In the system outlined by the EIO Directive, for the acquisition of the results of an interception already carried out abroad, it is not sufficient that such evidence has been authorized by a judge of a member state in compliance with the legislation of that state, but there is a need for control-which can only be entrusted to the national judge of the issuing state-on the admissibility and use of the evidence itself (the interception) according to Italian law.
The EIO Directive did not regulate the usability of evidence acquired through the EIO, referring for this aspect to the law of the issuing state, without prejudice in any case to "the rights of the defense" and the guarantees of "due process in the evaluation of evidence acquired through the EIO."
Where it appears that the investigative activity carried out abroad was carried out on the basis of an illegitimate order, because it was issued without the necessary court order, the pathological genesis of the evidence gathered abroad cannot but be reflected in the target criminal proceedings, decreeing the unusability of the evidence.
The European Investigation Order must be "necessary" and "proportionate" for the purposes of the criminal proceedings, "taking into account the rights of the person under investigation or accused," who, to this end, is entitled to knowledge of the "details of the investigation": 'acquisition of telephone or telematic traffic data, precisely because it is an activity aimed at affecting the right to privacy, as referred to in Articles. 7 and 8 Charta, must take place in a manner that ensures adequate judicial review, it having to be inferred that the acquisition abroad of documents and computer data inherent in correspondence or other forms of communication must always be authorized by a judge.
(non official machine translation)
Cassazione penale
sez. VI, ud. Oct. 26, 2023 (dep. Nov. 2, 2023), no. 44154
President De Amicis - Rapporteur Aprile
Held in fact
1. With the above-mentioned order, the Court of Milan, before which the case was brought pursuant to Article 309 of the Code of Criminal Procedure, confirmed the order of April 14, 2023, by which the Judge for Preliminary Investigations of the Court of Milan had ordered the application of the measure of pre-trial detention in prison against I.B, who was under investigation in connection with the crimes under Presidential Decree No. 309 of 1990, Articles 74 and 73, Art. 80, paragraph 2, for being part of a criminal association, headed by B.B., dedicated to the illicit trafficking of cocaine-type drugs imported from abroad, as well as for having participated in the purchase of large quantities of cocaine, intended in part to be transported to Calabria.
The Court noted how the serious indications of guilt against I. were inferable from the results of the investigations which, initiated in Italy with the execution of interceptions of telephone and environmental communications, and contextual observation services, had continued with the acquisition by the French judicial authorities of communications that the suspects had exchanged on a "chat" operating on the encrypted messaging platform "SKYECC." Such cognitive material, acquired by the Italian prosecutor through the issuance of European Investigation Orders (EIOs) - essential for delineating the role and activities carried out by today's appellant - was to be considered usable under Article 234-bis of the Code of Criminal Procedure, insofar as it concerned the content of communications not in progress but carried out previously, stored as messages partly already "unencrypted" and partly encrypted in a server of "SKYECC" located in (Omissis), but later rendered intelligible (and thus used as the content of mere computer documents) after acquiring the "encryption keys" or the algorithms that had enabled their decryption.
2. I. appealed against this order in a deed signed by his defense counsel, who put forward the following grounds.
2.1. Violation of the law, in relation to Articles 234-bis and 266 of the Code of Criminal Procedure, and defect of motivation, for having the Court of Review valorized the content of data contained in acts qualified as "computer documents", acquired by the French judicial authority and transmitted, after "decryption", to the Italian judicial authority in execution of a European Investigation Order (EIO): cognitive elements, in reality, inferred from chats extracted from the encrypted server "SSY-ECC", after the acquisition of special "reading keys", with the performance of operations constituting in part a form of interception of communications carried out in (Omissis) without compliance with the Italian regulations on the subject; and in other part, for the content of communications already made and stored in those servers, elements acquired in (Omissis) as computer documentation without observance of the rules on forensic copies to guarantee the authenticity of computer data in force in the Italian legal system. Activity, therefore, illegitimate because - in addition to having been formalized with an incomplete compilation of the OEI forms, in which no reference to I. had been included. - carried out in the absence of the conditions prescribed by Articles 6(1)(b) and 9(1) of Directive 2014/41/EU of the European Parliament and of the Council of April 3, 2014 on EIO: in particular, activity that had to be carried out through seizure pursuant to Article 254-bis of the Code of Criminal Procedure or through wiretapping pursuant to Article 266-bis of the Code of Criminal Procedure, and not also through a not allowed cross-border access. Activity, moreover, carried out in violation of Article 6(1)(a) of the aforementioned directive, which prescribes that the acquisition of investigative acts carried out by the judicial authority of another state of the European Union be possible only in accordance with the principles of proportionality and effectiveness, in order to avoid an undue violation of fundamental personal rights and to avert the risk of acquisitions of evidentiary data that have taken place in a completely illegal manner.
2.2. Violation of the law, in relation to Article 273 of the Code of Criminal Procedure and Article 6(1)(a). (a), Directive 2014/41/EU, and defect of motivation, for lack and erroneousness, for having the Court of Milan confirmed the genetic measure of the measure on the basis of incorrect identification criteria: in particular, for the crimes of chapters 71), 72), 73) and 74), no certain elements had been indicated against the applicant, to whom a user account of uncertain subjective attributability had been associated or whose data had been acquired at a time subsequent to that in which the crimes had been committed as formally charged.
