Venice Commission - Report on a rule of law and human rights compliant regulation of spyware

Disclaimer: this information was gathered by the Secretariat of the Venice Commission on the basis of contributions by the members of the Venice Commission, and complemented with information available from various open sources (academic articles, legal blogs, official information web-sites etc.).

Every effort was made to provide accurate and up-to-date information. For further details please visit our site : https://www.venice.coe.int/

Bosnia and Herzegovina

1. Does your legal framework allow for the use of spyware as a tool of targeted surveillance either in criminal or intelligence investigations or is there an explicit prohibition on the use of spyware? If so, how does your domestic legal framework define spyware?

In Bosnia and Herzegovina, there is no special legal framework related to the use of espionage software.

2. Are there specific rules (covering notably the scope ratione materiae, temporis and personae) in place or do the general rules on targeted surveillance (interception of communications) apply (could you please provide us with such specific or general rules)?

As stated in the answer to the previous question, there are no specific rules for using spyware. Law on Criminal Procedure of Bosnia and Herzegovina (hereinafter referred to as the CPC) contains provisions that generally refer to special investigative actions.
Against a person for whom there are grounds for suspicion that he or she participated alone or with other persons or participates in the commission of the criminal offense referred to in Article 117 of the CPC, special investigations may be ordered actions, if evidence cannot be obtained in any other way or obtaining it would be associated with disproportionate difficulties (Article 116, paragraph 1).
The special investigative actions provided for by the CPC are:
a) supervision and technical recording of telecommunications,
b) access to computer systems and computer comparison of data,
c) supervision and technical recording of premises,
d) secret monitoring and technical recording of persons, means of transport and objects standing in relate to them,
e) the use of undercover investigators and the use of informants,
f) simulated and controlled purchase of items and simulated payment of bribes,
g) supervised transportation and delivery of objects of a criminal offense (Article 116, paragraph 2 of the CPC).
Investigative actions from point a. they can also be determined according to the person for whom there are grounds for suspicion to the perpetrator, that is, from the perpetrator of the criminal offense referred to in Article 117 of this law information related to the criminal act, i.e. that the perpetrator uses its means telecommunications. (Article 116, paragraph 3 of the CPC).
Special investigative actions can be determined for the following criminal offenses (Article 117 of the CPC):
- criminal acts against the integrity of Bosnia and Herzegovina,
- against humanity and values protected by international law,
- terrorism
- causing national, racial and religious hatred, discord and intolerance;
- illegal deprivation freedom,
- unauthorized wiretapping and sound or optical recording,
- violation of freedom voter preferences,
- counterfeiting money,
- forgery of securities,
- money laundering,
- tax evasion or fraud,
- smuggling,
- organizing a group of people or an association for smuggling or distribution of customs-free goodscustoms fraud,
- receiving a gift and others forms of use,
- giving gifts and other forms of benefit,
- receiving a prize or other form of benefit for influence peddling,
- providing a reward or other form of benefit for influence peddling
- abuse of position or authority,
- unlawful release of a person deprived of liberty,
- help to the perpetrator after the committed criminal act,
- assistance to a person accused by an international criminal court,
- prevention of proof,
- revealing the identity of a protected witness,
- obstruction of justice,
- association for the purpose of committing criminal acts,
- organized crime,
- other criminal offenses for which a prison sentence of five years or a heavier sentence may be imposed.
Investigative actions from Article 116, paragraph (2) point. from a) to d) and point g) of this law may continue up to a month at most, and if they give results there is a reason to continue with theirs conducted for the purpose of gathering evidence, they can be extended by the reasoned proposal of the prosecutor another month, with the measure from the point from a) to c) can last a maximum of six months in total for criminal offenses punishable by a prison sentence of five years or a heavier sentence, and for other criminal offenses for a maximum of four months. Measures from point d) and g) can last the longest in total three months for criminal offenses punishable by a prison sentence of five years or more penalty, and for other criminal offenses a maximum of two months. Exceptionally in relation to a criminal offense organized crime and criminal acts of terrorism, investigative actions from Article 116, paragraph (2), item from a) to d) and point g) of this law, if they give results and there is a reason to continue by conducting them for the purpose of gathering evidence, they can be based on the reasoned proposal of the prosecutor extend for another three months. Proposal for action from Article 116, paragraph (2), point f) of this law it can only refer to a one-time act, and the request for each subsequent action against the same
persons must contain the reasons justifying its use. (Article 118, paragraph 3 of the CPC).
In accordance with the Law on the Intelligence and Security Agency of Bosnia and Herzegovina (Article 74) during operations, the implementation of which was approved by the Director General of the Agency, the Agency has authority to collect information:
a) from all publicly available sources;
b) from other bodies and institutions in Bosnia and Herzegovina, by direct access to the database except in cases where they are expressly prohibited by law;
c) measures of physical monitoring in public places (i.e. dedicated and systematic
observations with the aim of gathering information on specific issues concerning persons or facilities that are reasonably believed to be involved in any activities or preparations activities that fall within the Agency's scope of responsibility);
d) monitoring measures in places that do not have a public character, provided that the conditions are met determined in art. 77 and 78 of this law;
e) measures of search of movable and immovable property, provided that the established conditions are met Art. 77 and 78 of this law;
f) measures to monitor electronic media, provided that the conditions from Art. 77 and 78 of this year of the law; and
g) using other sources that are believed to be able to provide information that is required by the Agency, provided that the conditions from Article 75 of this law are met.

