Comparative Law
Law Review
Review
Comparative
22 2016
24
2018
Copernicus
University
Nicolaus Nicolaus
Copernicus
University
http://dx.doi.org/10.12775/CLR.2016.006
http://dx.doi.org/10.12775/CLR.2018.010
Duarte Rodrigues Nunes*
Katarzyna Krupa-Lipińska
THE MEANS OF OBTAINING EVIDENCE PROVIDED
THE PROBLEM OF THE INDETERMINATE DEFENDANT
BY THE PORTUGUESE CYBERCRIME LAW
IN TORT LAW IN EUROPE
(LAW NO. 109/2009 OF 15 SEPTEMBER 2009)
Abstract
Abstract
The article discusses the problem of the indeterminate defendant in European tort law systems
and in the projects aiming to unify tort law in Europe, such as Draft Common Frame of Reference
and Principles
of European
The
Portuguese
legislatorTort
has Law.
provided, for the first time, in the Portuguese legal system,
The given issue relates to a situation where there is a damage caused by one factor, yet upon
means
of
obtaining
evidence
specific
for Cybercrime in Law no. 109/2009, of September
available evidence one may indicate a few potential factors which might have led to the damage,
15,
incannot
whichbeFramework
no.was
2005/222/JHA,
of the
of February
24, with
but it
ascertainedDecision
which factor
the actual cause
of it.Council
The problem
is addressed
reference toattacks
two scenarios.
First, when there
is aand
limited
and known on
number
of persons
concerning
against information
systems
the Convention
Cybercrime
of theacting
tortiously, each of whom potentially might have led to the damage, but only one of them had
Council
Europe
transposed
to certain
the Portuguese
system.
While
the legislator’sgroup
actually of
caused
it. were
Second,
when it is
that one legal
tortfeasor
from
the undetermined
of tortfeasors
caused damage
some correct,
of the injured
from
the group
of In
thethe
injured
persons,
options
are considered
to be to
mostly
there persons
are some
critical
issues.
present
but it cannot be established precisely which tortfeasor caused damage to precisely which injured
Article,
the legal regime of these means of obtaining of evidence is critically analyzed.
person.
In comparative law analysis, one may find various attempts to deal with the given issue, which
come from the balance of ratios given to different solutions, as well as the legal possibilities
Keywords
or obstacles in national tort law systems. The main possibilities are: all-or-nothing approach, joint
and several liability, and proportional liability. Those solutions are discussed in article in more
Cybercrime
– Criminalthat
investigation
– Computerofdata
– Interception
of communications
–
detail with conclusion
the bold proposition
proportional
liability
presented in Principles
of
European
Tort
Law
seems
to
be
the
most
appropriate.
Seizure – Computer search.
Keywords
Introduction
tort law – alternative causation
– indeterminate defendant – joint and several liability –
proportional liability
The Portuguese legislator has provided, for the first time, in the Portuguese
legal system, means of obtaining evidence specific for Cybercrime in Law
no. 109/2009, of September 151. Through this law, Council Framework
* Judge. PhD in Criminal Law and Criminal Procedure. Investigator (Centre for
Research
in Criminal
Law and Criminal
Sciences
and
Centre for
Legal
Research
of and
*
Katarzyna
Krupa-Lipińska,
Juris doctor
(PhD),
Assistant
at the
Chair
of Civil
InternationalFaculty
Tradeof Law
Law,of Lisbon).
Faculty Author.
of LawE-mail:
and duarterodriguesnunes@hotmail.com.
Administration, Nicolaus Copernicus
Cyberspace,
University in Toruń, Poland; Patent and Trade Mark Attorney. E-mail: kkrupa@umk.pl.
ńi piL-apurK anyz250
rataK | 02
Duarte Rodrigues Nunes
Decision
2005/222/JHA of February 24 on attacks against information
.1.2
systems and the Convention on Cybercrime of Budapest, of November 23,
hton-ro-lla 2001,
ehT were transposed to the Portuguese legal system.
the 2007 reform1 of the Code of Criminal Procedure (Código
non auq enis oitiAlthough
dnoc
Penal)2 and the means of obtaining evidence provided by
t troppus sedeirtProcesso
nuoc
the
Code
ividni eht n
eew
teb of Criminal Procedure (clearly designed to obtain “tangible”
evidence) were inadequate to effectively investigate computer-related
f ni elbail reh/mih
crimes, only in 2009 the legislator provided means of obtaining evidence
suac evitanretla fo
specific to investigate Cybercrimes.
ca rosaeftrot hcihw
Thus, until then, means of obtaining evidence provided by the Code
a gnihton-ro-lla eht
of Criminal Procedure – such as searches and seizure, although they were
f seitluciffid esoht
designed to focus on tangible realities and not on intangible realities
lliw eb yam truoc
such as computer data3, or interceptions of telecommunications – , were
llautca saw the
egam
ad means of obtaining evidence used to investigate this kind of
only
lautca eht criminal
saw tca offences.
tilicaf snoitcidsUnlike
iruj the majority of states that signed the Convention on Cybercrime,
t fo tnemhthe
silbPortuguese
atse
legislator chose to draft a new law which provided the
t wal hsinmeans
aD dnaof obtaining evidence instead of providing them in the Code of
hcihw ,ecneCriminal
dive fo Procedure4.
ht elbaborp erom
is A .egamad eht
eht fo yroI.
ehScope
t“ eht of the rules on the means
TON-RO-LLA
S DN A TNIOJ
of obtaining evidence
.2.2
In accordance with Article 11 of Law no. 109/2009, except in the case of
the
:4 – IV kooB
nIinterception of communications and undercover operations (which
c fo noitpmuserp
tra ehT .debircserp
Hereinafter referred to as Law no. 109/2009. The text of Law no. 109/2009 available
ac neeb evat:
ahhttp://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=1137&tabela=leis
yam
(in
tnereffid hcPortuguese
ihw rof only).
1
Through
Law no. 48/2007, of August 29.
esuac saw egam
ad
2
The text of Portuguese Code of Criminal Procedure is available at: http://www.
ca si ohw nosrep
pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=199&tabela=leis (in Portuguese only).
3
Defined in Article 2, b) of Law no. 109/2009 as “any representation of facts,
information
61 or concepts in a form susceptible of processing in a computer system, including
reZ ,onitnafnI :eeS
71 capable of making a computer system perform a function”.
eppA fo t ruoCprograms
:eeS
81
there is nothing to prevent the use of means of obtaining evidence
p eht ot noituloS4 However,
ep eD .seno d eprovided
tacilpmocby the Criminal Procedure Code in the investigation of Cybercrimes.
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 251
Katarzyna Krupa-Lipińs
may only be used in the investigation of criminal offences referred to
in ALL-OR-NOTH
2.1.
Article 18, paragraph 1, and Article 19, paragraph 1, of Law no. 109/2009,
respectively), the other means of obtaining evidence may be usedThe
to all-or-nothi
5
investigate criminal offences punishable under Law no. 109/2009
andsine qua non
conditio
6
any criminal offences committed by means of a computer system
or support th
countries
criminal offences which investigation requires the collection of evidence
between the individ
in electronic form.
him/her liable in fu
And in paragraph 2 of this Article 11, the legislator determines that
of alternative causa
the provisions of Articles 12 to 19 of Law no. 109/2009 do not affect the
which tortfeasor act
regime of Law no. 32/2008 of July 17 (on the retention of data generated or
the all-or-nothing ap
processed in connection with the provision of publicly available electronic
those difficulties fo
communications services or of public communications networks)7. This
court may be willi
is a rule that raises enormous interpretative difficulties, since it does not
damage
clarify whether Article 9 of Law no. 32/2008 (which regulates the use
in the was actuall
was the actual c
revoked
criminal proceedings of data previously retained8) was or was not act
jurisdictions facilita
by Articles 12 to 19 of Law no. 109/20099, and Article 9 of Law 32/2008,
establishment of th
which only applies to serious crimes, provides a regime of use of retained
Danish law th
data much more restrictive than the regime of Articles 12 to 19and
of Law
of evidence, which
no. 109/2009, which apply to a much broader range of criminal offences.
more probable tha
the damage. A sim
5
Crimes of computer-related forgery, damage to programs or other computer
data,
the “theory
of the m
computer sabotage, illegal access, illegal interception and illegitimate reproduction of
protected program.
2.2. JOINT AND SE
6
Defined in Article 2, a) of Law no. 109/2009 as “any device or set of interconnected
or associated devices in which one or more of them develops automated processing of
In Book VI – 4:1
computer data in connection with a program network that supports the communication
between them and the set of computer data stored, processed, retrieved or transmitted
presumption of ca
by that or those devices with a view to their operation, use, protection and maintenance”.
prescribed. The arti
7
Hereinafter referred to as Law no. 32/2008. The text of Law no. 32/2008
may have been cau
available at: http://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?artigo_id=1264
for which
A0004&nid=1264&tabela=leis&pagina=1&ficha=1&so_miolo=&nversao=#artigo
(in different
Portuguese only).
damage was caused
8
The categories of data that is object of retention are referred in Article 4 of Law
person who is acc
no. 32/2008.
9
In this respect, it is understood mainly that Article 9 of Law no. 32/2008 was not
revoked by Articles 12 to 19 of Law no. 109/2009. A minority opinion (which we16endorse)
See: Infantino, Zerv
17 obtenção
has the opposite view. On this issue, see Duarte Rodrigues Nunes, Os meios de
See: Court of Appea
de prova previstos na Lei do Cibercrime [The means of obtaining evidence provided by18the Law
of
Solution
to the pr
complicated ones. Depe
Cybercrime], Gestlegal, Coimbra, 2018, at p. 24–32 (with bibliographic references).
several liability (see belo
ńi piL-apurK anyz252
rataK | 02
TON-RO-LLA
Duarte Rodrigues Nunes
.1.2
II. Expedited preservation of stored computer data
hton-ro-lla ehT(Article 12 of Law no. 109/200910)
non auq enis oitidnoc
preservation of stored computer data consists in giving
t troppus seThe
irtnexpeditious
uoc
an
ividni eht n
eeorder
wteb to who has the availability or control over any specific computer
data, which already exists in a stored form, to take the necessary measures
f ni elbail reh/mih
for protecting them from anything that might alter or deteriorate its
suac evitanretla fo
quality or condition, keeping the data safe from any modification, damage
ca rosaeftrot hcihw
or elimination, in order to enable the competent authorities to seek its
a gnihton-ro-lla eht
disclosure.
f seitluciffid esoht
The person who receives the preservation order must immediately
lliw eb yam truoc
preserve the data in question, protecting and preserving its integrity
llautca saw for
egathe
madtime set, in order to enable the competent judicial authority to
lautca eht obtain
saw tcathe data and is obliged to keep confidential the undertaking of
tilicaf snoisuch
tcidsiprocedural
ruj
measure11.
t fo tnemhsilbThe
atseorder must be given by the judicial authority12 or by the criminal
t wal hsinpolice
aD dnwith
a
the authorization of the competent judicial authority or in
hcihw ,ecneexigent
dive focircumstances, in which case the criminal police should inform
ht elbaborp erom
is A .egamad eht
eht fo yroeht“10 eThe
ht expedited preservation of computer data is also provided by Article 16 of the
Convention on Cybercrime.
11
See Article 12, para. 4, of Law no. 109/2009.
S DN A TNIOJ .2.212
Combining Article 12, para. 2, of Law no. 109/2009 with Article 1, b) of the Code
of Criminal Procedure (which contains the legal concept of “judicial authority”), the order
:4 – IV kooB
nI be issued by the Public Prosecutor in the inquiry phase, by the Examining Judge in
must
judicial phase and by the Judge in the trial phase. The Portuguese criminal
c fo noitpthe
mupreliminary
serp
procedure consists of four phases, two obligatory and two optional. The first phase is the
tra ehT .debircserp
inquiry (Inquérito), after which, a decision will be made to submit (indictment), or not
ac neeb ev(discharge),
ah yam the defendant to trial. This decision may be challenged by means of a request
tnereffid hcfor
ihw
of
therinitiation
of an preliminary judicial phase, thus initiating an optional phase, the
esuac saw preliminary
egamad judicial phase (Instrução), at the end of which a new decision will be issued,
to submit (pronunciation), or not (no pronunciation), the defendant on trial; the
ca si ohw innorder
osrep
request for the opening of the preliminary judicial phase shall be filed by the defendant
in cases where there has been an indictment or by the assistant (who, as a rule, will be the
crime) when the case has been closed. If the defendant has been charged and,
1
reZ ,onitnafnIvictim
:eeS of6the
71 been a preliminary judicial phase, has been pronounced, a new mandatory
eppA fo t ruoCif:ethere
eS has
81 trial phase (Julgamento), will be opened. And, at the end of the trial phase,
p eht ot noitphase,
uloS the
ep eD .seno d eanother
tacilpmooptional
c
phase may occur, which is the appeal phase (Recurso).
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 253
Katarzyna Krupa-Lipińs
the judicial authority immediately and forward a report where he briefly
2.1. ALL-OR-NOTH
mentions the investigations carried out, the results of the investigations,
the description of the facts found and the evidence gathered13.
The all-or-nothi
The expeditious preservation of computer data is determined
when-sine qua non
conditio
ever it is of relevance to the discovery of the truth and/or forcountries
use as support th
14
15
evidence , in respect of any type of crime .
between the individ
The preservation order must discriminate (under sanction of nullity)
him/her liable in fu
the nature of the data to be preserved, its origin and destination (if
of alternative causa
known) and the period of time by which they must be preserved, up to
which tortfeasor act
a maximum of three months (extendable up to a maximum of one year)16.
the all-or-nothing ap
In accordance with Articles 2, b), and 12, both of Law no. 109/2009,
those difficulties fo
the preservation order may include any type of computer data17.
court may be willi
As the preservation order does not imply any access to preserved
of Law was actuall
data, it does not restrict any fundamental right18. So, Article 12damage
act was the actual c
no. 109/2009 does not violate any provision of the European Convention
jurisdictions
facilita
on Human Rights. In addition, the Portuguese legislator complied
fully
establishment
of th
with the provisions of Article 16 of the Convention on Cybercrime.
and Danish law th
of evidence, which
more probable tha
13
See Article 12, para. 2, of Law no. 109/2009 in conjunction with Article 253 of the
the damage. A sim
Code of Criminal Procedure.
14
See Article 12, para. 1, of Law no. 109/2009
the “theory of the m
See PAULO DÁ MESQUITA, Processo Penal, Prova e Sistema Judiciário [Criminal
Procedure, Evidence and Judicial System], Coimbra Editora, Coimbra, 2010, at p. 98, and
2.2. JOINT AND SE
Judgments of the Court of Appeal of Évora of 06/01/2015 (Case 6793/11.6TDLSB-A.
E1), available at: http://www.dgsi.pt/jtre.nsf/134973db04f39bf2802579 bf005f080b/
In Book VI – 4:1
847dae6b85353cb880257de10056ff4c?OpenDocument [last accessed 22/06/2018] and 20/01
/2015 (Case 648/14.6GCFAR-A.E1), available at: http://www.dgsi.pt/jtre.nsf/134973d
presumption of ca
b04f39bf280 2579bf005f080b/2fbdd21285478f5f80257de10056ff7a?OpenDocument [last
prescribed. The arti
accessed 22/06/2018].
may have been cau
16
See Article 12, paras. 3 and 5, of Law no. 109/2009.