2.3. Violation of the law, in relation to Article 274 of the Code of Criminal Procedure, and defect of motivation, for lack and erroneousness, for having the Court of Review confirmed the existence of the precautionary requirements, without taking into account that I. carried out a regular work activity in a farm, that the existence of any current connection with other competitors in the crimes had not been demonstrated, and that the risk of flight was not concrete: requirements that, in any case, could be guaranteed with the application of the precautionary measure of house arrest with the use of an "electronic bracelet."
3. The case was dealt with at the hearing on October 19, 2023, but its deliberation was postponed to today's hearing pursuant to Article 615, Paragraph 1 of the Code of Criminal Procedure.
Considered in law
1. It is the opinion of the Court that the appeal filed in the interest of I.B. should be granted, the first ground of the notice of appeal being well-founded, for the reasons and with the effects specified below.
2. For the purpose of a proper assessment of the grievances raised by the defense, it is necessary first to properly define the nature of the acquisitive investigative activity carried out by the judicial authority abroad.
2.1. In point of fact, it appears that, as part of an Italian investigation into international drug trafficking offenses, the Milan judicial authority issued a series of European investigation orders to acquire from the French judicial authority the chats and other conversations exchanged by the present appellant using the "SKY-ECC" encrypted messaging platform.
A reading of the contested order shows, in fact, not only that in (Omissis) the investigating authority had "routed" those "chats" to a "server" and had subsequently identified the algorithm used to encrypt the messages, thus making the computer documents acquired intelligible, to be considered therefore "cold data" or "documentary outcomes of investigative activities" of that foreign authority (pp. 2-3, 7-8); but also the circumstance that the circumstantial elements against the top members of the criminal group had been provided by the results of the ordered telephone and environmental wiretaps (p. 5), as well as by the "seizure of the chats" (p. 14).
It was deduced from this - we read in that same order - that the investigative activity carried out abroad "enjoys" a "presumption of legitimacy," the power of control over the regularity of the investigative initiatives carried out in (Omissis) being taken away from the Italian judge, in the absence of a proven violation of fundamental rights (p. 9).
2.2. That being said, it must be said that the reasoning of the contested order appears to be seriously deficient in the part in which the review court found that the European investigation orders issued by the Public Prosecutor at the Court of Milan were exclusively concerned with forms of acquisition of computer documents and data, qualifying under Article 234-bis of the Code of Criminal Procedure.
In the order appealed, in fact, it was not clarified-especially given the articulated and specific questions of fact and law that had been proposed by the defense in a memorandum filed during the hearing on the request for review (see pp. 3 et seq. of the appeal) - whether the French judicial authority had autonomously initiated, on the basis of pre-existing notitiae criminis, the investigations in its own country or whether the investigations had been activated (also) on the basis of the investigative solicitations that had substantiated the issuance of European investigation orders by the Italian prosecutor. Nor is it clear whether, with respect to the time of the issuance and transmission of these orders, the investigations carried out by the French judicial authority had all been definitively concluded, or whether - as would appear from some brief hints contained in the contested measure - they had also continued on the basis of requests made by the Italian judicial authority.
Circumstances, these, of non-negligible importance, taking into account that the Tribunal of Milan, without any further specification, reported that the acquisition of "cold data", i.e. elements relating to communications that had already taken place and stored in the "servers" of the company "SKY-ECC" present in (Omissis), had taken place following the completion of a further - undefined investigative activity ordered by the French judicial authority: an activity that the defense had objected, in a circumstantiated manner, had also consisted in the performance of ongoing communications interception operations, also characterized by the use of computer capturers (c. d. "trojans" or "malware"), for the acquisition of telematic communication data stored in the "server" of that company and to allow the apprehension of the "decryption keys" present in the devices used by the users of the encrypted messaging platform in question; as well as following the seizure - it is not understood whether of entire computer systems or only of the related data, "poured" on other media - of material available to the said company.
It is necessary, therefore, to overcome these causes of uncertainty recognizable in the motivation of the contested order in order to be able to give a correct definition and a more precise normative framework to the means of searching for evidence whose use needed to be authorized on a case-by-case basis. And this is true - as will be remarked below - all the more so for the purposes of verifying the procedural usability of evidence acquired abroad by one or more European Investigation Orders (hereinafter E.O.s.), because of the "principle of equivalence" provided for in Art. 6(1)(b). (b), of Directive 2014/41/EU of the European Parliament and of the Council of April 3, 2014 on the European Investigation Order in criminal matters (hereinafter EIO Directive), whereby such an order may be issued provided that the authority of the issuing state verifies that "the investigative measure(s) requested in the EIO could have been issued under the same conditions in a similar domestic case."
2.3. In the light of the results of the work of supplementing the reasoning that will be mandated in the rescissory judgment, it will be necessary to give a correct legal qualification to the acts of investigation performed.
