The study was conducted within the EXFILES project. It aims at investigating the legal framework for the collection and use of electronic and digital evidence from encrypted smartphones by law enforcement agencies. The study focused on numerous national and supra-national documents from various sources – institutional, academic, legal technical, law enforcement, and NGO – and includes the legal framework of the involved partners: France, United Kingdom, Spain, Germany, Netherlands and Norway. The EXFILES project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 883156. As a serious infringement to the fundamental right to privacy, enshrined in the Article 8 of the European Convention on Huan Rights, access to data contained in a digital device is very limited. Investigation purposes, in case of crime or serious offences are exceptions to this right, but not at any expense. The European Court of Human Rights (ECHR), established that, like houses when they are searched, law enforcement agencies need warrants to search and seize mobile phone, and their content [1]. Thus, normally, no search of a mobile phone can be carried out without a warrant. Despite this principle, the volatile nature of electronic data represents an urgency that sometimes allows access to the data without such a warrant, often in relation to the seriousness of the offence that the investigation aims to prove. It is therefore necessary to strike a balance between the needs of the investigation and the necessary protection of fundamental rights. National legislations have different approaches towards the rules to access data of a lawfully seized device. In some of the studied states, a warrant is required, while other states allow exceptions. In France, a warrant is required if the data contained in the device may constitute evidence of an offence [2]. However, in Norway, as an exception, a police officer may carry out a search without such a court order in cases of flagrante delicto or when there is a strong suspicion of an act punishable by a prison sentence of more than 6 months and there is an imminent risk that the purpose of the search will be thwarted [3]. Some legislations give law enforcement agencies more leeway. In Germany, there are no relevant provisions in the Strafprozeßordnung (German Code of Criminal Procedure, StPO) for the evaluation of seized objects and data in accordance with § 94 StPO, so measures must be tailored to the purpose of the preliminary investigation and to safeguarding the originality of the evidence. The principle of proportionality, which has constitutional status, is also the general guiding rule for all state action in criminal investigations. In most countries access to data contained in electronic devices is conditional on obtaining a search warrant separate from that for the search of the device itself. For example, in Spain, the seizure of an electronic device does not also cover the consultation of its contents, which requires an express judicial authorisation5. However, in the Netherlands, the authorities are allowed to examine computers in the rooms to be searched, and this is a part of the search power.

Author: Audrey Dequesnes

Published in: World Congress on Internet Security (WorldCIS-2022)

• Date of Conference: 6-8 December 2022
• DOI: 10.20533/WorldCIS.2022.0003
• ISBN: 978-1-913572-56-3
• Conference Location: London, UK