Criminal investigation and privacy

custody and password

by Cabinet Roquefeuil | Nov 7, 2022

Updated November 7, 2022

One person was arrested for possession of narcotics. While in custody, she refused to give investigators codes to unlock two phones believed to have been used in drug trafficking.

This person, prosecuted before a criminal court, was not sentenced for having refused to give his telephone unlocking codes; she was released.

Passwords and encryption conventions allow the protection of data, and their disclosure imposed by the authorities can endanger individual freedom and democracy but also allow the repression of crime.

The Constitutional Council, on the QPC in which the Quadrature du Net intervenes, rules that the incrimination of refusal to communicate a password is not contrary to the Constitution.

Article 434-15-2 of the Penal Code, in its wording resulting from the law of 3 June 2016 provides:

"It is punishable by three years' imprisonment and a fine of €270,000 for anyone who has knowledge of the secret decoding agreement of a means of cryptology likely to have been used to prepare, facilitate or commit a crime or offence to refuse to hand over the said agreement to the judicial authorities or to implement it, at the request of these authorities issued pursuant to Titles II and III of Book 1 of the Code of Criminal Procedure.

"If the refusal is made when the surrender or implementation of the agreement would have made it possible to avoid the commission of a crime or offence or to limit its effects, the penalty is increased to five years' imprisonment and a fine of €450,000.

Article 29(1) of the 2004 law on confidence in the digital economy (theoi n° 2004-575 of 21 June 2004 for confidence in the digital economy) provides:

Cryptography means any hardware or software designed or modified to transform data, using secret conventions or to perform the reverse operation with or without secret conventions. The main purpose of these cryptographic means is to guarantee the security of the storage or transmission of data, by making it possible to ensure their confidentiality, authentication or control of their integrity.

The Council gave a classic reading of the text, i.e. a strict one, in application of the principle according to which criminal law is to be interpreted strictly, and deduced the constitutionality of the provision (in this case paragraph 1 of the article, the only one referred to).

The prosecution will have to characterise against the suspected person :

- knowledge of the password or agreement (the person who is required is the one who actually knows the password, and not only the person who is supposed to know, or who could, or should, know...technical intermediaries as companies relying on their machines to manage and access passwords could justify their refusal by opposing the absence of any physical body (human being) having access to the secret agreement) ;

– the probability that the means of cryptology has been used for criminal or tortious purposes.

The judicial authorities referred to are those involved in the preliminary or flagrante delicto investigation or in the investigation (Titles II and III of Book I of the Code of Criminal Procedure). The request must comply with certain formalities (official notification of the consequences of a refusal).

Decision 2018-696 of the Constitutional Council of March 30, 2018.

A simple request for the communication of a password by a police investigator does not therefore appear to qualify the facts. And the refusal to communicate the locking code, a "PIN" (for Personal Identification Number) is not a refusal to communicate an encryption convention. In this sense moreover Paris 16 April 2019, n°19/09267.

Conventionality. The Court of Cassation ruled that the offence of refusing to hand over a secret cryptological decryption agreement did not in itself infringe the right to remain silent and not to incriminate oneself under Article 6 of the European Convention on Human Rights (Cas. crime, Dec. 10 2019, No. 18-86.878)

The Court of Cassation indicates that the refusal to deliver the PIN may amount to refusing to deliver the decryption agreement (Crim.13 oct.2020, n°20-80150).

It is a question of distinguishing between the code allowing access to a terminal (computer, telephone, server, SIM card, etc.) and the key allowing decryption of the stored or circulating data or metadata.

In some cases, PINs or other secret codes and passwords do not prevent access to data, in others yes, the case law is therefore hesitant (CA Paris 16 April 2019, 18-09.267 ; Cas. crim., 13 Oct. 2020, no. 20-80.150; Cas. crim., 13 Oct. 2020, n° 19-85.984).

