The numerous international investigations led by the French police into Encrochat and Sky-ECC have repeatedly highlighted the issue of the use of foreign investigative tools in domestic proceedings. On the one hand, the reliability of investigation results and the review of them by defenses and judges comes into focus, and on the other hand that of legality and the compatibility of the investigative tool with due process.
The issue was brought before the Dutch Judicial Authorities again, coming before the Supreme Court of the Netherlands (Hoge Raad) in the form of preliminary questions, which were decided in Judgment No. 913 dated 06/13/2023 [1].
The case in point
In the cases under discussion, the evidence produced by the Dutch prosecutors is based mainly on (de)encrypted communications exchanged by the defendants on phones provided by the Encrochat and Sky-ECC services. Since both services made use of servers in France [2], authorities in the latter country initiated activities to intercept users’ real-time communications (tens of thousands of people) as part of a joint investigation (through the establishment of joint investigation teams, JIT[3]) that also involved the Police Force of the Netherlands.
As a result of the investigative activities, intercepted communications were shared with other foreign authorities that had directly participated or that (like Germany) became interested only later in the development of the investigation.
As has already happened in Italy or Germany, advocates of intercepted persons involved in criminal proceedings in the Netherlands have raised the question regarding the verification of the “legality” of activities carried out in France and their reliability and trustworthiness. In fact, the technical ways in which the data were obtained by the French authorities are bound by the State Secret and, therefore, were not and cannot be shared with other cooperating countries, much less cognizable by the defenses.
This constraint once again posed an extremely significant obstacle to the fullness of the right of defense and, in particular, to the exercise of cross-examination of the manner in which evidence was formed. The method of data acquisition-unknowable to the defendants-thus becomes impossible for the parties to challenge and is also removed from the Judge’s review of legality.
In this respect, in the Netherlands as well as in other countries, the prosecution’s position is based on the application of the principle of mutual trust between states in the context of investigations carried out through Joint Investigation Teams, which would make any further exploration of method and substance unnecessary.
Preliminary questions
In light of this complexity, the District Court of the Northern Netherlands and the District Court of Overjssel addressed a preliminary question to the Hoge Raad, aimed at understanding whether data extracted by the French police by an unknowable method can be used as evidence in Dutch proceedings on the basis of the principle of interstate trust.
The procedure followed to reach the Court’s ruling is the preliminary reference provided for in Art. 553 para. 1 of the Dutch Code of Criminal Procedure, according to which a question of law may be submitted to the Hoge Raad whenever the resolution is, at the same time, necessary to decide on the merits of the proceedings and the subject of an interest beyond the specific case and, therefore, relevant to more than one criminal case. Therefore, it must be a question of cross-cutting interest, which may also affect cases from other Courts in addition to the one being dealt with before the referring court.
The most important issue addressed by the Supreme Judges concerns the usability of the results of investigations carried out in other states in Dutch domestic proceedings by a JIT to which the Netherlands was a party, based on the aforementioned principle of interstate trust; whether, therefore, the recognition by the Dutch system of the foreign one allows for the assumption that the investigative procedures provided for and followed by the latter are a guarantee of a reliable result compatible with “due process.”
The (ir)relevance of Directives 2002/58/EC and 2016/680 (EU)
Another question submitted to the Supreme Court concerns the applicability to investigations of this kind of the provisions of Directives 2002/58/EC (concerning the processing of personal data and the protection of privacy in the electronic communications sector) [4] and 2016/680 (EU) (on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data) [5].
The ruling resolves the issue in the negative. In fact, Directive 2002/58/EC imposes retention requirements for electronic communications data (e.g., traffic or location data) to be made available to national authorities.
However, citing the Court of Justice of the European Union, the Dutch court clarified that where member states use measures that infringe on the confidentiality of electronic communications, without availing themselves of processing obligations imposed on service provider companies, this directive does not apply. Moreover, the very nature of the service offered by Sky-ECC or Encrochat meant that no personal data of users was processed, and users never had to disclose any personal data in order to make use of the platforms.
Where, on the other hand, potential relevance is recognized to the rules of Directive 2016/680 (EU), the Court dismissed the question of its applicability by deeming it irrelevant for the sole purpose of resolving the preliminary questions before it.
The limits set by the Dutch investigating judges.
However, on the subject of stakeholder protection, it is useful to mention the precautions taken in some of the national cases mentioned in the judgment. In the context of one of the operations on Sky-ECC chats, conducted instead by Dutch authorities on Dutch users, when the investigating judges (the equivalent of the Italian Judge for preliminary investigations) had to authorize wiretapping activities, they decided to strictly limit the use of the extracted data according to a proportionality test to protect the privacy of those involved and aimed at avoiding “fishing expeditions” [sic].
Specifically, information collected and decrypted could only be investigated using queries submitted to the court in advance, including: user information from ongoing investigations of criminal organizations; keywords or images that in themselves are indicative of serious criminal activity in an organized setting.
The query investigation, moreover, must be carried out in a way that can be repeatable and verifiable for the judge and the defense by obtaining the same search datasets, allowing them to see what data were used and made available for conducting the investigation. Subsequently, the results of the activity must be submitted to the investigating judge for verification of the content and scope, as well as the actual existence of indications of crime.
Particular protection is afforded to privileged communications, such as with advocates, which must be actively filtered as much as possible.
The investigating judge, moreover, must have access to the foreign (in this case French) judicial decisions underlying the data collection.
