The III Section of the Supreme Court referred to the United Sections the questions concerning the applicable discipline for the acquisition of encrypted chats from abroad (Sky-ECC) and the need for a review of the legitimacy of such acquisition by the Italian judicial authority.
Ordinance no. 47798 dated 11/30/2023
As mentioned in the order, the issues concerning the Sky-ECC platform originate from the joint operation of French, Belgian, and Dutch police that led to accessing and decrypting the chats of more than 70,000 users from different countries in 2021.
In particular, the Court noted how on the one hand there are multiple legitimacy rulings[1] that have upheld the possibility of acquiring encrypted chats under Art. 234 bis c.p.p. (allowing the acquisition of documents and computer data stored abroad), outlining a distinction between wiretapping, on the one hand, and the activities of acquiring and deciphering communicative data, on the other.
This guideline, in fact, distinguishes between the operation of capturing the encrypted message in transit to the recipient and the operations of capturing and decrypting the forwarded content, deeming the discipline of wiretapping applicable only to the former case, as flows of communications under Article 266 bis of the Code of Criminal Procedure[2]. The messages now sent and received, therefore, would represent a mere record of these communicative flows, usable as evidence when there is the availability of the cryptographic key to decipher their content.
Based on this distinction between data “in progress” and data crystallized on a device’s memory, the cited case law deems it possible to acquire the latter through a European Investigation Order triggered by the prosecutor. In fact, Art. 234 bis c.p.c. would constitute the domestic rule granting the necessary power to proceed with the OIE, which can only be used if the same investigative acts requested “could have been issued in a similar domestic case.”[3]
Moreover, with respect to the second question submitted to the consideration of the United Sections, the case law in question has maintained that no control must be carried out by the Italian judge with respect to the evidence acquired in the foreign court proceedings; this on the basis of the assumption that the acquisition activity is and must be carried out according to the legislation of the foreign state, since it is carried out on its own initiative and not at the request of the Italian Prosecutor’s Office. Therefore, judicial protection with respect to this activity can only be found within the foreign legal system.
In the face of these directions, however, two recent Supreme Court rulings have shed light on a different direction.
In particular, the former (No. 44154, 02.11.2023) argued how acquisition under Article 234 bis of the Code of Criminal Procedure is justified in the case of ““dematerialized” information elements, which pre-existed with respect to the time of the initiation of investigations by the French judicial authority or were formed outside of those investigations“; this was not the case at the time of the request and transmission of the data in question.
According to the Court, such a takeover should otherwise be framed under the rules on search and seizure (namely Article 254 bis of the Code of Criminal Procedure).
In addition, and with respect to the question concerning the OIE, the Court found it necessary that it be verified “forthe purpose of usability of the acquired information data, concerning communications at the ‘static’ stage, whether the original conditions for the jurisdictional authorization of the relevant investigative activities covered by the European orders were met.”
This guideline, moreover, recalls the recent rulings of the EDU Court[4] that extended the protection of Article 8 ECHR (Right to respect for private and family life)[5] to messages sent and received via the Internet and the Constitutional Court’s ruling no. 170/2023 with respect to the extension of the guarantees of Art. 15 of the Constitution with respect to all forms of communication[6].
It also enhances the emergency introduction of the provisions of Art. 132 Privacy Code (d.l. 132/2021, converted into l. 178/2021), by which the legislature recently chose to jurisdictionalise the procedure for acquiring external telephone and telematic traffic data in criminal proceedings, which now requires a reasoned authorizing order from the judge.
A final guideline, however, was formed by two recent rulings[7], published in the course of drafting the reasons for the ordinance under review. In light of the Constitutional Court’s ruling 170/2023, it was argued, most recently, that the correspondence nature of computer messaging (even when retained after receipt) would exclude the applicability of Art. 234 bis c.p.c., falling instead within the scope of the acquisition of documentary evidence under Article 234 c.p.c.
The issues
In light of this interpretive uncertainty, the Court referred the following questions to the United Sections:
“(a) On the subject of evidence, does the acquisition of messages on group chats exchanged using an encrypted system, through [Sky-ECC] with foreign A.G. who performed the decryption, constitute the acquisition of “documents and computer data” within the meaning of Art. 234-bis cod. proc. pen. in the mind of which “it is always permissible to acquire computer documents and data stored abroad, even other than those available to the public, subject to the consent, in the latter case, of the rightful owner” or documents under Article 234 of the Code of Criminal Procedure. pen. or is attributable in other discipline related to the acquisition of evidence.
(b) Further, should such acquisition be subject, for the purpose of the usability of the data so poured into the record, to prior or subsequent judicial review of its legality by the National Judicial Authority.”
References
[1] Cass. sez. 4, no. 37503 of 30/05/2023 n.m.; sez. IV of 16/05/2023 no. 38002/23 n.m; sez. 4, no. 16345 of 05/04/2023, Liguori and others, non mass; Sez. 4 -, no. 16347 of 05/04/2023 Rv. 284563 – 01; Sez. 1 – no. 6364 of 13/10/2022 (dep. 15/02/2023) Rv. 283998 – 01;)
[2] “1. In proceedings related to the crimes specified in Article 266, as well as those committed through the use of computer or telematic technologies, the interception of the flow of communications related to computer or telematic systems or interspersed between several systems shall be permitted.”
[3] Directive 2014/41/EU of the European Parliament and of the Council of 03.04.2014.
[4] EDU Court, judgment. 5/09/2017, Barbulescu v. Romania, § 72; EDU Court, sent. 3/04/2007, Copland v. United Kingdom, § 41; EDU Court, judgment. 17/12/2020, Saber v. Norway, § 48.
[5] “1. Every person has the right to respect for his or her private and family life, home and correspondence.
2. There can be no interference by public authority in the exercise of this right except insofar as such interference is provided for by law and insofar as it constitutes a measure which, in a democratic society, is necessary for national security, public order, the economic welfare of the country, the prevention of crime, the protection of health or morals, or the protection of the rights and freedoms of others.”
[6] “The freedom and secrecy of correspondence and all other forms of communication are inviolable.
Their limitation can only take place by reasoned act of the judicial authority with the guarantees established by law.”
[7] Cass. Sez. VI no. 46482, Nov. 17, 2023; Sect. VI no. 46833 dated 11/21/2023).