The applicability, in the case at hand, of Article 234-bis of the Code of Criminal Procedure, which, introduced by Decree Law No. 7 of February 18, 2015, converted by Law No. 43 of April 17, 2015, establishes that "It is always permitted to acquire computer documents and data stored abroad, even other than those available to the public, subject to the consent, in the latter case, of the legitimate owner," should be excluded.
To this normative provision the judges of merit, in the case at hand, referred in a generalized manner, for this purpose recalling the interpretative orientation offered on the matter by this Court of Cassation (for which cf, among others, Sec. 4, no. 16347 of 05/04/2023, Papalia, Rv. 284563; Sec. 1, no. 19082 of 13/01/2023, Costacurta, Rv. 284440; Sec. 1, no. 6364 of 13/10/2022, dep. 2023, Calderon, Rv. 283998; Sec. 6, no. 18907 of 20/04/2021, Civale, Rv. 281819).
According to this jurisprudential direction, the messaging on group "chat" on "Sky-ECC" system, acquired through European order of investigation by foreign judicial authority that carried out its decryption, constitutes documentary information data stored abroad, usable under Article 234-bis c.p.p., and not communicative flow, not finding application of the discipline of wiretapping under Articles 266 and 266-bis c.p.p. (Sect. 4, no. 16347 of 05/04/2023, Papalia, cited above, according to which it does not matter whether the messages were acquired by the foreign judicial authority "ex post" or in real time, since at the time of the request the communication flows were not in place).
Now, the operativeness of the aforementioned provision can be considered justified exclusively in the hypothesis of the acquisition of computer documents and data, understood as "dematerialized" information elements, which pre-existed with respect to the moment when the French judicial authority initiated the investigations, or which had been formed outside those investigations: in the case brought to the attention of this Court today, by contrast, it is sufficiently clear that what was acquired was in part documentation of investigative activities and in part pre-existing documentation that did, however, constitute the subject of the further investigative initiatives of that foreign authority.
In particular, the provision dictated by art. 234-bis c.p.p. is certainly inapplicable if it refers to the results of an acquisitive activity that, also in implementation of the request for assistance formulated by the Italian judicial authority, took the form of the concealed apprehension of the content stored in a "server" or in the seizure of related data stored therein or present in other computer media, in the availability of the company that managed that messaging platform. In this hypothesis, it is, likewise, questionable the relief that the acquisition of the computer documents and data - certainly not available to the public - took place with "the consent of the legitimate owner," i.e., the sender or recipient of the messages, that is, the aforementioned company operating the platform, the foreign judicial authority having to be considered a mere qualified holder of those data for the purposes of justice.
Such an acquisitive activity, therefore, should be framed in the provisions dictated on search and seizure, especially in the rule dictated by art. 254-bis c.p.p. (introduced by Law no. 48 of March 18, 2008), concerning the hypothesis of seizure of computer data from providers of computer, telematic and communication services (in the same terms Sez. 6, 26/10/2023, R.G. no. 29723/23, Kolgjokaj).
On the other hand, if for the acquisition of data "external" to telephone or telematic traffic it is necessary to refer to Legislative Decree No. 196 of June 30, 2003, Article 132 (as amended) - the contents of which we will return to examine shortly - the discipline of Article 266 of the Code of Criminal Procedure, et seq. is applicable in the hypothesis in which there has been an ongoing capture of telephone, environmental or telematic flow communications, in the so-called "dynamic" phase.
This is without forgetting that Legislative Decree No. 108 of 2017, Art. 43, paragraph 4, in regulating the modalities of interception of telecommunications with the technical assistance of the judicial authority of another member state of the European Union, establishes that the request contained in a European Investigation Order "may have as its object the transcription, decoding or decryption of the intercepted communications": thus suggesting that even such larly "ancillary" activities, if requested by the Italian authority, must be previously authorized by the judge.
2.4. In this context, it should not be overlooked that the aforementioned Legislative Decree no. 196 of 2003, in accordance with the structure of domestic law and case law at the time living, had originally subtracted the activities of the acquisition of extrinsic data from the operators of telephone or telematic traffic, both for the active and passive phase, from the discipline of wiretapping, providing less burdensome conditions than those required for the capture of "communicative contents", respectively legitimizing to the issuance of the order during the preliminary investigation phase the public prosecutor and referring instead to the provisions of art. 256 of the Code of Criminal Procedure on the subject of orders to produce documents for the recognition and execution of orders issued abroad.
The well-established jurisprudence of this Court (Sect. U, no. 16 of 21/06/2000, Tammaro, Rv. 216247; Sect. U, no. 6 of 23/02/2000, D'Amuri, Rv. 215841), taking its cue from the pronouncements of the Constitutional Court (notably ruling no. 281 of 1998), had in fact excluded from the notion of wiretapping-which pertains to "the apprehension and acquisition of the contents of communications"-the "acquisitions for evidentiary purposes of news concerning the historical fact of the communication that took place," deeming sufficient the reasoned decree of the P. M. to acquire telephone records, so as to implement a constitutional protection proportionate to the injury to the confidentiality of the private sphere by reason of the limited invasiveness of the act that has as its object the acquisition of "external elements" of telecommunication, not secret from the service provider and the subscriber.