17
which
See Pedro Verdelho, “A Convenção sobre o Cibercrime do Conselho dafor
Europa
– different
Repercussões na Lei portuguesa”, in Direito da Sociedade da Informação, VI [The Convention
on was caused
damage
Cybercrime of the Council of Europe – Repercussions in Portuguese Law, “Information Society
person who is acc
Law”, VI], Coimbra Editora, Coimbra, 2006, at p. 270, and Benjamin Silva Rodrigues, Da
Prova Penal, II [On Criminal Evidence, II], Rei dos Livros, Lisbon, 2010, at p. 439.
18
See Pedro Verdelho, “A Convenção sobre o Cibercrime do Conselho da16Europa
See:–Infantino, Zerv
17
Repercussões na Lei portuguesa”, in Direito da Sociedade da Informação, VI [The Convention
onCourt of Appea
See:
18 Society
Cybercrime of the Council of Europe – Repercussions in Portuguese Law, “Information
Solution to the pr
complicated ones. Depe
Law”, VI], Coimbra Editora, Coimbra, 2006, at p. 270.
several liability (see belo
15
ńi piL-apurK anyz254
rataK | 02
TON-RO-LLA
Duarte Rodrigues Nunes
.1.2
III. Expedited disclosure of traffic data19
hton-ro-lla (Article
ehT
13 of Law no. 109/200920)
non auq enis oitidnoc
with Article 13 of Law no. 109/2009, a person who has
t troppus seInirtaccordance
nuoc
received
ividni eht n
eewteb an expedited preservation order of computer data must indicate
to the entity that has given the preservation order, as soon as it knows,
f ni elbail reh/mih
other service providers who were involved in the transmission of that
suac evitanretla fo
communication, in order to ensure that they are also subject to a preservaca rosaeftrot hcihw
tion order. In fact, often more than one service provider may be involved
a gnihton-ro-lla eht
in the transmission of a communication and each service provider may
f seitluciffid esoht
possess only some traffic data related to the transmission of the specified
lliw eb yam truoc
communication, which either has been generated and retained by that
llautca saw service
egamadprovider in relation to the passage of the communication through
lautca eht its
saw
tca or has been provided from other service providers. In such
system
tilicaf snoiatcicase,
dsiruany
j
one of the service providers may possess the crucial traffic
t fo tnemhdata
silbathat
tse is needed to determine the source or destination of the comt wal hsinmunication
aD dna
or each one of them possesses only one part of the puzzle.
hcihw ,ecnedivThe
e foexpedited disclosure of traffic data is ancillary to the expeditious
ht elbaborpreservation
p erom
of data, since its purpose is only to ensure the efficacy of
is A .egam
a
d
e
h
t
the expeditious preservation of data21.
eht fo yroeht“As
ehthe
t expedited disclosure of traffic data does not imply any access to
preserved data, it does not restrict any fundamental right22. Thus, Article
S DN A TNIOJ 13
.2.2of Law no. 109/2009 does not violate any provision of the European
Convention on Human Rights. In addition, the Portuguese legislator
:4 – IV kooB nI
c fo noitpmuserp
19
in Article 2, c) of Law no. 109/2009 as “computer data related to
tra ehT .debircseDefined
rp
a communication made through a computer system generated by this system as part of
ac neeb evaacommunication
h yam
chain, indicating the origin of the communication, the destination, the
tnereffid hcpath,
ihw time,
rof date, size, duration or type of the underlying service”.
20
esuac saw egam
aThe
d expedited disclosure of traffic data is also provided by Article 17 of the
Convention on Cybercrime.
ca si ohw no21srep
See Benjamin Silva Rodrigues, Da Prova Penal, II [On Criminal Evidence, II], Rei
dos Livros, Lisbon, 2010, at p. 444.
22
61 Pedro Verdelho, “A Convenção sobre o Cibercrime do Conselho da Europa –
reZ ,onitnafnI :eeS See
71
na Lei portuguesa”, [in:] Direito da Sociedade da Informação, VI [The Convention
eppA fo t ruoCRepercussões
:eeS
81
of the Council of Europe – Repercussions in Portuguese Law, “Information Society
p eht ot noiton
uloCybercrime
S
ep eD .seno d eLaw”,
tacilpm
oc Coimbra Editora, Coimbra, 2006, at p. 270.
VI],
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 255
Katarzyna Krupa-Lipińs
complied fully with the provisions of Article 17 of the Convention2.1.
on ALL-OR-NOTH
Cybercrime.
The all-or-nothi
conditio sine qua non
IV. The order for submitting or granting access
countries support th
23
to data (Article 14 of Law no. 109/2009 ) between the individ
him/her liable in fu
The order for submitting or granting access to data consists in a judicial
of
alternative causa
authority24 orders a person to submit or allow the access to specified
which tortfeasor act
computer data in that person’s possession or control, whenever it is of
the all-or-nothing ap
relevance to the discovery of the truth and/or for use as evidence25.
those difficulties fo
Likewise, service providers may receive an order to submit or allow
court may be willi
access to data relating to their customers or subscribers (other than traffic
damage was actuall
data or content) held by them and to determine the type of communication
act was
service used, the technical measures taken thereto and the period
of the actual c
facilita
service, as well as the subscriber’s identity, postal or geographicaljurisdictions
address
establishment
of th
and telephone number and any other access number, data relating to
and Danish
law th
billing and payment available on the basis of a service agreement
or
of evidence, which
any other information on the location of the communication equipment
26
more probable tha
available on the basis of a service agreement .
the damage.
A sim
The order for submitting or granting of access to data relates
to
computer data (other than traffic data or content of communications)
the “theory of the m
27
and the key to access the encryption of the data concerned . The order
, so JOINT AND SE
must specify which data the submission or access is intended for282.2.
In Book VI – 4:1
presumption of ca
23
The order for submitting or granting access to data is also provided by Article 18
prescribed. The arti
of the Convention on Cybercrime, under the designation of “Production order”.
have been cau
24
Combining Article 14, para. 1, of Law no. 109/2009 with Article 1, b) ofmay
the Code
which different
of Criminal Procedure (which contains the legal concept of “judicial authority”),for
the order
must be issued by the Public Prosecutor in the inquiry phase, by the Examiningdamage
Judge in was caused
the preliminary judicial phase and by the Judge in the trial phase.
person who is acc
25
See Article 14, para. 1, of Law no. 109/2009.
See Article 14, at para. 4, of Law no. 109/2009.
27
See David Ramalho, Métodos Ocultos de Investigação Criminal em Ambiente
16 Digital
See: Infantino, Zerv
17
[Covert Methods of Criminal Investigation in Digital Environment], Almedina, Coimbra,
2017,
See: Court of Appea
18
at p. 170.
Solution to the pr
28
complicated ones. Depe
See Article 14, at para. 2, of Law no. 109/2009.
several liability (see belo
26
ńi piL-apurK anyz256
rataK | 02
Duarte Rodrigues Nunes
that
.1.2 access only affects the data relevant to the investigation and there
is no indiscriminate access to all data29.
hton-ro-lla ehTHowever, pursuant to Article 14, paragraph 5, of Law no. 109/2009,
non auq enisthe
oitiorder
dnoc for submitting or granting access to data may not be addressed
to
the
or to the suspect who has not yet been constituted as
t troppus seirtnuodefendant
c
30
31
defendant
ividni eht n
eewteb , in order to safeguard the privilege against self-incrimination .
The order for submitting or granting access to data relates only to
f ni elbail reh/mih
computer data that has already been collected and stored by its holders,
suac evitanretla fo
not including obtaining real-time computer data or the retention of future
ca rosaeftrot hcihw
traffic data or real-time access to the content of the communications32,
a gnihton-ro-lla eht
which will have to be obtained by means of interception of communications
f seitluciffid esoht
provided by Article 18 of Law no. 109/200933.
lliw eb yam truoc
Failure to comply with the order for submitting or granting access to
llautca saw data
egamwill
ad be treated as the crime of simple disobedience34.
lautca eht saw tca
tilicaf snoitcids29irSee
uj Pedro Verdelho, Cibercrime” [in:] Direito da Sociedade da Informação, IV [Cybert fo tnemhcrime,
silba“Information
tse
Society Law”, IV], Coimbra Editora, Coimbra, 2003, at p. 377.
See
t wal hsinaD 30dn
a Pedro Verdelho, “A Convenção sobre o Cibercrime do Conselho da Europa –
hcihw ,ecneRepercussões
dive fo na Lei portuguesa”, [in:] Direito da Sociedade da Informação, VI [The Convention
on Cybercrime of the Council of Europe – Repercussions in Portuguese Law, “Information Society
ht elbaborLaw”,
p ero
m
VI], Coimbra Editora, Coimbra, 2006, at p. 271.
is A .egamad31 eSee
ht Rita Castanheira Neves, As Ingerências nas Comunicações Electrónicas em Processo
eht fo yroPenal
eht“[The
ehtInterferences in Electronic Communications in Criminal Procedure], Coimbra Editora,
TON-RO-LLA
Coimbra, 2011, at p. 235.
32
See BENJAMIM SILVA RODRIGUES, Das Escutas Telefónicas, II [On Wiretapping, II],
S DN A TNIOJ .2.2
Rei dos Livros, Lisbon, 2008, at p. 336, and Judgments of the Court of Appeal of Évora
of 06/01/2015 (Case 6793/11.6TDLSB-A.E1), available at: http://www.dgsi.pt/jtre.ns:4 – IV kooB
nI
f/134973db04f39bf2802579bf005
f080b/847dae6b85353cb880257de10056ff4c?OpenDocuc fo noitpment
mus[last
erp accessed 22/06/2018] and 20/01/2015 (Case 648/14.6GCFAR-A.E1), available
79bf005f080b/2fbdd21285478f5ftra ehT .deat:
birhttp://www.dgsi.pt/jtre.nsf/134973db04f39bf28025
cserp
80257de10056ff7a? OpenDocument [last accessed 22/06/2018].
ac neeb evah y
33 am
See Carlos Pinho, “Os problemas interpretativos resultantes da Lei n.º 32/2008, de 17 de
tnereffid hcJulho”,
ihw rinofRevista do Ministério Público, n.º 129 [The interpretative problems resulting from Law
esuac saw no.
ega32/2008,
mad of July 17, “Public Ministry Review”, no. 129], at p. 78, and Judgments of the Court
of Appeal of Évora of 06/01/2015 (Case 6793/11.6TDLSB-A.E1), available at: http://www.
ca si ohw nosrep
dgsi.pt/jtre.nsf/134973db04f39bf280 2579bf005f080b/847dae6b85353cb880257de10056ff4c?OpenDocument [last accessed 22/06/2018] and 20/01/2015 (Case 648/14.6GCFAR-A.
at: http://www.dgsi.pt/jtre.nsf/134973db04f39bf2802579 bf005f080b/2fb61
reZ ,onitnafnIE1),
:eeSavailable
71
[last accessed 22/06/2018].
eppA fo t ruoCdd21285478f5f80257de10056ff7a?OpenDocument
:eeS
81 Article 14, at para. 1 and 3, of Law no. 109/2009 and Article 348, par. 1, a), of the
p eht ot noituloS34 See
ep eD .seno d ePortuguese
tacilpmoc Penal Code. Pursuant to Article 348, para. 1, a), of the Portuguese Penal Code,
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 257
Katarzyna Krupa-Lipińs
The order for submitting or granting access to computer data may
2.1. ALL-OR-NOTH
be used to investigate any type of crime35.
Regarding professional confidentiality, pursuant to Article 14, paraThe all-or-nothi
graph 6, of Law no. 109/2009, the order for submitting or granting
accesssine qua non
conditio
to data may not be directed to computer systems used for lawyer,
medi- support th
countries
cal and banking activities and for the profession of journalist. Although
between the individ
only some cases of professional confidentiality are specified, we consider
him/her liable in fu
that Article 14, paragraph 6, of Law no. 109/2009, applies to any activity
of alternative causa
subject to professional confidentiality.
which tortfeasor act
At first sight, it seems that the use of the order for submitting or
the all-or-nothing ap
granting access to data is not admissible in such cases. However, Arthose difficulties fo
ticle 14, paragraph 7, provides for the possibility of lifting of professional
court may be willi
confidentiality. Therefore, it is possible to direct the order for submitting
damage was actuall
or granting access to data stored on computer systems used for activities
act conwas the actual c
subject to professional confidentiality, provided that professional
jurisdictions
facilita
fidentiality has been lifted, by permission of the Judge or, in the
cases
36
establishment
of th
provided by law, by the Public Prosecutor .
and not
Danish law th
It is not understandable that Article 14 of Law no. 109/2009 does
of evidence, which
provide any special procedure in exigent circumstances as are provided
more probable tha
the damage. A sim
anyone who fails to comply with a lawful order or mandate, regularly communicated
or
the “theory
of the m
emanating from the relevant authorities or official, shall be punished by imprisonment
for up to one year or a fine of up to 120 days if a legal provision sanctions in this case
2.2. JOINT AND SE
the simple disobedience.
The text of Portuguese Penal Code is available at: http://www.pgdlisboa.pt/leis/
In Book VI – 4:1
lei_mostra_articulado.php?nid=109&tabela=leis (in Portuguese only). There is an English
version (outdated) of the General Part of the Code available at: http://www.legislationline.
presumption of ca
org/documents/section/criminal-codes/country/9.
prescribed. The arti
35
See Paulo Da Mesquita, Processo Penal, Prova e Sistema Judiciário [Criminal Procedure,
may have
been cau
Evidence and Judicial System], Coimbra Editora, Coimbra, 2010, at p. 98, and Judgments
of
for which
the Court of Appeal of Évora of 06/01/2015 (Case 6793/11.6TDLSB-A.E1), available
at: different
http://www.dgsi.pt/jtre.nsf/134973db04f39bf28025 79bf005f080b/847dae6b85353cbdamage was caused
880257de10056ff4c?OpenDocument ([last accessed 22/06/2018] and 20/01/2015 (Case
person who is acc
648/14.6GCFAR-A.E1), available at: http://www.dgsi.pt/jtre.nsf/134973db04f 39bf2802579bf005f080b/2fbdd21285478f5f80257de10056ff7a?OpenDocument [last accessed
22/06/2018].
