Digital evidence and covert investigative actions (НСРД)

Covert investigative actions, limits on interference with communications, and admissibility.

Covert investigative (search) actions are actions of which the person is unaware while they are being carried out. Article 246 of the Criminal Procedure Code of Ukraine sets out the grounds and procedure for conducting them; interference with private communications is treated separately (Article 258 of the Code). Digital evidence also enters the proceedings through this channel.

What follows is the path such material takes: who gives authorisation, the applicable time limits, how the result is documented, when the person learns of it, and how admissibility is determined. This is an orientation, not advice on a case.

The general sequence of stages — search, detention, notice of suspicion and trial — is set out separately. Criminal defence

Grounds and decision to conduct the action

Article 246 of the Criminal Procedure Code sets out the grounds and procedure for conducting covert investigative (search) actions: the proceedings in which they are possible, the condition for resorting to them, who makes the decision, and who may prohibit or terminate their further conduct.

What is determinedwhether there will be interference and in what form.

What is foreclosednothing. And nothing is visible: the person learns of the action later, in accordance with Article 253 of the Code.

Authorisation and time limit

An application for authorisation is considered by the investigating judge specified in Article 247 of the Criminal Procedure Code; Article 248 governs the examination procedure and the contents of the ruling. Exceptional urgent cases in which an action begins before the ruling is made are described in Article 250. Time limits are governed by Article 249: the period for which the action is authorised, the extension procedure, the maximum limit, and the ground for a prosecutor’s resolution terminating the action.

What is determinedthe scope and duration of the authorised interference — which actions, in respect of whom, and for what period.

What is foreclosednothing immediately. What expiry of the time limit means for material already obtained is a question of admissibility (Articles 86 and 87 of the Code).

Documenting the result

Article 252 of the Criminal Procedure Code governs the recording of the course and results of a covert action, the drawing up of the record and its transmission to the prosecutor. The time limits within which both the action and its documentation must be completed are examined in a separate publication by the association.

What is determinedwhether the result exists in procedural form.

What is foreclosednothing — until the question arises whether the documentation complies with the procedure in the Code.

Interference with private communications

Article 31 of the Constitution of Ukraine guarantees the secrecy of correspondence and telephone conversations; in the Criminal Procedure Code, this is Article 14, while the general provisions on interference are in Article 258. Article 8 of the Convention protects respect for private life and correspondence. Two covert actions involving digital channels are the interception of information from electronic communications networks (Article 263 of the Code) and the retrieval of information from electronic information systems (Article 264 of the Code).

What is determinedwhether the content of communications will become part of the proceedings and within what limits.

What is foreclosednothing. The decision under which the interference took place and the limits stated in it become visible after disclosure of the materials.

Equipment seized other than covertly

Not all digital material comes from covert actions. Temporary seizure of property, including electronic systems and mobile terminals, is governed by Article 168 of the Criminal Procedure Code; actions involving computer systems at the place of a search are governed by Article 236; and temporary access to items and documents by Article 159. The wording of these Articles has changed repeatedly.

What is determinedwhether the device will come into the possession of the prosecution and what will then happen to its contents.

What is foreclosednothing immediately. But from the moment of seizure, the extent of what the prosecution has seen no longer depends on the person.

When the person learns of it

Notification of persons in respect of whom covert investigative (search) actions were conducted is governed by Article 253 of the Criminal Procedure Code. Materials from such actions bear a secrecy classification, so the question of which procedural documents will be included among the disclosed materials is determined separately from disclosure itself (Article 290 of the Code).

What is determinedwhether the defence will see the basis on which the interference was authorised.

What is foreclosednothing — but this is where it becomes apparent what is absent from the materials.

Admissibility

Article 86 of the Criminal Procedure Code determines the admissibility of evidence. Article 87 sets out the grounds for finding evidence inadmissible as a result of a substantial violation of rights and freedoms; part 2 of that Article separately identifies actions requiring prior court authorisation.

What is determinedwhether the material obtained will form part of the body of prosecution evidence.

What is foreclosedeverything that precedes it converges here. Authorisation, time limits, documentation and disclosure of the materials become a single question.

Publications by the association on this subject

• Under the SECRET classification: how the prosecution seeks to stretch the limits of covert investigative actions — Ukrainian publication
• Shades of privacy: judicial control and the limits of interference with private communications — Ukrainian publication
• Search at a minimum: the importance of the full text of the investigating judge’s ruling — Ukrainian publication

The outcome of the proceedings is determined by the court.