This framework of national legislation for the acquisition at the "server" of external telecommunications data has been profoundly changed following the arrests of the Court of Justice of the European Union.
In its judgment of March 2, 2021 (H.K., C-746/18), the Grand Chamber clarified what the conditions are for access for purposes of prevention or detection of crime to telephone/computer traffic or location data associated with it, with the stated aim of combining such activity with Articles 7, 8 and 11 and 52 of the Charter of Fundamental Rights. The Court, in recalling how such "external" communications data are capable of revealing very precise information about the private lives of the persons whose data have been retained, such as the habits of daily life, permanent or temporary places of residence, daily or other movements, activities exercised, the social relations of such persons and the social circles frequented by them, ruled first that access must be limited to procedures whose purpose is the fight against serious forms of crime or the prevention of serious threats to public security and second, that the prosecutor cannot be the competent authority to authorize access to such data.
With regard to the first profile, the Court reiterated how exceptions to and limitations on the protection of personal data must be accomplished within the limits of what is strictly necessary: thus, access must meet the requirement of proportionality, with the consequence that "both the category or categories of data concerned and the duration for which access to those data is requested must be, depending on the circumstances of the case, limited to what is strictly necessary for the purposes of the investigation in question."
As for the second profile, the Court noted that only a judge or an independent third-party authority in the process can impartially and objectively exercise control over the existence of the substantive and procedural conditions for access, so as to ensure "a fair balance between, on the one hand, the interests related to the needs of the investigation in the context of the fight against crime and, on the other hand, the fundamental rights to respect for the privacy and protection of personal data of the persons whose data are affected by the access."
This ruling had a disruptive impact on the Italian legal system, so much so that it required urgent regulatory intervention (Decree Law No. 132 of 2021), which, with the new provisions inserted into Article 132 of the Privacy Code (as resulting from conversion law No. 178 of 2021), has "jurisdictionalized" in criminal proceedings the procedure for the acquisition of external telephone and telematic traffic data (which now requires a reasoned authorizing order of the judge), selecting its objective scope of application, which can be experienced only in the context of proceedings registered for crimes connoted by a certain circumstantial gravity, configured quoad poenam.
As for the criterion of proportionality, the legislature anchored access, on the one hand, to the circumstantial prerequisite and, on the other, to investigative needs. The first requirement was identified in a lower level of ascertainment (sufficient evidence) than that provided for the authorization of the different and far more invasive means of seeking evidence of wiretapping. The second ("where relevant to the prosecution of the investigation") comes to implement the dictum of the Court of Justice where it imposed the concrete verification of the actual need for an acquisitive intervention, so as to exclude its use per inquisitio generalis.
From this perspective, it is possible to conclude that the acquisition abroad of documents and computer data inherent in correspondence or other forms of communication must always be authorized by a judge: it would be truly singular to consider that for the acquisition of external data of telephone and telematic traffic, a prior authorizing order of the judge is necessary, while to carry out the seizure of computer data concerning the content of communications subject to that traffic, an order of the prosecutor is sufficient.
2.5. In this normative and jurisprudential framework, the position taken by the Constitutional Court regarding the applicative extension of the guarantees provided by Article 15 of the Constitution regarding the freedom and secrecy of correspondence and all other forms of communication assumes central importance.
The Justices of the Laws have recently clarified that - without prejudice to the distinction between the activity of interception, which concerns the covert capture by an "extraneus" of communications in their so-called "dynamic" phase, and the activity of seizure, which pertains to the acquisition of the support bearing the memory of communications that have already taken place, that is, in their so-called "static" phase - the concept of correspondence, to which the "coverage" of Article 15 Const, is "broadly inclusive, capable of embracing every communication of human thought (...) between two or more determinate persons, implemented in a manner different from conversation in presence;...(so that) the protection granted by Article 15 Const. which ensures to all citizens the freedom and secrecy "of correspondence and all other forms of communication," allowing its limitation "only by reasoned act of the judicial authority with the guarantees established by law," is irrespective of the characteristics of the technical means used...(and)... extends, therefore, to every instrument that technological evolution makes available for communication purposes, including electronic and computer ones." It follows that Article 15 of the Constitution, referring to the "generality of citizens," protects correspondence "including electronic correspondence, even after it has been received by the addressee, at least until, due to the passage of time, it has lost all topicality in relation to the interest in its confidentiality, turning into a mere 'historical' document" (Constitutional Court, Sentence No. 170 of 2023).
This authoritative interpretative indication, although contained in a ruling issued in a judgment on a conflict of attribution between the powers of the State with specific reference to the immunities enjoyed by parliamentarians under Article 68 of the Constitution, possesses a general value in the part in which the preceptive scope of Article 15 of the Constitution was considered, leading this Court to enhance its implications in relation to the case at hand.
