Computer Crime III Act: police hacking powers and their safeguards

The Computer Crime III Act (Wet computercriminaliteit III) allows Dutch investigators to secretly enter phones, computers and servers used by a suspect, under Article 126nba of the Dutch Code of Criminal Procedure (Sv). The key limit: this “police hacking” power is only available for serious offences and only with prior written authorisation from an investigating judge (rechter-commissaris).

The Senate (Eerste Kamer) passed the Act on 26 June 2018, and the hacking power entered into force on 1 March 2019. For businesses and individuals, the practical significance lies less in the new offences than in the investigative powers: data on a company system can be reached in an investigation aimed at someone else, without the user ever noticing.

What powers does the Act give investigators?

Under Article 126nba Sv, the public prosecutor can order investigators to enter a device that is in use by the suspect. The explanatory memorandum to the bill (Kamerstukken 34372) names five purposes:

• Identifying the device or its user: for example obtaining an IP address or IMEI number.
• Recording stored data: for example login details for closed online communities or stored images relevant to the investigation.
• Making data inaccessible: for example disabling a botnet that is actively used to attack other systems.
• Intercepting confidential communications: with or without the cooperation of the provider that carries them.
• Systematic observation: tracking a suspect’s location and movements over time, including through software installed on the device.

Together, these powers allow ongoing and largely invisible monitoring of a suspect’s digital life for as long as the order lasts. An order is valid for at most four weeks and can be extended by four weeks at a time, each time with a new authorisation.

Which offences can trigger these powers?

The powers are not limited to cybercrime. The suspicion must concern an offence for which pre-trial detention is allowed under Article 67(1) Sv, which as a rule means an offence carrying a maximum prison sentence of four years or more, and which seriously breaches the legal order given its nature or connection with other offences.

Recording stored data and making data inaccessible require more: the offence must carry a maximum prison sentence of eight years or more, or be designated by order in council (algemene maatregel van bestuur). That designation is meant for offences where ending the crime is of clear public importance.

What safeguards apply before these powers can be used?

Only the public prosecutor can give the order, and only after written authorisation from the investigating judge, which states the parts of the order and its period of validity. Within the Public Prosecution Service (OM), the Central Assessment Committee (Centrale Toetsingscommissie) also reviews an intended use of the hacking power in advance.

Every use must also meet the general requirements of proportionality and subsidiarity in Dutch criminal procedure: the intrusion must be justified by the seriousness of the case, and there must be no less invasive way to reach the same result. The Besluit onderzoek in een geautomatiseerd werk (Stb. 2018, 340) sets technical requirements for the software used.

What else changed under the Act?

Two further changes affect a wider group of people. Investigators may now use a decoy profile presenting as a minor to trace adults who seek sexual contact with children online (grooming). It has also become easier to prosecute people who knowingly deal in stolen data, and online sellers who take payment but never deliver.

What are the main objections to the Act?

The four-year threshold does not guarantee that only the gravest offences are involved: many offences most people would not see as especially grave carry that maximum sentence or more. A suspect who turns out to be innocent will still have had their data examined, and often the data of family, friends and employers they were in contact with.

Critics also question whether everyone involved in approving requests has the technical knowledge to assess a hacking request, given how quickly the technology develops. Unlike the US PRISM programme revealed in 2013, however, the Dutch Act requires case-by-case prior judicial authorisation.

What should you check as a business?

If your organisation stores communications, logs or other data on its own systems, that data can be reached even if the investigation targets an employee, customer or third party. Because the powers are used covertly, the first sign of an investigation may only appear when it is already over, for example when the case file is shared with the defence.

• Decide who in your organisation receives orders and requests from the police or the OM.
• Keep a record of any data or assistance given to investigators, with date and legal basis.
• Ask for the written order and its legal basis before handing over data voluntarily.
• Check your GDPR obligations towards employees and customers whose data may be affected.
• Involve a criminal lawyer as soon as your company or an employee is named as a suspect.

What can we do for you with a digital criminal investigation?

Our criminal lawyers assist suspects and companies confronted with digital investigative powers.

• We review the case file to check whether the order and the investigating judge’s authorisation met the requirements of Article 126nba Sv.
• We challenge unlawfully obtained evidence before the criminal court.
• We advise your company on how to respond to an order or request for data.
• We assist you during a police interview as a suspect.

Summary

• The Computer Crime III Act gives investigators covert hacking, data-recording, data-blocking, interception and observation powers.
• The Senate passed the Act on 26 June 2018; the hacking power has applied since 1 March 2019.
• The powers require a serious offence, an order from the prosecutor and prior written authorisation from an investigating judge, for at most four weeks at a time.
• Data of a company or an uninvolved third party can be reached in an investigation aimed at someone else.

Frequently asked questions