Legislative Decree n. 216/2017 introduces the use of the trojan software during investigations. The new rules certainly allow to make use of it in respect to the criminal offenses of organized crime and terrorism. But doubts remain on the concrete possibility of making use of the newly introduced investigative tool with regard to criminal offenses committed against public administrations or common crimes.

The trojan is a sofware that if it is put into a device (i.e. computers, smartphones, tablets, etc) is able to remotely intercept (and to make copies of) both data and communication flows. More specifically, this software allows a hidden access to: data stored in the device and recordings of incoming or outgoing data traffic  (including what is typed on the keyboard, recordings of phone calls and video calls and, above all, the activation of the microphone and/or camera functions). Trojans, therefore, make it possible to become aware of somebody’s conversation  and to steal somebody’s images, regardless of the user’s consent.

Trojan softwares when installed on a mobile device, follows the user wherever and can activate the microphone enabling the hearing of the conversations  of those who are within the device field. The use of such tool – in the context of criminal investigations – raises the legal problem of predetermination of the physical place of the interception.

Collecting, through the use of trojan software, conversations and communications between those who are present, falls – ratione materiae – within the scope of environmental interceptions, which is matter governed by Article 266 of the Italian Criminal Procedure Code.

Paragraph 2 of the aforementioned Article does not allow the environmental interception in the house, or in any another, private abode, unless there is a reason to believe that a criminal activity is taking place there. Article 13 of Legislative Decree n. 152/1993, transposed into law by Law n. 203/91, permits – notwithstanding what provided by Article 266, of the Criminal Procedure Code – environmental interception in the house, or in any other private places, in proceedings relating to organized crime offenses, even if there is no reasonable ground to believe that any criminal activity is actually taking place there.

Trojan softwares interceptions  make it technically impossible to predict where the collecting of conversations or communications will carry out. Thus, it becomes difficult to hypothesize its use for criminal offenses other than those of terrorism, criminal organisation, kidnapping, counterfeiting and slavery (Article 51, paragraphs 3-bis and 3-quater, of the Italian Criminal Procedure Code).

About the application of Article 266, of the Italian Criminal Procedure Code, to the interceptions between those present made through the usage trojan softwares, the Italian Supreme Court  – with decision n. 27100/2015 – stated that the decree of authorisation must identify, with precision, the places where the interception will have to be carried out, since an indeterminate indication, or the absence of any indication, is not admissible.

In relation to such issue, the United Criminal Chambers of the Supreme Court – with decision n. 26889/2016 – stated that ,the identification of  the place of the environmental interception in the authorisation decree, does not constitute an indefectible condition for the legitimacy and usability of interceptions of conversations and communications between those present, recorded by using of trojan,.  The use of this investigative tool is, however, allowed only for proceedings relating to terrorist offenses, criminal organisation, kidnapping, counterfeiting and slavery (Article 51, paragraphs 3-bis and 3-quater,Criminal Procedure Code). It i salso to noticed that according to Article 614, of the Criminal Code, it can ordered  also in places like houses, or other private abodes, even in the absence of the fumus commissi delicti.

The Legislative Decree n. 216/2017 containing provisions concerning the interception of conversations or communications, has solved the aforementioned doubts of iterpretation, introducing a specific regulation for the use of the trojans in matter of criminal investigation. 

The legislator, by implementing the enabling act n. 103/2017, indeed codified the scope of application of such tecnological instrument, providing for its admissibility even for the interceptions of conversations in matters concerning criminal offenses relating to drugs, weapons, contraband, persecutory acts and child pornography (Art. 266 Code of Criminal Procedure). If the aforementioned crimes occur in the house or in any other private place, the interception trough the use of trojans are allowed only if there is a reasonable ground to believe that one of the aforementioned criminal activities is taking place there.

Without prejudice to the use of trojan in the context of environmental interceptions, the Legislative Decree n. 216/2017, has provided that in proceedings for crimes against the public administration, the interception in the house or in any other private residence can not be performed by using the trojan if any effective probability of the crime consummation is lacking.

In relation to the criminal offenses of terrorism, criminal association, kidnapping, counterfeiting and slavery, it is sufficient that the authorization decree points out the reasons of the interception through the use of trojan softwares, given the peculiaruty of such criminal offenses; while, under the assumptions provided for by Article 266, of the Code of Criminal Procedure, the decree must also include information about the time and place  - albeit indirectly determined – of the trojan software activation, in order to guarantee the rights and freedoms of the intercepted persons.

The data recorded trhough the usage of trojan softwares can not be used – as evidence – in criminal proceedings relating to crimes other than those for which the authorization decree was issued. At the same time, the data acquired during the preliminary operations and those collected outside the limits of palce and time, as pointed out in the decree, can not be used.

Article 7 of Legislative Decree n. 216/2017 refers to a subsequent Ministerial Decree, which will define the rules for the implementation of the provisions introduced therein with regard to the interceptions through the use of trojan softwares.