In its judgment of November 7, 2022, the Court of Cassation, plenary assembly, appeal no. K 2183.146, indicates, in its press release:

A " means of cryptology is intended to render information incomprehensible, in order to secure its storage or transmission. A " secret decryption convention allows the clearing of encrypted information. When a mobile phone is equipped with a " means of cryptology », their home screen unlock code may be a " decryption key » if the activation of this code has the effect of clarifying the encrypted data that the device contains or to which it gives access. Therefore, if a mobile phone with these technical characteristics - as is the case with most mobile phones today - is likely to have been used for the preparation or the commission of a crime or offense, its holder, who will have been informed of the penal consequences of a refusal, is required to give the investigators the unlock code for the home screen. If he refuses to communicate this code, he commits the offense of “refusal to deliver a secret decryption agreement ". Therefore, in this case, the decision of the Court of Appeal is quashed and another Court of Appeal is appointed to retry the case.

Controlling access to data held by telephone operators

Police custody and the right to silence

by Cabinet Roquefeuil | Sep 23, 2022

(Update of 14 February 2023: > On DNA and biometric samples, CJEU judgment 26 Jan. 2023, case C-205/21)

The exercise of the right to silence by the detainee or respondent speeds up the management of the case, allows more time to prepare the defence, and avoids the production of a confession where there is no evidence or nothing else to say.

At a time when the fragmentation of society makes communication between individuals more difficult, the exercise of the right to silence by the person in custody enables him or her to guarantee the right of access to the case file, and thus to be better informed of the charges against him or her, and to avoid errors of assessment.

The remark is particularly relevant during police custody in police premises as part of a preliminary investigation or an investigation procedure, procedures which a priori concern cases of a certain complexity.

The lawyer does not have access to the file and does not know the evidence against him

Indeed, in the context of police custody, the person in police custody is informed of his rights and the qualification of the facts with which he is charged, but without any details on the evidence that has been collected.

The lawyer also does not have access to the evidence file and therefore cannot give specific advice to his client.

The latter can therefore invoke his right to silence and remain silent in front of the investigators, at least as long as his lawyer does not have access to the file, or has not had the time to have the file studied in depth (at least for files of a certain complexity).

This right to silence is a constitutional right deriving from the right not to incriminate oneself following coercive measures, and from the right to a fair trial.

The right to silence must be recalled by the investigators themselves.

A constitutional right

The right not to "self-incriminate" is grounded in Article 14.3 of the International Covenant on Civil and Political Rights, as well as in the case law of the European Court of Human Rights (ECHR) on 6 of the Convention (ECHR 25 Feb. 1993, No. 10828/84, Funke v. France) (ECHR 21 Dec. 2000, No. 34720/97, Heaney and McGuinness v. Ireland), and in the European Directive 2012/13/EU relating to the right to information in the context of criminal proceedings, and of course in the code of criminal procedure during the hearing of the suspect placed in police custody (art. 63-1) or heard freely (art. 61-1), during the investigation as regards the indictment (art. 116) or placement under the status of assisted witness (art. 113-4), during the presentation before the prosecutor of the Republic in application of article 393, as well as before the trial courts, in contraventional (art. 535), tort (art. 406) or criminal (art. 32) matters 8), as well as articles 396 (translation of a defendant before the judge of freedoms and detention in the context of an immediate appearance), 199 (appearance of the defendant before the investigating chamber), 148- 2 (hearing of a defendant or an accused within the framework of an application for release from judicial review or release), and 12 of the order of February 2, 1945 (hearing of a minor before the services of the Judicial Protection of Youth). The Constitutional Council sees in this a guarantee of the presumption of innocence provided for in article 9 of the declaration of the rights of man and of the citizen.

Investigators seek confessions

Placement in police custody is only possible if the person incurs a prison sentence.

The suspicion leveled against him is therefore necessarily serious, and the least you can do is for him to have access to the file.