16
See: Infantino, Zerv
36
17 meios
On this issue, with more developments, Duarte Rodrigues Nunes, Os
See:deCourt of Appea
18
obtenção de prova previstos na Lei do Cibercrime [The means of obtaining evidence provided
by
the
Solution
to the pr
complicated ones. Depe
Law of Cybercrime], Gestlegal, Coimbra, 2018, at p. 73–83 (with bibliographic references).
several liability (see belo
ńi piL-apurK anyz258
rataK | 02
Duarte Rodrigues Nunes
in
12, paragraph 2, 15, paragraph 4, and 16, paragraph 2. Firstly,
.1.Articles
2
exigent circumstances may also arise in connection with the order for
or granting of access to data. Secondly, such a possibility is
hton-ro-lla submitting
ehT
non auq enisprovided
oitidnoc by the case of searches of computer data and seizure of computer
data.
t troppus seirtnuSuch
oc a difference is not understandable, since the order for submitting
oreegranting
access to data is not more damaging to fundamental rights
ividni eht n
wteb
than the search of computer data or the seizure of computer data (and
f ni elbail reh/mih
may even be less damaging than the search of computer data).
suac evitanretla fo
With respect to the restriction of fundamental rights, the order for
ca rosaeftrot hcihw
submitting or granting access to data restricts the fundamental rights to
a gnihton-ro-lla eht
privacy and informational self-determination protected by Article 8 of
f seitluciffid esoht
the European Convention on Human Rights37. Pursuant to Article 8 (2),
lliw eb yam truoc
there shall be no interference by a public authority with the exercise of
llautca saw these
egamrights,
ad
except such as is in accordance with the law and is necessary
lautca eht in
saw
t
c
a
a democratic society in the interests of national security, public safety
tilicaf snoior
tcid
sireconomic
uj
the
well-being of the country, for the prevention of disorder
t fo tnemhor
silcrime,
batse for the protection of health or morals, or for the protection of
t wal hsinthe
aD rights
dna and freedoms of others.
hcihw ,ecnedivThe
e fo explanatory report notes that, in the course of a criminal
ht elbaborinvestigation,
p erom
subscriber information may be needed mainly in two
is A .egam
a
d
e
h
t
situations. Firstly, to identify which services and related technical
eht fo yromeasures
eht“ eht have been used or are being used by a subscriber, such as
the type of telephone service used, the type of other associated services
S DN A TNIOJ used
.2.2 (for example, call forwarding, voicemail), or the telephone number
or other technical address (for example, the e-mail address). Secondly,
where
:4 – IV kooB
nI a technical address is known, subscriber information is needed
c fo noitpin
morder
userp to assist in establishing the identity of the person concerned.
the ECtHR emphasizes38, “[…] the Convention on Cybercrime obliges
tra ehT .debircAs
serp
ac neeb evthe
ah States
yam to make measures such as the real-time collection of traffic data and
issuing
tnereffid hcthe
ihw
rof of production orders available to the authorities […]. However, such
measures
esuac saw egamad are, pursuant to Article 15 of that Convention, “subject to conditions
TON-RO-LLA
ca si ohw nosrep
See ECtHR, Benedik v. Slovenia, Application no. 62357/14, Judgment of 24.04.2018,
available
61 at: https://hudoc.echr.coe.int/eng#{%22fulltext%22:[%22\%22production
reZ ,onitnafnI :eeS
71
2%22:[%22GRANDCHAMBER%22,%eppA fo t ruoC%20order\%22%22],%22documentcollectionid
:eeS
81
%22itemid%22:[%22001-182455%22]} [last accessed 07/11/2018].
p eht ot noit22CHAMBER%22],
uloS
38moc
ep eD .seno d etacilp
Ibid.
oleb ees( ytilibail lareves
37
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 259
Katarzyna Krupa-Lipińs
and safeguards provided for under [State parties’] domestic law” and must2.1.
“as ALL-OR-NOTH
appropriate in view of the nature of the procedure or power concerned, inter alia,
include judicial or other independent supervision, grounds justifying application,
The all-or-nothi
and limitation of the scope and the duration of such power or procedure””.
conditio sine qua non
An order for submitting or granting access to data provides
a less support th
countries
intrusive and less onerous measure which law enforcement authorities
between the individ
can apply instead of measures such as interception of content data and
him/her liable in fu
real-time collection of traffic data, which must be used only to investigate
of alternative
causa
serious offences (Articles 20 and 21 of the Convention on Cybercrime)39.
which tortfeasor act
And because Article 14 of Law no. 109/2009 does not include access
the all-or-nothing ap
neither to traffic data nor to the content of communications, the order
those difficulties fo
for submitting or granting access to data does not constitute an intense
court may be willi
restriction of fundamental rights. Thus, we consider that neither Articles
damage was actuall
15 and 18 of the Convention on Cybercrime nor Article 8 of the European
act was
Convention on Human Rights require that the order for submitting
or the actual c
jurisdictions facilita
granting access to data depend on judicial authorization.
establishment of th
Thus, Article 14 of Law no. 109/2009 empowers the investigating
and Danish law th
authorities to order (1) a person in Portugal to submit specified computer
of evidence, which
data in that person’s possession or control, which is stored on a computer
probable tha
system or computer-data storage medium or (2) a service providermore
offering
the
damage.
A sim
its services in the territory of Portugal to submit subscriber information
relating to such services in that service provider’s possession or control.
And
the “theory
of the m
respects the safeguards imposed by Articles 14 and 15 of the Convention on
Cybercrime and Article 8 of the European Convention on Human Rights.
2.2. JOINT AND SE
In Book VI – 4:1
presumption
of ca
V. Search of stored computer data
prescribed. The arti
(Article 15 of Law no. 109/200940)
may have been cau
The search of stored computer data consists in the authoritiesforaccess
which different
a computer system or part of it and computer data stored damage
therein, was caused
person who is acc
39
See ECtHR, K.U. v. Finland, Application no. 2872/02, Judgment of 02.12.2008, available at: https://hudoc.echr.coe.int/eng#{%22fulltext%22:[%22\%2 2production%20order\%22%22],%22document collectionid2%22:[%22GRANDCHAMBER%22, %22CHAM16
See: Infantino, Zerv
17
BER%22],%22itemid%22:[%22001-89964%22]} [last accessed 07/11/2018].
See: Court of Appea
40
18
The search of computer data is also provided by Article 19 of the Convention
on
Solution
to the pr
complicated ones. Depe
Cybercrime.
several liability (see belo
ńi piL-apurK anyz260
rataK | 02
Duarte Rodrigues Nunes
whenever
it is of relevance to the discovery of the truth and/or for use
.1.2
as evidence41. Thus, the search may focus on all or part of the computer
or an independent data storage device.
hton-ro-lla system
ehT
non auq enis oitiThe
dnocsearch of stored computer data may be used to investigate any
42
type
t troppus seirtnuofoccrime .
The
ividni eht neew
teb search of stored computer data is authorized by the judicial
authority (who, whenever possible, shall be present during the search)43,
f ni elbail reh/mih
and the authorization has a maximum period of validity of 30 days,
suac evitanretla fo
under sanction of nullity44.
ca rosaeftrot hcihw
Pursuant to Article 15, paragraph 3, of Law no. 109/2009, the search
a gnihton-ro-lla eht
may also be conducted by the criminal police without prior authorization
f seitluciffid esoht
from the judicial authority in two situations:
lliw eb yam truoc
a) Upon consent of any person who has the availability or control of
llautca saw egamadthe computer data in question (the consent must be documented); or
lautca eht sawb)tcaIn cases of terrorism and violent or highly organized crime, when
tilicaf snoitcidsirujthere is evidence of the imminent commitment of a criminal
t fo tnemhsilbatseoffence which seriously endangers the life or integrity of any
t wal hsinaD dnaperson.
hcihw ,ecnedivIn
e fboth
o
cases, a report containing a summary of the investigations
ht elbaborcarried
p eromout, the results of the investigations, a description of the facts found
is A .egam
ad the
ehtevidence gathered must be submitted to the judicial authority and,
and
b), the execution of the search must be communicated to the
eht fo yroin
ehsituation
t“ eht
competent judicial authority in the shortest possible time for validation45.
TON-RO-LLA
S DN A TNIOJ
.2.2
41
See Article 15, para. 1, of Law no. 109/2009.
:4 – IV kooB nI42 See Paulo Da Mesquita, Processo Penal, Prova e Sistema Judiciário [Criminal Procedure,
c fo noitpEvidence
muserpand Judicial System], Coimbra Editora, Coimbra, 2010, p. 98, and Judgments of
the Court of Appeal of Évora of 06/01/2015 (Case 6793/11.6TDLSB-A.E1), available at:
tra ehT .debircserp
http://www.dgsi.pt/jtre.nsf/134973db04f39bf280 2579bf005f080b/847dae6b85353cbac neeb ev880257de10056ff4c?
ah yam
OpenDocument [last accessed 22/06/2018] and 20/01/2015 (Case
tnereffid hc648/14.6GCFAR-A.E1),
ihw rof
available at: http://www.dgsi.pt/jtre.nsf/134973db04f39bf280
de10056ff7a?OpenDocument [last accessed
esuac saw 2579bf005f080b/2fbdd21285478f5f80257
egamad
22/06/2018].
ca si ohw no43srep
Combining Article 15, para. 1, of Law no. 109/2009 with Article 1, b), of the
Code of Criminal Procedure (which contains the legal concept of “judicial authority”),
must be issued by the Public Prosecutor in the inquiry phase, by the
61
reZ ,onitnafnIthe
:eeSauthorization
71 Judge in the preliminary judicial phase and by the Judge in the trial phase.
eppA fo t ruoCExamining
:eeS
81 Article 15, para. 2, of Law no. 109/2009.
p eht ot noituloS44 See
45moc
ep eD .seno d etacilp
See Article 15, para. 4, of Law no. 109/2009.
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 261
Katarzyna Krupa-Lipińs
The paragraph 5 of Article 15 of Law no. 109/2009 provides that
2.1. ALL-OR-NOTH
if there are reasons to believe that the data sought is found in another
computer system or in a different part of the system searched, but
is all-or-nothi
The
legitimately accessible from or available to the initial system, the
searchsine qua non
conditio
can be extended upon authorization of the competent judicial authority.
countries support th
With regard to professional confidentiality, pursuant to Article
15, the individ
between
paragraph 6, of Law no. 109/2009, computer searches in computer
him/her liable in fu
systems used for activities subject to professional confidentiality46 must be
of alternative causa
authorized by the Judge (who must also be present during the search). The
which tortfeasor act
Judge must notify the President of the local council of the Bar Association
the all-or-nothing ap
or of the Order of Physicians, the president of the regional council of
those difficulties fo
the Order of Solicitors and Execution Agents, the president of the most
court may be willi
representative trade union organization of journalists or, in the other
damage
cases, a similar entity, so that the same, or a delegate, may be present;
in was actuall
act was the actual c
the case of a search in an official health establishment, the notification
jurisdictions facilita
shall be made to the chairman of the board of directors or management
establishment of th
of the establishment or to his/her legal substitute. And the professional
and Danish law th
wanted by the search may also be present.
of evidence,
which
With respect to the restriction of fundamental rights, the search
of
more
probable tha
stored computer data restricts the fundamental rights to privacy
and to
the
damage.
A sim
informational self-determination, protected by Article 8 of the European
47
Convention on Human Rights . Pursuant to Article 8 (2), there shall
no
thebe
“theory
of the m
interference by a public authority with the exercise of these rights, except
such as is in accordance with the law and is necessary in a democratic
2.2. JOINT AND SE
society in the interests of national security, public safety or the economic
well-being of the country, for the prevention of disorder or crime,Infor
Book VI – 4:1
the protection of health or morals, or for the protection of the rights
and
presumption
of ca
freedoms of others.
prescribed. The arti
may have been cau
for which different
46
We consider that, although Article 15, para. 6, of Law no. 109/2009 onlydamage
mentions was caused
the professional confidentiality of physician, lawyer or journalist, it shall apply to all
person who is acc
cases in which computer research is carried out in a computer system used for an activity
subject to professional confidentiality.
47
See ECtHR, Prezhdarovi v. Bulgaria, Application no. 8429/05, Judgment of 30.09.2014,
16
See: Infantino, Zerv
17
available at: https://hudoc.echr.coe.int/eng#{%22fulltext%22:[%22 CASE%20OF%20
See: Court of Appea
18
PREZHDAROVI%20v.%20BULGARIA%22], %22documentcollectionid2%22:[%22JUDGSolution to the pr
MENTS%22], %22itemid%22:[%22001-146565%22]} [last accessed 07/11/2018].complicated ones. Depe
several liability (see belo
ńi piL-apurK anyz262
rataK | 02
Duarte Rodrigues Nunes
.1.2The explanatory report notes that Article 19 of the Convention on
Cybercrime “aims at modernising and harmonising domestic laws on
hton-ro-lla search
ehT and seizure of stored computer data for the purposes of obtaining
non auq enisevidence
oitidnoc with respect to specific criminal investigations or proceedings.
Any
criminal procedural law includes powers for search and
t troppus seirtnudomestic
oc
seizure
ividni eht n
eewtebof tangible objects. However, in a number of jurisdictions stored
computer data per se will not be considered as a tangible object and
f ni elbail reh/mih
therefore cannot be secured on behalf of criminal investigations and
suac evitanretla fo
proceedings in a parallel manner as tangible objects, other than by
ca rosaeftrot hcihw
securing the data medium upon which it is stored. The aim of Article 19
a gnihton-ro-lla eht
of this Convention is to establish an equivalent power relating to stored
f seitluciffid esoht
data”.
lliw eb yam truoc
The ECtHR analyzed the compliance of Portuguese Law in matter of
llautca saw search
egamaof
d stored computer data with Article 8 of the European Convention
lautca eht on
saw
tca Rights in the Judgement of the Case Sérvulo & Associados –
Human
tilicaf snoiSociedade
tcidsiruj de Advogados, RL and Others v. Portugal48 and considered
t fo tnemhthat
silbPortuguese
atse
Law did not violate the European Convention on Human
t wal hsinRights
aD dn49a. Furthermore, pursuant to Article 19 (5) of the Convention on
hcihw ,ecneCybercrime,
dive fo
the search of stored computer data is subject to Articles 14
ht elbaborand
p er15
omof that Convention.
is A .egamadLike
eht an order for submitting or granting access to data, the search
eht fo yroof
ehtstored
“ eht computer data provides a less intrusive measure which law
enforcement authorities can apply instead of measures such as interception
content data and real-time collection of traffic data, which must be
S DN A TNIOJ of
.2.2
used only to investigate serious offences. Although Article 15 of Law
no.
:4 – IV kooB
nI109/2009 may include access to traffic data and even to the content
communications
stored on a computer system, the search of stored
c fo noitpof
mu
serp
tra ehT .decomputer
bircserp data does not constitute an intense restriction of fundamental
rights
like, for example, an interception of communications. Thus, we
ac neeb evah yam
tnereffid hcconsider
ihw rof that neither Articles 15 and 19 of the Convention on Cybercrime
TON-RO-LLA
esuac saw egamad
ca si ohw no48srep
ECtHR, Sérvulo & Associados – Sociedade de Advogados, RL and Others v. Portugal,
Application no. 27013/10, Judgment of 03.12.2015, available at: https://hudoc.echr.coe.
[accessed 07/11/2018].
61
reZ ,onitnafnIint/eng#{%22itemid%22:[%22001-156519%22]}
:eeS
49
71
the Court did not analyse Articles 15 and 16 of Law no. 109/2009, but,
eppA fo t ruoC :eeS Although
81
Articles 174, 176 and 178 of the Code of Criminal Procedure, whose regime
p eht ot noitamong
uloS others,
ep eD .seno d ewas
tacilsimilar
pmoc to Articles 15 and 16 of Law no. 109/2009.
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 263
Katarzyna Krupa-Lipińs
nor Article 8 of the European Convention on Human Rights require that
2.1. ALL-OR-NOTH
the order for submitting or granting access to data depend on judicial
authorization.
