INFORMATION TECHNOLOGY
United Sections of the Court of Cassation: clarifying principles on the acquisition as evidence through a European Investigation Order from a foreign judicial authority of data taken from cryptophones.
The United Criminal Sections of the Court of Cassation in its judgment No. 23755 of 14 June 2024 answered the following questions: "Does the acquisition of messages on group chats, exchanged using an encrypted system, by means of a European Investigation Order with a foreign judicial authority that has carried out the decryption constitute the acquisition of computer documents and data within the meaning of Article 234-bis of the Code of Criminal Procedure or of documents pursuant to Article 234 of the Code of Criminal Procedure? 234 of the Code of Criminal Procedure, or is it subject to other rules relating to the acquisition of evidence; whether the acquisition referred to above must be subject, for the purposes of the usability of the relevant data, to prior or subsequent judicial verification of its legitimacy by the national judicial authority".
These are the principles of law affirmed by the Supreme Court:
- the transmission, requested by means of a European investigation order, of the content of communications exchanged by means of crypto-mobile telephones, already acquired and decrypted by the foreign judicial authority in criminal proceedings pending before it, does not fall within the scope of Article 234-bis of the Code of Criminal Procedure, which operates outside the hypotheses of cooperation between judicial authorities, but rather within the rules relating to the circulation of evidence between criminal proceedings, as inferable from Articles 238 and 270 of the Code of Criminal Procedure and 78 of the operative provisions of the Code of Criminal Procedure
- with regard to the European Investigation Order, evidence already in the possession of the competent authorities of the executing State may be legitimately requested and acquired by the Italian Public Prosecutor without the need for prior authorisation by the judge of the proceedings in which it is intended to be used
- the issuance, by the Public Prosecutor, of a European Investigation Order aimed at obtaining the content of communications exchanged by means of crypto-mobile telephones, already acquired and decrypted by the foreign judicial authority in criminal proceedings pending before it, does not need to be preceded by authorisation from the Italian court, as a necessary condition under Article 6 of Directive 2014/41/EU, because such authorisation, under the national rules on the circulation of evidence, is not required in order to obtain the availability of the content of communications already acquired in other proceedings
- the rules set out in Article 132 of the Privacy Code relating to the acquisition of data concerning electronic communications traffic and the location of the devices used, apply to requests addressed to service providers, but not to those addressed to another judicial authority that already holds such data, so that, in this case, the public prosecutor may legitimately access them without seeking prior authorisation from the judge before whom he intends to use them
- the usability of the content of communications exchanged by means of crypto-mobile telephones, already acquired and decrypted by the foreign judicial authority in criminal proceedings pending before it, and transmitted on the basis of a European Investigation Order, must be excluded if the Italian court finds that their use would give rise to a breach of fundamental rights, it being understood that the burden of alleging and proving the facts from which to infer such a breach rests on the party concerned
- the impossibility for the defence to have access to the algorithm used within a system of communications to encrypt the text of those communications does not give rise to a violation of fundamental rights, since the danger of alteration of the data must be excluded, unless specific allegations to the contrary are made, since the content of each message is inseparably linked to its encryption key, and an incorrect key has no possibility of decrypting it even partially.
These are the principles of law affirmed by the Supreme Court:
- the transmission, requested by means of a European investigation order, of the content of communications exchanged by means of crypto-mobile telephones, already acquired and decrypted by the foreign judicial authority in criminal proceedings pending before it, does not fall within the scope of Article 234-bis of the Code of Criminal Procedure, which operates outside the hypotheses of cooperation between judicial authorities, but rather within the rules relating to the circulation of evidence between criminal proceedings, as inferable from Articles 238 and 270 of the Code of Criminal Procedure and 78 of the operative provisions of the Code of Criminal Procedure
- with regard to the European Investigation Order, evidence already in the possession of the competent authorities of the executing State may be legitimately requested and acquired by the Italian Public Prosecutor without the need for prior authorisation by the judge of the proceedings in which it is intended to be used
- the issuance, by the Public Prosecutor, of a European Investigation Order aimed at obtaining the content of communications exchanged by means of crypto-mobile telephones, already acquired and decrypted by the foreign judicial authority in criminal proceedings pending before it, does not need to be preceded by authorisation from the Italian court, as a necessary condition under Article 6 of Directive 2014/41/EU, because such authorisation, under the national rules on the circulation of evidence, is not required in order to obtain the availability of the content of communications already acquired in other proceedings
- the rules set out in Article 132 of the Privacy Code relating to the acquisition of data concerning electronic communications traffic and the location of the devices used, apply to requests addressed to service providers, but not to those addressed to another judicial authority that already holds such data, so that, in this case, the public prosecutor may legitimately access them without seeking prior authorisation from the judge before whom he intends to use them
- the usability of the content of communications exchanged by means of crypto-mobile telephones, already acquired and decrypted by the foreign judicial authority in criminal proceedings pending before it, and transmitted on the basis of a European Investigation Order, must be excluded if the Italian court finds that their use would give rise to a breach of fundamental rights, it being understood that the burden of alleging and proving the facts from which to infer such a breach rests on the party concerned
- the impossibility for the defence to have access to the algorithm used within a system of communications to encrypt the text of those communications does not give rise to a violation of fundamental rights, since the danger of alteration of the data must be excluded, unless specific allegations to the contrary are made, since the content of each message is inseparably linked to its encryption key, and an incorrect key has no possibility of decrypting it even partially.
