habits once connected to the internet.6F

7

Surveillance – monitoring of behaviour, activities, or information for the purpose of information gathering, influencing, managing or directing.7F 8

Tapping - connecting a listening device to a telephone line to monitor conversations secretly.

6 See Eurojust, https://www.eurojust.europa.eu/judicial-cooperation/instruments/special-investigative-measures 7 European Commission definition in Communication from the Commission of 15 November 2006 to the European

Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on fighting spam, spyware and malicious software [COM(2006) 688 final 8 Lyon, David (2001). Surveillance Society: Monitoring in Everyday Life. Philadelphia: Open University Press.