Sometimes the suspect, caught in a Stockholm syndrome, will tend to want to please the investigators, especially if they have a sympathetic and reassuring attitude, in the hope of quickly escaping his misfortune, and even though he is in cell after having been able to undergo a muscular arrest.

He will think that cooperating will be able to release him more quickly from his suffering (custody is stressful), and that it would be unreasonable not to be sympathetic in turn towards the investigators "since he has nothing to reproach".

He will therefore make confessions which are not always appropriate, or even which do not concern the precise subject of the investigation, and may aggravate his case, even though the file of the investigators may be thin or relate to other facts.

It is therefore recommended to follow the advice of your lawyer, and to exercise your right to silence if necessary, even if it means making a statement admitting to the facts and then exercising the right to remain silent.

This can also help to shorten the length of police custody and lengthy stringy hearings (where the suspect speaks but without conviction, and where the investigators stall), at least if the other investigative acts are finished (hearings of the others kept in custody in the event of offenses in meetings, searches, telephone and video exploitation, etc.).

Indeed, these acts may possibly justify the extension of police custody until they are completed.

But investigators may be tempted to extend to sanction, to put pressure.

Police custody, a coercive measure, is subject to legal conditions

Police custody is in all cases only justified under certain conditions, set out in Article 62-2 of the Code of Criminal Procedure:

"Custody is a measure of constraint decided by a judicial police officer, under the control of the judicial authority, by which a person against whom there are one or more plausible reasons to suspect that he has committed or attempted to commit a crime or an offence punishable by imprisonment is kept at the disposal of investigators.

This measure must be the only way to achieve at least one of the following objectives:

1° To allow investigations involving the presence or participation of the person to be carried out;

2° Guarantee that the person is brought before the public prosecutor so that the latter can assess the follow-up to the investigation;

3° Prevent the person from modifying the evidence or material evidence;

4° Prevent the person from putting pressure on the witnesses or the victims as well as on their family or relatives;

5° Preventing the person from consulting with other persons who may be their co-perpetrators or accomplices;

6° Guaranteeing the implementation of measures intended to put an end to the crime or misdemeanor.”

On the extension of police custody

Section 63

[…]
II. – The duration of police custody may not exceed twenty-four hours.
However, police custody may be extended for a further period of up to twenty-four hours, with the written and reasoned authorisation of the public prosecutor, if the offence that the person is suspected of having committed or attempted to commit is a felony or a misdemeanour punishable by a prison sentence of one year or more and if extending the measure is the only way to achieve at least one of the objectives mentioned in 1° to 6° of Article 62-2 [...].
The public prosecutor may make his or her authorisation conditional on the person's appearance before him or her. This presentation may be carried out by the use of an audiovisual means of telecommunication.
[…]

What happens next? What is the direction of the case?

Section 395

If the maximum term of imprisonment provided for by law is at least two years, the public prosecutor, when it appears to him or her that the charges are sufficient and that the case is ready for trial, may, if he or she considers that the elements of the case justify an immediate appearance, bring the accused before the court immediately.

In the case of a flagrant offence, if the maximum term of imprisonment provided for by law is at least six months, the public prosecutor, if he or she considers that the elements of the case justify an immediate appearance, may bring the accused before the court immediately.

The defendant is held until his appearance in court, which is scheduled for the same day; he is taken under escort to the court.

An “information” is an investigation procedure carried out by an investigating judge

The rate of opening of investigation procedures (known as “information”) on the procedures for the elucidation of offenses is very low.

The investigation is compulsory only for crimes and can only be opened for misdemeanors for which the penalty incurred is equal to or greater than three years.

Section 137

Any person charged, presumed innocent, remains free.

However, because of the needs of the investigation or as a security measure, he or she may be subject to one or more obligations of judicial supervision or, if these prove insufficient, to house arrest with electronic surveillance.

Exceptionally, if the obligations of judicial supervision or house arrest with electronic monitoring do not allow these objectives to be achieved, he or she may be remanded in custody.