3. What kind of data, if any, could be collected with spyware?

N/A

4. Has there been any official evaluation of the need for, or added value of, spyware?

N/A

5.Who authorises/approves measures of targeted surveillance in criminal and intelligence investigations (judiciary, executive, expert bodies, security services)?

Investigative actions referred to in Article 116, paragraph 2 of the Criminal Procedure Act are determined by order the judge for the preliminary proceedings, at the reasoned proposal of the Prosecutor. In connection with this issue, see the previously cited Article 74 of the Law on Intelligence security agency.
Also, in accordance with Article 77 of the Law on the Intelligence and Security Agency, monitoring of places that do not have a public character, monitoring communications through telecommunications and other forms of electronic devices, as well as the search of property without the consent of the owner or person which temporarily occupies that property, can only be exercised in the cases for which it was obtained prior authorization from the President of the Court of Bosnia and Herzegovina or a judge of the Court of Bosnia and Herzegovina determined by the President of the Court of Bosnia and Herzegovina.
Article 78, para. 3, 4 and 5 of the Law on Intelligence and Security Agency provides for the following: The order cannot be approved for a period longer than 60 days. In justified cases, the judge may extend the validity of the order for additional periods of 30 days each if it is convinced that it is account still required. Exceptionally from the provisions of Article 77 of this Law and the previous paragraph of this Article, the use of these the measure can be approved by the Director General with the consent of the Chairman of the Council of Ministers Bosnia and Herzegovina, if the delay would cause irreparable damage to the security of Bosnia and Herzegovina Herzegovina. After approving the use of those measures, the Director General must immediately notify the judge, who takes appropriate action to confirm approval or suspend collection information, in accordance with this law. However, by Decision of the Constitutional Court of Bosnia and Herzegovina No. U-21/16 of June 1, 2017. it was established that Article 78, para. 3, 4 and 5 is not in accordance with the Constitution of Bosnia and Herzegovina and Article 8. European conventions. The Constitutional Court concluded that the provisions of Article 78, para. 3, 4 and 5 opposed provisions of Article I/2. of the Constitution of Bosnia and Herzegovina in connection with Article II/3.f) of the Constitution of Bosnia Herzegovina and Article 8 of the European Convention because it is not clear when extending the validity of the order prescribed scope of discretion granted to the President of the Court of Bosnia and Herzegovina, i.e. the judge authorized by him, given that his discretion is manifested in the form of unlimited powers when interprets the vague legal terms "in justified cases" and "when he is convinced that the order and still needed" and when the maximum duration of these measures solely depends on discretion decisions of the president of the Court of Bosnia and Herzegovina, that is, the judge authorized by him so that they do not guarantee an individual appropriate protection against arbitrary interference with constitutional rights. Disputed provisions also do not ensure that monitoring and search measures will not be introduced accidentally, irregularly or without proper and adequate consideration. In relation to the introduction of secret collection measures data, that is, monitoring and search measures, the Constitutional Court pointed out that the legislator did not provided for the prior consent of the judge, but provided for the prior obtaining of consent Chairman of the Council of Ministers of Bosnia and Herzegovina. The Constitutional Court reiterated that effective control and from by a non-judicial body may be in accordance with the Convention provided that such a body sufficiently independent from the executive. In the specific case, as emphasized by the Constitutional Court the chairman of the Council of Ministers of Bosnia and Herzegovina is the executive power. Furthermore, the legislator is provided that after approving the use of those measures, the Director General must immediately notify the judge who takes appropriate action to confirm the approval or suspend it collection of information in accordance with this law. The Constitutional Court found that it could be interpreted that the corresponding actions from the disputed provision are the same actions that he undertakes the judge when he approves the order (verifies the fulfillment of the conditions prescribed by the Law). However, the legislator did not prescribe that the general director send a written request to the judge (who in within the meaning of the law, it has a prescribed content), nor did it prescribe within which period the judge must either approve or suspend the application of these measures. Since there is no deadline, monitoring and search measures continue indefinitely adequate consideration of justification until the judge "takes appropriate action" to confirm approval or stop the collection of information. The Constitutional Court concluded that contested provisions according to which, in cases where there is an additional "stronger" danger to security of Bosnia and Herzegovina, the application of monitoring and search measures can be approved by the General director after obtaining the consent of the chairman of the Council of Ministers and according to which the general director, after approving the application of these measures, must inform the judge who takes "appropriate action" to confirm authorization or stop collection information does not ensure that monitoring and search measures will not be introduced without proper and adequate consideration. In this case, the Constitutional Court issued a Decision on non-execution in which it determined that the Parliamentary Assembly of Bosnia and Herzegovina did not implement the decision number U-21/16 of June 1, 2017 and determined method of execution. Namely, until the parliamentary assembly executes this decision of the provision Article 78, para. 3, 4 and 5 of the Law on the Intelligence and Security Agency of Bosnia and Herzegovina ("Official Gazette of BiH" no. 12/04, 20/04, 56/06, 32/07, 50/08 and 12/09) will be applied in in accordance with the aforementioned decision, standards from the Constitution of Bosnia and Herzegovina and the European Constitution convention for the protection of human rights and fundamental freedoms and the practice of the Constitutional Court of Bosnia and Herzegovina and the European Court of Human Rights.