The all-or-nothi
Article 15 of Law no. 109/2009 empowers the investigating authorities
conditio sine qua non
to search or similarly access a computer system or part of it and computer
countries support th
data stored therein and a computer-data storage medium inbetween
which the individ
computer data may be stored and respects the safeguards imposed by
him/her liable in fu
Articles 14 and 15 of the Convention on Cybercrime and Article 8 of
of alternative causa
the European Convention on Human Rights. However, there are some
which tortfeasor act
differences between Article 15 of Law no. 109/2009 and Article 19 of the
the all-or-nothing ap
Convention on Cybercrime.
those difficulties fo
Thus, pursuant to Article 19 of the Convention on Cybercrime, only
court may be willi
computer data stored on computer systems or computer-data storage
damage was actuall
mediums located in the territory of each Party may be searched. However,
actrefers
was the actual c
in Article 15 of Law no. 109/2009, the Portuguese legislator only
jurisdictions
facilita
to the search of stored computer data without mentioning whether
the
establishment
of th
computer system is located in the Portuguese territory or abroad.
and Danish
law th
Therefore, we consider that Article 15 of Law no. 109/2009 allows
the
of in
evidence,
which
search of computer data in computer systems that are not located
the
more probable tha
Portuguese territory without to resort to international judicial cooperation
the damage.
A sim
mechanisms. Firstly, if the Portuguese legislator wanted to restrict
the
search of computer data to the systems that are located in the Portuguese
the “theory of the m
territory, he would have done it, but he did not. Secondly, computer crime
knows no frontiers and, therefore, the application of criminal procedural
2.2. JOINT AND SE
law must be adapted to that reality. And finally, when the authorities
know where data is stored but don’t know in which country the computer
In Book VI – 4:1
system is located, the rejection of the possibility of Article 15 of presumption
Law no.
of ca
109/2009 allow remote cross-border access to computer systemsprescribed.
located
The arti
in foreign countries without resort to international judicial cooperation
may have been cau
50
.
mechanisms, would make impossible to carry out such a measure
for which
different
And we find another difference between Article 15 of Law no.
109/
damage was caused
2009 and Article 19 of the Convention on Cybercrime. In fact,
the who is acc
person
16
See: Infantino, Zerv
17 de prova
For further arguments, see Duarte Rodrigues Nunes, Os meios de obtenção
See: Court of Appea
18
previstos na Lei do Cibercrime [The means of obtaining evidence provided by the Law of Cybercrime],
Solution to the pr
complicated ones. Depe
Gestlegal, Coimbra, 2018, p. 91–94.
several liability (see belo
50
ńi piL-apurK anyz264
rataK | 02
Duarte Rodrigues Nunes
Portuguese
legislator did not empower the authorities to order any person
.1.2
who has knowledge about the functioning of the computer system or
applied to protect the computer data therein to provide, as
hton-ro-lla measures
ehT
the necessary information, to enable the undertaking of
non auq enisisoireasonable,
tidnoc
a
search
of
computer
stored data. Thus, we consider that, in this aspect,
t troppus seirtnuoc
the
Portuguese
legislator has not fully complied with Article 19 of the
ividni eht n
eew
teb
Convention on Cybercrime51.
f ni elbail reh/mih
suac evitanretla fo
ca rosaeftrot hcihw
of stored computer data
a gnihton-rVI.
o-llaSeizure
eht
16 of Law no. 109/200952)
f seitluciffi (Article
d esoht
lliw eb yam truoc
The seizure of computer data consists in seize or similarly secure
llautca saw computer
egamad data that has been searched or similarly accessed53, as well as
lautca eht the
sawprograms
tca
necessary to access such data54.
tilicaf snoitcidsiruj
t fo tnemhsilbatse
The
t wal hsinaD 51dn
a explanatory report notes that “This power is not only of benefit to the
investigating
authorities. Without such cooperation, investigative authorities could
hcihw ,ecnedive fo
remain on the searched premises and prevent access to the computer system for long
ht elbaborperiods
p erom
of time while undertaking the search. This could be an economic burden on
is A .egam
ad eht businesses or customers and subscribers that are denied access to data during
legitimate
eht fo yrothis
eht“time.
eht A means to order the co-operation of knowledgeable persons would help in
TON-RO-LLA
making searches more effective and cost efficient, both for law enforcement and innocent
individuals affected. Legally compelling a system administrator to assist may also relieve
S DN A TNIOJ .2.2
the administrator of any contractual or other obligations not to disclose the data”.
52
The seizure of computer data is also provided by Article 19 of the Convention on
:4 – IV kooB
nI
Cybercrime.
we may include the collection of computer data by a specialist in the place
c fo noitpmu53seWhere
rp
where the computer system is located, a search in the place where the computer system
tra ehT .debircserp
is located or the access to the computer system or to the autonomous device by means of
ac neeb evan
ahorder
yamfor submitting or granting access to data (see David Ramahlo, Métodos Ocultos
tnereffid hcdeihInvestigação
w rof
Criminal em Ambiente Digital [Covert Methods of Criminal Investigation in the
Almedina, Coimbra, 2017, p. 133–134).
esuac saw Digital
egamaEnvironment],
d
54
The printing by the authorities of what appears on a web page or on a social
ca si ohw nosrep
network profile constitutes a seizure of computer data [see Judgments of the Court
of Appeal of Oporto of 13/04/2016 (Case 471/15.0T9AGD-A.P1) in http://www.dgsi.pt/
61
reZ ,onitnafnIjtrp.nsf/56a6e7121657f91e80257cda00381fdf/ef54d51d3972157d80257fa4002e2d75?OpenDoc:eeS
71 accessed 22/06/2018] and 04/04/2017 (Case 671/14.0GAMCN.P1), available
eppA fo t ruoCument
:eeS [last
81
cda00381fdf/16ebc99e65fcp eht ot noitat:
ulohttp://www.dgsi.pt/jtrp.nsf/56a6e7121657f91e80257
S
ep eD .seno d e19038025810c0051991a?OpenDocument
tacilpmoc
[last accessed 22/06/2018].
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 265
Katarzyna Krupa-Lipińs
55
The seizure of computer data is authorized by the judicial authority
2.1., ALL-OR-NOTH
whenever it is of relevance to the discovery of the truth and/or for use
as evidence56, and can be used to investigate any type of crime57. The all-or-nothi
Pursuant to Article 16, paragraphs 2 and 4, of Law no. 109/2009,
conditio sine qua non
the seizure may be carried out by the criminal police in the course
of support th
countries
a computer search legitimately ordered and executed in accordance
between the individ
with Article 15 of Law no. 109/2009 or in exigent circumstances; and
him/her liable in fu
the police must inform the competent judicial authority, for validation,
of alternative causa
within 72 hours.
which tortfeasor act
Pursuant to Article 16, paragraphs 5 and 6, of Law no. 109/2009, the
the all-or-nothing ap
seizure of stored data in computer systems used for lawyer, medical and
those difficulties fo
banking activities must be authorized by the Judge (who must also be
court may be willi
present during the seizure)58, without prejudice to the power of the judicial
damage was actuall
authority provided by special laws. The Judge or the judicial authority
act was
must notify the President of the local council of the Bar Association
or the actual c
jurisdictions
facilita
of the Order of Physicians, the president of the regional council
of the
establishment
of th
Order of Solicitors and Execution Agents, the president of the most
andother
Danish law th
representative trade union organization of journalists or, in the
of evidence,
which
cases, a similar entity, so that the same, or a delegate, may be present;
in
more probable tha
the case of a search in an official health establishment, the notification
the damage. A sim
shall be made to the chairman of the board of directors or management
of the establishment or to his/her legal substitute. And the professional
the “theory of the m
wanted by the seizure may also be present.
2.2. JOINT AND SE
Combining Article 16, paragraph 1, of Law no. 109/2009 with Article 1, b), of the
In Book VI – 4:1
Code of Criminal Procedure (which contains the legal concept of “judicial authority”),
the authorization must be issued by the Public Prosecutor in the inquiry phase,
by the
presumption
of ca
Examining Judge in the preliminary judicial phase and by the Judge in the trial phase.
prescribed. The arti
56
See Article 16, paragraph 1, of Law no. 109/2009.
mayProcehave been cau
57
See Paulo Da Mesquita, Processo Penal, Prova e Sistema Judiciário [Criminal
for which different
dure, Evidence and Judicial System], Coimbra Editora, Coimbra, 2010, p. 98, and Judgments
of the Court of Appeal of Évora of 06/01/2015 (Case 6793/11.6TDLSB-A.E1),
avail- was caused
damage
able at: http://www.dgsi.pt/jtre.nsf/134973db04f39bf2802579bf005f080b /847dae6bperson who is acc
85353cb880257de10056ff4c?OpenDocument (accessed 22/06/2018) and 20/01/2015
(Case 648/14.6GCFAR-A.E1), available at: http://www.dgsi.pt/jtre.nsf/134973db04f39bf280 2579bf005f080b/2fbdd21285478f5f80257de100 56ff7a?OpenDocument
(ac-Infantino, Zerv
16
See:
17
cessed 22/06/2018).
See: Court of Appea
58
18 Code
See also Articles 180, paragraph 1, 181 and 268, paragraph 1, c), of the
of
Solution
to the pr
complicated ones. Depe
Criminal Procedure.
several liability (see belo
55
ńi piL-apurK anyz266
rataK | 02
Duarte Rodrigues Nunes
.1.2Pursuant to Article 16, paragraph 7, of Law no. 109/2009, the seizure
of computer data may be carried out by means of:
hton-ro-lla ehTa) Seizure of the device where the system is installed or seizure of
non auq enis oitidnocthe device where the computer data is stored, as well as the other
t troppus seirtnuocdevices that are necessary for its reading;
b)tebRealization of a copy of the data to an autonomous device, that
ividni eht neew
will be added to the process;
f ni elbail reh/mih
c) Preservation by technological means of the integrity of the data,
suac evitanretla fo
without copying or removal thereof; or
ca rosaeftrot hcihw
d) Non-reversible elimination or blocking of data access.
a gnihton-ro-lla eht
And, in accordance with paragraph 8 of the same Article, if the seizure
f seitluciffid esoht
consists in making a copy of the data, the copy must be made in duplicate
lliw eb yam truoc
and one of the copies must be sealed and entrusted to the judicial clerk of
llautca saw the
egam
ad where the process is taking place and, if technically possible,
Court
lautca eht the
sawseized
tca data will be certified by digital signature.
tilicaf snoitcidsThe
iruj choice of one of the ways of carrying out the seizure is not
t fo tnemharbitrary
silbatse and the authorities shall choose the one that, being appropriate
t wal hsinto
aDpursue
dna the purposes of the investigation, is less damaging to the
hcihw ,ecnefundamental
dive fo
rights of the people affected by the measure59.
ht elbaborp eWith
rom respect to the restriction of fundamental rights, the seizure of
is A .egam
a
d
ehcomputer
t
stored
data restricts the fundamental rights to privacy and to
self-determination, protected by Article 8 of the European
eht fo yroinformational
eht“ eht
Convention on Human Rights60. Pursuant to Article 8 (2), there shall be no
by a public authority with the exercise of these rights, except
S DN A TNIOJ interference
.2.2
such as is in accordance with the law and is necessary in a democratic
society
in the interests of national security, public safety or the economic
:4 – IV kooB
nI
c fo noitpwell-being
muserp of the country, for the prevention of disorder or crime, for
of health or morals, or for the protection of the rights and
tra ehT .dethe
bircprotection
serp
freedoms
of
others.
ac neeb evah yam
TON-RO-LLA
tnereffid hcihw rof
59
esuac saw egam
aRita
d Castanheira Neves, As Ingerências nas Comunicações Electrónicas em Processo
Penal [The Interference in Electronic Communications in Criminal Procedure], Coimbra Editora,
ca si ohw nosrep
Coimbra, 2011, p. 273, and BENJAMIM SILVA RODRIGUES, Da Prova Penal, II [On Criminal
Evidence, II], Rei dos Livros, Lisbon, 2010, p. 452.
60
61 ECtHR, Prezhdarovi v. Bulgaria, Application no. 8429/05, Judgment of 30.09.2014,
reZ ,onitnafnI :eeS See
71at: https://hudoc.echr.coe.int/eng#{%22fulltext%22:[ %22CASE%20OF%20
eppA fo t ruoCavailable
:eeS
81
%22documentcollectionid2%22:[%22JUDGp eht ot noitPREZHDAROVI%20v.%20BULGARIA%22],
uloS
ep eD .seno d eMENTS%22],
tacilpmoc
%22itemid%22:[%22001-146565%22]} [last accessed 07/11/2018].
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 267
Katarzyna Krupa-Lipińs
The explanatory report notes that Article 19 of the Convention2.1.
on ALL-OR-NOTH
Cybercrime “aims at modernising and harmonising domestic laws on
search and seizure of stored computer data for the purposes of obtaining
The all-or-nothi
evidence with respect to specific criminal investigations or proceedings”.
conditio sine qua non
The ECtHR61 analyzed the compliance of Portuguese Law in matter
of support th
countries
seizure of stored computer data with Article 8 of the European Convention
between the individ
on Human Rights and considered that the Portuguese Law did not violate
him/her liable in fu
the European Convention on Human Rights62. Furthermore, pursuant
of alternative causa
to Article 19 (5) of the Convention on Cybercrime, the seizure of stored
which tortfeasor act
computer data is subject to Articles 14 and 15 of that Convention.
the all-or-nothing ap
The seizure of stored computer data provides a less intrusive measure
those difficulties fo
which law enforcement authorities can apply instead of measures such
court may be willi
as interception of content data and real-time collection of traffic data,
which must be used only to investigate serious offences. Althoughdamage
Article was actuall
was
15 of Law no. 109/2009 may include access to traffic data and act
even
to the actual c
jurisdictions
facilita
the content of communications stored on a computer system, the
search
establishment
of th
of stored computer data does not constitute an intense restriction of
law th
fundamental rights like (except when the content of computerand
dataDanish
is
of evidence, which
likely to reveal personal or intimate data), for example, an interception
probable tha
(in real-time) of communications. Thus, we consider that neither more
Articles
the
damage.
A sim
15 and 19 of the Convention on Cybercrime nor Article 8 of the European
Convention on Human Rights require that the order for submitting
or
the “theory
of the m
granting access to data depend on judicial authorization.
However, pursuant to Article 16, paragraph 3, of Law no. 109/2009,
2.2. JOINT AND SE
when the content of computer data is likely to reveal personal or intimate
data, which may jeopardize the privacy of the respective holder orInof
Book VI – 4:1
a third party, such data or documents shall be submitted to the
judge,
presumption
of ca
who shall decide about their relevance to the case, taking into prescribed.
account
The arti
63
. have been cau
the interests of the particular situation, under sanction of nullitymay
for which different
damage was caused
61
ECtHR, Sérvulo & Associados – Sociedade de Advogados, RL and Others v. Portugal,
person who is acc
Application no. 27013/10, Judgment of 03.12.2015, available at: https://hudoc.echr.coe.
int/eng#{%22itemid%22:[%22001-156519%22]} [last accessed 07/11/2018].