Section 143-1

Subject to the provisions of Article 137, pre-trial detention may be ordered or extended only in one of the following cases
1° The person charged incurs a criminal penalty;
2° The person under investigation is liable to a correctional sentence of three years' imprisonment or more.
Pre-trial detention may also be ordered under the conditions set out in Article 141-2 where the accused person voluntarily evades the obligations of judicial supervision or house arrest with electronic surveillance.

The pre-trial investigation is supposed to complement the evidence and the study of personalities in complex cases.

Under what conditions can the right to silence be exercised before the investigating judge? In the context of an investigation or an examination at first appearance, exercising the right to silence, possibly accompanied by a statement of acknowledgement of the facts, may also make it possible to speed up the processing of the case or to obtain more time to prepare the defence.

In the case of an investigation procedure (still called "information"), it is Article 144 of the Code of Criminal Procedure that is pleaded before the liberty and custody judge, possibly with an incursion on the substantive debate on the facts:

"Pre-trial detention may be ordered or extended only if it is shown, in the light of the precise and detailed elements of the proceedings, that it is the sole means of achieving one or more of the following objectives and that these objectives cannot be achieved by placing the person under judicial supervision or by assigning him or her to house arrest with electronic surveillance :

1° Preserve the proofs or material indices which are necessary for the manifestation of the truth;

2° To prevent pressure on witnesses or victims as well as on their families;

3° Prevent fraudulent consultation between the person charged and his co-authors or accomplices;

4° Protect the person under investigation;

5° Ensure that the person under investigation is kept at the disposal of the justice system;

6° To put an end to the offence or prevent its recurrence ;

7° Put an end to the exceptional and persistent disturbance of public order caused by the seriousness of the offence, the circumstances in which it was committed or the extent of the damage it caused. This disturbance may not be the result of the media coverage of the case alone. However, this paragraph shall not apply in criminal cases.

Section 145

“[…] the liberty and detention judge cannot immediately order detention when the person under investigation or his lawyer requests time to prepare his defence.
In this case, he may, by means of an order reasoned by reference to the provisions of the preceding paragraph and not subject to appeal, prescribe the incarceration of the person for a specified period which may in no case exceed four working days. Within this period, the judge shall summon the person to appear again and, whether or not he or she is assisted by a lawyer, shall proceed as described in the sixth paragraph. If the court does not order that the person be remanded in custody, the person shall be released automatically.
In order to allow the investigating judge to carry out verifications relating to the personal situation of the accused or to the acts of which he or she is accused, when such verifications are likely to allow the person concerned to be placed under judicial supervision, the liberty and custody judge may also decide ex officio to prescribe, by reasoned order, the provisional imprisonment of the accused for a specified period which may not exceed four working days until the hearing of the parties. In the absence of a debate within this period, the person shall be released automatically. The order referred to in this paragraph may be appealed against in accordance with Article 187-1. [...]"

On data encryption: https://roquefeuil.avocat.fr/les-mots-de-passe-et-le-conseil-constitutionnel-lavocat-en-droit-informatique-analyse/

Update 14 February 2023: On DNA and biometric samples, the CJEU judgment 26 Jan. 2023, Case C-205/21

Article 10 of the Police-Justice Directive (EU) 2016/680 of 27 April 2016 provides:

Article 10

Processing of special categories of personal data

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning the sex life or sexual orientation of a natural person shall be permitted only in case of absolute necessity, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:

a)

where they are permitted by Union law or the law of a Member State;

b)

to protect the vital interests of the data subject or another natural person; or

c)

where the processing relates to data which are manifestly made public by the data subject.

According to the above-mentioned judgment :

The systematic collection of biometric and genetic data from any defendant for the purpose of police registration is contrary to the requirement to ensure greater protection against the processing of sensitive personal data

French law provides for the feeding of several files, which can be checked against this case law; only a few provisions are cited here for reference:

Article 706-56 of the Criminal Procedure Code provides:

II -Refusing to submit to the biological sample provided for in the first paragraph of I is punishable by one year's imprisonment and a fine of 15,000 euros.