From this point of view, in fact, the recalled decision of the Judge of Laws "welds" coherently with the already sufficiently defined exegetical orientation of the constitutional jurisprudence on the basis of which it had pointed out that the protection provided by that provision of the fundamental charter - which ensures to all citizens the freedom and secrecy "of correspondence and all other forms of communication." allowing its limitation "only by reasoned act of the judicial authority with the guarantees established by law" - "opens" "the constitutional text to the possible emergence of new means and forms of confidential communication" (Constitutional Court. , Sent. no. 2 of 2023, regarding the illegitimacy of the rule on prohibitions, established by the administrative authority, on the possession and use of communication devices) and extends to "every instrument that technological evolution makes available for communication purposes, including electronic and computer-based ones, unknown at the time of the launch of the Constitutional Charter," in relation to which limitations on constitutional freedom are allowed only in compliance with "the absolute reservation of law and jurisdiction" (Const. Court, Sent. no. 20 of 2017, regarding forms of control of prisoner's correspondence by correspondence; conf., previously Const. court Sent. no. 1030 of 1988; and Const. court Sent. no. 81 of 1993).
Nor is there any doubt that the Constitutional Court, precisely in consideration of the guarantees associated with the "reservation of jurisdiction," has extended to freedom of communications the criteria applied to legitimize limitations on personal freedom: explaining that "the substantial, and not merely formal, significance of the intervention of the judicial authority, in the presence of preventive measures involving restrictions with respect to fundamental rights assisted by the reservation of jurisdiction," implies that that control should be understood as "screening by the judicial authority (. ..) associated with the guarantee of cross-examination, the possible contestation of the application prerequisites of the measure, its excessiveness and disproportionality, and, ultimately, allows the full unfolding to the right of defense itself" (Const. Court, Judgment No. 2 of 2023).
The hermeneutical direction favored by the Consulta is also connected to the positions taken on the matter by the European Court of Human Rights, which - as recalled expressly in Judgment No. 170 of 2023 - has brought "under the cone of protection of Art. 8 ECHR, where reference is also made to "correspondence" tout court, e-mail messages (EDU Court, Judgment 5/09/2017, Barbulescu v. Romania, p. 72; EDU Court, Judgment 3/04/2007, Copland v. United Kingdom, p. 41), SMS (EDU Court, Judgment 17/12/2020, Saber v. Norway, p. 48) and instant messaging sent and received via the internet (EDU Court, Judgment Barbulescu, cit, p. 74)".
2.6. In identifying the procedural discipline most appropriate to the case at hand, the relevant domestic legislation must, then, necessarily be read and interpreted in a manner consistent with the principles formulated by EuroUnion law. In this regard, the oft-quoted EIO Directive stipulates that the European Investigation Order must be "necessary" and "proportionate" for the purposes of criminal proceedings, "taking into account the rights of the person under investigation or accused," who, to this end, is entitled to knowledge of the "details of the investigation" (thus in recital 10 of the Directive).
It is also necessary to consider that Legislative Decree No. 108 of 2017, Art. 3 provides that "in the performance of activities relating to the issuance, transmission, recognition and execution of the investigation order, personal data shall be processed in accordance with the legislative provisions governing the processing of judicial data and in accordance with the normative acts of the European Union and the Conventions of the Council of Europe."
Of so much, as anticipated, there is confirmation in the case law of the Court of Justice of the European Union, which has had occasion to emphasize, on the one hand, how the acquisition of telephone or telematic traffic data, precisely because it is an activity aimed at affecting the right to privacy, as referred to in Articles 7 and 8 CDFUE, must take place in a manner that ensures adequate judicial review (EU Court of Justice, Judgment 2/03/2021, H.K., C-746/18, cit.): acquisition which, in the case of the issuance of a European Investigation Order, must allow the person concerned to promote an adequate means of appeal, so as to validly exercise the right to an effective remedy under Article 47 CDFUE (EU Court of Justice, Judg. 11/11/2021, Gavanozov, C-852/19). And, on the other hand, how, apart from the criterion of autonomy of each member state in regulating "the procedural modalities of actions intended to ensure the protection of the rights due to individuals under Union law," it is necessary, in any case, that those modalities "are not less favorable than those relating to similar situations subject to domestic law" and "that they do not make the exercise of rights impossible or excessively difficult in practice," preventing "information and evidence obtained unlawfully from unduly prejudicing a person suspected of having committed crimes" (Court of Justice. EU, sent. 16/12/2021, HP, C-724/19).
3. Only once it has been clarified what act is required by the o.e.i. and executed in (Omissis) and the regime for its acquisition in Italy, can the question raised by the defense of "competence" to issue the European Investigation Order be addressed.
3.1. The EIO Directive - a regulatory instrument of the European Union that is part of the system of mutual recognition of judicial measures in criminal matters - provides that, in order to carry out one or more specific investigative acts in another member state (the "executing state") for the purpose of acquiring evidence, a "judicial decision" the European Investigation Order) must be issued by an authority competent under national law to order such acts.
And this is to ensure that "the investigative act or acts requested in the o.e.i. could have been issued under the same conditions in a similar domestic case" (Art. 6).
Thus, the o.e.i. presupposes first of all the "competence" of the issuing authority to the adoption of the "specific" act to be executed abroad and, consistently, the existence of the conditions for the issuance of the act in question in the issuing state.