62
Although the Court did not analyse Articles 15 and 16 of Law no. 109/2009,
but,Infantino, Zerv
16
See:
17 regime
among others, Articles 174, 176 and 178 of the Code of Criminal Procedure, whose
See: Court of Appea
18
was similar to Articles 15 and 16 of Law no. 109/2009.
Solution to the pr
63
complicated
On this issue, with more developments, Duarte Rodrigues Nunes, Os
meios de ones. Depe
several liability (see belo
ńi piL-apurK anyz268
rataK | 02
Duarte Rodrigues Nunes
.1.2Article 16 of Law no. 109/2009 empowers the investigating authorities
to seize or similarly secure a computer system or part of it or a computerhton-ro-lla data
ehT storage medium, make and retain a copy of those computer data,
non auq enismaintain
oitidnoc the integrity of the relevant stored computer data or render
inaccessible
or remove those computer data in the accessed computer
t troppus seirtnuoc
system
ividni eht n
eewteband respects the safeguards imposed by Articles 14 and 15 of the
Convention on Cybercrime and Article 8 of the European Convention
f ni elbail reh/mih
on Human Rights.
suac evitanretla fo
However, there are some differences between Article 16 of Law
ca rosaeftrot hcihw
no. 109/2009 and Article 19 of the Convention on Cybercrime.
a gnihton-ro-lla eht
Thus, pursuant to Article 19 of the Convention on Cybercrime,
f seitluciffid esoht
the seize of stored computer data can only occur on computer data
lliw eb yam truoc
stored on computer systems or computer-data storage mediums located
llautca saw in
egathe
materritory
d
of each Party. However, in Articles 15 and 16 of Law
lautca eht no.
saw109/2009,
tca
the Portuguese legislator only refers to the search and
tilicaf snoiseize
tcidsiof
rujstored computer data without mentioning whether the computer
t fo tnemhsystem
silbatseis located in the Portuguese territory or abroad.
t wal hsinaD Therefore,
dna
for the same reasons as we referred with regard to the
hcihw ,ecnesearch
dive foof stored computer data, we consider that Article 16 of Law
ht elbaborno.
p e109/2009
rom
allows the seizure of computer data in computer systems
is A .egam
a
d
e
h
t
that are not located in the Portuguese territory without to resort to
judicial cooperation mechanisms.
eht fo yrointernational
eht“ eht
And we find another difference between Article 16 of Law no. 109/
2009
S DN A TNIOJ .2.2 and Article 19 of the Convention on Cybercrime. In fact, the Portuguese legislator did not empower the authorities to order any person
who
:4 – IV kooB
nI has knowledge about the functioning of the computer system or
c fo noitpmeasures
muserp applied to protect the computer data therein to provide, as
the necessary information, to enable the undertaking of
tra ehT .deis
birreasonable,
cserp
a
seizure
of
computer
stored data. Thus, we consider that, in this aspect,
ac neeb evah yam
legislator has not fully complied with Article 19 of the
tnereffid hcthe
ihwPortuguese
rof
Convention
on
Cybercrime.
esuac saw egamad
TON-RO-LLA
ca si ohw nosrep
61
reZ ,onitnafnI :eeS
71
eppA fo t ruoC :eeS
81 prova previstos na Lei do Cibercrime [The means of obtaining evidence provided by the
de
p eht ot noitobtenção
uloS
ep eD .seno d eLaw
tacilof
pm
oc
Cybercrime],
Gestlegal, Coimbra, 2018, p. 120–127 (with bibliographic references).
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
VII. Seizure of electronic mail and records
of communications of asimilar nature
(Article 17 of Law no. 109/200964)
20 | 269
Katarzyna Krupa-Lipińs
2.1. ALL-OR-NOTH
The all-or-nothi
conditio sine qua non
countries support th
Article 17 of Law no. 109/2009 regulates the cases in which,between
during the individ
a computer search or other legitimate access to a computer system, the
him/her liable in fu
authorities find electronic messages or records of communications of
of
alternative causa
a similar nature65, subjecting their seizure to the legal regime of seizure
which tortfeasor act
of postal items provided by the Code of Criminal Procedure (Articles 179
the all-or-nothing ap
and 252)66.
those difficulties fo
The seizure of e-mails or records of communications of a similar
court may be willi
nature must be authorized by the Judge, whenever such seizure is of great
damage
67 was actuall
relevance to the discovery of the truth and/or for use as the evidence
,
act
was
68
and may be used in the investigation of any type of crime . Due to the the actual c
jurisdictions facilita
specificity of electronic mail, authorization can only be granted a posteriori
of th
and it will not be possible to return the seized electronic mailestablishment
that is
and 3Danish
law th
irrelevant to the investigation, and therefore, paragraphs 1 and
of
evidence, which
Article 179 of the Code of Criminal Procedure will have to be of
applied
more probable tha
the damage. A sim
64
The Convention on Cybercrime does not contain any provision specifically
the “theory of the m
providing the seizure of electronic mail and communication records of a similar nature.
65
E.g. SMS MMS, conversations in Messenger, voice messages related to
2.2. JOINT AND SE
communications via Whatsapp, Viber, Skype, Facebook, etc.
66
This legislative option is subject to strong criticism, being understood that the
In Book VI – 4:1
seizure should be regulated by Article 16 of Law no. 109/2009 and not by the legal regime
of seizure of postal items. On this issue, with more developments; Duarte Rodrigues
presumption of ca
Nunes, Os meios de obtenção de prova previstos na Lei do Cibercrime [The means of obtaining
prescribed. The arti
evidence provided by the Law of Cybercrime], Gestlegal, Coimbra, 2018, p. 141–146 (with
may have been cau
bibliographic references).
67
for which different
See Article 17 of Law no. 109/2009.
68
See Paulo Da Mesquita, Processo Penal, Prova e Sistema Judiciário [Criminal damage
Procedure, was caused
Evidence and Judicial System], Coimbra Editora, Coimbra, 2010, p. 98, and Judgments of
person who is acc
the Court of Appeal of Évora of 06/01/2015 (Case 6793/11.6TDLSB-A.E1), available at:
http://www.dgsi.pt/jtre.nsf/134973db04f39bf280 2579bf005f080b/847dae6b85353cb880257de10056ff4c? OpenDocument [last accessed 22/06/2018] and 20/01/2015
(Case
16
See: Infantino, Zerv
17
648/14.6GCFAR-A.E1), available at: http://www.dgsi.pt/jtre.nsf/134973db04f39bf280
See: Court of Appea
2579bf005f080b/2fbdd21285478f5f80257de 10056ff7a?OpenDocument [last18accessed
Solution to the pr
complicated ones. Depe
22/06/2018].
several liability (see belo
ńi piL-apurK anyz270
rataK | 02
Duarte Rodrigues Nunes
with
.1.2 the necessary adaptations to the seizure of electronic mail or records
of communications of a similar nature.
hton-ro-lla ehTIn exigent circumstances, authorities may use the police measures
69
non auq enisprovided
oitidnoc by Article 252 of the Code of Criminal Procedure , but only
70
provided by paragraph 3 .
t troppus sethe
irtnmeasure
uoc
Due
ividni eht neew
teb to the reference of Article 17 of Law no. 109/2009 to the legal
regime of seizure of postal items pursuant to Article 179, paragraph 1, a),
f ni elbail reh/mih
of the Code of Criminal Procedure, only e-mails or other similar realities
suac evitanretla fo
that have been sent by the suspect or addressed to him or her, even if
ca rosaeftrot hcihw
under a different name or through a different person, may be seized.
a gnihton-ro-lla eht
With regard to professional confidentiality, in accordance with Article
f seitluciffid esoht
179, paragraph 2, of the Code of Criminal Procedure, no seizure or other
lliw eb yam truoc
control of electronic mail and records of communications of a similar
llautca saw nature
egamad
between the defendant or suspect and between the defendant and
lautca eht his
sawdefence
tca
counsel is allowed unless the judge has reasonable grounds
tilicaf snoito
tcidbelieve
siruj that the said communication is the object or the constitutive
t fo tnemhelement
silbatse of a criminal offence.
t wal hsinaD Although
dna
we disagree with the legislative option to submit the
hcihw ,ecneseizure
dive foof e-mails or records of communications of a similar nature to
ht elbaborthe
p elegal
rom regime of seizure of correspondence provided by the Code of
is A .egam
a
d
eht Procedure71, Article 17 of Law no. 109/2009 complies with the
Criminal
eht fo yroprovisions
eht“ eht of Article 8 of the European Convention on Human Rights. In
TON-RO-LLA
S DN A TNIOJ
.2.269 See Pinto De Albuquerque, Comentário ao Código de Processo Penal, 4.ª Edição
[Commentary on the Code of Criminal Procedure, 4th Edition], Universidade Católica Editora,
:4 – IV kooB
nI 2011, p. 510.
Lisbon,
c fo noitpmu70seDue
rp to the specificity of the electronic mail and communications of a similar nature,
which does not include package-equivalent realities, the measure provided by Article 252,
tra ehT .debircserp
para. 2, of the Code of Criminal Procedure cannot be applied to the seizure of electronic
ac neeb evmail
ah yand
amcommunications of a similar nature).
71
tnereffid hcihw rBecause
of
the seizure of electronic mail and communication records of a similar
by Article 17 of Law No. 109/2009 applies to obtaining electronic mail,
esuac saw nature,
egamaprovided
d
SMS, etc. that has already been received by the recipient and is stored on a computer
ca si ohw nosrep
system that has been legitimately accessed by the authorities and not to obtaining, in realtime, electronic mail, SMS, etc. Therefore, unlike the seizure of correspondence provided
of Criminal Procedure, there is no restriction on the right to confidentiality
61
reZ ,onitnafnIby
:eethe
S Code
71
In fact, the seizure of electronic mail and communication records of
eppA fo t ruoCof:ecorrespondence.
eS
8nature
1
restricts exactly the same fundamental rights as the seizure of computer
p eht ot noitausimilar
loS
ep eD .seno d estored
tacilpmdata
oc provided by Article 16 of Law no. 109/2009.
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 271
Katarzyna Krupa-Lipińs
fact, pursuant to Article 8 (2), there shall be no interference by a public
2.1. ALL-OR-NOTH
authority with the exercise of these rights, except such as is in accordance
with the law and is necessary in a democratic society in the interests
of all-or-nothi
The
national security, public safety or the economic well-being of the country,
conditio sine qua non
for the prevention of disorder or crime, for the protection of health
or support th
countries
morals, or for the protection of the rights and freedoms of others.
Thus, the individ
between
the ECtHR considers that the seizure of correspondence can only be
him/her liable in fu
justified if the conditions set out in the second paragraph of Article 8
of alternative causa
are satisfied: the seizure of correspondence must be “in accordance with
which tortfeasor act
the law”, pursue one or more “legitimate aims” and be “necessary in
the all-or-nothing ap
a democratic society” in order to achieve them72.
those difficulties fo
court may be willi
damage was actuall
VIII. Interception of communications
act was the actual c
(Article 18 of Law no. 109/200973)
jurisdictions facilita
74
establishment of th
Article 18 of Law no. 109/2009 provides for the interception of computer
and Danish law th
communications, which includes obtaining real-time communication
75
of chats,
evidence, which
content data (e-mail, SMS, Messenger conversations, news,
more probable tha
the damage. A sim
72
See ECtHR, Silver and Others v. The United Kingdom Application no. 5947/72;
6205/73;
the
“theory of the m
7052/75; 7061/75; 7107/75; 7113/75; 7136/75, Judgment of 25.03.1983, available at: https://
hudoc.echr.coe.int/eng#{%22fulltext%22: [%22silver%22],%22documentcollectionid2%22:
2.2. JOINT AND SE
[%22GRANDCHAMBER%22,%22CHAMBER%22], %22itemid%22:[%22001-57577%22]}
[last accessed 07/11/2018].
73
Book VI – 4:1
This mean of obtaining evidence is also provided by Articles 20 and 21 ofInthe
Convention on Cybercrime.
presumption of ca
74
Defined in Article 2, e), of Law no. 109/2009 as “the act intended to capture
prescribed. The arti
information contained in a computer system by means of electromagnetic, acoustic,
may have been cau
mechanical or other devices”.
75
which different
Paulo Da Mesquita, Processo Penal, Prova e Sistema Judiciário [Criminal for
Procedure,
Evidence and Judicial System], Coimbra Editora, Coimbra, 2010, p. 122, Pedro Diasdamage
Venacio, was caused
Lei do Cibercrime [Law of Cybercrime], Coimbra Editora, Coimbra, 2011, p. 119, and Judgments
person who is acc
of the Court of Appeal of Lisbon of 03/05/2016 (Case 73/16.4PFCSC-A.L1-5), available
at: http://www.dgsi.pt/jtrl.nsf/33182fc73231603980 2565fa00497eec/7eafd3bff46e1a1b80257fd400314510? OpenDocument [last accessed 22/06/2018] and 07/03/2017
(Case
16
See: Infantino, Zerv
17
1585/16.5PBCSC-A.L1-5), available at: http://www.dgsi.pt/jtrl.nsf/33182fc73231603980
See: Court of Appea
2565fa00497eec/ec0f3a35d90f697d802580ea0056629e?OpenDocument [last 18accessed
Solution to the pr
complicated ones. Depe
22/06/2018].
several liability (see belo
ńi piL-apurK anyz272
rataK | 02
Duarte Rodrigues Nunes
videoconferences
and web conferences, etc.76 and communications carried
.1.2
77
out by VoIP ) and traffic data (whether real time or data retained under
78
hton-ro-lla the
ehTterms of Law 32/2008) .
non auq enis oitiThe
dnoc interception of computer data shall only be authorized during
the
stage, where there are reasons to believe that this
t troppus seirtninvestigation
uoc
measure
ividni eht n
eewteb is essential to the uncovering of the truth or that, otherwise, it
would be impossible or very difficult to obtain evidence, on the basis of
f ni elbail reh/mih
a substantiated order from the examining judge, further to a request from
suac evitanretla fo
the Public Prosecution79. The authorization shall be limited to a maximum
ca rosaeftrot hcihw
time-limit of three months, renewable for equal periods, provided that
a gnihton-ro-lla eht
the respective requirements for admissibility have been met80.
f seitluciffid esoht
In exigent circumstances, the authorization may be granted by the
lliw eb yam truoc
Judge with jurisdiction over the locations from where the telephone
llautca saw conversation
egamad
or communication is likely to occur, or over the central
lautca eht office
saw tof
ca the entity competent to conduct the criminal investigation, but
tilicaf snoionly
tcidsiwhen
ruj dealing with one of criminal offences provided by Article 187,
t fo tnemhparagraph
silbatse 2, of the Code of Criminal Procedure81. Likewise, the criminal
t wal hsinpolice
aD dnauthority
a
may directly request an interception of communications
hcihw ,ecnetodithe
ve fJudge
o
without any intermediation by the Public Prosecutor82.
ht elbaborp eHowever,
rom
under Article 11, paragraph 2, b), of the Code of Criminal
is A .egam
a
d
e
h
t
Procedure, the interception, recording and transcription of conversations
involving the President of the Republic, the President
eht fo yroor
ehcommunications
t“ eht
TON-RO-LLA
S DN A TNIOJ
.2.276 Pinto De Albuquerque, Comentário ao Código de Processo Penal, 4.ª Edição [Commentary
on the Code of Criminal Procedure, 4th Edition], Universidade Católica Editora, Lisbon, 2011,
:4 – IV kooB
I and Pedro Dias Venancio, Lei do Cibercrime [Law of Cybercrime], Coimbra Editora,
p. n
542,
c fo noitpCoimbra,
muserp2011, p. 119.
