Police Hacking regulation abroad. A comparative law study into legal regulations and safeguards regarding the quality of data
By J.J. van Berkel A. van Uden J.H. Goes
The Dutch Computer Crime Act III (CCIII) came into effect on 1 March 2019. Among other things, this Act introduces the power of the police to carry out hacking operations. The new Sections 126nba, 126uba, 126zpa in the Code of Criminal Procedure will allow specially authorised investigating officers to covertly and remotely intrude into computer systems under certain conditions and investigate them. The police can carry out investigative actions using technical tools. In principle, a technical device must be inspected and approved by an independent inspection service (de Keuringsdienst) prior to its use, in order to guarantee the reliability, traceability and integrity of the evidence. The Justice & Security Inspectorate (hereinafter Inspectorate) supervises the implementation of the hacking power. In its first Report in 2020, it concluded that the use of technical tools for hacking powers and the inspection of these tools were not yet proceeding as intended under the legal framework. In his response to the first Inspectorate Report, the then Minister of Justice and Security indicated that he would have an investigation into the safeguards of technical tools used by foreign police authorities. The present report is the result of this research. This report also supplements the previously published evaluation of the use of the hacking power in the Netherlands, carried out by the WODC.
The central research question for this study is as follows: What safeguards govern hacking powers abroad, more specifically the use of technical tools, and how does this compare with the Dutch situation? The central research question is answered on the basis of the following subquestions: 1 What countries allow ‘authorised hacking’ and on the basis of which legal ground can foreign police services carry out hacking operations in their own country? 2 What statutory conditions apply in other countries for police services to deploy the hacking power? 3 To what extent do other countries test technical tools and what has been laid down in legislation and regulations on this? 4 To what extent are there any other rules to ensure the reliability, traceability and integrity of data obtained with the use of technical tools? 5 How does the working method abroad compare with the Dutch working method regarding the approval of technical tools and any other safeguards to achieve data reliability, integrity and traceability?
The Hague: Netherlands Ministry of Justice, WODC Research and Documentation Centre , 2023. 154p