The function of this rule is to ensure already in the issuing State the "upstream" control over the act that is intended to be executed or obtained abroad: indeed, it is up to the issuing authority to ascertain pursuant to Article 6(1) of the Directive "whether the evidence sought to be obtained is necessary and proportionate for the purpose of the proceedings, whether the investigative act chosen is necessary and proportionate for the acquisition of such evidence," as well as "full respect for the rights set forth in Article 48 of the Charter of Fundamental Rights of the European Union" (Recital 11).
3.2. Legislative Decree No. 108 of 2017, which implemented the 2014 Directive, established in Article 27 that competent authorities to issue the E.O. are the prosecutor and the prosecuting judge "within the scope of their respective powers," thus assigning to the prosecutor the legitimacy to issue the order for the preliminary investigation phase.
The delegated legislature thus enhanced the prosecutor's "domination" of the phase, even when the o.e.i. has as its object activities postulating the judge's prior authorizing control, given that the investigating judge's jurisdiction is only incidental.
The decree also excluded for this stage that the issuance of the o.e.i. must be preceded by cross-examination with the parties (reserved only for proceedings in which it is the judge who issues the order).
Thus, the choice of the delegated legislature was to diversify the competence to issue the o.e.i. from that to issue the requested investigative act.
Moreover, in attributing to the prosecutor for the investigation phase the competence to issue the o.i.e. for each type of act to be acquired abroad, the legislative decree expressly provided - albeit only for wiretapping - that the order be preceded by the adoption of the authorization order by the Judge for Preliminary Investigations (Art. 43).
Indeed, it is up to the latter to "verify the prerequisites of the request, according to the codictic discipline," and then - if necessary - to reject it in the absence of such prerequisites (so expressly the Illustrative Report). Since the authorizing measure is not expected to be attached to the order, in the o.e.i. the prosecutor will have to set out "the reasons why he considers the act of investigation useful to the criminal proceedings."
When, on the other hand, the act to be performed abroad is within the jurisdiction of the prosecutor himself, according to the codictic discipline, it is the o.e.i. - as a judicial decision - that constitutes the internal act of investigation (in fact, Article 28 provides in the case of evidentiary seizure that it is the o.e.i. that is subject to appeal).
3.3. The o.e.i. can also be issued to obtain evidence already available in the executing state (Art. 1: "evidence already in the possession of the authority of the executing state").
The EIO Directive, in fact, incorporated the cooperation mechanism already provided in the E.U. framework for the acquisition of evidence already existing and available in the executing state-the Framework Decision 2008/978/JHA on the evidence warrant (which Italy has not implemented)-which, as stated in the European Commission's proposal (doc. COM (2003) 688, Nov. 14, 2003), could also be used to acquire "existing data concerning intercepted communications."
As for the rules provided for in the latter instrument, it is significant that the Framework Decision had provided, as conditions for issuing the warrant, not only an assessment by the issuing authority of the necessity and proportionality of the acquisition of the evidence with respect to the criminal proceedings a quo, but also the "compatibility" of the same acquisition with respect to the legislation of the issuing state "if the evidence had been available in the territory of the issuing state" (the warrant, in other words, could be issued only in cases where the objects, documents or data were acquirable under national law). This condition, as stated in the relevant proposal of the European Commission, was intended to prevent the aforementioned mechanism for acquiring evidence from coming to circumvent prohibitions or limitations under the legislation of the issuing state.
Since neither the EIO Directive nor the implementing legislative decree dictated specific rules for the issuance of the E.O. for the acquisition of evidence that is already available, the prosecutor's jurisdiction at the preliminary investigation stage must be considered firm for this form of order as well.
Rather, the problem relates to whether or not the o.e.i. must be preceded by an authorizing order from the judge, where this is provided for by national legislation for the type of act to be acquired.
The question, which thus concerns more than the issue of the prosecutor's competence to issue the o.e.i. the issue of the legitimate issuance of the order itself, in the present case is in any case irrelevant, for what will be specified below on p. 4.4.
4. It should therefore be clarified what, with reference to the appeal under consideration, are the consequences arising from the illegitimate issuance of the o.e.i. insofar as it is not preceded by the necessary court order.
4.1. The EIO Directive provides that the defense may first rely on the remedies available in the executing State so as to prevent the recognition of the o.e.i. or the transmission of the evidence or otherwise its use in the ad quem proceedings (Art. 14), the issuing State having to take into account the outcome of a successful appeal implemented by the person concerned.
Among the profiles that the defense may raise with the executing State is that of the competence of the issuing authority to adopt the specific act requested (in this sense, see ECJ, 16/12/2021, HP C-724/19, cit.).
4.2. In turn, the issuing state, as the Court of Justice has made clear, regardless of the remedies available in the executing state, must allow the defense to challenge "the necessity and regularity of a European Investigation Order" (Judgment 11/11/2021, Gavanozov, C-852/19).
In the silence of the implementing decree of the EIO Directive, it must be considered that the defense may avail itself of the remedies provided by our legal system to subject the profile of the illegitimacy of the o.i.e. to review (principle already affirmed by the United Sections with reference to a request for judicial assistance, Sect. U, no. 21420 of 16/04/2003, Monnier).
4.3. Well, where it turns out that the investigative activity carried out abroad was carried out on the basis of an illegitimate order, because it was issued without the necessary court order, the pathological genesis of the evidence gathered abroad cannot but be reflected on the criminal proceedings of destination, decreeing the unusability of the evidence.