6. What are the national oversight mechanisms in place in your country for the activities of the security services (are they judicial, parliamentary, executive, or expert)? Do these bodies have (binding) remedial powers?

In the Law on the Intelligence and Security Agency as a body of external management and supervision of the agency listed are: Presidency of Bosnia and Herzegovina, Council of Ministers, Chairman of the Council ministers, the Executive Intelligence Committee and the Bosnia and Herzegovina Parliamentary Assembly. Within the Council of Ministers, the formation of the Executive Intelligence Committee with its own was foreseen secretariat, with the aim of advising the chairman of the Council of Ministers and facilitating coordination of intelligence and security issues (Article 12 of the Law on Intelligence and Security agency). Also, the Bosnia and Herzegovina Presidency, as an important part of the executive power, plays its role in directing the work and control of the Intelligence and Security Agency of Bosnia and Herzegovina. It is stated that receives intelligence data, directs the chief inspector to carry out an inspection, audit or an investigation concerning current or potential problems related to the work of the Agency, which may pose a threat to the responsibilities of the Bosnia and Herzegovina Presidency, opined about reports of the inspector general, approves the annual intelligence policy platform, annual report on the work and expenses of the Agency, agreements between the Agency and institutions of foreign countries and international organizations and their institutions, determines the list of institutions and facilities that are object of protection. (Article 7 of the Law on Intelligence and Security Agency). Also, Article 18. The Law on the Intelligence and Security Agency provides for parliamentary supervision in the sense that The House of Representatives and the House of Peoples of the Parliamentary Assembly of Bosnia and Herzegovina are jointly established The Joint Commission for Supervision of the Work of the Intelligence and Security Agency of Bosnia and Herzegovina. The role of the Bosnian judiciary in controlling the work of the Intelligence and Security Agency is primarily related to the use of special investigative actions by the Intelligence security agencies. The Office of the Ombudsman for Human Rights also has a role in supervising the work of security institutions rights. Although this office considers cases related to poor functioning or to violation of human rights committed by any body of Bosnia and Herzegovina, its entities and Brčko District, the office also considers complaints in cases of corruption in security institutions if they are violated basic human rights of citizens or employees in the security sector. Legally, the framework defines the jurisdiction and powers of the Ombudsmen of Bosnia and Herzegovina, the rules of procedure in monitoring the work bodies and institutions in procedures for citizens' complaints and ex officio, and other important issues related to the functioning of this state mechanism for the protection of basic human rights and freedom. However, this body can only issue recommendations and they are not binding on institutions to which they refer.

7. Does a post-surveillance notification mechanism exist? Are there any other remedies available for individual targeted by measures of targeted surveillance?

In accordance with Article 119 of the CPC, the judge for preliminary proceedings shall, without delay, a after taking the actions referred to in Article 116 of this law, notify the person against whom it is committed action was taken. The person against whom the measure was taken can request the Court examination of the legality of the order and the manner in which the measure was implemented.
In accordance with Article 77 of the Law on Intelligence and Security Agency, a citizen of Bosnia and of Herzegovina that was the subject of monitoring or eavesdropping should, after the end of the monitoring or eavesdropping, be informed of the measures taken, unless such information could endanger the completion of the Agency's tasks or the completion of the proceedings before the competent authorities.