77
tra ehT .debircseSee
rp Pedro Dias Venancio, Lei do Cibercrime [Law of Cybercrime], Coimbra Editora,
Coimbra, 2011, p. 119; different opinion, David Ramalho, Métodos Ocultos de Investigação
ac neeb evCriminal
ah yam
em Ambiente Digital [Covert Methods of Criminal Investigation in Digital Environment],
tnereffid hcAlmedina,
ihw rof Coimbra, 2017, p. 339 et seq.
78
esuac saw egam
aSee
d Article 18, para. 3, of Law no. 109/2009.
79
See Article 18, para. 1, of Law no. 109/2009.
ca si ohw no80srep
See Article 187, para. 6, of the Code of Criminal Procedure, applicable ex vi Article
18, para. 4, of Law no. 109/2009.
81
61 Article 187, para. 2, of the Code of Criminal Procedure, applicable ex vi Article
reZ ,onitnafnI :eeS See
74,
1 of Law no. 109/2009.
eppA fo t ruoC18,
:eepara.
S
81 Article 269, paras. 1, e), and 2, in conjunction with Article 268, para. 2, both of
p eht ot noituloS82 See
ep eD .seno d ethe
taciCode
lpmocof Criminal Procedure.
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 273
Katarzyna Krupa-Lipińs
of the Parliament or the Prime Minister must be authorized by 2.1.
the ALL-OR-NOTH
President of the Supreme Court of Justice, which includes the interception
of communications provided by Article 18 of Law no. 109/2009. The all-or-nothi
Pursuant to Article 18, paragraph 1, of Law no. 109/2009, the intercepconditio sine qua non
tion of communications may only be authorized to investigate criminal
countries support th
offences punishable under Law no. 109/2009 (Articles 3 to 8) and criminal
between the individ
offences committed by means of a computer or criminal offences which
him/her liable in fu
investigation requires collection of evidence in electronic form, when
of alternative causa
criminal offences are referred to in Article 187, paragraphs 1 and 2, of
which tortfeasor act
the Code of Criminal Procedure83. And pursuant to Article 187, parathe all-or-nothing ap
graph 4, of the Code of Criminal Procedure (applicable ex vi Article 18,
those difficulties fo
court may be willi
83
“Article 187: 1 – Interception and tape recording of telephone conversations
or was actuall
damage
communications may only be authorized during the inquiry where there are grounds
for
act was the actual c
believing that this step is indispensable for the discovery of the truth or that the evidence
jurisdictions facilita
would, by any other means, be impossible or very hard to collect. Such authorization
of th
shall be granted by means of a reasoned order issued by the Examining Judge establishment
and upon
the request of the Public Prosecution Service, as regards the following criminaland
offences:
Danish law th
a) Criminal offences to which a custodial sentence with a maximum limit over
three
of evidence, which
years applies;
more probable tha
b) Drug-related offences;
c) Possession of a prohibited weapon and illicit trafficking in weapons; the damage. A sim
d) Smuggling offences;
the “theory of the m
e) Insult, threat, coercion, disclosure of private life and disturbance of the peace and
quiet, whenever committed by means of a telephone device;
2.2. JOINT AND SE
f) Threat with the commission of a criminal offence or abuse and simulation of
danger signals; or
In Book VI – 4:1
g) Escape from justice, whenever the defendant has been sentenced for a criminal
offence referred to in the preceding sub-paragraphs.
presumption of ca
2 – The authorization provided for in paragraph 1 above may be requested to the
prescribed. The arti
judge with jurisdiction over the locations from where the telephone conversation or
may have
been cau
communication is likely to occur, or over the central office of the entity competent
to
for which different
conduct the criminal investigation, when dealing with the following criminal offences:
a) Criminal offences to which a custodial sentence with a maximum limit over
three was caused
damage
years applies;
person who is acc
b) Illegal restraint, kidnapping and taking of hostages;
c) Offences against cultural identity and personal integrity, as provided for in Book II,
Title III, of the Criminal Code and in the Criminal Law on Violations of International
16
See: Infantino, Zerv
17
Humanitarian Law;
See: Court of Appea
d) Offences against State security foreseen in Book II, Title V, Chapter18 I, ofSolution
the
to the pr
complicated ones. Depe
Criminal Code;
several liability (see belo
ńi piL-apurK anyz274
rataK | 02
Duarte Rodrigues Nunes
paragraph
4, of Law 109/2009), regardless of the entity who owns the
.1.2
means of communication used, the interception can only be authorised
(1) the suspect or the defendant, (2) any person acting as an
hton-ro-lla against
ehT
against whom there are grounds to believe that he/she
non auq enisintermediary,
oitidnoc
receives
or
transmits
messages aimed at, or coming from, the suspect
t troppus seirtnuoc
oreethe
or (3) the victim of a crime (upon his/her effective or
ividni eht n
wtedefendant
b
alleged consent). Evidence obtained in a process by means of the interf ni elbail reh/mih
ception of communications cannot be used in other proceedings (either
suac evitanretla fo
ongoing or to be initiated) unless it has resulted from the interception of
ca rosaeftrot hcihw
a means of communication used by the suspect, defendant, intermedia gnihton-ro-lla eht
ary or victim and insofar as it proves to be indispensable for obtaining
f seitluciffid esoht
evidence of a criminal offence set out in Article 18, paragraph 1, of Law
lliw eb yam truoc
no. 109/2009. However, the information obtained can always be used
llautca saw as
eganotitia
mad criminis84.
lautca eht sawPursuant
tca
to Article 187, paragraph 5, of the Code of Criminal
tilicaf snoiProcedure
tcidsiruj (applicable ex vi Article 18, paragraph 4, of Law no. 109/2009),
t fo tnemhno
silinterception
batse
of computer data transmissions between the defendant and
t wal hsinhis
aD defence
dna
counsel is allowed unless the judge has reasonable grounds
hcihw ,ecnetodibelieve
ve fo that the said communication is the object or the constitutive
ht elbaborelement
p erom of a criminal offence, and the evidence may be used against the
is A .egam
ad eht and the defender85.
accused
eht fo yroeht“ eht
TON-RO-LLA
e) Counterfeiting of currency or securities equivalent to currency foreseen in articles
.2.2
262, 264 – to the extent that it refers to article 262 – and article 267 – to the extent that it
refers to articles 262 and 264 – of the Criminal Code;
:4 – IV kooB nIf) Offences covered by a convention on the safety of air or maritime navigation”.
c fo noitpmu84seSee
rp Article 187, para. 7, of the Code of Criminal Procedure, applicable ex vi
Article 18, para. 4, of Law no. 109/2009.
tra ehT .debirc85serp
See Lamas Leite, As escutas telefónicas – algumas reflexões em redor do seu regime
ac neeb eveadas
h yconsequências
am
processuais derivadas da respectiva violação, [in:] Separata da Revista da
tnereffid hcFaculdade
ihw rofde Direito da Universidade do Porto, 2004 [The wiretapping – some reflections around
esuac saw its
egregime
amadand the procedural consequences derived from the respective violation, “Offprint of
the Journal of the Faculty of Law of the University of Oporto”, 2004], p. 46, Helena Susano,
ca si ohw nosrep
Escutas Telefónicas [Wiretapping], Coimbra Editora, Coimbra, 2009, p. 39, and Pinto De
Albuquerque, Comentário ao Código de Processo Penal, 4.ª Edição [Commentary on the Code
61 Procedure, 4th Edition], Universidade Católica Editora, Lisbon, 2011, p. 527.
reZ ,onitnafnIof:eCriminal
eS
71 Marcolino de Jesus, Os Meios de Obtenção de Prova em Processo Penal [The Means of
eppA fo t ruoCDifferently
:eeS
81Evidence in Criminal Procedure], Almedina, Coimbra, 2011, p. 246, Ana Conceicao,
p eht ot noitObtaining
uloS
ep eD .seno d eEscutas
tacilpmTelefónicas
oc
[Wiretapping], Quid Juris, Lisbon, 2009, p. 112, and Costa Andre, Das
oleb ees( ytilibail lareves
S DN A TNIOJ
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 275
Katarzyna Krupa-Lipińs
Although the law only refers to the communications between 2.1.
the ALL-OR-NOTH
defendant and his defence counsel, it is discussed whether the rule also
includes other cases of communications involving persons subject toThe
the all-or-nothi
86
duty of professional confidentiality .
conditio sine qua non
The criminal police that carries out the interception of communications
countries support th
draws up the respective records and produces a report pointingbetween
out the the individ
parts which bear relevance for use as evidence, describing in brief the
him/her liable in fu
respective contents and explaining the respective importance for the
of
alternative causa
discovery of the truth87.
which tortfeasor act
Pursuant to Article 188, paragraphs 3 to 6, of the Code of Criminal
the all-or-nothing ap
Procedure, the criminal police that carries out the interception of
those difficulties fo
communications provides the Public Prosecutor, every fortnight counted
court may be willi
damage was actuall
act was the actual c
Escutas Telefónicas, [in:] I Congresso de Processo Penal [On Wiretapping, “I Congress of Criminal
jurisdictions facilita
Procedure”], Almedina, Coimbra, 2005, p. 221, consider that the evidence can only be used
establishment of th
against the defence counsel, in order not to prejudice the defence.
86
Duarte Rodrigues Nunes, Os meios de obtenção de prova previstos na Lei do and
Cibercrime
Danish law th
[The means of obtaining evidence provided by the Law of Cybercrime], Gestlegal, Coimbra,
2018,
of evidence, which
p. 184–186, and Lamas Leite, As escutas telefónicas – algumas reflexões em redor do seu regime
more probable tha
e das consequências processuais derivadas da respectiva violação, [in:] Separata da Revista da
thearound
damage. A sim
Faculdade de Direito da Universidade do Porto, 2004 [The wiretapping – some reflections
its legal regime and the procedural consequences derived from the respective violation,the
“Offprint
“theory of the m
of the Journal of the Faculty of Law of the University of Oporto”, 2004], p. 48, consider that
Article 187, para. 5, of the Code of Criminal Procedure does not apply to such cases. On
2.2. JOINT AND SE
the other hand, the Majority Doctrine considers that Article 187, para. 5, of the Code of
Criminal Procedure also applies in these cases (see Costa Andrade, Das Escutas Telefónicas,
In Book VI – 4:1
[in:] I Congresso de Processo Penal [On Wiretapping, “I Congress of Criminal Procedure”],
Almedina, Coimbra, 2005, p. 220, Pinto De Albuquerque, Comentário ao Código de
Processo
presumption
of ca
Penal, 4.ª Edição [Commentary on the Code of Criminal Procedure, 4th Edition], Universidade
prescribed. The arti
Católica Editora, Lisbon, 2011, p. 527, Germano Marques Da Silva, Curso de Processo Penal,
may2008,
have been cau
II, 4.ª Edição [Course on Criminal Procedure, II, 4th Edition], Editorial Verbo, Lisbon,
forProcesso
which different
p. 252, Rita Castanheira Neves, As Ingerências nas Comunicações Electrónicas em
Penal [The Interference in Electronic Communications in Criminal Procedure], Coimbra
Editora, was caused
damage
Coimbra, 2011, p. 295 et seq., Helena Susano, Escutas Telefónicas [Wiretapping], Coimbra
person who is acc
Editora, Coimbra, 2009, p. 41, Benjamin Silva Rodrigues, Das Escutas Telefónicas, I [On
Wiretapping, I], Rei dos Livros, Lisbon, 2008, p. 291 et seq., Ana Conceicao, Escutas Telefónicas
[Wiretapping], Quid Juris, Lisbon, 2009, p. 111, and Guedes Valente, Escutas Telefónicas,
2.ªInfantino, Zerv
16
See:
17
Edição [Wiretapping, 2nd Edition], Almedina, Coimbra, 2008, p. 92).
See: Court of Appea
87
18
See Article 188, para. 1, of the Code of Criminal Procedure, applicable
ex vi
Solution
to the pr
complicated ones. Depe
Article 18, para. 4, of Law no. 109/2009.
several liability (see belo
ńi piL-apurK anyz276
rataK | 02
Duarte Rodrigues Nunes
from
.1.2 the first interception made, with the respective technical material,
as well as with the respective records and reports88. Then, the Public
submits those elements to the judge within a maximum time
hton-ro-lla Prosecutor
ehT
ofocforty-eight hours89. The Judge, in order to become acquainted with
non auq enislimit
oitidn
t troppus sethe
irtncontent
uoc of the communications, is assisted, whenever appropriate, by
90
aecriminal
ividni eht n
ewteb police body and shall appoint, if necessary, an interpreter and
orders the immediate destruction of the technical materials and reports
f ni elbail reh/mih
clearly bearing no interest to the case and concerning communications
suac evitanretla fo
between persons who could not be subject to an interception of comca rosaeftrot hcihw
munications, covering matters under professional confidentiality, under
a gnihton-ro-lla eht
confidentiality binding officials or under State confidentiality or which
f seitluciffid esoht
disclosure may seriously affect rights, liberties and guarantees91.
lliw eb yam truoc
With respect to the restriction of fundamental rights, the interception
llautca saw of
egacommunications
mad
restricts the fundamental rights to privacy, to
lautca eht informational
saw tca
self-determination, to confidentiality of communications
tilicaf snoiand,
tcidsiin
ruthe
j case of the interception of communications by means of VoIP,
t fo tnemhthe
silbright
atse to confidentiality and to integrity of information technology
t wal hsinsystems,
aD dna protected by Article 8 of the European Convention on Human
hcihw ,ecneRights
dive f92o. Pursuant to Article 8 (2), there shall be no interference by a public
ht elbaborauthority
p erom with the exercise of these rights, except such as is in accordance
is A .egam
ad ethe
ht law and is necessary in a democratic society in the interests of
with
eht fo yronational
eht“ eht security, public safety or the economic well-being of the country,
for the prevention of disorder or crime, for the protection of health or
or for the protection of the rights and freedoms of others.
S DN A TNIOJ morals,
.2.2
TON-RO-LLA
:4 – IV kooB nI
c fo noitpmuserp
88
tra ehT .debircseSee
rp Article 188, para. 3, of the Code of Criminal Procedure, applicable ex vi
Article 18, para. 4, of Law no. 109/2009.
ac neeb evah y
89 am
See Article 188, para. 4, of the Code of Criminal Procedure, applicable ex vi
tnereffid hcArticle
ihw r18,
of para. 4, of Law no. 109/2009.
90
esuac saw egam
aSee
d Article 188, para. 5, of the Code of Criminal Procedure, applicable ex vi
Article 18, para. 4, of Law no. 109/2009.
ca si ohw no91srep
See Article 188, para. 6, of the Code of Criminal Procedure, applicable ex vi
Article 18, para. 4, of Law no. 109/2009.