4.4. In contrast, the consequences of such illegitimacy are different where it is found that the o.e.i. was issued in order to acquire evidence "already available" in the executing state.
Given that it does not appear that the defense has successfully challenged in the executing state the illegitimate issuance of the o.e.i. by the Italian prosecutor, this profile is definitively absorbed by the transmission of the evidence by the latter (occurring in a case similar to that in which the evidence was spontaneously made available to another state, according to a mechanism now established in international law and in the practice of relations between states).
In the face of evidence definitively transmitted to the Italian authority, the question posed by the defense here is therefore precluded.
This does not exclude, however, as the Court of Justice has requested, that the defense may obtain, through the remedies available in our legislation, verification as to the existence of the conditions for the admissibility of the evidence in accordance with the rules proper to the national legal system. Verification that, insofar as it was not carried out by the judge in the proceedings a quo before the issuance of the E.O.I., incidentally, can also be carried out later by the review judge.
In fact, the EIO Directive did not regulate the usability of evidence acquired through the EIO, referring for this aspect to the law of the issuing state, without prejudice in any case to "the rights of the defense" and the guarantees of "due process in the evaluation of evidence acquired through the EIO" (Art. 14(7))
Thus, in the case of results of wiretapping operations already available in the executing state, the reference standard in the national perspective cannot be only Article 270 of the Code of Criminal Procedure, which regulates the use of evidence acquired in other proceedings.
As the United Sections have made clear, the procedure of "admission" of wiretapping is completely unrelated to this norm, which, however, cannot fail to be relevant in the ad quem judgment from the standpoint of the legality of the procedure of authorization and execution of wiretapping: if the violation of the guarantee of freedom and secrecy of communications can make evidence unusable in the a quo judgment, a fortiori it must be able to make evidence unusable in the ad quem judgment, in which it has narrower limits of admissibility. And for that matter, it is evident what abuses the circulation of evidence deprived of the memory of its genesis would otherwise lend itself to (Sec. U, No. 45189, Nov. 17, 2004, Esposito, Rv. 229244).
It is therefore clear that, in the system outlined by the EIO Directive, for the acquisition of the results of an interception already carried out abroad, it is not sufficient that such evidence has been authorized by a judge of a member state in compliance with the legislation of that state, but there is a need for control-which can only be entrusted to the national judge of the issuing state-on the admissibility and use of the evidence itself (the interception) according to Italian law.
5. Finally, it remains to be clarified what is the regime of usability of the evidence collected through the o.e.i. system.
5.1. The EIO Directive, as anticipated, contains no provisions on this point, given that it is a constant affirmation of the Court of Justice that "in the absence of Union legislation" on the admissibility and evaluation of evidence obtained through the instruments of judicial cooperation, it should be up to national legal systems, in accordance with the principle of "procedural autonomy," to establish "the procedural modalities of actions intended to ensure the protection of the rights due to individuals under Union law." The important thing is that these should "be no less favorable than those relating to similar situations subject to domestic law," and "not render the exercise of rights impossible or excessively difficult in practice," preventing "information and evidence obtained unlawfully from unduly prejudicing a person suspected of having committed crimes" (Grand Chamber, October 6, 2020, C-511/18, C-512/18 and C-520/18).
The legislative decree in turn merely stipulated in Article 36 which documents can be collected in the case file for the trial, replicating the rules on letters rogatory (Article 431 of the Code of Criminal Procedure).
Therefore, the well-established principles affirmed by the jurisprudence of legitimacy on the subject of the usability of the results of rogatory letters are taken into consideration, insofar as they are compatible, namely the rule of the prevalence of the "lex loci" over the "lex fori," according to which the act is executed according to the procedural rules of the requested State, with the only limitation that the evidence cannot be used if it is in conflict with the fundamental principles of the Italian legal system (among many others, Sez. 3, no. 1396 of 12/10/2021, dep. 2022, Rv. 282886; Sec. 5, no. 1405 of 16/11/2016, dep. 2017, Rv. 269015; Sec. 2, no. 2173 of 22/12/2016, dep. 2017, Rv. 269000; Sec. 5, no. 45002 of 13/7/2016, Rv. 268457).
Indeed, the latter constitute the mandatory limit for the usability of evidence taken abroad under Article 191 of the Code of Criminal Procedure.
Among the pivotal principles of the Italian legal system, to which the evidentiary act taken abroad must conform, according to the aforementioned constitutionally bound interpretation, the jurisprudence of legitimacy has consistently referred to the protection of the inviolable right of defense under Article 24 Const., paragraph 2, and of the cross-examination for evidence under Article 111 Const. (Sez. 1, no. 19678 of 03/03/2003, Rv. 225744).
If, on the one hand, the Supreme Court has ruled out the possibility of expecting an integral adaptation of the typical case of the notarized act to the lines of the domestic procedural model, that is, an automatic transposition to the field of international judicial cooperation of any probative rule or prohibition provided by the code of procedure of the sanction of unusability; on the other hand, it has clarified that the defensive prerogatives, which must modulate in their explication on the law of the State that has executed the investigation order, cannot be compressed in their essential core.