Finally, the information collected may be made available to the prosecutor’s office or judicial police for further investigation only with the permission of the investigating judge and only for particularly serious crimes or crimes committed for the purpose of terrorism.
The decision
The Court’s pronouncement, following a clear but mortifying course of argumentation toward the rights of the accused, followed a particularly favorable criterion toward the principle of interstate trust.
In fact, the ruling severely limits the possibility of domestic court scrutiny with respect to investigative activities conducted abroad-under the responsibility of a foreign judicial authority-whose results have flowed into domestic proceedings.
In particular, the trial court cannot make an assessment of whether the investigation complies with the relevant foreign domestic regulations for this type of activity, as such a screening would be a violation of the sovereignty of the third country. Moreover, if the actual conduct of an investigation occurred in violation of the rights guaranteed by the ECHR, the suspect would be protected by the possibility of bringing an appeal under Article 13 ECHR[6] in the country where the investigation was conducted.
In fact, the Court believes that the decisions of the Foreign Judicial Authorities on which the investigations are based should be respected and there is a presumption of legitimate conduct of the related activities. The only exception to this principle is in the event that an irrevocable decision has since been made in the same state that has established the existence of investigative methods that differ from the applicable regulations. Only then will the Dutch court be empowered to assess whether there are repercussions on the usability of the relevant findings in the domestic proceedings, considering the seriousness of the violation and the concrete detriment to the suspect’s rights.
Ostensibly, the Court’s reasoning is concerned with the rights of the suspect and refers to the Strasbourg Court’s jurisprudence to remind us that the ECHR does not preclude the use of foreign investigative findings in criminal proceedings as long as it does not conflict with the right to a fair trial under Article 6[7] and the trial judge ensures its “overall correctness.”
However, the attention that the deciding magistrate should pay to the legality of the investigation appears to be merely formal and abstract, an assessment of pure legitimacy that does not investigate in concrete terms the reliability of the results produced, unless there are “concrete indications to the contrary,” also pointed out by the defense.
Therefore, merely because they come from countries that participate in European judicial cooperation, investigative activities that are ostensibly and formally compatible with domestic law would not merit any further investigation; a presumption that is perhaps hazardous in practice, given the varying geometries of both the guarantees vis-à-vis the rights of defendants and the independence of the judiciary within states of the European Union itself.
Of course, in cases where there are elements of doubt about the reliability of the results of the investigation, it is possible for the Judge to make an assessment of the guarantees observed in practice – for example, in the case of the extraction of computer data, with respect to the reliability, traceability, and integrity of the data.
However, one has to wonder how a defense can identify concrete indications of unreliability on ways of conducting investigations to which it does not have access because of (albeit legitimate) foreign state regulations and measures – as in the case of the French affixing of the Secret of State on how encrypted data was extracted.
In this regard, the Court’s reasoning is unconvincing when, in affirming the fundamental nature of due process and the equality of arms between prosecution and defense in cross-examination (both on the merits and on aspects concerning procedure), it simultaneously argues that the right to knowledge of evidence is not an absolute right, but must be balanced against any competing interests, such as national security, the protection of witnesses at risk of retaliation, or the secrecy of the judicial police’s methods of investigation.
In the Court’s opinion, in fact, in order to assess whether the defense can bring certain acts into the trial and have knowledge of them, the following elements must be evaluated: whether the prosecution has made available all the computer files collected in the proceedings, the extent to which these acts may have relevance in the specific trial, and the lawfulness (evaluated as above) of the investigative process within the limits of the scope of assessment allowed to the Dutch court. Beyond the issue of relevance, it is clear that the mere availability of the data collected by the Dutch Public Prosecutor’s Office is not sufficient to scrutinize the methods of obtaining them, and the limitation placed on the national court’s assessment prevents any effective further verification. And in fact, the ruling clarifies by pointing out how any request for the acquisition of documents or for further study on which a Dutch court cannot rule can only be rejected.
In light of the arguments of the judgment under review, the repercussions of which will be seen on the decisions taken by the judges on the merits, the way in which principles of law of constitutional rank, also crystallized in the EDU Convention, are used as an abstract premise and then deprived of meaning at the time of concrete application appears worrying. Although other domestic jurisprudence (e.g., Italian) has been more cautious in the past, what should cause serious concern is that several domestic courts of legitimacy may be allowing themselves to be tempted with respect to the need to save important international police operations, systematically sacrificing on the altar of a supposedly higher national interest the fundamental rights of defendants, hollowing out due process and subordinating the procedural order not to the rule of law but to the reason of state.
Prof. Avv. Roberto De Vita
Avv. Marco Della Bruna
References
[1] https://uitspraken.rechtspraak.nl/#!/details?id=ECLI:NL:HR:2023:913
[2] In the servers of the OVH Company in Roubaix.
[3] The Joint Investigation Team is a joint investigation team governed by Art. 13 of the Convention on Mutual Legal Assistance between the Member States of the European Union dated 12.07.2000, which may be established for a limited period and with a specific purpose to carry out investigations within one of the countries that decide to establish it, https://eur-lex.europa.eu/legal-content/IT/TXT/HTML/?uri=CELEX:42000A0712(01)
[4] https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX:32002L0058
[5] https://eur-lex.europa.eu/legal-content/IT/TXT/PDF/?uri=CELEX:32016L0680&from=RO
[6] https://www.echr.coe.int/documents/d/echr/convention_ita
[7] Ibid.