92
61 ECtHR, Valenzuela Contreras v. Spain, Application no. 58/1997/842/1048,
reZ ,onitnafnI :eeS See
71 of 30.07.1998, available at: https://hudoc.echr.coe.int/eng#{%22fulltext%22:
eppA fo t ruoCJudgment
:eeS
81
p eht ot noit[%22valenzuela%22],%22documentcollectionid2%22:[%22GRANDCHAMBER%22,%
uloS
ep eD .seno d e22CHAMBER%22],%22itemid%22:[%22001-58208%22]}[last
tacilpmoc
accessed 07/11/2018].
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 277
Katarzyna Krupa-Lipińs
According to ECtHR’s case-law, the interception of communications
2.1. ALL-OR-NOTH
constitutes an interference by a public authority in the right to respect
for private life and correspondence and such an interference will be
in all-or-nothi
The
breach of Article 8 (2) of the European Convention on Humanconditio
Rightssine qua non
unless it is in accordance with the law, pursues one or more legitimate
countries support th
aims under paragraph 2 and is necessary in a democratic society
to the individ
between
achieve those aims. “In accordance with the law” require firstly that the
him/her liable in fu
impugned measure should have some basis in domestic law. However,
of alternative causa
that expression does not merely refer back to domestic law but also relates
which tortfeasor act
to the quality of the law, requiring it to be compatible with the rule of law.
the all-or-nothing ap
The expression thus implies that there must be a measure of protection in
those difficulties fo
domestic law against arbitrary interference by public authorities with the
court may be willi
rights safeguarded by paragraph. From that requirement stems the need
damage was actuall
for the law to be accessible to the person concerned, who must, moreover,
act was
be able to foresee its consequences for him. Especially where a power
of the actual c
facilita
the executive is exercised in secret the risks of arbitrariness are jurisdictions
evident.
establishment
of th
In the context of interception of communications by public authorities,
andmust
Danish law th
the requirement of foreseeability implies that the domestic law
of evidence, which
be sufficiently clear in its terms to give citizens an adequate indication
more probable tha
as to the circumstances in and conditions on which public authorities
damage. A sim
are empowered to take any such secret measures. It is essentialthe
to have
clear, detailed rules on the subject, especially as the technology available
the “theory of the m
for use is constantly becoming more sophisticated. ECtHR’s case-law
mentions the following minimum safeguards that should be set out in2.2.
the JOINT AND SE
statute in order to avoid abuses of power: a definition of the categories
of people liable to have their telephones tapped by judicial order,In
the
Book VI – 4:1
nature of the offences which may give rise to such an order, a presumption
limit on
of ca
the duration of telephone tapping, the procedure for drawingprescribed.
up the
The arti
summary reports containing intercepted conversations, the precautions
may have been cau
to be taken in order to communicate the recordings intact andfor
in their
which different
entirety for possible inspection by the judge and by the defencedamage
and the was caused
circumstances in which recordings may or must be erased or the
tapes who is acc
person
destroyed, in particular where an accused has been discharged by an
investigating judge or acquitted by a court93.
See: Infantino, Zerv
See: Court of Appea
93
18 v. Spain,
About the analysis of ECtHR’s case-law, see ECtHR, Valenzuela Contreras
Solution to the pr
complicated ones. Depe
Application no. 58/1997/842/1048, Judgment of 30.07.1998, available at: https://hudoc.
several liability (see belo
16
17
ńi piL-apurK anyz278
rataK | 02
Duarte Rodrigues Nunes
.1.2Thus, as we can see, Article 18 of Law no. 109/2009 complies with the
provisions of Article 8 of the European Convention on Human Rights.
hton-ro-lla ehTWith regard to the Convention on Cybercrime, Articles 20 and 21
non auq enisempower
oitidnoc the investigating authorities to collect or record through the
application
of technical means on the territory of that Party and compel
t troppus seirtnuoc
aeservice
ividni eht n
ewteb provider, within its existing technical capability to collect or
record through the application of technical means on the territory of that
f ni elbail reh/mih
Party or to co-operate and assist the competent authorities in the collection
suac evitanretla fo
or recording of content data and traffic data, in real-time, associated
ca rosaeftrot hcihw
with specified communications in its territory transmitted by means of
a gnihton-ro-lla eht
a computer system. However, pursuant to Articles 20 (4) and 21 (4) the
f seitluciffid esoht
collection or recording of content data and traffic data in real-time is,
lliw eb yam truoc
pursuant to Article 15 of that Convention, “subject to conditions and
llautca saw safeguards
egamad provided for under domestic law” and must “in view of the
lautca eht nature
saw tcaof the procedure or power concerned, inter alia, include judicial
tilicaf snoior
tcidother
siruj independent supervision, grounds justifying application, and
t fo tnemhlimitation
silbatse of the scope and the duration of such power or procedure”.
t wal hsinAnd
aD dthe
na explanatory report notes that “the conditions and safeguards
hcihw ,ecneapplicable
dive fo to real-time interception of content data may be more stringent
ht elbaborthan
p erothose
m applicable to the real-time collection of traffic data, or to the
is A .egam
a
d
e
h
t seizure or similar accessing or securing of stored data”.
search and
eht fo yroeht“Thus,
eht as we can see, Article 18 of Law no. 109/2009 also complies with
the conditions and safeguards of Articles 14 and 15 of the Convention
S DN A TNIOJ on
.2.2Cybercrime.
TON-RO-LLA
:4 – IV kooB nI
c fo noitpIX.
musUndercover
erp
operations
tra ehT .de (Article
bircserp
18 of Law no. 109/200994)
ac neeb evah yam
legislator defines undercover operations as “any
tnereffid hcThe
ihw Portuguese
rof
operations
conducted
by criminal investigation officers, or third persons
esuac saw egamad
ca si ohw nosrep
echr.coe.int/eng#{%22fulltext%22:[%22valenzuela%22],%22documentcollection
61
reZ ,onitnafnIid2%22:[%22GRANDCHAMBER%22,%22CHAMBER%22],%22itemid%22:[%22001:eeS
71 [last accessed 07/11/2018].
eppA fo t ruoC58208%22]}
:eeS
81 Convention on Cybercrime does not contain any provision specifically
p eht ot noituloS94 The
ep eD .seno d eproviding
tacilpmoc for the use of undercover agents in digital environment.
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 279
Katarzyna Krupa-Lipińs
subject to the scrutiny of the Judiciary Police (Polícia Judiciária), acting
2.1. ALL-OR-NOTH
under undisclosed capacity and identity for the purpose of preventing
19 all-or-nothi
or punishing the offences specified in this Act”95, regulating in ArticleThe
of Law no. 109/2009 the undercover operations in digital environment.
conditio sine qua non
Pursuant to Article 3, paragraphs 3 to 5, of Law 101/2001, undercover
countries support th
operations within the framework of the inquiry are subjected between
to prior the individ
authorisation of the competent member of the Public Prosecution, to
him/her liable in fu
mandatory communication to the investigating judge, and will be deemed
of alternative causa
to be ratified if no order refusing permission is issued within seventywhich tortfeasor act
two hours and if the operation is carried out in the framework of crime
the all-or-nothing ap
prevention, it falls within the competence of the investigation judge of
those difficulties fo
the Criminal Instruction Central Court to give the required authorisation
court may be willi
upon proposal by the Public Prosecution.
damage was actuall
Pursuant to Article 19, paragraph 1, of Law no. 109/2009, undercover
act was the actual c
operations in a digital environment may only be used to investigate:
facilita
a) Criminal offences punishable under Articles 3 to 8 of Law jurisdictions
no. 109/
establishment
of th
2009;
Danish law th
b) Criminal offences committed by means of a computer and
system,
of evidence,
which
to which correspond, in abstract, a term of imprisonment
with
more probable tha
a maximum band of over 5 years; and
the damage. A sim
c) Regardless of the applicable penalty, intentional criminal offences,
those against freedom and sexual self-determination,the
in “theory
case
of the m
victims are minors or incapacitated adults (Articles 163 to 176
A of the Penal Code), qualified swindling (Article 218 of 2.2.
the JOINT AND SE
Penal Code), computer-related fraud (Article 221 of the Penal
Code), racial, religious or sexual discrimination (Articles 240
Into
Book VI – 4:1
245 of the Penal Code), criminal offences laid down in title
IV of
presumption
of ca
the Code of Copyright and Related Rights (Articles 195prescribed.
to 199)
The arti
and economic and financial infringements when committed
by
may have been cau
means of a computer system96.
for which different
damage was caused
person who is acc
95
See Article 1, paragraph 2, of Law no. 101/2001, of August 25, hereinafter referred
to as Law no. 101/2001. The text of Law no. 101/2001 available at: http://www.pgdlisboa.
pt/leis/lei_mostra_articulado.php?nid=89&tabela=leis (in Portuguese only). 16
See: Infantino, Zerv
96
The catalogue of criminal offences of Article 19, paragraph 1, of Law no.17109/2009
See: Court of Appea
18
is of dubious constitutionality by allowing the use of undercover operations to investigate
Solution to the pr
criminal offences of small or medium gravity such as the crimes punishable undercomplicated
Article 4, ones. Depe
several liability (see belo
ńi piL-apurK anyz280
rataK | 02
Duarte Rodrigues Nunes
.1.2Pursuant to Article 19, paragraph 2, of Law no. 109/2009, when it is
necessary to use computer means and devices in the context of undercover
Article 18 of Law no. 109/2009 shall apply.
hton-ro-lla operations,
ehT
to Article 4, paragraph 4, of Law no. 101/2001, when the
non auq enis oitiPursuant
dnoc
judge,
should,
on grounds of evidential indispensability, order the
t troppus seirtnuoc
undercover
officer to attend the hearing, the public must be excluded
ividni eht n
eewteb
and, as a rule, the undercover agent will give his testimony without its
f ni elbail reh/mih
identity being revealed and using image concealment, voice distortion
suac evitanretla fo
and videoconference, to protect the agent from being influenced by
ca rosaeftrot hcihw
possible pressures and reprisals and to allow the agent to be used in
a gnihton-ro-lla eht
future investigations97. In such cases, pursuant to Article 19, paragraph
f seitluciffid esoht
2, of Law no. 93/99, of July 1498, no conviction may be based, exclusively
lliw eb yam truoc
or decisively, on the testimony or statements produced by one or more
llautca saw witnesses
egamad whose identity was not revealed.
lautca eht sawPursuant
tca
to Article 6, paragraph 1, of Law no. 101/2001, any conduct
tilicaf snoiof
tcidan
siru
j
undercover agent which, in the framework of an undercover
t fo tnemhoperation,
silbatse amounts to the commission of preparatory or instrumental
t wal hsinacts
aD dinnaany form of participation other than incitement shall not be
hcihw ,ecnepunishable
dive fo
whenever due proportionality is kept with regard to the
ht elbaboraim
p erto
om
be achieved.
is A .egamadFinally,
eht
pursuant to Article 3, paragraph 6, of Law no. 101/2001,
Police will report the undercover agent operation to the
eht fo yrothe
eht“Judiciary
eht
competent judicial authority within 48 hours at the latest as from the
S DN A TNIOJ date
.2.2 on which the operation was completed.
TON-RO-LLA
:4 – IV kooB nI
c fo noitpmuserp
tra ehT .deparagraphs
bircserp 1 and 3, Article 6, paragraphs 1,2 and 3, Article 7 and Article 8 of Law
no. 109/2009 – related to crimes of damage caused to programmes or other computer data,
ac neeb evillegal
ah yaaccess,
m illegal interception and illegal reproduction of protected programmes – (see
tnereffid hcPAULO
ihw roDÁ
f MESQUITA, Processo Penal, Prova e Sistema Judiciário [Criminal Procedure,
esuac saw Evidence
egamadand Judicial System], Coimbra Editora, Coimbra, 2010, p. 126, and Pinto De
Comentário do Código de Processo Penal, 4.ª Edição [Commentary on the Code of
ca si ohw Albuquerque,
nosrep
Criminal Procedure, 4th Edition], Universidade Católica Editora, Lisbon, 2011, p. 681–682).
97
See David Ramalho, Métodos Ocultos de Investigação Criminal em Ambiente Digital
[Covert
of Criminal Investigation in Digital Environment], Almedina, Coimbra, 2017,
61
reZ ,onitnafnI :eeS Methods
71
eppA fo t ruoCp.:e304–305.
eS
81 text of Law no. 93/99 is available at: http://www.pgdlisboa.pt/leis/lei_
p eht ot noituloS98 The
ep eD .seno d emostra_articulado.php?nid=234&tabela=leis
tacilpmoc
(in Portuguese only).
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 281
Katarzyna Krupa-Lipińs
With respect to the restriction of fundamental rights, undercover
2.1. ALL-OR-NOTH
operations in a digital environment restrict the fundamental rights to
privacy, to informational self-determination and to confidentiality The
and all-or-nothi
to the integrity of information technology systems. However, theconditio
ECtHRsine qua non
usually analyses the admissibility of undercover operations in thecountries
context support th
of the right to a fair trial [Article 6(1) of the Convention on Humanbetween
Rights. the individ
In Ramanauskas v. Lithuania99, the ECtHR set out the general
him/her liable in fu
principles concerning the issue of undercover operations and entrapment:
of alternative causa
“49. The Court observes at the outset that it is aware of the difficulties
which tortfeasor act
inherent in the police’s task of searching for and gathering evidence for
the all-or-nothing ap
the purpose of detecting and investigating offences. To perform this
those difficulties fo
task, they are increasingly required to make use of undercover agents,
court may be willi
informers and covert practices, particularly in tackling organised crime
damage was actuall
and corruption.
act –was
50. Furthermore, corruption – including in the judicial sphere
has the actual c
facilita
become a major problem in many countries, as is attested by the jurisdictions
Council
establishment
of th
of Europe’s Criminal Law Convention on the subject […]. This instrument
and Danish law th
authorises the use of special investigative techniques, such as undercover
of evidence, which
agents, that may be necessary for gathering evidence in this area, provided
more probable tha
that the rights and undertakings deriving from international multilateral
damage. A sim
conventions concerning “special matters”, for example humanthe
rights,
are not affected.
the “theory of the m
51. That being so, the use of special investigative methods – in
particular, undercover techniques – cannot in itself infringe the right
to JOINT AND SE
2.2.
a fair trial. However, on account of the risk of police incitement entailed
by such techniques, their use must be kept within clear limits […]. In Book VI – 4:1
53. More particularly, the Convention does not preclude reliance,
presumption of ca
at the preliminary investigation stage and where the natureprescribed.
of the
The arti
offence may warrant it, on sources such as anonymous informants.
may have been cau
However, the subsequent use of such sources by the trial court to
forfound
which different
a conviction is a different matter and is acceptable only if adequate
and was caused
damage
sufficient safeguards against abuse are in place, in particular a clear
and who is acc
person
ECtHR, Ramanauskas v. Lithuania, Application no. 74420/01, Judgment16 of 05.02.