Regarding, in particular, the right of the accused person to be able to know and challenge the evidentiary material used against him or her, the Supreme Court has held, on the subject of wiretapping, that the defense's right of access to the evidence must be guaranteed even if it is collected abroad: in the event that the activity of putting encrypted messages in the clear (in this case, exchanged using a "Blackberry" system) was carried out abroad by the service provider out of the cross-examination, the defense has the right to obtain the original, encrypted version of the messages and the security keys necessary for decryption, under penalty of nullity under Art. 178 c.p.p., lett. c), (Sec. 4, no. 49896 of 15/10/2019, Rv. 277949).
It should be recalled, in this regard, that the EDU Court has consistently held that, in order to establish the fairness of the trial, it must be ascertained whether and in what manner the defendant was given the opportunity to access "decisive" evidence for the purposes of conviction.
With reference to a case in which the right of defense had been compressed in relation to data collected in an encrypted messaging "server," not allowing the raw data to be verified in their content and integrity, the EDU Court (Grand Chamber, Judgment 26/09/2023, Yuksel Yalcinkaya v. Turkey) has held that although electronic evidence differs in many respects from traditional evidence, including with regard to its nature and the special technologies required for its collection, storage, processing, and analysis, there is no reason for a differentiated application of the guarantees of Article 6(1) ECHR; that the right to an adversarial trial thus presupposes that the investigating authority disclose to the defense all evidence, including "electronic" evidence and not only that which the prosecution considers relevant. This right is not, however, absolute as it may need to be balanced against competing interests, such as national security or the need to keep secret the police's methods of investigating crimes.
Such balancing may, therefore, lead to restrictive measures of the rights of the defense; indeed, in such a case, in order to ensure a fair trial, it is required, within the limits of strict necessity only, that limitations on the rights of the defense be counterbalanced by adequate procedural safeguards (see p. 308) in light of "the importance of the undisclosed material and its use in the trial," and that the accused be given "an adequate opportunity" to prepare his defense, as required by Article 6 of the Convention.
5.2. In the present case, it is unclear what part of the investigative initiatives carried out abroad is covered by an unspecified "state secret" affixed by the French authority, which is also mentioned in the contested measure, and at what moment in the proceedings for the execution of the o.i.e., if any, was the secret in question opposed to the parties.
Excluding that in such a hypothesis art. 256-ter c.p.p. is applicable, which concerns cases in which the state secret has been affixed by an Italian authority - it must therefore be verified, on the basis of the productions of the parties, whether and to what extent the exercise of the defensive faculties of access to the evidence has been concretely limited by the French state secret.
Indeed, it does not emerge from the substantive measures whether the defense - which has the burden, in the case of the transmission of evidence already independently acquired by an authority of another European Union member state, to turn to the authorities of that state - was given the opportunity to obtain the original version of the messages as well as the data necessary to make the encrypted messages intelligible.
In any case, it is up to the defense, as is the case with the right of access to wiretap recordings (Sec. 2, No. 43772, 03/10/2013, Rv. 257304), to allege that it has not been able to benefit from such opportunities to challenge the circumstantial material used against the appellant.
6. The contested order should, therefore, be annulled with referral to the Court of Milan, which in the new judgment will fill the indicated motivational gaps by conforming to the principles of law outlined above.
In particular, on the basis of the aforementioned parameters and taking into account the connotations assumed by the concrete case submitted to its examination, the Court of Milan will have to:
- clarify what were the nature and characteristics of the investigation activities carried out abroad, attribute to them the correct legal qualification and identify the relevant applicable procedural regime;
- verify, for the purposes of the usability of the information data acquired, concerning communications in the "static" phase, whether the original conditions for the jurisdictional authorization of the relevant investigative activities covered by the European orders existed;
- Declare, if appropriate, the unusability of the elements of knowledge acquired, concerning communications in the "dynamic" phase, in the absence of a prior authorizing order of the Italian court;
- assess the usability in Italy of the evidence collected abroad on the basis of the issues raised by the defense on the subject of access to circumstantial material.
At the outcome of the findings mandated by the present rescinded ruling, in rescinding, the referring judge - should he possibly recognize the unusability of part of the circumstantial evidence - must, finally, carry out a "test of resistance" to verify whether compliance with Article 273 of the Code of Criminal Procedure can be considered, in the case at hand, equally guaranteed on the basis of further elements of knowledge legitimately acquired. This is because in the grounds of the order appealed against, the Court of Milan specified that the affirmation of the existence of serious indicia of guilt is based not only on the results of the investigations carried out by the French judicial authority, but also on the results of the investigations carried out directly by the Italian investigating authority, summarized in the results of telephone and environmental interceptions, the acquisition of self- and hetero-accusatory statements of a suspect and further judicial police operations.
In the recognition of the merits of the first plea, consideration of the remaining grounds of the appeal is consequently absorbed.
The Clerk's Office should be referred to the executive duties of the law.
P.Q.M.
Annuls the order under appeal and refers the case for new trial to the Court of Milan, which has jurisdiction pursuant to Article 309 of the Code of Criminal Procedure, para.7.