The first paragraph of I provides:

I.-The judicial police officer may take a biological sample, or have it taken under his supervision, from the persons mentioned in the first, second or third paragraphs of Article 706-54, in order to analyse their genetic fingerprint. Prior to this operation, he or she may check or have checked by a judicial police officer under his or her control or by a specialised officer, technician or forensic engineer under his or her control, that the genetic fingerprint of the person concerned is not already registered, solely on the basis of his or her civil status, in the national automated genetic fingerprint database.

The first three paragraphs of 706-54 provide:

The automated national DNA database, placed under the control of a magistrate, is intended to centralise the genetic fingerprints from biological traces as well as the genetic fingerprints of persons convicted of one of the offences mentioned in Article 706-55 with a view to facilitating the identification and investigation of the perpetrators of these offences. The genetic fingerprints of persons prosecuted for one of the offences referred to in Article 706-55 who have been found not criminally responsible pursuant to Articles 706-120, 706-125, 706-129, 706-133 or 706-134 shall be stored under the same conditions.

The genetic fingerprints of persons in respect of whom there is serious or corroborating evidence making it likely that they have committed one of the offences referred to in Article 706-55 shall also be kept in this file on the decision of a judicial police officer acting either ex officio or at the request of the public prosecutor or investigating judge; this decision shall be noted in the file of the proceedings.

Judicial police officers may also, on their own initiative or at the request of the public prosecutor or investigating judge, match the fingerprint of any person against whom there are one or more plausible grounds for suspecting that he or she has committed one of the offences referred to in Article 706-55 with the data included in the file, without, however, the fingerprint being kept in the file.

Finally, 706-55 provides:

The National Automated DNA Database centralises DNA traces and fingerprints relating to the following offences

1° The sexual offences referred to in Article 706-47 of the present Code as well as the offence provided for in Article 222-32 of the Criminal Code and the offences provided for in Articles 222-26-2, 227-22-2 and 227-23-1 of the same Code;

2° Crimes against humanity and crimes and offences of deliberate attacks on human life, torture and acts of barbarism, deliberate violence, threats to harm people, drug trafficking, attacks on personal freedoms, trafficking in human beings, pimping, exploitation of begging and endangering minors, as provided for in Articles 221-1 to 221-5, 222-1 to 222-18, 222-34 to 222-40, 224-1 to 224-8, 225-4-1 to 225-4-4, 225-5 to 225-10, 225-12-1 to 225-12-3, 225-12-5 to 225-12-7 and 227-18 to 227-24 of the Criminal Code, as well as the offences provided for in Articles 221-5-6 and 222-18-4 of the same Code;

3° The crimes and offences of theft, extortion, fraud, destruction, degradation, deterioration and threats of damage to property provided for by articles 311-1 to 311-13, 312-1 to 312-9, 313-2 and 322-1 to 322-14 of the Criminal Code;

4° Attacks on the fundamental interests of the Nation, acts of terrorism, counterfeiting of money, criminal conspiracy and war crimes and misdemeanours provided for in Articles 410-1 to 413-12, 421-1 to 421-6, 442-1 to 442-5, 450-1 and 461-1 to 461-31 of the Criminal Code;

5° The offences provided for in Articles 222-52 to 222-59 of the Criminal Code, Articles L. 2339-2, L. 2339-3, L. 2339-4, L. 2339-4-1, L. 2339-10 to L. 2339-11-2, L. 2353-4 and L. 2353-13 of the Defence Code and Articles L. 317-1-1 to L. 317-9 of the Internal Security Code ;

6° The offences of concealment or laundering of the proceeds of one of the offences mentioned in 1° to 5°, as provided for by Articles 321-1 to 321-7 and 324-1 to 324-6 of the Criminal Code.