See: Infantino, Zerv
17
2008, available at: https://hudoc.echr.coe.int/eng#{%22fulltext%22:[%22Ramanauskas
See: Court of Appea
18
%20v.%20Lithuania%22],%22documentcollectionid2%22:[%22GRANDCHAMBER
Solution to the pr
complicated ones. Depe
%22,%22CHAMBER%22],%22itemid%22:[%22001-84935%22]} [last accessed 07/11/2018].
several liability (see belo
99
ńi piL-apurK anyz282
rataK | 02
Duarte Rodrigues Nunes
foreseeable
procedure for authorising, implementing and supervising
.1.2
the investigative measures in question (…). While the rise in organised
hton-ro-lla crime
ehT requires that appropriate measures be taken, the right to a fair
non auq enistrial,
oitidnfrom
oc which the requirement of the proper administration of justice
is
to
be
t troppus seirtnuoc inferred, nevertheless applies to all types of criminal offence,
from
ividni eht n
eewtthe
eb most straightforward to the most complex. The right to the
fair administration of justice holds so prominent a place in a democratic
f ni elbail reh/mih
society that it cannot be sacrificed for the sake of expedience […].
suac evitanretla fo
54. Furthermore, while the use of undercover agents may be tolerated
ca rosaeftrot hcihw
provided that it is subject to clear restrictions and safeguards, the public
a gnihton-ro-lla eht
interest cannot justify the use of evidence obtained as a result of police
f seitluciffid esoht
incitement, as to do so would expose the accused to the risk of being
lliw eb yam truoc
definitively deprived of a fair trial from the outset […].
llautca saw egam
55.adPolice incitement occurs where the officers involved – whether
lautca eht members
saw tca of the security forces or persons acting on their instructions – do
tilicaf snoinot
tcidconfine
siruj themselves to investigating criminal activity in an essentially
t fo tnemhpassive
silbatsemanner, but exert such an influence on the subject as to incite the
t wal hsincommission
aD dna
of an offence that would otherwise not have been committed,
hcihw ,ecneindiorder
ve fo to make it possible to establish the offence, that is, to provide
ht elbaborevidence
p erom and institute a prosecution […].
is A .egamad56.
ehtIn Teixeira de Castro […] the Court found that the two police
eht fo yroofficers
eht“ eht concerned had not confined themselves “to investigating
Mr Teixeira de Castro’s criminal activity in an essentially passive manner,
S DN A TNIOJ but
.2.2[had] exercised an influence such as to incite the commission of the
offence”. It held that their actions had gone beyond those of undercover
agents
:4 – IV kooB
nI because they had instigated the offence and there was nothing to
c fo noitpsuggest
muserpthat without their intervention it would have been committed […].
that conclusion the Court laid stress on a number of
tra ehT .debircIn
serreaching
p
factors,
in
particular
the fact that the intervention of the two officers had
ac neeb evah yam
tnereffid hcnot
ihwtaken
rof place as part of an anti-drug trafficking operation ordered and
supervised
by a judge and that the national authorities did not appear
esuac saw egamad
have
ca si ohw tono
srep had any good reason to suspect the applicant of being a drug
dealer: he had no criminal record and there was nothing to suggest that
he had a predisposition to become involved in drug trafficking until he
61
reZ ,onitnafnIwas
:eeS approached
by the police […].
71
eppA fo t ruoC :eeS
More
specifically,
the Court found that there were no objective
81
p eht ot noituloS
ep eD .seno d esuspicions
tacilpmoc
that the applicant had been involved in any criminal activity.
TON-RO-LLA
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 283
Katarzyna Krupa-Lipińs
Nor was there any evidence to support the Government’s argument that
2.1. ALL-OR-NOTH
the applicant was predisposed to commit offences. On the contrary,
he was unknown to the police and had not been in possession of The
any all-or-nothi
drugs when the police officers had sought them from him; accordingly,
conditio sine qua non
he had only been able to supply them through an acquaintance
who support th
countries
had obtained them from a dealer whose identity remained unknown.
between the individ
Although Mr Teixeira de Castro had potentially been predisposed to
him/her liable in fu
commit an offence, there was no objective evidence to suggest that he had
of alternative causa
initiated a criminal act before the police officers’ intervention. The Court
which tortfeasor act
therefore rejected the distinction made by the Portuguese Government
the all-or-nothing ap
between the creation of a criminal intent that had previously been absent
those difficulties fo
and the exposure of a latent pre-existing criminal intent […]
court may be willi
60. The Court has also held that where an accused asserts that he was
incited to commit an offence, the criminal courts must carry out adamage
careful was actuall
was the actual c
examination of the material in the file, since for the trial to be fairact
within
jurisdictions
facilita
the meaning of Article 6 § 1 of the Convention, all evidence obtained
as
establishment
of th
a result of police incitement must be excluded. This is especially true
and Danish law th
where the police operation took place without a sufficient legal framework
of evidence, which
or adequate safeguards […]
more probable tha
61. Lastly, where the information disclosed by the prosecution
the damage. A sim
authorities does not enable the Court to conclude whether the applicant
was subjected to police incitement, it is essential that the Court examine
the “theory of the m
the procedure whereby the plea of incitement was determined in each
case in order to ensure that the rights of the defense were adequately
2.2. JOINT AND SE
protected, in particular the right to adversarial proceedings and to
equality of arms […]”.
In Book VI – 4:1
Thus, in its case-law in matter of entrapment, the Court has developed
presumption of ca
criteria to distinguish entrapment breaching Article 6 (1) of the Convention
prescribed. The arti
from permissible conduct in the use of legitimate undercover techniques
may have been cau
in criminal investigations, developing the examination of complaints
of different
for which
entrapment on the basis of two tests: the substantive and the procedural
damage was caused
test of incitement100.
person who is acc
See ECtHR, Bannikova v. Russia, Application no. 18757/06, Judgment of 04.02.2011,
16
See: Infantino, Zerv
17
available at: https://hudoc.echr.coe.int/eng#{%22fulltext%22:[%22bannikova%22],
See: Court of Appea
18
%22documentcollectionid2%22:[%22GRANDCHAMBER%22,%22CHAMBER%22],
Solution to the pr
complicated ones. Depe
%22itemid%22:[%22001-101589%22]} [last accessed 07/11/2018].
several liability (see belo
100
ńi piL-apurK anyz284
rataK | 02
Duarte Rodrigues Nunes
.1.2However, since undercover operations in a digital environment is
a mean of obtaining evidence that restricts fundamental rights protected by
hton-ro-lla Article
ehT 8 of the European Convention on Human Rights, its admissibility
non auq enismust
oitidnbe
ocanalyzed also in the light of these fundamental rights. Therefore,
we
consider
that the requirements referred to in Judgment Valenzuela
t troppus seirtnuoc
101
Contreras
ividni eht n
eewteb v. Spain (and quoted above) apply mutatis mutandis to
undercover operations in a digital environment.
f ni elbail reh/mih
Thus, as we can see, Article 19 of Law no. 109/2009 and Law no. 101/
suac evitanretla fo
2001 comply with the provisions of Articles 6 and 8 of the European
ca rosaeftrot hcihw
Convention on Human Rights, except when the use of undercover
a gnihton-ro-lla eht
operations is allowed to investigate criminal offences of small or medium
f seitluciffid esoh102
t
gravity .
lliw eb yam truoc
llautca saw egamad
lautca eht saw tca
X. Online search of stored computer data
tilicaf snoitcidsiruj
(Articles 15 and 18 of Law no. 109/2009)
t fo tnemhsilbatse
t wal hsinThe
aD d
na search consists in a “clandestine infiltration into a computer
online
hcihw ,ecnesystem
dive foto observe its use and access stored data”103, which is carried out
ht elbaboronline
p erom
using technical means and by means of the surreptitious installation
is A .egam
a
d
e
h
t
of a computer
program of the type Trojan horse in the computer system104,
eht fo yrowhich
eht“ ehmay
t consist of a single access or occur continuously and over time.
TON-RO-LLA
S DN A TNIOJ
.2.2
101
ECtHR, Valenzuela Contreras v. Spain, Application no. 58/1997/842/1048, Judgment
:4 – IV kooB
I
of n
30.07.1998,
available at: https://hudoc.echr.coe.int/eng#{%22fulltext%22:[%22valenzuec fo noitpla%22],%22documentcollectionid2%22:[%22GRANDCHAMBER%22,%22CHAMBER%22],
muserp
[last accessed 07/11/2018].
tra ehT .de%22itemid%22:[%22001-58208%22]}
birc102
serp
Such as criminal offences punishable under Article 4, paras. 1 and 3, Article 6,
ac neeb evparas.
ah ya1,m2 and 3, Article 7 and Article 8 of Law no. 109/2009, that are punishable with
tnereffid hcimprisonment
ihw rof
up to 3 years (Article 4, paras. 1 and 3, 6, para. 3, and Article 8) and 1 year
esuac saw (Article
egama6,
d paras. 1 and 2, and Article 7). In fact, this possibility violates the principle of
that regulates the restriction of fundamental rights.
ca si ohw proportionality,
no103
srep
See Costa Andrade, Bruscamente no Verão Passado [Suddenly Last Summer], Coimbra
Editora, Coimbra, 2009, p. 166, and Pinto De Albuquerque, Comentário ao Código de Processo
[Commentary on the Code of Criminal Procedure, 4th Edition], Universidade
1
reZ ,onitnafnIPenal,
:eeS 4.ª6Edição
7Editora,
1
Lisbon, 2011, p. 502 and 541.
eppA fo t ruoCCatólica
:eeS
81 Costa Andrade, Bruscamente no Verão Passado [Suddenly Last Summer], Coimbra
p eht ot noituloS104 See
ep eD .seno d eEditora,
tacilpmoCoimbra,
c
2009, p. 166, and Pinto De Albuquerque, Comentário ao Código de Processo
oleb ees( ytilibail lareves
The Means of Obtaining Evidence Provided by the Portuguese Cybercrime Law
20 | 285
Katarzyna Krupa-Lipińs
In the absence of express legal provisions in our legal system105,2.1.
the ALL-OR-NOTH
admissibility of this means of obtaining evidence in Portuguese law is
discussed106. However, we consider that Article 15 of Law no. 109/2009
The all-or-nothi
is the legal basis of the online search in Portuguese Law. However,
whensine qua non
conditio
the online search is carried out in a continuous and prolongedcountries
way in support th
time, it will be prejudicial to fundamental rights similar to the interception
between the individ
of communications. Therefore, operating an interpretation according to
him/her liable in fu
the Constitution, even if this form of execution of the online search is
of alternative causa
admissible in the light of Article 15 of Law no. 109/2009, the legal regime
which tortfeasor act
(much more restrictive) of the interception of communications provided
the all-or-nothing ap
by Article 18 of Law no. 109/2009107 shall apply to such cases.
those difficulties fo
court may be willi
damage was actuall
act was the actual c
jurisdictions facilita
Penal, 4.ª Edição [Commentary on the Code of Criminal Procedure, 4th Edition], Universidade
establishment of th
Católica Editora, Lisbon, 2011, p. 502 and 541.
105
We can find cases of express legal provisions of online searches in German
and Law
Danish law th
(online Durchsuchung) [§100b of the Strafprozessordnung (Criminal Procedure Code)],
in
of evidence,
which
Spanish Law (registros remotos sobre equipos informáticos) [Article 588csepties a of the Ley
more probable tha
de enjuiciamiento criminal (Criminal Procedure Code)] and in Italian Law (captatore
the
damage. A sim
informatico) [Article 266 (2) of the Codice di Procedura Penale (Criminal Procedure
Code)].
106
See Pinto De Albuquerque, Comentário ao Código de Processo Penal, the
4.ª Edição
“theory of the m
[Commentary on the Code of Criminal Procedure, 4th Edition], Universidade Católica Editora,
Lisbon, 2011, p. 502 and 545, and Conde Correia, Prova digital: as leis que temos e a lei que
2.2. JOINT AND SE
devíamos ter, [in:] Revista do Ministério Público, n.º 139 [Digital Evidence: The Laws We Have
and the Law We Should Have, “Public Ministry Review”, no. 139], p. 42 et seq., consider
In Book VI – 4:1
that it is admissible. Differently, Rita Castanheira Neves, As Ingerências nas Comunicações
Electrónicas em Processo Penal [The Interference in Electronic Communications inpresumption
Criminal
of ca
Procedure], Coimbra Editora, Coimbra, 2011, p. 196 et seq., 248 and 273, David Ramalho,
prescribed. The arti
Métodos Ocultos de Investigação Criminal em Ambiente Digital [Covert Methods of Criminal
have been cau
Investigation in Digital Environment], Almedina, Coimbra, 2017, p. 346 et seq., may
Benjamin
forLisbon,
which different
Silva Rodrigues, Da Prova Penal, II [On Criminal Evidence, II], Rei dos Livros,
2010, p. 474–475, Marcolino De Jesus, Os Meios de Obtenção de Prova em Processo damage
Penal [The was caused
Means of Obtaining Evidence in Criminal Procedure], Almedina, Coimbra, 2011, p. 196, and
person who is acc
Armando Ramos, A prova digital em processo penal: O correio eletrónico [The digital evidence
in criminal proceedings: Electronic mail], Chiado Editora, Lisbon, 2014, p. 91, consider that
it is inadmissible.
16
See: Infantino, Zerv
107
17
About our opinion, with more developments, see Duarte Rodrigues Nunes,
OsCourt of Appea
See:
18 evidence
meios de obtenção de prova previstos na Lei do Cibercrime [The means of obtaining
Solution to the pr
complicated ones. Depe
provided in the Law of Cybercrime], Gestlegal, Coimbra, 2018, p. 226–234.
several liability (see belo
ńi piL-apurK anyz286
rataK | 02
TON-RO-LLA
Duarte Rodrigues Nunes
.1.2
XI. Final remarks
hton-ro-lla ehT
legislature has regulated, for the first time in the
non auq enisThe
oitidPortuguese
noc
Portuguese
legal
system,
the means of obtaining evidence specific for
t troppus seirtnuoc
Cybercrime
in Law no. 109/2009, with which we cannot fail to agree.
ividni eht n
eewteb
However, not all legislative options deserve this approval as, for
f ni elbail reh/mih
example the option of subjecting the seizure of electronic mail or records
suac evitanretla fo
of communications of a similar nature to the legal regime of seizure
ca rosaeftrot hcihw
of postal items provided by the Code of Criminal Procedure. And the
a gnihton-ro-lla eht
same applies to the catalogue of criminal offences that allow the use
f seitluciffid esoht
of undercover actions in the digital environment (because it includes
lliw eb yam truoc
criminal offences of small and medium gravity) and the lack of provision
llautca saw for
egaamspecial
ad
procedure in exigent circumstances in matter of an order for
lautca eht submitting
saw tca or granting access to data.
tilicaf snoitcidsiruj
t fo tnemhsilbatse
t wal hsinaD dna
hcihw ,ecnedive fo
ht elbaborp erom
is A .egamad eht
eht fo yroeht“ eht
S DN A TNIOJ
.2.2
:4 – IV kooB nI
c fo noitpmuserp
tra ehT .debircserp
ac neeb evah yam
tnereffid hcihw rof
esuac saw egamad
ca si ohw nosrep
61
reZ ,onitnafnI :eeS
71
eppA fo t ruoC :eeS
81
p eht ot noituloS
ep eD .seno d etacilpmoc
oleb ees( ytilibail lareves